14a75508339306887d6c201278e6828c7930f5e6035b7818ac7bf3b006d36e23

Analysis

max time kernel
149s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 722KB
Sample260701-sdnwysaw2v
SHA256 14a75508339306887d6c201278e6828c7930f5e6035b7818ac7bf3b006d36e23
MD5 ae68321c70511c154c67cdc12820f2f3
SHA1 422ae57bde0bbbc1fb9078d81ae854d5c3516a11
SHA512 d10addac7f2a8a2fc34bc2df2fb8dec009aaf16e9a0ffbacb4a25d2b0061c69a6afa8772bddb1d8764d2a418eef1c7d97891074eceb64fc4fa905e91b8c3acf9
SSDEEP 12288:bflfAsiVGjSGecvXAflfAsiVGjSGecvX:zMcfcMcf
TLSH
T180F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3924	trljdbwtomgeywqo.exe
460	trljdbwtomgeywqo.sys
5028	CreateProcess.exe
5268	bwtrljdbwr.exe
5292	CreateProcess.exe
3444	CreateProcess.exe
3868	i_bwtrljdbwr.exe
1796	ojgbytqljd.sys
5884	CreateProcess.exe
1664	gayvqolgey.exe
2868	CreateProcess.exe
460	CreateProcess.exe
5440	i_gayvqolgey.exe
5016	gdyvqoigay.sys
2848	CreateProcess.exe
2836	gdyvqoigay.exe
5404	CreateProcess.exe
5964	CreateProcess.exe
2500	i_gdyvqoigay.exe
1208	oigaysqnli.sys
2060	CreateProcess.exe
5608	axvpnkicay.exe
6048	CreateProcess.exe
3004	CreateProcess.exe
2772	i_axvpnkicay.exe
3060	ifaxvsnkid.sys
3940	CreateProcess.exe
4996	icavsnlfdx.exe
2108	CreateProcess.exe
5372	CreateProcess.exe
2256	i_icavsnlfdx.exe
2296	nhfaxspkic.sys
3524	CreateProcess.exe
5368	kicausmkic.exe
5080	CreateProcess.exe
5640	CreateProcess.exe
5272	i_kicausmkic.exe
2604	pnhecwurpj.sys
3228	CreateProcess.exe
4196	usmjhezwur.exe
3180	CreateProcess.exe
2740	CreateProcess.exe
6036	i_usmjhezwur.exe
2448	smkebzxrpm.sys
992	CreateProcess.exe
3908	mbztrmjecw.exe
5140	CreateProcess.exe
3312	CreateProcess.exe
4132	i_mbztrmjecw.exe
1080	wuomgezwrp.sys
108	CreateProcess.exe
5096	wrojhbztrl.exe
4956	CreateProcess.exe
3320	CreateProcess.exe
4936	i_wrojhbztrl.exe
1984	ywqojgbztr.sys
1912	CreateProcess.exe
2276	wtrljebwto.exe
5888	CreateProcess.exe
4992	CreateProcess.exe
2816	i_wtrljebwto.exe
5788	igebztrljd.sys
5084	CreateProcess.exe
6088	gbytqljdbv.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtrljdbwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axvpnkicay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmjhezwur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkfcxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwuomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icavsnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtrljebwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbytqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtrljdbwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gayvqolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicausmkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmjhezwur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mbztrmjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrojhbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwuomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gayvqolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icavsnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicausmkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojhbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbytqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcxupnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdyvqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axvpnkicay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaxvpnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwuomhezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqolgdbytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqolgdbytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mbztrmjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtrljebwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaysqoljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaysqoljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkfcxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwuomhezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtomywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdyvqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtomywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbwtomgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaxvpnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcxupnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjhfcxusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjhfcxusmk.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1288	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2816	ipconfig.exe
3984	ipconfig.exe
2708	ipconfig.exe
1044	ipconfig.exe
5960	ipconfig.exe
5872	ipconfig.exe
952	ipconfig.exe
6020	ipconfig.exe
2080	ipconfig.exe
2672	ipconfig.exe
1656	ipconfig.exe
4512	ipconfig.exe
1760	ipconfig.exe
3972	ipconfig.exe
2892	ipconfig.exe
1284	ipconfig.exe
5772	ipconfig.exe
5580	ipconfig.exe
6076	ipconfig.exe
2776	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273916577891590"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3865087520-2734723108-1233268525-1000\{FDADD568-FC62-450E-AE5C-71B2933E8739}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3924	trljdbwtomgeywqo.exe
