e7ad82f7a3b97a5d80d2ffef876447ea8fe7e5dff65d70e0a027c33229ab299a

Analysis

max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 02:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 722KB
Sample260703-dbcctaaw2s
SHA256 e7ad82f7a3b97a5d80d2ffef876447ea8fe7e5dff65d70e0a027c33229ab299a
MD5 88033cbf0a841e906b10d1f904900a53
SHA1 f08d86fe7c81d507582f8c914a71320984c8eb8d
SHA512 4a40b6ffdc836a27f693c1ef52386f833ab2b5e0c849d584e1158c8a6d7a456072f79473358c862e49c7d3a3c1a9ecdf718c0f7dd0479ec6359b1d3ddf5c4156
SSDEEP 12288:sflfAsiVGjSGecvXAflfAsiVGjSGecvX:4McfcMcf
TLSH
T1F1F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
5616	jebwuomgebzwrojg.exe
3056	jebwuomgebzwrojg.sys
3888	CreateProcess.exe
2176	trljgbztrl.exe
4520	CreateProcess.exe
5252	CreateProcess.exe
3344	i_trljgbztrl.exe
4404	vtrlgeywqo.sys
1364	CreateProcess.exe
2084	oljdbywqoi.exe
5092	CreateProcess.exe
3320	CreateProcess.exe
5588	i_oljdbywqoi.exe
5404	vqolfdbytq.sys
1944	CreateProcess.exe
356	vsqlidbvtq.exe
4724	CreateProcess.exe
2156	CreateProcess.exe
4108	i_vsqlidbvtq.exe
2700	igaysqlidb.sys
5416	CreateProcess.exe
2956	vsnlfdxvpn.exe
3332	CreateProcess.exe
3284	CreateProcess.exe
900	i_vsnlfdxvpn.exe
2928	icavsnkifa.sys
5780	CreateProcess.exe
5920	lfdxvsqhfa.exe
5924	CreateProcess.exe
5356	CreateProcess.exe
824	i_lfdxvsqhfa.exe
4268	nkfcaxspnh.sys
1740	CreateProcess.exe
2344	pnkecausmk.exe
5052	CreateProcess.exe
1236	CreateProcess.exe
364	i_pnkecausmk.exe
3828	hcamkecwup.sys
1612	CreateProcess.exe
4108	caupmhfzxs.exe
2096	CreateProcess.exe
916	CreateProcess.exe
3280	i_caupmhfzxs.exe
2776	pjhbzurpmk.sys
3432	CreateProcess.exe
5028	omjhbzurmb.exe
4076	CreateProcess.exe
5992	CreateProcess.exe
5096	i_omjhbzurmb.exe
5160	wurmjhezwu.sys
2304	CreateProcess.exe
1768	zwrojhbztr.exe
4712	CreateProcess.exe
5508	CreateProcess.exe
4268	i_zwrojhbztr.exe
5320	geywrojgby.sys
1396	CreateProcess.exe
5960	eywqoigbyt.exe
3400	CreateProcess.exe
252	CreateProcess.exe
2196	i_eywqoigbyt.exe
5272	rljdbvtolj.sys
2640	CreateProcess.exe
2808	gdbywqoigd.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5032_204591577\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5032_204591577\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5032_1203549845\kp_pinslist.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5032_1415893290\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5032_1415893290\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5032_1203549845\crs.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5032_1203549845\ct_config.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5032_1203549845\manifest.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgecwurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdxvsqhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idavtnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkicausmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnlfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_caupmhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwrojhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywqoigbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojhbztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwtojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caupmhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywqoigbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idbvtqolgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljgbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnkecausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omjhbzurmb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omjhbzurmb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdbywqoigd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspnheczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnkecausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oljdbywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsqlidbvtq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsqlidbvtq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdxvsqhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwrojhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspnheczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecwupmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oljdbywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvsqligdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgecwurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojhbztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idbvtqolgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebwuomgebzwrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljgbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnlfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvsqligdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkicausmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecwupmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwtojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdbywqoigd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idavtnlfdx.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
684	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1208	ipconfig.exe
6080	ipconfig.exe
5572	ipconfig.exe
2740	ipconfig.exe
6032	ipconfig.exe
2708	ipconfig.exe
5608	ipconfig.exe
3812	ipconfig.exe
992	ipconfig.exe
3856	ipconfig.exe
3928	ipconfig.exe
5320	ipconfig.exe
2308	ipconfig.exe
5816	ipconfig.exe
1292	ipconfig.exe
3452	ipconfig.exe
3236	ipconfig.exe
3336	ipconfig.exe
4840	ipconfig.exe
4324	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275205881069475"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1749168396-1890032557-311772428-1000\{0D267915-3EB7-4D1D-96C4-F9FF5237FCCC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5616	jebwuomgebzwrojg.exe
5616	jebwuomgebzwrojg.exe
5616	jebwuomgebzwrojg.exe
5616	jebwuomgebzwrojg.exe
5616	jebwuomgebzwrojg.exe
5616	jebwuomgebzwrojg.exe
5616	jebwuomgebzwrojg.exe
5616	jebwuomgebzwrojg.exe