3924	trljdbwtomgeywqo.exe
3924	trljdbwtomgeywqo.exe
3924	trljdbwtomgeywqo.exe
3924	trljdbwtomgeywqo.exe
3924	trljdbwtomgeywqo.exe
3924	trljdbwtomgeywqo.exe
3924	trljdbwtomgeywqo.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	3868	i_bwtrljdbwr.exe
Token: SeDebugPrivilege	5440	i_gayvqolgey.exe
Token: SeDebugPrivilege	2500	i_gdyvqoigay.exe
Token: SeDebugPrivilege	2772	i_axvpnkicay.exe
Token: SeDebugPrivilege	2256	i_icavsnlfdx.exe
Token: SeDebugPrivilege	5272	i_kicausmkic.exe
Token: SeDebugPrivilege	6036	i_usmjhezwur.exe
Token: SeDebugPrivilege	4132	i_mbztrmjecw.exe
Token: SeDebugPrivilege	4936	i_wrojhbztrl.exe
Token: SeDebugPrivilege	2816	i_wtrljebwto.exe
Token: SeDebugPrivilege	5476	i_gbytqljdbv.exe
Token: SeDebugPrivilege	5548	i_gaysqoljdb.exe
Token: SeDebugPrivilege	4400	i_ifaxvpnifa.exe
Token: SeDebugPrivilege	5172	i_snkfcxvpnh.exe
Token: SeDebugPrivilege	3316	i_fcxupnhfzx.exe
Token: SeDebugPrivilege	2708	i_mjhfcxusmk.exe
Token: SeDebugPrivilege	5276	i_cwuomhezwr.exe
Token: SeDebugPrivilege	4512	i_ebwuomgeyw.exe
Token: SeDebugPrivilege	2432	i_bwtomywqoi.exe
Token: SeDebugPrivilege	1500	i_tqolgdbytq.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4960	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5132 wrote to memory of 3924	5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 5132 wrote to memory of 3552	5132	2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 3552 wrote to memory of 4960	3552	iexplore.exe	90
PID 4960 wrote to memory of 780	4960	msedge.exe	91
PID 4960 wrote to memory of 4540	4960	msedge.exe	92
PID 4960 wrote to memory of 1288	4960	msedge.exe	93
PID 4960 wrote to memory of 4540	4960	msedge.exe	92
PID 4960 wrote to memory of 4540	4960	msedge.exe	92
PID 4960 wrote to memory of 5996	4960	msedge.exe	94
PID 4960 wrote to memory of 5996	4960	msedge.exe	94
PID 4960 wrote to memory of 4724	4960	msedge.exe	97
PID 4960 wrote to memory of 4724	4960	msedge.exe	97
PID 4960 wrote to memory of 4444	4960	msedge.exe	96
PID 4960 wrote to memory of 4724	4960	msedge.exe	97
PID 4960 wrote to memory of 4444	4960	msedge.exe	96
PID 4960 wrote to memory of 4444	4960	msedge.exe	96
PID 4960 wrote to memory of 2524	4960	msedge.exe	98
PID 4960 wrote to memory of 4104	4960	msedge.exe	99
PID 4960 wrote to memory of 2524	4960	msedge.exe	98
PID 4960 wrote to memory of 2524	4960	msedge.exe	98
PID 4960 wrote to memory of 4104	4960	msedge.exe	99
PID 4960 wrote to memory of 4104	4960	msedge.exe	99
PID 4960 wrote to memory of 120	4960	msedge.exe	100
PID 4960 wrote to memory of 120	4960	msedge.exe	100
PID 3924 wrote to memory of 5028	3924	trljdbwtomgeywqo.exe	104
PID 5268 wrote to memory of 5292	5268	bwtrljdbwr.exe	107
PID 4960 wrote to memory of 6084	4960	msedge.exe	110
PID 4960 wrote to memory of 4260	4960	msedge.exe	111
PID 4960 wrote to memory of 6084	4960	msedge.exe	110
PID 4960 wrote to memory of 4260	4960	msedge.exe	111
PID 4960 wrote to memory of 5092	4960	msedge.exe	113
PID 4960 wrote to memory of 6092	4960	msedge.exe	116
PID 4960 wrote to memory of 6092	4960	msedge.exe	116
PID 4960 wrote to memory of 2820	4960	msedge.exe	117
PID 4960 wrote to memory of 2820	4960	msedge.exe	117
PID 3924 wrote to memory of 3444	3924	trljdbwtomgeywqo.exe	118
PID 3924 wrote to memory of 5884	3924	trljdbwtomgeywqo.exe	122
PID 1664 wrote to memory of 2868	1664	gayvqolgey.exe	124
PID 3924 wrote to memory of 460	3924	trljdbwtomgeywqo.exe	127
PID 3924 wrote to memory of 2848	3924	trljdbwtomgeywqo.exe	131
PID 2836 wrote to memory of 5404	2836	gdyvqoigay.exe	133
PID 3924 wrote to memory of 5964	3924	trljdbwtomgeywqo.exe	136
PID 3924 wrote to memory of 2060	3924	trljdbwtomgeywqo.exe	140
PID 5608 wrote to memory of 6048	5608	axvpnkicay.exe	142
PID 3924 wrote to memory of 3004	3924	trljdbwtomgeywqo.exe	146
PID 4960 wrote to memory of 6108	4960	msedge.exe	148
PID 4960 wrote to memory of 2168	4960	msedge.exe	149
PID 4960 wrote to memory of 2860	4960	msedge.exe	150
PID 3924 wrote to memory of 3940	3924	trljdbwtomgeywqo.exe	153
PID 4996 wrote to memory of 2108	4996	icavsnlfdx.exe	155
PID 3924 wrote to memory of 5372	3924	trljdbwtomgeywqo.exe	158
PID 3924 wrote to memory of 3524	3924	trljdbwtomgeywqo.exe	162
PID 5368 wrote to memory of 5080	5368	kicausmkic.exe	164
PID 3924 wrote to memory of 5640	3924	trljdbwtomgeywqo.exe	167
PID 3924 wrote to memory of 3228	3924	trljdbwtomgeywqo.exe	171
PID 4196 wrote to memory of 3180	4196	usmjhezwur.exe	173
PID 3924 wrote to memory of 2740	3924	trljdbwtomgeywqo.exe	176
PID 3924 wrote to memory of 992	3924	trljdbwtomgeywqo.exe	180
PID 3908 wrote to memory of 5140	3908	mbztrmjecw.exe	182
PID 3924 wrote to memory of 3312	3924	trljdbwtomgeywqo.exe	185
PID 4960 wrote to memory of 3748	4960	msedge.exe	189
PID 4960 wrote to memory of 3748	4960	msedge.exe	189
PID 3924 wrote to memory of 108	3924	trljdbwtomgeywqo.exe	193
PID 5096 wrote to memory of 4956	5096	wrojhbztrl.exe	195

C:\Users\Admin\AppData\Local\Temp\2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_ae68321c70511c154c67cdc12820f2f3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5132
- C:\Temp\trljdbwtomgeywqo.exe
  C:\Temp\trljdbwtomgeywqo.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3924
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bwtrljdbwr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5028
  - - C:\Temp\bwtrljdbwr.exe
      C:\Temp\bwtrljdbwr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5268
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5292
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6020
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bwtrljdbwr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3444
  - - C:\Temp\i_bwtrljdbwr.exe
      C:\Temp\i_bwtrljdbwr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3868
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gayvqolgey.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5884
  - - C:\Temp\gayvqolgey.exe
      C:\Temp\gayvqolgey.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1664
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2868
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5772
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gayvqolgey.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:460
  - - C:\Temp\i_gayvqolgey.exe
      C:\Temp\i_gayvqolgey.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5440
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gdyvqoigay.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2848
  - - C:\Temp\gdyvqoigay.exe
      C:\Temp\gdyvqoigay.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2836
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5404
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2080
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gdyvqoigay.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5964
  - - C:\Temp\i_gdyvqoigay.exe
      C:\Temp\i_gdyvqoigay.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2500
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\axvpnkicay.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2060
  - - C:\Temp\axvpnkicay.exe
      C:\Temp\axvpnkicay.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5608
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6048
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_axvpnkicay.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3004
  - - C:\Temp\i_axvpnkicay.exe
      C:\Temp\i_axvpnkicay.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2772
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\icavsnlfdx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3940
  - - C:\Temp\icavsnlfdx.exe
      C:\Temp\icavsnlfdx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4996
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2108
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1760
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_icavsnlfdx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5372
  - - C:\Temp\i_icavsnlfdx.exe
      C:\Temp\i_icavsnlfdx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kicausmkic.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3524
  - - C:\Temp\kicausmkic.exe
      C:\Temp\kicausmkic.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5368
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5080
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3972
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kicausmkic.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5640
  - - C:\Temp\i_kicausmkic.exe
      C:\Temp\i_kicausmkic.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usmjhezwur.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3228
  - - C:\Temp\usmjhezwur.exe
      C:\Temp\usmjhezwur.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4196
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3180
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2892
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usmjhezwur.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2740
  - - C:\Temp\i_usmjhezwur.exe
      C:\Temp\i_usmjhezwur.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6036
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mbztrmjecw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:992
  - - C:\Temp\mbztrmjecw.exe
      C:\Temp\mbztrmjecw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3908
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5140
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2672
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mbztrmjecw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3312
  - - C:\Temp\i_mbztrmjecw.exe
      C:\Temp\i_mbztrmjecw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4132
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wrojhbztrl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:108
  - - C:\Temp\wrojhbztrl.exe
      C:\Temp\wrojhbztrl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5096
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4956
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wrojhbztrl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3320
  - - C:\Temp\i_wrojhbztrl.exe
      C:\Temp\i_wrojhbztrl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4936
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtrljebwto.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1912
  - - C:\Temp\wtrljebwto.exe
      C:\Temp\wtrljebwto.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2276
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5888
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1656
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtrljebwto.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4992
  - - C:\Temp\i_wtrljebwto.exe
      C:\Temp\i_wtrljebwto.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gbytqljdbv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5084
  - - C:\Temp\gbytqljdbv.exe
      C:\Temp\gbytqljdbv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6088
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2616
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1044
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gbytqljdbv.exe ups_ins
    3⤵
    PID:6036
  - - C:\Temp\i_gbytqljdbv.exe
      C:\Temp\i_gbytqljdbv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5476
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gaysqoljdb.exe ups_run
    3⤵
    PID:3520
  - - C:\Temp\gaysqoljdb.exe
      C:\Temp\gaysqoljdb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3192
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3756
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5960
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gaysqoljdb.exe ups_ins
    3⤵
    PID:5908
  - - C:\Temp\i_gaysqoljdb.exe
      C:\Temp\i_gaysqoljdb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5548
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ifaxvpnifa.exe ups_run
    3⤵
    PID:5744
  - - C:\Temp\ifaxvpnifa.exe
      C:\Temp\ifaxvpnifa.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5628
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1672
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1284
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ifaxvpnifa.exe ups_ins
    3⤵
    PID:5348
  - - C:\Temp\i_ifaxvpnifa.exe
      C:\Temp\i_ifaxvpnifa.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4400
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\snkfcxvpnh.exe ups_run
    3⤵
    PID:6024
  - - C:\Temp\snkfcxvpnh.exe
      C:\Temp\snkfcxvpnh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4376
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6104
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_snkfcxvpnh.exe ups_ins
    3⤵
    PID:1700
  - - C:\Temp\i_snkfcxvpnh.exe
      C:\Temp\i_snkfcxvpnh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5172
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fcxupnhfzx.exe ups_run
    3⤵
    PID:2468
  - - C:\Temp\fcxupnhfzx.exe
      C:\Temp\fcxupnhfzx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2568
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4428
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fcxupnhfzx.exe ups_ins
    3⤵
    PID:2588
  - - C:\Temp\i_fcxupnhfzx.exe
      C:\Temp\i_fcxupnhfzx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3316
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mjhfcxusmk.exe ups_run
    3⤵
    PID:1080
  - - C:\Temp\mjhfcxusmk.exe
      C:\Temp\mjhfcxusmk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1748
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4748
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5872
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mjhfcxusmk.exe ups_ins
    3⤵
    PID:2644
  - - C:\Temp\i_mjhfcxusmk.exe
      C:\Temp\i_mjhfcxusmk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cwuomhezwr.exe ups_run
    3⤵
    PID:6112
  - - C:\Temp\cwuomhezwr.exe
      C:\Temp\cwuomhezwr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5364
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5196
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5580
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cwuomhezwr.exe ups_ins
    3⤵
    PID:4528
  - - C:\Temp\i_cwuomhezwr.exe
      C:\Temp\i_cwuomhezwr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5276
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ebwuomgeyw.exe ups_run
    3⤵
    PID:1512
  - - C:\Temp\ebwuomgeyw.exe
      C:\Temp\ebwuomgeyw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1304
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5436
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:952
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ebwuomgeyw.exe ups_ins
    3⤵
    PID:468
  - - C:\Temp\i_ebwuomgeyw.exe
      C:\Temp\i_ebwuomgeyw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bwtomywqoi.exe ups_run
    3⤵
    PID:5420
  - - C:\Temp\bwtomywqoi.exe
      C:\Temp\bwtomywqoi.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5492
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4084
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6076
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bwtomywqoi.exe ups_ins
    3⤵
    PID:5516
  - - C:\Temp\i_bwtomywqoi.exe
      C:\Temp\i_bwtomywqoi.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2432
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqolgdbytq.exe ups_run
    3⤵
    PID:1064
  - - C:\Temp\tqolgdbytq.exe
      C:\Temp\tqolgdbytq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1492
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5308
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2776
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqolgdbytq.exe ups_ins
    3⤵
    PID:4188
  - - C:\Temp\i_tqolgdbytq.exe
      C:\Temp\i_tqolgdbytq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1500
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff83cacc188,0x7ff83cacc194,0x7ff83cacc1a0
      4⤵
      PID:780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,14808466009903612980,15197015799439812534,262144 --field-trial-handle=2596,i,17900914892892039088,7863441642585412480,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:2
      4⤵
      PID:4540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,13195189021961510118,7546155644215927768,524288 --field-trial-handle=2596,i,17900914892892039088,7863441642585412480,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:11
      4⤵
      System Time Discovery
      PID:1288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2288,i,10457004813014385281,16554851003038753387,524288 --field-trial-handle=2596,i,17900914892892039088,7863441642585412480,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:13
      4⤵
      PID:5996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3632,i,2284966388469928598,14216924139471899552,2097152 --field-trial-handle=2596,i,17900914892892039088,7863441642585412480,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
      4⤵
      PID:4444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3636,i,9838851430144769662,14049985305307273443,2097152 --field-trial-handle=2596,i,17900914892892039088,7863441642585412480,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:1
      4⤵
      PID:4724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,14513118085568627406,16695493891947624828,2097152 --field-trial-handle=2596,i,17900914892892039088,7863441642585412480,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:1
      4⤵
      PID:2524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,18147580234098872393,13412356186519043735,2097152 --field-trial-handle=2596,i,17900914892892039088,7863441642585412480,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:9
      4⤵
      PID:4104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3948,i,13946126989518504146,2174240244979962403,524288 --field-trial-handle=2596,i,17900914892892039088,7863441642585412480,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:14
      4⤵
      PID:120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3968,i,13587338743879889860,17242424663916208715,524288 --field-trial-handle=2596,i,17900914892892039088,7863441642585412480,262144 --variations-seed-version --mojo-platform-channel-handle=3944 /prefetch:14
      4⤵
      PID:6084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,5959332873116478972,12582552576080811882,524288 --field-trial-handle=2596,i,17900914892892039088,7863441642585412480,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:14
      4⤵
      PID:4260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,13620966468443034395,16055833202152633909,524288 --field-trial-handle=2596,i,17900914892892039088,7863441642585412480,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
      4⤵
      PID:4160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,13620966468443034395,16055833202152633909,524288 --field-trial-handle=2596,i,17900914892892039088,7863441642585412480,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
      4⤵
      PID:5092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,5895289419440708023,2307245112312587122,524288 --field-trial-handle=2596,i,17900914892892039088,7863441642585412480,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
      4⤵
      PID:6092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,902484717637167263,6737674804530895419,524288 --field-trial-handle=2596,i,17900914892892039088,7863441642585412480,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:14
      4⤵
      PID:2820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4776,i,6620136527099123524,2458078203718534552,524288 --field-trial-handle=2596,i,17900914892892039088,7863441642585412480,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:14
      4⤵
      PID:6108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4812,i,686628679700156468,7305073078140064381,524288 --field-trial-handle=2596,i,17900914892892039088,7863441642585412480,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:14
      4⤵
      PID:2168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,7017386934945735764,11809147158655516737,524288 --field-trial-handle=2596,i,17900914892892039088,7863441642585412480,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
      4⤵
      PID:2860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,1318831026996740150,13373212586443276234,524288 --field-trial-handle=2596,i,17900914892892039088,7863441642585412480,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
      4⤵
      PID:3748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3508,i,11463932271064131944,9626827707406963798,262144 --field-trial-handle=2596,i,17900914892892039088,7863441642585412480,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:10
      4⤵
      PID:1264