Suspicious behavior: LoadsDriver 21 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	3344	i_trljgbztrl.exe
Token: SeDebugPrivilege	5588	i_oljdbywqoi.exe
Token: SeDebugPrivilege	4108	i_vsqlidbvtq.exe
Token: SeDebugPrivilege	900	i_vsnlfdxvpn.exe
Token: SeDebugPrivilege	824	i_lfdxvsqhfa.exe
Token: SeDebugPrivilege	364	i_pnkecausmk.exe
Token: SeDebugPrivilege	3280	i_caupmhfzxs.exe
Token: SeDebugPrivilege	5096	i_omjhbzurmb.exe
Token: SeDebugPrivilege	4268	i_zwrojhbztr.exe
Token: SeDebugPrivilege	2196	i_eywqoigbyt.exe
Token: SeDebugPrivilege	4448	i_gdbywqoigd.exe
Token: SeDebugPrivilege	1400	i_dbvsqligdy.exe
Token: SeDebugPrivilege	300	i_idavtnlfdx.exe
Token: SeDebugPrivilege	2776	i_pkicausmkf.exe
Token: SeDebugPrivilege	4612	i_xspnheczus.exe
Token: SeDebugPrivilege	3856	i_mkecwupmhf.exe
Token: SeDebugPrivilege	3644	i_mgecwurmke.exe
Token: SeDebugPrivilege	4176	i_ojhbztrlje.exe
Token: SeDebugPrivilege	5244	i_ebwtojgbzt.exe
Token: SeDebugPrivilege	3264	i_idbvtqolgd.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5032	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 5616	552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 552 wrote to memory of 1704	552	2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 1704 wrote to memory of 5032	1704	iexplore.exe	91
PID 5032 wrote to memory of 1288	5032	msedge.exe	92
PID 5032 wrote to memory of 2060	5032	msedge.exe	94
PID 5032 wrote to memory of 684	5032	msedge.exe	93
PID 5032 wrote to memory of 2060	5032	msedge.exe	94
PID 5032 wrote to memory of 2060	5032	msedge.exe	94
PID 5032 wrote to memory of 3520	5032	msedge.exe	96
PID 5032 wrote to memory of 3520	5032	msedge.exe	96
PID 5032 wrote to memory of 2568	5032	msedge.exe	97
PID 5032 wrote to memory of 5544	5032	msedge.exe	98
PID 5032 wrote to memory of 2568	5032	msedge.exe	97
PID 5032 wrote to memory of 2568	5032	msedge.exe	97
PID 5032 wrote to memory of 5544	5032	msedge.exe	98
PID 5032 wrote to memory of 5544	5032	msedge.exe	98
PID 5032 wrote to memory of 2764	5032	msedge.exe	101
PID 5032 wrote to memory of 5816	5032	msedge.exe	102
PID 5032 wrote to memory of 2764	5032	msedge.exe	101
PID 5032 wrote to memory of 5816	5032	msedge.exe	102
PID 5616 wrote to memory of 3888	5616	jebwuomgebzwrojg.exe	103
PID 5032 wrote to memory of 1144	5032	msedge.exe	106
PID 2176 wrote to memory of 4520	2176	trljgbztrl.exe	108
PID 5616 wrote to memory of 5252	5616	jebwuomgebzwrojg.exe	113
PID 5616 wrote to memory of 1364	5616	jebwuomgebzwrojg.exe	117
PID 2084 wrote to memory of 5092	2084	oljdbywqoi.exe	119
PID 5616 wrote to memory of 3320	5616	jebwuomgebzwrojg.exe	122
PID 5616 wrote to memory of 1944	5616	jebwuomgebzwrojg.exe	126
PID 356 wrote to memory of 4724	356	vsqlidbvtq.exe	128
PID 5616 wrote to memory of 2156	5616	jebwuomgebzwrojg.exe	131
PID 5616 wrote to memory of 5416	5616	jebwuomgebzwrojg.exe	135
PID 2956 wrote to memory of 3332	2956	vsnlfdxvpn.exe	137
PID 5616 wrote to memory of 3284	5616	jebwuomgebzwrojg.exe	141
PID 5032 wrote to memory of 1248	5032	msedge.exe	143
PID 5032 wrote to memory of 1172	5032	msedge.exe	144
PID 5032 wrote to memory of 1776	5032	msedge.exe	145
PID 5616 wrote to memory of 5780	5616	jebwuomgebzwrojg.exe	148
PID 5920 wrote to memory of 5924	5920	lfdxvsqhfa.exe	150
PID 5616 wrote to memory of 5356	5616	jebwuomgebzwrojg.exe	153
PID 5616 wrote to memory of 1740	5616	jebwuomgebzwrojg.exe	157
PID 2344 wrote to memory of 5052	2344	pnkecausmk.exe	159
PID 5616 wrote to memory of 1236	5616	jebwuomgebzwrojg.exe	162
PID 5616 wrote to memory of 1612	5616	jebwuomgebzwrojg.exe	166
PID 4108 wrote to memory of 2096	4108	caupmhfzxs.exe	168
PID 5616 wrote to memory of 916	5616	jebwuomgebzwrojg.exe	171
PID 5616 wrote to memory of 3432	5616	jebwuomgebzwrojg.exe	175
PID 5028 wrote to memory of 4076	5028	omjhbzurmb.exe	177
PID 5616 wrote to memory of 5992	5616	jebwuomgebzwrojg.exe	180
PID 5032 wrote to memory of 6000	5032	msedge.exe	184
PID 5032 wrote to memory of 6000	5032	msedge.exe	184
PID 5616 wrote to memory of 2304	5616	jebwuomgebzwrojg.exe	187
PID 1768 wrote to memory of 4712	1768	zwrojhbztr.exe	189
PID 5616 wrote to memory of 5508	5616	jebwuomgebzwrojg.exe	192
PID 5616 wrote to memory of 1396	5616	jebwuomgebzwrojg.exe	196
PID 5960 wrote to memory of 3400	5960	eywqoigbyt.exe	198
PID 5616 wrote to memory of 252	5616	jebwuomgebzwrojg.exe	201
PID 5616 wrote to memory of 2640	5616	jebwuomgebzwrojg.exe	205
PID 2808 wrote to memory of 1496	2808	gdbywqoigd.exe	207
PID 5616 wrote to memory of 2444	5616	jebwuomgebzwrojg.exe	210
PID 5032 wrote to memory of 1404	5032	msedge.exe	214
PID 5032 wrote to memory of 1404	5032	msedge.exe	214
PID 5616 wrote to memory of 556	5616	jebwuomgebzwrojg.exe	215
PID 2536 wrote to memory of 5964	2536	dbvsqligdy.exe	217
PID 5616 wrote to memory of 3428	5616	jebwuomgebzwrojg.exe	220

C:\Users\Admin\AppData\Local\Temp\2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-03_88033cbf0a841e906b10d1f904900a53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:552
- C:\Temp\jebwuomgebzwrojg.exe
  C:\Temp\jebwuomgebzwrojg.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5616
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trljgbztrl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3888
  - - C:\Temp\trljgbztrl.exe
      C:\Temp\trljgbztrl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2176
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4520
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1208
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trljgbztrl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5252
  - - C:\Temp\i_trljgbztrl.exe
      C:\Temp\i_trljgbztrl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3344
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oljdbywqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1364
  - - C:\Temp\oljdbywqoi.exe
      C:\Temp\oljdbywqoi.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2084
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5092
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6080
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oljdbywqoi.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3320
  - - C:\Temp\i_oljdbywqoi.exe
      C:\Temp\i_oljdbywqoi.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5588
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vsqlidbvtq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1944
  - - C:\Temp\vsqlidbvtq.exe
      C:\Temp\vsqlidbvtq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:356
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4724
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vsqlidbvtq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2156
  - - C:\Temp\i_vsqlidbvtq.exe
      C:\Temp\i_vsqlidbvtq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4108
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vsnlfdxvpn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5416
  - - C:\Temp\vsnlfdxvpn.exe
      C:\Temp\vsnlfdxvpn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2956
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3332
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vsnlfdxvpn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3284
  - - C:\Temp\i_vsnlfdxvpn.exe
      C:\Temp\i_vsnlfdxvpn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:900
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lfdxvsqhfa.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5780
  - - C:\Temp\lfdxvsqhfa.exe
      C:\Temp\lfdxvsqhfa.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5920
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5924
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2740
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lfdxvsqhfa.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5356
  - - C:\Temp\i_lfdxvsqhfa.exe
      C:\Temp\i_lfdxvsqhfa.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:824
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnkecausmk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1740
  - - C:\Temp\pnkecausmk.exe
      C:\Temp\pnkecausmk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2344
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5052
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5320
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnkecausmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1236
  - - C:\Temp\i_pnkecausmk.exe
      C:\Temp\i_pnkecausmk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:364
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\caupmhfzxs.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1612
  - - C:\Temp\caupmhfzxs.exe
      C:\Temp\caupmhfzxs.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4108
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2096
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6032
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_caupmhfzxs.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:916
  - - C:\Temp\i_caupmhfzxs.exe
      C:\Temp\i_caupmhfzxs.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3280
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omjhbzurmb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3432
  - - C:\Temp\omjhbzurmb.exe
      C:\Temp\omjhbzurmb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5028
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4076
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2308
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omjhbzurmb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5992
  - - C:\Temp\i_omjhbzurmb.exe
      C:\Temp\i_omjhbzurmb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5096
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwrojhbztr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2304
  - - C:\Temp\zwrojhbztr.exe
      C:\Temp\zwrojhbztr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1768
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4712
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwrojhbztr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5508
  - - C:\Temp\i_zwrojhbztr.exe
      C:\Temp\i_zwrojhbztr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4268
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eywqoigbyt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1396
  - - C:\Temp\eywqoigbyt.exe
      C:\Temp\eywqoigbyt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5960
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3400
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1292
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eywqoigbyt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:252
  - - C:\Temp\i_eywqoigbyt.exe
      C:\Temp\i_eywqoigbyt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gdbywqoigd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2640
  - - C:\Temp\gdbywqoigd.exe
      C:\Temp\gdbywqoigd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2808
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1496
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3452
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gdbywqoigd.exe ups_ins
    3⤵
    PID:2444
  - - C:\Temp\i_gdbywqoigd.exe
      C:\Temp\i_gdbywqoigd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbvsqligdy.exe ups_run
    3⤵
    PID:556
  - - C:\Temp\dbvsqligdy.exe
      C:\Temp\dbvsqligdy.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2536
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5964
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:992
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbvsqligdy.exe ups_ins
    3⤵
    PID:3428
  - - C:\Temp\i_dbvsqligdy.exe
      C:\Temp\i_dbvsqligdy.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1400
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\idavtnlfdx.exe ups_run
    3⤵
    PID:5424
  - - C:\Temp\idavtnlfdx.exe
      C:\Temp\idavtnlfdx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3160
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2876
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_idavtnlfdx.exe ups_ins
    3⤵
    PID:5824
  - - C:\Temp\i_idavtnlfdx.exe
      C:\Temp\i_idavtnlfdx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:300
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pkicausmkf.exe ups_run
    3⤵
    PID:5680
  - - C:\Temp\pkicausmkf.exe
      C:\Temp\pkicausmkf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3280
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1456
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4324
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pkicausmkf.exe ups_ins
    3⤵
    PID:200
  - - C:\Temp\i_pkicausmkf.exe
      C:\Temp\i_pkicausmkf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2776
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xspnheczus.exe ups_run
    3⤵
    PID:900
  - - C:\Temp\xspnheczus.exe
      C:\Temp\xspnheczus.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5524
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4364
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3236
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xspnheczus.exe ups_ins
    3⤵
    PID:2872
  - - C:\Temp\i_xspnheczus.exe
      C:\Temp\i_xspnheczus.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4612
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkecwupmhf.exe ups_run
    3⤵
    PID:1400
  - - C:\Temp\mkecwupmhf.exe
      C:\Temp\mkecwupmhf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5284
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2188
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3928
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkecwupmhf.exe ups_ins
    3⤵
    PID:3960
  - - C:\Temp\i_mkecwupmhf.exe
      C:\Temp\i_mkecwupmhf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mgecwurmke.exe ups_run
    3⤵
    PID:1332
  - - C:\Temp\mgecwurmke.exe
      C:\Temp\mgecwurmke.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3452
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1056
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mgecwurmke.exe ups_ins
    3⤵
    PID:2000
  - - C:\Temp\i_mgecwurmke.exe
      C:\Temp\i_mgecwurmke.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3644
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ojhbztrlje.exe ups_run
    3⤵
    PID:908
  - - C:\Temp\ojhbztrlje.exe
      C:\Temp\ojhbztrlje.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1444
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5468
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3336
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ojhbztrlje.exe ups_ins
    3⤵
    PID:5644
  - - C:\Temp\i_ojhbztrlje.exe
      C:\Temp\i_ojhbztrlje.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4176
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ebwtojgbzt.exe ups_run
    3⤵
    PID:5892
  - - C:\Temp\ebwtojgbzt.exe
      C:\Temp\ebwtojgbzt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3840
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6056
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ebwtojgbzt.exe ups_ins
    3⤵
    PID:4832
  - - C:\Temp\i_ebwtojgbzt.exe
      C:\Temp\i_ebwtojgbzt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5244
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\idbvtqolgd.exe ups_run
    3⤵
    PID:2520
  - - C:\Temp\idbvtqolgd.exe
      C:\Temp\idbvtqolgd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4756
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3468
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5608
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_idbvtqolgd.exe ups_ins
    3⤵
    PID:2828
  - - C:\Temp\i_idbvtqolgd.exe
      C:\Temp\i_idbvtqolgd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3264
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffe5acfc188,0x7ffe5acfc194,0x7ffe5acfc1a0
      4⤵
      PID:1288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,17943256893961208642,7763869932911820413,524288 --field-trial-handle=2316,i,1076088050608724624,12193299066056147069,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:11
      4⤵
      System Time Discovery
      PID:684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,4996686871035484746,1499459110919650051,262144 --field-trial-handle=2316,i,1076088050608724624,12193299066056147069,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
      4⤵
      PID:2060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,4684852808118603688,14739370793366516783,524288 --field-trial-handle=2316,i,1076088050608724624,12193299066056147069,262144 --variations-seed-version --mojo-platform-channel-handle=2832 /prefetch:13
      4⤵
      PID:3520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,9934746811240581890,682304569227325499,2097152 --field-trial-handle=2316,i,1076088050608724624,12193299066056147069,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
      4⤵
      PID:2568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,1229799132127839180,9104150817899799178,2097152 --field-trial-handle=2316,i,1076088050608724624,12193299066056147069,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
      4⤵
      PID:5544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,6782604040602618494,778729160283670242,524288 --field-trial-handle=2316,i,1076088050608724624,12193299066056147069,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:14
      4⤵
      PID:2764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,17925763552789772571,12020448499084970826,524288 --field-trial-handle=2316,i,1076088050608724624,12193299066056147069,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:14
      4⤵
      PID:5816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,1940319778595450709,14947468936504725998,524288 --field-trial-handle=2316,i,1076088050608724624,12193299066056147069,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:14
      4⤵
      PID:1236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,1940319778595450709,14947468936504725998,524288 --field-trial-handle=2316,i,1076088050608724624,12193299066056147069,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:14
      4⤵
      PID:1144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,9723115287159050809,16922750324699022795,524288 --field-trial-handle=2316,i,1076088050608724624,12193299066056147069,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:14
      4⤵
      PID:1248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,10985387070339990793,3830722326695254966,524288 --field-trial-handle=2316,i,1076088050608724624,12193299066056147069,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
      4⤵
      PID:1172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,11059874195755221221,16298609640173108733,524288 --field-trial-handle=2316,i,1076088050608724624,12193299066056147069,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
      4⤵
      PID:1776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,9448033078161193212,11323331604001264202,524288 --field-trial-handle=2316,i,1076088050608724624,12193299066056147069,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:14
      4⤵
      PID:6000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,14429006006522141822,7808159486622842931,524288 --field-trial-handle=2316,i,1076088050608724624,12193299066056147069,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:14
      4⤵
      PID:1404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,15103097689102239453,4622495584534324279,524288 --field-trial-handle=2316,i,1076088050608724624,12193299066056147069,262144 --variations-seed-version --mojo-platform-channel-handle=916 /prefetch:14
      4⤵
      PID:2668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6528,i,16867092798318589673,6502766060813820253,262144 --field-trial-handle=2316,i,1076088050608724624,12193299066056147069,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:10
      4⤵
      PID:3264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3860,i,15970097304444839312,6275383912025117985,524288 --field-trial-handle=2316,i,1076088050608724624,12193299066056147069,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:14
      4⤵
      PID:3828