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4932

C:\Temp\trljdbwtomgeywqo.sys
C:\Temp\trljdbwtomgeywqo.sys
1⤵
- Executes dropped EXE
PID:460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3136

C:\Temp\ojgbytqljd.sys
C:\Temp\ojgbytqljd.sys
1⤵
- Executes dropped EXE
PID:1796

C:\Temp\gdyvqoigay.sys
C:\Temp\gdyvqoigay.sys
1⤵
- Executes dropped EXE
PID:5016

C:\Temp\oigaysqnli.sys
C:\Temp\oigaysqnli.sys
1⤵
- Executes dropped EXE
PID:1208

C:\Temp\ifaxvsnkid.sys
C:\Temp\ifaxvsnkid.sys
1⤵
- Executes dropped EXE
PID:3060

C:\Temp\nhfaxspkic.sys
C:\Temp\nhfaxspkic.sys
1⤵
- Executes dropped EXE
PID:2296

C:\Temp\pnhecwurpj.sys
C:\Temp\pnhecwurpj.sys
1⤵
- Executes dropped EXE
PID:2604

C:\Temp\smkebzxrpm.sys
C:\Temp\smkebzxrpm.sys
1⤵
- Executes dropped EXE
PID:2448

C:\Temp\wuomgezwrp.sys
C:\Temp\wuomgezwrp.sys
1⤵
- Executes dropped EXE
PID:1080

C:\Temp\ywqojgbztr.sys
C:\Temp\ywqojgbztr.sys
1⤵
- Executes dropped EXE
PID:1984

C:\Temp\igebztrljd.sys
C:\Temp\igebztrljd.sys
1⤵
- Executes dropped EXE
PID:5788

C:\Temp\oigaysqlid.sys
C:\Temp\oigaysqlid.sys
1⤵
PID:4236

C:\Temp\ifdavsqkic.sys
C:\Temp\ifdavsqkic.sys
1⤵
PID:1200

C:\Temp\vpnkfdxvpn.sys
C:\Temp\vpnkfdxvpn.sys
1⤵
PID:5580

C:\Temp\nkfdxvpnhf.sys
C:\Temp\nkfdxvpnhf.sys
1⤵
PID:3416

C:\Temp\smkecwupmk.sys
C:\Temp\smkecwupmk.sys
1⤵
PID:6076

C:\Temp\cztromhezx.sys
C:\Temp\cztromhezx.sys
1⤵
PID:1404

C:\Temp\eywrojhbzt.sys
C:\Temp\eywrojhbzt.sys
1⤵
PID:4560

C:\Temp\wqomjebztq.sys
C:\Temp\wqomjebztq.sys
1⤵
PID:2944

C:\Temp\ytqljdbvtn.sys
C:\Temp\ytqljdbvtn.sys
1⤵
PID:1948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

axvpnkicay.exe

Path C:\Temp\axvpnkicay.exe
Size 722KB
SHA256 32abb91f651e6b7dc84d9f1ca40578cf4d6d8de72e0d642912067100091f05e5
MD5 5e3f917a686189f170217ae7549d6bdc
SHA1 b8b6f23ea1bb52685c24bd9f36a01772e2c5f428
SHA512 667297e3bec10e5ea642347e183cca0365d61397d054782398d89518e6dbed8464f523bc33c97c3b30e4b831182c4aefc9327f08acfefcfdff30fe407fae58b9
SSDEEP 12288:nflfAsiVGjSGecvXAflfAsiVGjSGecvX:fMcfcMcf
TLSH
T165F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bwtrljdbwr.exe