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4772

C:\Temp\jebwuomgebzwrojg.sys
C:\Temp\jebwuomgebzwrojg.sys
1⤵
- Executes dropped EXE
PID:3056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5028

C:\Temp\vtrlgeywqo.sys
C:\Temp\vtrlgeywqo.sys
1⤵
- Executes dropped EXE
PID:4404

C:\Temp\vqolfdbytq.sys
C:\Temp\vqolfdbytq.sys
1⤵
- Executes dropped EXE
PID:5404

C:\Temp\igaysqlidb.sys
C:\Temp\igaysqlidb.sys
1⤵
- Executes dropped EXE
PID:2700

C:\Temp\icavsnkifa.sys
C:\Temp\icavsnkifa.sys
1⤵
- Executes dropped EXE
PID:2928

C:\Temp\nkfcaxspnh.sys
C:\Temp\nkfcaxspnh.sys
1⤵
- Executes dropped EXE
PID:4268

C:\Temp\hcamkecwup.sys
C:\Temp\hcamkecwup.sys
1⤵
- Executes dropped EXE
PID:3828

C:\Temp\pjhbzurpmk.sys
C:\Temp\pjhbzurpmk.sys
1⤵
- Executes dropped EXE
PID:2776

C:\Temp\wurmjhezwu.sys
C:\Temp\wurmjhezwu.sys
1⤵
- Executes dropped EXE
PID:5160

C:\Temp\geywrojgby.sys
C:\Temp\geywrojgby.sys
1⤵
- Executes dropped EXE
PID:5320

C:\Temp\rljdbvtolj.sys
C:\Temp\rljdbvtolj.sys
1⤵
- Executes dropped EXE
PID:5272

C:\Temp\bvtnligayv.sys
C:\Temp\bvtnligayv.sys
1⤵
PID:1268

C:\Temp\ifdxvqniga.sys
C:\Temp\ifdxvqniga.sys
1⤵
PID:1144

C:\Temp\nkfdxvpnhf.sys
C:\Temp\nkfdxvpnhf.sys
1⤵
PID:2264

C:\Temp\fcaxspnkic.sys
C:\Temp\fcaxspnkic.sys
1⤵
PID:1468

C:\Temp\mhfzxrpjhc.sys
C:\Temp\mhfzxrpjhc.sys
1⤵
PID:5948

C:\Temp\pmhezxrpjh.sys
C:\Temp\pmhezxrpjh.sys
1⤵
PID:1264

C:\Temp\zwuomgezwj.sys
C:\Temp\zwuomgezwj.sys
1⤵
PID:1136

C:\Temp\jdbwtolgey.sys
C:\Temp\jdbwtolgey.sys
1⤵
PID:2412

C:\Temp\igaytqljgb.sys
C:\Temp\igaytqljgb.sys
1⤵
PID:4448

C:\Temp\qlidavtnli.sys
C:\Temp\qlidavtnli.sys
1⤵
PID:812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hcamkecwup.sys

Path C:\Temp\hcamkecwup.sys
Size 293KB
SHA256 43d78691f3e31e27528e34f3f1296db972f91c1ab51b5c0751da90a14a0c11ae
MD5 84bfdf766e8af00974ceb01a18ea7757
SHA1 c408affbcc75dedcf059d883893254b8ce04f7a6
SHA512 249d9c3c8693afbbc2b783c998174aa7f95727ecbdf50db2a597c8f3adf08742b40da409fd727e85485a08bbc4eab0759c2e4068095ce6ba99667f28aa736898
SSDEEP 3072:stKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:sIJjiJcbI03GBc3ucY5DCSj
TLSH
T1DD545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lfdxvsqhfa.exe

Path C:\Temp\i_lfdxvsqhfa.exe
Size 722KB
SHA256 67271c925701e4a0adc62a8d1f7619f90ca7bb81c69f404b031a7a3c987bb489
MD5 0e43dff7bb608d1826db3075a179b19f
SHA1 7786aff27be29a439065327f55f1d71047d9c828
SHA512 e521fca199e0c8d9c31c416b02bf94b2fc7030fed8a33640a64f05eef571c41bf363e91992ca4c98347475a602048a023a7f5d4721bdbf3f3498cb83a17d603e
SSDEEP 12288:jflfAsiVGjSGecvXAflfAsiVGjSGecvX:rMcfcMcf
TLSH
T1B2F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_oljdbywqoi.exe

Path C:\Temp\i_oljdbywqoi.exe
Size 722KB
SHA256 a453d0ef0884ff01959b53e7718b64b041af51013fd6cec108e8bc894d4df9cf
MD5 aaa3dea8fff0024f7aab47e9e46a412c
SHA1 3a9a1ef435d62d3889f3c9e3a96fcd8f4fb4a299
SHA512 b1159329ba98dcb7d7383040961bb3c018059b1194eb2cbb37f47659b2318d427eb74f820068acfe5dac45e0925bb9ad08bdd97c1c3e106bd226edf7da465d30
SSDEEP 12288:OflfAsiVGjSGecvXAflfAsiVGjSGecvX:qMcfcMcf
TLSH
T131F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pnkecausmk.exe

Path C:\Temp\i_pnkecausmk.exe
Size 722KB
SHA256 52b42579a61aad5804c23eb443d8e4c4af0176ff1adfd83989cdf08915306f8d
MD5 a14d48ca014ebab91575bcea54375606
SHA1 97b7749e080bac9ddd63624fdfc66b124f826afd
SHA512 8f91903ed508ea3aee566d0643cfe3d75b43e3187703b759dc81cabcc7b1234335849fb74e013124feb323da0d4f471ae4ebecaaf4a1a906840746d894357317
SSDEEP 12288:lflfAsiVGjSGecvXAflfAsiVGjSGecvX:tMcfcMcf
TLSH
T171F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_trljgbztrl.exe

Path C:\Temp\i_trljgbztrl.exe
Size 722KB
SHA256 f30c74b1dacac95442817121790a2392ef4bdec7ab997c56a0e01d5565956176
MD5 bf0adac551eb50cecf4abfdeb3200d31
SHA1 98acafaf3ad49675531e7ae3c67a1998ba30e84b
SHA512 870a3daa59b7044c7eebf3f211ef6e181cc348a7275690d7a471042556e02b9ae4526715c11911dcb8c8638160afecc8784a0a202e86c71282425db32c6d7705
SSDEEP 12288:AflfAsiVGjSGecvXAflfAsiVGjSGecvX:cMcfcMcf
TLSH
T168F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vsnlfdxvpn.exe

Path C:\Temp\i_vsnlfdxvpn.exe
Size 722KB
SHA256 5abe9c2e098e6fa402bd47feafc7283f2ec983c58edc80369c91e17e752c9779
MD5 8e423de950ee1d0911635a08b19adaf0
SHA1 0f3a5fc02ba64f097e2719d05c7708e10b752bf7
SHA512 5b3c6d78f44493550438c1d2470c78fe187b5c9afea484de0bd375e354da725257dc795212e67f8af2a31ae26f2da0e8a0b245b0f99e5a815c762d4b0a23cb44
SSDEEP 12288:/flfAsiVGjSGecvXAflfAsiVGjSGecvX:nMcfcMcf
TLSH
T19DF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vsqlidbvtq.exe

Path C:\Temp\i_vsqlidbvtq.exe
Size 722KB
SHA256 4740a7d05925bb28af374e32f99ac762c6ce2fec01318bfc8c5f54c3c0eaea7c
MD5 c27783023ce6a7afe7cb09ca42ebd02c
SHA1 f1c1733a6c648a4fed926f5c6350083ce27da82b
SHA512 42fe87acf586f1884707e48667c5fbd9a01c0bbd4364f7628d9b42d376145003507ff39afe48a35696fd5d5ee994c563a3e2a195e7ac9b29b5e7c9cbce431861
SSDEEP 12288:oflfAsiVGjSGecvXAflfAsiVGjSGecvX:0McfcMcf
TLSH
T141F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icavsnkifa.sys

Path C:\Temp\icavsnkifa.sys
Size 293KB
SHA256 e7e6e92f3b85653284f8879d04e66ebff6ad1e794c669c331533c1af681c96be
MD5 009428efddc98b0e217d69e51387b756
SHA1 f7d89f30d93c195bfa3d50ba6b893ce9273808ef
SHA512 89de733988faa06f50244836b5f7dec3816660c193133fc0f5f2d1b54b0cc9080cfd8fc8a878dfc692b5b56e47c0b2efe9ceb2571a5286079efdf49e55f9e02e
SSDEEP 3072:otKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:oIJjiJcbI03GBc3ucY5DCSj
TLSH
T1CA545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igaysqlidb.sys

Path C:\Temp\igaysqlidb.sys
Size 293KB
SHA256 aab00855ad8ad2526ff00a6e82d1107121213b485374636f28d13945242ad4f7
MD5 9466cad08f7fc3eb9d4a5050e0a65a81
SHA1 186aabef8dc795e350033b95469d2ff2b87f618d
SHA512 01dc5d6fc72e71c44c944d0999ccdf5e1de12a7e1c921bc4fb2dcf54ecbe2a5aeda8953ab612d711e43afe013c94227b14db4898ecfb34dbda7583bed6d1dae3
SSDEEP 3072:EtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:EIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D7545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jebwuomgebzwrojg.exe

Path C:\Temp\jebwuomgebzwrojg.exe
Size 722KB
SHA256 e5aff8c9af1e4c5e6a21b94cfe81febea7e9241f4387344b61b7a73a2f14bce3
MD5 73d192460116c7040a8676dee8d97397
SHA1 50e38e3497114b562495cd5c4c755002c3704845
SHA512 9a0eff0f3c1d9b4a198a8527252b86032b848a020d543170e9ecc96ad9d53fb7d82cab035c00e02834eac5be534760a4cfff7273170c30289af99f338a89e79c
SSDEEP 12288:RflfAsiVGjSGecvXAflfAsiVGjSGecvX:ZMcfcMcf
TLSH
T114F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jebwuomgebzwrojg.sys