Path C:\Temp\bwtrljdbwr.exe
Size 722KB
SHA256 9077ac4d506a16ed91250ea078b237e724bbf2bb72e9272e36d6c9314b9d568b
MD5 f2f5482dbdb46ffe1e01b25ca10d26df
SHA1 4086564d779cba510fd98962589548fc97c41264
SHA512 de5450e7d1aa95fbdd3f9e6defc350da0bdc6676c2640b6ed04bdf4267c6be2268a575e8b530d0628f219593dfa313d9f24981e2286a9cbe774f6b6adab16240
SSDEEP 12288:aflfAsiVGjSGecvXAflfAsiVGjSGecvX:2McfcMcf
TLSH
T136F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gayvqolgey.exe

Path C:\Temp\gayvqolgey.exe
Size 722KB
SHA256 e970cf59f711ea76b67595dd41fb192bb64f4a7f808501adefa798dacf0ccc26
MD5 2fa1b14f90945479b1a3dba4492807d9
SHA1 825c8b0d481c9784e4c24061a80cc37988dea73b
SHA512 d8f2186f23dd941aac3e53af9393260084e3c29e43250d5142527ab20689f748305f27cf4ee635d9d688634a02885fede28b896e6cc9347bcd566750a1c47b70
SSDEEP 12288:OflfAsiVGjSGecvXAflfAsiVGjSGecvX:qMcfcMcf
TLSH
T1D9F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdyvqoigay.exe

Path C:\Temp\gdyvqoigay.exe
Size 722KB
SHA256 99bf776c10bd140822699acb162655b77805fa70eff9c94e569bd57dfd5f1ffc
MD5 0817263bd128ed5fad655a04ed836aca
SHA1 191ff8fdabbf29f6373d09033bff6fff719c5c41
SHA512 29c3c948a8eee04a0954d0f76cab38ba4d5907c71867e16750dcb0304ab58f7495c454da0f14a54e8a5eff9d818c99dd98078056ec6e5e8366e33a764ad2da93
SSDEEP 12288:QflfAsiVGjSGecvXAflfAsiVGjSGecvX:MMcfcMcf
TLSH
T15DF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdyvqoigay.sys

Path C:\Temp\gdyvqoigay.sys
Size 293KB
SHA256 f587864f30ad6a56b7f423f9ccf9632846ba785b953d3c853f92debd2ee68667
MD5 1b68617457497c979c9e7fd8ef7685e0
SHA1 78aee4e992398e4333c298299212445d3c792ee8
SHA512 5114ac4e53171630359d05d5c926e0e0d6a9812482d95cedaeecd4607f06aac58681db841f6366b1f3f488216a9c33a79599a21f9251932609273f58380053d0
SSDEEP 3072:2tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:2IJjiJcbI03GBc3ucY5DCSj
TLSH
T15A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_axvpnkicay.exe

Path C:\Temp\i_axvpnkicay.exe
Size 722KB
SHA256 8facd65426247e2f17d8b6fee464fe5fb4999887916f3b59575d100f768cb4e5
MD5 4b791a01285b5f35e15304439496e7c7
SHA1 e781db954940e8cb94ffcae51845fc5baa528294
SHA512 02d6b66d8af49038fefa4e39a55b8e77864800514bc55bd5b9605059ff5cd0cb2c99c442da639a8c31759fa60ad603e68670572970f776bd27ffd2c4a7efeacc
SSDEEP 12288:BflfAsiVGjSGecvXAflfAsiVGjSGecvX:pMcfcMcf
TLSH
T172F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bwtrljdbwr.exe

Path C:\Temp\i_bwtrljdbwr.exe
Size 722KB
SHA256 bd1f1e9cb8052157749bd2f42e9cb9992afd30f6855ea76a7c493b0092022dd7
MD5 193006a05a82ca09f577a8aa9d858e97
SHA1 ed8f744a366776f20251e8ba9aa55f61f144b8c0
SHA512 4c456117f1d6875d78e2da6497711182e356d658b43b60ceffd1d4554c9845b2c2b942823452e64c4fb720090ec6cb624a9402e30fcdcc87606f0e9d73af40c8
SSDEEP 12288:DflfAsiVGjSGecvXAflfAsiVGjSGecvX:LMcfcMcf
TLSH
T10FF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gayvqolgey.exe

Path C:\Temp\i_gayvqolgey.exe
Size 722KB
SHA256 223e28f8b9ca9d71f7eb69f1f0caab329f115d2092bcf7f1a5e58b6605b85295
MD5 468a7f6468246dc820d0994308215936
SHA1 3ac8c25d959b39b62cc9806a0623502e110c34ce
SHA512 7dc445a19874d80ed6fdd990c60fd0b112b859e7794160a3ca2e328a6256ae4710036000417f0c3a712c7e89f8ad915632e42eb7007905f19c2c1372e29fba6c
SSDEEP 12288:4flfAsiVGjSGecvXAflfAsiVGjSGecvX:kMcfcMcf
TLSH
T1D6F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gdyvqoigay.exe

Path C:\Temp\i_gdyvqoigay.exe
Size 722KB
SHA256 b85fa81385bb9002765ea9079a0b1f3832e465f49bbc8512dc74ebaa2768c32c
MD5 fc12ab08631844927351a3746704ab5a
SHA1 8f245165ef3a9684a607f19f0b87b47cb46b9f9b
SHA512 64f5b1a7c90590888889670e9853fb39b889da21985f033f0c3767788e4d29385dfe4759635541025b61f8747b8e1ce57aef933b230380fa68f2b3d8ac4bf16b
SSDEEP 12288:mflfAsiVGjSGecvXAflfAsiVGjSGecvX:yMcfcMcf
TLSH
T141F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_icavsnlfdx.exe