Path C:\Temp\jebwuomgebzwrojg.sys
Size 293KB
SHA256 4fb19857163922dcfeaffdc39ed6d9b7742574060914eabb3e2c25a8310f56ec
MD5 158a09755ae3c699e760351c33308983
SHA1 0543cc3e457ecaffc8d599ab089d0e9a96cf95bf
SHA512 d87d3ff8d9ee966f8328b711d308fb3f218ed684a6f9bc228db628d8205fee8501cd4a8adf4eaeda31066a9ad7de2b1f7fbdff528779cb6c981078002d2166b1
SSDEEP 3072:vtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:vIJjiJcbI03GBc3ucY5DCSj
TLSH
T113545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdxvsqhfa.exe

Path C:\Temp\lfdxvsqhfa.exe
Size 722KB
SHA256 639250be20fab5a1c3b36fc6250236c147fa541e58d06e18a062bef830c81e7c
MD5 f8e501909fe24a1c353f323422fa6b62
SHA1 eda4227bc50ebda396020ecc8850be5e3d12c2ca
SHA512 5235868ccf13748637a762bd7eda1f805da275268bb9f7c27601e98b4c3d80fffab58c7caa9ae4a2fb0f9704f2bd793688cbc4f72826b6fe66f4b6bb9db4d33a
SSDEEP 12288:lflfAsiVGjSGecvXAflfAsiVGjSGecvX:tMcfcMcf
TLSH
T14EF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkfcaxspnh.sys

Path C:\Temp\nkfcaxspnh.sys
Size 293KB
SHA256 f7af1de3d1b5c37a89c6d45f525fc402d6dd19ee9920bc344a5f32bb386433c9
MD5 d53084d4cb1590141906bb100afc0bf3
SHA1 e679c553c1355658e0e8f3f6f38439a26058754a
SHA512 e384f43fa5e2b96c7d9b637ccf53580c775eb24fc463daa80b9d0e5144670378e8597e136f3e9c02af52e3d9dd14537f49944ca30ca837c6282167b39b25915b
SSDEEP 3072:ytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:yIJjiJcbI03GBc3ucY5DCSj
TLSH
T1B3545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oljdbywqoi.exe

Path C:\Temp\oljdbywqoi.exe
Size 722KB
SHA256 abaa555c529432050c0611310b93b4dd151c9917abe9952d3bdc01e1724a3728
MD5 b140a0506cab96e2b20287925271b9ab
SHA1 dad325ac66ad96f690821a0eef9084f2151b3163
SHA512 c97463e3b6a41d0fe958db99dd0ccf0f088246da1a6e3c555053e603534cfef8c3be83812909161f5a621b978444ea375fe7b465fa84b10c9b49a6680cb3a33e
SSDEEP 12288:WflfAsiVGjSGecvXAflfAsiVGjSGecvX:CMcfcMcf
TLSH
T1E8F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnkecausmk.exe

Path C:\Temp\pnkecausmk.exe
Size 722KB
SHA256 f6ed4ca014348a0a039cc543e19464a7bb9cc9969fbf09db30c0a58340b1df7e
MD5 37de35b3dc6504eefdeb2ca2dc397329
SHA1 91ed506c956ca0928981e8ea56bc57a367705648
SHA512 2ec38d00efd6d16ce40e4a50ddac0be956858e2671cdb3c48a443499c717333a04da2f006bd011674aa9a95393f4cb675d79e1a9ba20da944d895927e6027615
SSDEEP 12288:hflfAsiVGjSGecvXAflfAsiVGjSGecvX:JMcfcMcf
TLSH
T1F5F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljgbztrl.exe

Path C:\Temp\trljgbztrl.exe
Size 722KB
SHA256 e0eccbdc02c6c9974240543f2b0c049024e35878f8ecc22e75faec190c61ab3c
MD5 d39fdd02da8e1cb17a05529a384dde78
SHA1 a8c92cb0c1db1c36ed1db5e5545383e392c2b913
SHA512 17452b1b36dec089de29aff0043e348457b8b319568dd9e7533de30a36fcc8818d9abf2a4555c47beba65114a92561a09e09534c8c2dd4cc38d0c8db846312cd
SSDEEP 12288:+flfAsiVGjSGecvXAflfAsiVGjSGecvX:6McfcMcf
TLSH
T175F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqolfdbytq.sys

Path C:\Temp\vqolfdbytq.sys
Size 293KB
SHA256 5ad6273a42329743ba8a22416ce42d328bf34204e1c8c0e557a363eac9ec8b88
MD5 dcdf034a724c604f82ecdb537ca1e756
SHA1 96ec25263bd8d956854d8b89848a5d9ba367367a
SHA512 f21b0b990eccf8ce7cb5f99d395a9083a088e06849402f0b69c4eac36c8ce699d4d18d39179135b4fa117bee2f7c13be9d6a5d7555bff0609e9f702c17544331
SSDEEP 3072:0tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:0IJjiJcbI03GBc3ucY5DCSj
TLSH
T1AC545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsnlfdxvpn.exe

Path C:\Temp\vsnlfdxvpn.exe
Size 722KB
SHA256 709808ce6ef39a28b47d5e5f5ea75548191b7e77aa6850a4c30dd011c5c98c4a
MD5 f14d9437f5dab1426d26b6843da834bb
SHA1 54ae1ccbb993eb6f342dfad91f41dfe0c3db4e90
SHA512 94002eb8b1c9db841ea144f31bf1bd309060f5d4ece51bf48979cbc15971973a6ebe318578a326147557f6e88f7b12d43e645ade495558808924291b279d20a5
SSDEEP 12288:FflfAsiVGjSGecvXAflfAsiVGjSGecvX:NMcfcMcf
TLSH
T166F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsqlidbvtq.exe

Path C:\Temp\vsqlidbvtq.exe
Size 722KB
SHA256 9f7f9f069b7bd90c51a775a7e5592c23c0d993733c5a89890d4f1dc589edca43
MD5 ff1cf19d48099007c6486b1aa921edf4
SHA1 b70053af652333001cdeebf10096348bafc1e54e
SHA512 e405621b3f58f687b183715b60489bc1fd688e1b34c46880c68adb1a4292a4297cfcf0a849e8cf3bc8d48109ad2af0b4e588e051023a753d2ce35ab9e23d7724
SSDEEP 12288:JflfAsiVGjSGecvXAflfAsiVGjSGecvX:BMcfcMcf
TLSH
T147F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtrlgeywqo.sys