Path C:\Temp\i_icavsnlfdx.exe
Size 722KB
SHA256 2bd6bb32533f1f00cd8a089f1a1514ecf2731dbb4aca7cfd91671869162e739e
MD5 67f21329e5d8ab2f395e525450ba7b94
SHA1 e8fdad7b7c3cb1aed36263dbc82d56cc8ba4d70e
SHA512 85dbb8f008976ef4485b2cd42d50506c7013eb94f11d9038808650663ec43a2d3992028fb04d3a3299120e9d786cf78a4724e1c678b778f0113ca67f80a5f6b5
SSDEEP 12288:NflfAsiVGjSGecvXAflfAsiVGjSGecvX:lMcfcMcf
TLSH
T175F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icavsnlfdx.exe

Path C:\Temp\icavsnlfdx.exe
Size 722KB
SHA256 d177273f1424c0074355d47df8ccc8de57aff5e24b7e6e937b8dcdc17cac6fde
MD5 a794a23d65c9871710e4a0ecd00ff617
SHA1 dd25ca6155bbbb7dbb6a2142209e940b8ca64e6f
SHA512 feff1a7439ff26a0fb76613e54677fab9eac494cf62aef6961eed518f2d4fd21dbaffd607c6519d1af856e69bddb1e90707750f7fe3075f44744ebd457bf48fe
SSDEEP 12288:jflfAsiVGjSGecvXAflfAsiVGjSGecvX:rMcfcMcf
TLSH
T10EF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifaxvsnkid.sys

Path C:\Temp\ifaxvsnkid.sys
Size 293KB
SHA256 69abfcf30da628ccec03067be1f7c4f36b9294f13a5f739c0cd2955c6c03ac8d
MD5 eb94d7306c42a1159c085172255231b7
SHA1 4c2608b9bb5f2ad67bc0031d39e2868eac87edca
SHA512 82eece4d74d2f1492c3177f969225efa7cfa8705232aed92807ddd796dfe891b9fae80ccc97aa316761e80e04203db8982a114c1a4481a9ed82e76a6ae4cc3b6
SSDEEP 3072:ftKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:fIJjiJcbI03GBc3ucY5DCSj
TLSH
T18A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicausmkic.exe

Path C:\Temp\kicausmkic.exe
Size 722KB
SHA256 6cbe4eab5f6deb45e2e96ac16600bbc5592208832390f121db281c77330a9773
MD5 9df644f8b8c63d257a09b64befcd1d90
SHA1 1887e9a4c7c970578bf0304bf5c8d9c73021f283
SHA512 e294f38762beb1b30c6cf681e7beff40231313534f6dcf7337b5051fcddd6f2c6a354576b059485fecbb8bd3d5f0bc6e0908a7565d9994818596a6c3b2c7a98a
SSDEEP 12288:7flfAsiVGjSGecvXAflfAsiVGjSGecvX:TMcfcMcf
TLSH
T142F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfaxspkic.sys

Path C:\Temp\nhfaxspkic.sys
Size 293KB
SHA256 981a8ca40c2f1707509fd0591cff9f46b0797a4d1b66e7c5a9735f0c444934de
MD5 0ea1d7903e6567ddc66ec0a895e4f6ce
SHA1 b9aed518f18b423ebbebbe512db9014cdbcbf6fe
SHA512 4a61dc561d37ce993cb15df90a0c102090e5f776f2dd8e13f2a7892282332d7c54efb67a974f4bd3c459a57e675923bafc471520d01cf07261e426823fc220e8
SSDEEP 3072:ytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:yIJjiJcbI03GBc3ucY5DCSj
TLSH
T177545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigaysqnli.sys

Path C:\Temp\oigaysqnli.sys
Size 293KB
SHA256 69949dcda5c025bbae47815a4787d7c5f0a4dca2e512a94dafc5716d9b8e70b8
MD5 dacd856da2d88272c6415283b92c8e9b
SHA1 ee4c713a66ec585bdd0bffbe79157ae94a560e59
SHA512 ce8e506b4d60a87a7672007bf0d7a02c1e885141309c28d9c2b04651622d09367bfd533de28fcab0cb2cb84b5ad7e69039f405ae3899f3449148173ff118c2ee
SSDEEP 3072:wtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:wIJjiJcbI03GBc3ucY5DCSj
TLSH
T1CC545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ojgbytqljd.sys

Path C:\Temp\ojgbytqljd.sys
Size 293KB
SHA256 3d9799117738bb8158d02b3bbdc591b612ff2ecb078f119df1c38b8d46126810
MD5 1385ff52288f8ba316272a1856a806d4
SHA1 6a8ed400a09a9fe509b4fa5687d5dcd6ed2194d4
SHA512 8d9c377dc9223500b89776de44e80618cc50e284a71a3a39c55554086bafee782e8bf924c60b47b026b953dead685634c2a53a5af7ebfdb75595bce874f2255a
SSDEEP 3072:FtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:FIJjiJcbI03GBc3ucY5DCSj
TLSH
T131545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljdbwtomgeywqo.exe

Path C:\Temp\trljdbwtomgeywqo.exe
Size 722KB
SHA256 4e3f52af0fcdd37ba38e1f06caed1c01308476a5bcf6f88a96a7a395a7d5f0eb
MD5 3b22b706a19912687bb0383da2916050
SHA1 927b42399841b01843638acf7a9e5c8370680ff0
SHA512 47de8533c9aacfb75563a52a77319f089e74cd4b33094f8aec3476cddf7045ca3c23606272358ec85a95d6d9eb626939903a4b3b1f27ebf173d9c82aad716849
SSDEEP 12288:GflfAsiVGjSGecvXAflfAsiVGjSGecvX:SMcfcMcf
TLSH
T1BFF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljdbwtomgeywqo.sys

Path C:\Temp\trljdbwtomgeywqo.sys
Size 293KB
SHA256 294372ae13e3a0a89700176ce45cae7b45a1175148f3574a0b7cc69db04d3812
MD5 8871ac8a8348836d3a9a7e1f10893ffe
SHA1 2296bbdaeac1a52419d5412e7f0be3a0e932b1de
SHA512 15289998d7ab085048582a7a053a23d151b9f715e8348353101f0135c6af8c5822d3cae50fdfeeadddd2b6acd7c05f5053f10f60b05a34f6a84e9d7cf966af46
SSDEEP 3072:BtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:BIJjiJcbI03GBc3ucY5DCSj
TLSH
T197545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 37abd39218624bea608ed1c31cedc29697ad7dcee756e85d36f477bc96d5d79e
MD5 02d5d30f7a50d6501cf8e28620d036a8
SHA1 7b35285f7d86d5c3e0211627a1949eba907bccc2
SHA512 75c5013e8f146add9f0df252bb7669ce045b68d4f02b1aa7609d01a9ab18fda0f9b2e387ce15f36d76b8019dce58f4ed010f4a4528819164adeaf356a9fdc485
TLSH
T1FFD0C02D3D44FC02C1891070760033D0756001F03056C3C59002E01DDC3814083DB0AF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b4b91e2c6408056d62e9ab108c4a1bc3372697cc673aea50cc1ab639cb36d31
MD5 31627e295d41c3cf43475c41d5522c43
SHA1 03580db0a47167f6acdfbb28d1db3e5fd631377d
SHA512 b71b6edd012c155ef24382afc691d07b436ca311747e424ecd928e1ae50b54eb9c2cef7113ea3e73a4f92dfa3cafacd84c0410c0f05a6860d79a46a87ba532f3
TLSH
T192D0C0293D44FC02C1891070760133D0755001F03056C3C59002E02DDC3814083DB09B
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7d18c37d8ae4ad06280bc37f2bddcc44c55f29a9726446fba1cffae8797aab58
MD5 d869842718f3320a0a030b5026a21773
SHA1 7e0a6b1a9fb5649b6cc4d4b567a37ece1f3e30a0
SHA512 3d81ab850ea9c02f4dab45dc49b569577de79fe304a5f8bff6d34f808493dfad3327aff70b875452b0ff3d10f2322e9b3f24d39eff4dda7318b99110dc75858f
TLSH
T16C61C52534670932D7AB45BA50E620AAFFB44072C2072F5D538D9C395F1A73764F543E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58af27.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58af27.TMP
Size 3KB
SHA256 2c33ca5727058f2502c1436b720b6da3ed3b4095f5a1f61c0095104a12bab429
MD5 c313642523ef019b81a6be2aeae470b1
SHA1 4966b5df9e80adbb5c2c4a303a375d4ba5408326
SHA512 48b87b2685b08a96192b0d43cfd5e95b3dd79787344be7c3ec98ee5e86dd322ce75ef1773192bc6adc410e0e1557f0455cf41c3d260c705f8f3ac5b43dd0aeee
TLSH
T1C761E52634670932D7AB05BA50E620AAFFB44072C2072F5C538C9C395F1A73368F143E
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c92926362369c5f9c6fb89c422548642c3e1acd436f131c51c176553f7f97fc2
MD5 b358e92fca1a5712f0198826a5bdf090
SHA1 556e237f50e60e73b4228696151b635514638045
SHA512 7dc97f9c00f26ef42fb8d2457d138c8deac46e54de9d56f5903bb8444b4ad9f1492ee8fd591232bda43d017ad7e7b039e32bc8d757ed8edf771dddbceb8dea77
TLSH
T17241BFF7C7E8867D8A0145F4BA186E2BCE2D0914832C3D5AC8E4AF5F93E2471E24195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e8eaf4c98b29200ee0528ed7e97816896f72c09178303536c184eaaeaca9e25d
MD5 32402077adc7eae15840cdb1e3b3e689
SHA1 836eb0e0bf77a6545fb9b53ff8f10ce182208292
SHA512 999c9ea9ed0188be6392dacc2d549cbbe039dc8dc624015f19977d1e0a3b239c04441e58399c1b3b77d8972b94ee918817ee96d3417b03df468fc8337a89ff6c
SSDEEP 192:sxRVV7RI/yM/jK1Ml8wcYv/fyVsNuVPZFPegXg+iszoA8p9VM/g6+WNCVwp/YHTI:sxR/UCI/fysNQR0zQ/5p/Pv3
TLSH
T19E62D916AA24597B8CDBD209F955BF53D6F81573A2900E04AAFCCB0C05E7BDD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2be5bf4f7530e325444d5b65f571a6616c0aa8d2c5e80f5ea9a712135d22fdd1
MD5 e8b7d4a14fadaf7e6e805b97dd771ffa
SHA1 5534cc9f4fa9b361ac3dd48cfff47702f1367c68
SHA512 1204bb619af5c2add3f2e3cf4f08ef05dbc7b972ed370f3fa758eb4a06a7877d7bc8dba1cadc6cdee78b9bd656e896c3b67a9016980386d11e75fe2cc672334f
SSDEEP 192:sxRVw7RI/yM/jK1Ml8wcYv/fyVsYIuVPZFPegXg+iszoA8p9VM/g6+WNCVwp/YHR:sxR0UCI/fysNQR0zQ/5p/PvU
TLSH
T1B562D916AA24597B8CDBD209FA55BB53D6F81572E2900E04AAFC8B0C05E77DD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3629e68c5c8143686842747637657f95eb1784ca66662ed552624710bf0ee095
MD5 64e50dec5a81904cd8ee82246cfa8af9
SHA1 bf54b1d295e5ff95a9565dd368bae89fd583911c
SHA512 aa475425eb1ea0dc3099c62b50c2678d931f7b862de7b3f21348bdec41945a39ae1d24e1df8086451d8ad3d4583052394ed4e1fae86c9597100f1663e255a0da
SSDEEP 192:sxRVw7RI/yM/jK1Ml8UQYFcYv/fyVsYIuSOPZFPegXg+iszoA8prVM/g6+WNCVwc:sxR0UqRI/fysNkR0z+/5p/zvy
TLSH
T11A62C816AA24597B8CDBD209F955BF53D6F81573A2900E04AAFCCB0C05E7BDD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 8be2b729ad8568470df0463b353e8f5502c553d67f19932ae294cd982682d835
MD5 e21125c795e00dd398004444710fc2ec
SHA1 ff0ef7d61b844fe95d308cb8c7ac5d50cef13881
SHA512 a0dd4370099722bd2af0a425169cf7d0b74d0320347abb115d2a34e0b24ee6de1f647ad7f17f9a5cec204bb7b23b351f34ab723ffecc16b8bcffc77812e817ef
SSDEEP 768:6laYfO7pLuL7mjWgRNf2b8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEJDAzwJro3J2Y:6laYfOE7mjWgRNf2bu1jajJDUwi52Y
TLSH
T143E2EC3B680CCB7E4F80499CED297D9AADDC02CB56D88D5447EA840C03C67EB551B5EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4ebc2ed42c8d09b4be2bc447b17bfdb058b456356da74f6eea633b1b4ad80c0d
MD5 d5fdfe57470b23a678a0585d729177b7
SHA1 c917c316ed0f287050a5d23e44f65f8e280d8f34