Path C:\Temp\vtrlgeywqo.sys
Size 293KB
SHA256 5e025be99e0fe329f06553f55d6249c4479ef04325f328557fe173606f4fc14f
MD5 003a46e14e90a58adcc475dd788601bd
SHA1 788d37119d006b0e5c14cf1fb1f54089e83e046f
SHA512 079fc35397688f0a3a1d56f9613c8e82e677c302dceff5172aae672c1f8d9082fc1999215f1f05e5b359e88ef7861aab011a7bae557ed757b255546a886390d2
SSDEEP 3072:LtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:LIJjiJcbI03GBc3ucY5DCSj
TLSH
T1BF545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 55b968461c3cac4c7effa8a6c28244f55447bc6d9425abffdc980dbcf8f66a56
MD5 0f2dd8d756f52925ee56edb716c271af
SHA1 5baaa4f814deacaf47060c8d09015a8db39ce0b5
SHA512 9f360c7252debebc7f5372dc3ef1b650a635a7874dcf1f582432193203c260b088889ed1445047bad1f96fda147db83e0ec8ddfccd1d60be7a75e2fa03873bb0
TLSH
T1A1D0C0E073697941C32134F278218700F35004B1682BCA41B0C4400C8D7504A53C620B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 aebb6c70ab7a24d554d6f6ac0f891eea8d0143d763ae26afd14158a62471d32c
MD5 4df2b013f915bbf768a35e9c1e788fe1
SHA1 5f99dfa4310596930be8e393c0de83bb374a10f7
SHA512 5285653806cab96614917acfa4a3f6992cd581c9ad8eb14808de784b888ecfebb44f82a0a32c756a63c062605216d2535eed0d53eb14c4498ab3ae12d2d005b5
TLSH
T148D080E077697941C32534F274158740F7555471646BCA41B0D4D10C8D7555AA7C6257
MD5 SHA1 SHA512 TLSH

Submit Download

9d98773f-c8f6-46da-adf7-2d8abe50ee93.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9d98773f-c8f6-46da-adf7-2d8abe50ee93.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 1f8243265e796d2f2651ad963ab087b79c12afab83da4e18b391ff88c8eda21c
MD5 e038104cb30f853d4fb4c17d93d811bd
SHA1 fd60f18b9de22295125c43e8f69d0bb409d9e4e0
SHA512 80a02ea233087329d60395883bcea2f3da0ceeeb470966e0ea39af14d3eb10d17a1e1de9cb90f04c3b5a5aab52eae358823b9066867a21e71295bab997049157
TLSH
T1D6E02BAAC921AC2708FC6B6C70954641E650132627508D4F3A3D810CCFB2B7B426682C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 eb17a1ffa3768a40bfcf8cc588acd3137322acc2ac1fa0b6a516dcda38047810
MD5 3d872f659c93c2e9dba4ec8410945a71
SHA1 9bf97eb00014ef618e38da37167294f2166e7035
SHA512 002cbdf264396ed0f1b336cd9a5c46302f3db59dfb2705b53ea835f60547b8c194b407807b4b789b3d3de4d33bfca5454979e5307375c38804450c3a810a6bb3
TLSH
T12741C0F783F4866EC91196F0AA187E2BCE1D0915832C7D5AC9E0AF1B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 f77876a21204a7c3e7e2a25c436340a4bfca433c0653b02a3b98cd2c58814633
MD5 fd6da666c05bc668c1d157905f090240
SHA1 a7fa84440cee96fcb61b58fc8668b3d1a6275058
SHA512 3f36ea412924076f080ce9d94148ee5a0f489b594951ffdb79488524d805398e7384cb230ad90773713f3d9758225354df4574b9c689b7b2d57ab4596a1279b0
SSDEEP 192:sxRhReyMqZjK1Ml8UQKct/fNsry8tZKOOZI0zoA8prw/g6+WNCtC/YA/DTfaG4Id:sxRhHq5t/fNsr7DeZgU/5j/7faDW
TLSH
T12B72D71669349D7B8CDBD208FA857F53D6F8517391945E44AAFCCA0C05EB6EC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 09a3df65265b49c70dfd8d4fed94ef30169382618521784250773d7cd9da2192
MD5 5065f045c2af54c721dab273c6d2af81
SHA1 d09c2a6cc1729fa990dd66eaa7d5b9ee3e9ffad2
SHA512 eedf0c80090d8d935610355a6e68dccf5a45775faffc05b59d218242f9e62e44b673d7d562dadb0801ca598ece2ca398f3cffd2d6af2d9b9303dee7297883bcd
SSDEEP 192:sxRhReyMqZjK1Ml8wct/fNsWyxtZKOOZI0zoA8prw/g6+WNCtC/YAwDTfaG4IgjN:sxRhHCt/fNsWiDeZgU/5j/ifajN
TLSH
T1A772E90669349D7B8CDBD208FA957F53D6F85573A2905E44AAFC8A0C05EB6EC211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 3a5fe1090357576296398e34f3788664ec4c160eea2f50d10b978fad3ca86f1f
MD5 941d046b8be116980a1f111168d21ec1
SHA1 0eddf69879422f170cea449c1ffb97f573098a45
SHA512 075cd354cea2d821b44c4104657b63bfeafc2792e0fbbc2eba86979151d3716c4dbc328fbf9e4cdfcb3d3f42bf85c263c44b1bf221924b2a1d3b6544ce543948
SSDEEP 768:DckYJT7pLuL7glWg1NfgB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVMSVhHgurop/fn:DckYJFE7glWg1NfgBu1jafSVdglpn
TLSH
T14FE2DB7B680CCB7F4F804A9DEC297D9A6DA801CF96D8CD5447EA840C03C67EB511A5EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 cc97f2531abd024d997d9e5f3d95456220c13a3052f1d421976cc4b07768a8ba
MD5 0aaea91d6c153d2d71743ce0e4f3b8bc
SHA1 6ebcbfeffec9f9787027761406d1fbdac0a97acc
SHA512 30f0216cfac11877a0b6e0a452ba45067d41f72b0b6f9eb11af15744613d0ca6fec377c8ab111c273c04b8a038f03f5ed52f463d825c6429178a9d633e35aec7
SSDEEP 192:E61PhSGGXWL8MMLOi70MjSEJB3BPorbu/drtBZnZN7x/KzPKzYKz9Kz5Kz4:E+PKFT3JoPuVr/ZZNF4
TLSH
T121B21810773A32C2397D39088194942F52C23563321AA56B7BBC64EA4F6BE41DFFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 7aa301142f206fd45c19e63d1df573f100ef6663dc93d72eca0958b7be7e54d5
MD5 267ddcb499ce8f97d2c635d5305a5a92
SHA1 f02761e02bec48196fbf85b4318e92bbfcfd3794
SHA512 fadab47aa5de0e6e5ce0ee49422690b14165c6fc6a52e4356f486525fc054dc698eef5c312de3195f15489b1eef113b7c189cb423e734bc86baa3052b0981a53
SSDEEP 384:njiF1tNn/s3n9Sy8Nj8TUNTUlIRNnB1iiEYZstsfUG7UXS6vc3jk9mn15wbAjEKE:OF1j+9XiwgfqOwGALvqk9mn12bfH
TLSH
T13AC23936DC64DE77EDE68FC9B70ABA5AAEE001A381D859D4D9D80D4C00D72DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 85805f41172fafb65077e43445b375c8db855c7e4a5777baf9e6e609dd61fcee
MD5 737af5cf16a49d8d64e73318cb90f387
SHA1 862f52403f90b985c9b7ece0abbf04467121e036
SHA512 0511f0734e8ed14015addf3f2911de229517ad0cb4188ded7060553f5c012e540e1b3bc1c135c763f53e2034beb7b672e08840581dc471ddb69ae553c1a5b6ce
SSDEEP 384:nEiF1tNn/s3n9SX8NL8TUNTUlIR6B1xHonstsfUG7UXS6vc3jwr1iOObjI9G6w7h:fF1j+9yCwgSI6GALvqwr1i29Miu
TLSH
T1F8D25A36EC64CEB79CE68FD8B74A3A8AEEE011A384985DC4E9D95D4C00C71ED070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 cf6d1fbdd8eb0a7cc04bffda7a9c6c42ba3b6428c739b8a8fe76af3dab3e3176
MD5 32d97e4ef7f9c6761f27530bd696fda1
SHA1 2878f013bdde60537ca13299c55e96e8988656af
SHA512 f440fedc20a57b8fde01370f0f61bc3463f4c051520f74ac4a87424b2c7f085b3655fd1f30247185f6433db4ed902edbeb222e1f02ba68a40a6ec4667e754300
SSDEEP 384:n0iF1tNn/s3n9S98NL8TUNTUlIR6B1xMonstsfUG7UXS6vc3jwr1iOObjI9G6w7h:PF1j+9YCwgSn6GALvqwr1i29Miu
TLSH
T146D25A36EC64CEB79CE68FD8B74A3A8AEEE011A384985DC4E9D95D4C00871ED070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 44adea9ef48a6d6f8b55e0edb3380b040b57a0d5dc63b2c16b5169c91b61716b
MD5 a0b78c81274c300c170b8d136ddafab0
SHA1 10db581b123718ce663fa88b9bb22412d34d587d
SHA512 0decae23a3078614bd4b25a116f938328f08fcf6d6c55470ff275d7f5652d503faef64354a05b8c50187195054cf2251962a3a805aa4dcb69ebcfd25222cbb07
SSDEEP 384:ngiF1tNn/s3n9SE8NL8TUNTUlIR6B1xMVnstsfUG7UXS6vc3jwr0viOObjI9G6w1:7F1j+9dCwgS26GALvqwr0vi29Miu
TLSH
T1F0E2B2F598D78A77D89E8B97A37D2E469AFCC163B4885984F7C84D0CCC861BFC606805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 b02e1686ea84a9d4a9821674b4808e08d77c0171a3e66b98a10a4496db9af286
MD5 6f32b20ed9a0b17cf4dc9cf341845eb3
SHA1 3d1349ac777ded6a2f76ea58ffb04a77a4d3b51b
SHA512 09fa8bb97649eeddd0e20d7f77fbf55ecf6be5aa563d40594aaef35c836043b414f19e645560560087926bdb21227a063ea9c196a55fade17252e40978bcc6a5
TLSH
T1713120E099381AD1C4BE49BFF48B35FC94E9D622F49530392898EC58922D65D258043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 b3efa74c3a4e6ee7530015696ca405b2b6cf84d429e0cd2c0bb8e21d45d563e3
MD5 00817e6218bad742e0bb1bfc3d59fcd2
SHA1 7399ad4efba5da235c39fcd4f164b9bd3356a1cc
SHA512 43aae0cd0937105d64f66b85493843c83c4281ada4d04962455c27780e6b94d0c0c53998f4b279bdf7a102b20f8b477dd3a7751d3b2c7cfac2e60195c41a66ea
TLSH
T1853122E0993C1AD1C4BE49BFF45B39FC94E9D612F46870393888EC58952E64D258043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 4add50b911c832c238af18a216cd81908cfe170b749dc762f5d386c832c3e7a9
MD5 56a3e8d37363cb08e673b6294ffce615
SHA1 80f4fc584aa1119a1482888dc0cf3e2eb0d008cf
SHA512 078a255c417c414ed7e1f0ef009e790731deb87b44229deeb6608fcfe495b3fb02573329e98f7d38916d157a2ac4b497ef914826e1fff91441c32164a7eb573f
TLSH
T1853122D059382AD1C4BE09AFF49B39FC94E9D221F858743D7884E898952E54A658083F
MD5 SHA1 SHA512 TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 66f585bb3415e9c0eb2cd0074ddbfc296832708fc76baf47d4c0adfc1f4d699f
MD5 3ea998c626ce8e9440633ab28b363ac4
SHA1 425a9cd236d7467f02579ab2ebfe25a4b6af77de
SHA512 feffce116e3b0d09cb166a14722fbdd3cf240878e76e40295e4bc7dd740d339bc02d1267c63003c945aff6832820107874ffc81ad3dd21134e6193688647a6b9
TLSH
T14A71008357A8C6F2C1DE5FF102835648F5BB22784B2330204B61554ABA34ABA24B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/812-427-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1136-378-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1144-320-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1264-373-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1268-309-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1468-342-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2264-338-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2412-390-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2700-211-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2776-280-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2928-224-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3056-59-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3828-275-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4268-239-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4404-156-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4448-407-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5160-284-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5272-305-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5320-288-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5404-191-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5948-353-0x0000000000010000-0x00000000000AB000-memory.dmp

Download