SHA512 61e6d5cea5e30a216daf633c1ff7bede1c02eeaf6bc8efa9ad6aef7fdef07171dec639b91febc49af34640c9a03aa1fa05388c6453d052c54665b475485991b5
SSDEEP 96:KOf2DvFB1Qx5kD3HQKfF3NQDXHUtf96SYKz6ia0QKVCHc9oMm/:9f2DvFB1I5kjHbF3NQXHUtf9P3vSc9oL
TLSH
T1AB910011B0BB5B00387D650A9679851E164375E231DEA83B3BA860F63F67E004FFDAD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe594a1f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe594a1f.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 7f7dfbffe05d36ddd6a0df576647fb1bb882bb5652caa4c025a77d4b95c09974
MD5 e0f1548ed194d73716028dcd7f8fabcc
SHA1 4f883b1e73a97d6161e25acaef173789b535d41a
SHA512 7a01cebf48ebd161083fc165e867f9c9702823ee70c706d0e2f5ef4bbd6f10ea89061b1efc6bccd80c25f03f996662a70578155365672004c0e4825e915c2a94
SSDEEP 768:arv+4UNbdB3BRC9x+Tf/O1ffGeWyvPIINRzWnhIoAR+8r7W:absbT3zTfOffngyROIo8Dra
TLSH
T18803CF32E9745AA3ACFBC2C8B74B73577EB4456396C60B90C5CC2B4C458B6AE530B853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 eb805bf0c74e6db542ef797b9d5c6fc6b1a6fffe061d158df3d22944ef896773
MD5 41bd7f8a9e4bf8c60842b0ad25121d1b
SHA1 2ca41e529f4c359c71dd7fec2efb9a14ee38b477
SHA512 4e348dd9bf23e1b05660c4bfce4b3a93b4b603f73c80a06dba8e4b6d0507dc2cfb3f5b4762e9068531a55272a390849fb4bfb09cc11233035ef2553c097effb6
SSDEEP 768:frv+4UNbdo3EQC9x+Tf/O1ffGSfGVWyvPIINRzWnhIoQcD:fbsbm3bTfOfflf4gyROIo1D
TLSH
T11A03CF72E5799EA39CFBD288B64B77937FB8146385C50B54C9C81B4C064B2AE230F817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 ca4f4fde450683ffd5ac0e61ca082a1f945eca75626565c957ee7d60f33dd98a
MD5 11f3744822bccb56b0223496e61c1883
SHA1 cecaf606bf03b456dc4fba7564a9235c84180acc
SHA512 abe88c0a6df830b07f2a3f3bcc9e7e3094c4f0cabe574f97edf07489d3696dc2ef19d273790b6087cde99db77e0ed1264aca2cd60fa0923433b14c05223bc035
SSDEEP 768:VF1j+9J3Vwg87Mf/O1ffGSfGRWyvPIINRzWnhIoQcc8KzL:89J3ZfOfflfqgyROIo1ctzL
TLSH
T173133AF694D38976D8AE8387673D7E569EBCC163B5854990F7C81E0CCC862BFD20A805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 4e550eaa9efe82379c6e0a9f96c1afa27809b06114d825918539a63b5392c528
MD5 cfddbc330fe485b7d4b02cc6a7cfa338
SHA1 5b1f099aa7c8dc27f69c47ca3a93c5f2b75a4bff
SHA512 3b76b47ae4580dbe0f69256ed5afbaad043d9aeaa26174249dcd01a5f95eb5b7a6f6fd53e9277ba9996bf274882ae9fac197c07473b25cb30a5aac3a53ffab44
SSDEEP 768:8j+9S3hQC9x+Tf/O1ffGSfGVWyvPIINRzWnhIoQcc8KzL:b9S36TfOfflf4gyROIo1ctzL
TLSH
T125F2AE76E9624EA39CEBD298770B3B97AEE4416396C50F64C5CC1B0C058736E231B80A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f492ca0f5bb72a28ab17c20c6322b286c44910d34e7abd3ca00cc16298fa19f1
MD5 9e82c7007f9144adf79bd30956d6f063
SHA1 a6a59eea8af90a3bf6106d4ab48f8bb8210f571d
SHA512 7e631dd91047cd92c0662e711c28103b6a0c19b15f7b0794f6d45258593fea7a00c91058eda6fb098f3c4dec0109578b12fafab964c6988d3169183f29624ea5
SSDEEP 768:cj+9S38QC9x+Tf/O1ffGSfGVWyvPIINRzWnhIoQcc8KzL:79S3TTfOfflf4gyROIo1ctzL
TLSH
T1F7F2AE76E9625EA39CEBD298770B3B97BEE4416396C50F64C5CC5B0C058736E231B80A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5e111f17-baec-4b0d-baad-897c58cd93e8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5e111f17-baec-4b0d-baad-897c58cd93e8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4960_1251889664\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 ef297dbd7db2f04951df4f215a955e4d0fe574afb3646833f0c3bfe8184d50e7
MD5 4bf031c41a699af89d35778e37f09ec7
SHA1 a4e4a21697ede11d7dd7adf602eac617aa0f32df
SHA512 650ea3d4671e20f1fc21bff0292c657006765a0128fbcb3b43139bff38300c751e8e7562c28fda9b404d940453022b5b4ad9d8828dbfabc1fc8936edd84198d2
TLSH
T1F871008356BDC5B3C5DA9BF102835648F2FB2338476330250BA15586AA70A7A24B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/460-59-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1080-328-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1200-384-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1208-267-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1404-409-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1796-192-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1984-343-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2296-296-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2448-324-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2604-320-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2944-426-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3060-280-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3416-401-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4236-380-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4560-414-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5016-270-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5016-239-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5580-397-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5788-368-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6076-405-0x0000000000010000-0x00000000000AB000-memory.dmp

Download