5a8fdb1f08df1a5df4a3c4a65407e275c48294ef16f2c83dc76dc70f13b56ac2

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 14:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 722KB
Sample260710-rnns9sa15n
SHA256 5a8fdb1f08df1a5df4a3c4a65407e275c48294ef16f2c83dc76dc70f13b56ac2
MD5 07914be17ea9c9763d268417eee4e2ef
SHA1 61fab470d4fb15cc94ba3a24019147e12a190136
SHA512 93fb454e4266aa011ba4faa1a63088197438d6a8ec7f1e6768cf48e8df2f04531b2b7141bcc6f3f00394410fd67896dbbbeb36e23ba1a135e542e45cd58deb25
SSDEEP 12288:eflfAsiVGjSGecvXAflfAsiVGjSGecvX:aMcfcMcf
TLSH
T194F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3360	hbzurmkhczxupmke.exe
1224	hbzurmkhczxupmke.sys
3620	CreateProcess.exe
5764	pjhezwrmjh.exe
3696	CreateProcess.exe
3076	CreateProcess.exe
2416	i_pjhezwrmjh.exe
5596	omgezwromg.sys
3000	CreateProcess.exe
4956	eywrpjezwr.exe
2120	CreateProcess.exe
3704	CreateProcess.exe
5800	i_eywrpjezwr.exe
6060	geywurmjeu.sys
4668	CreateProcess.exe
5792	tomgeytqoj.exe
4892	CreateProcess.exe
5724	CreateProcess.exe
5644	i_tomgeytqoj.exe
1300	mgeywtolge.sys
1536	CreateProcess.exe
5368	eywigbytql.exe
2060	CreateProcess.exe
4796	CreateProcess.exe
1320	i_eywigbytql.exe
4320	olgdywqoig.sys
5272	CreateProcess.exe
4924	aytqoigayv.exe
5308	CreateProcess.exe
4688	CreateProcess.exe
1936	i_aytqoigayv.exe
3404	sqkidavtnl.sys
1624	CreateProcess.exe
1620	nifaysqkif.exe
3636	CreateProcess.exe
4832	CreateProcess.exe
5136	i_nifaysqkif.exe
3716	axspnhfaxv.sys
5864	CreateProcess.exe
1300	sqkicavsnk.exe
5392	CreateProcess.exe
4216	CreateProcess.exe
4304	i_sqkicavsnk.exe
1772	kfcxvpnhfa.sys
1100	CreateProcess.exe
5292	smkfcxupnh.exe
4880	CreateProcess.exe
4936	CreateProcess.exe
4756	i_smkfcxupnh.exe
1404	mjhczusmkh.sys
700	CreateProcess.exe
6092	hczusmkecw.exe
1616	CreateProcess.exe
4748	CreateProcess.exe
2896	i_hczusmkecw.exe
5960	rmjecwuomh.sys
568	CreateProcess.exe
4840	jhbzurmjec.exe
3260	CreateProcess.exe
2160	CreateProcess.exe
6136	i_jhbzurmjec.exe
4536	wqojgbztrl.sys
4940	CreateProcess.exe
3168	mgeywuomge.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_49288467\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_213523252\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_213523252\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1260656424\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1260656424\nav_config.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 40 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqljgbytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkhcausmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trmjebwtrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywrpjezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tomgeytqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywigbytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nifaysqkif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nifaysqkif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkfcxupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgeywuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kigaysqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgeywuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kigaysqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvpnifdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkhcausmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hczusmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywigbytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigaysqlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwuomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywrpjezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigaysqlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbzurmkhczxupmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhezwrmjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhezwrmjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tomgeytqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkicavsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkfcxupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczusmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkicavsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbzurmjec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqljgbytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbzurmjec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvpnifdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwusmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwusmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trmjebwtrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aytqoigayv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aytqoigayv.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4600	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3408	ipconfig.exe
4852	ipconfig.exe
2408	ipconfig.exe
1936	ipconfig.exe
4908	ipconfig.exe
5856	ipconfig.exe
1304	ipconfig.exe
4404	ipconfig.exe
4172	ipconfig.exe
2064	ipconfig.exe
1412	ipconfig.exe
2144	ipconfig.exe
3328	ipconfig.exe
5484	ipconfig.exe
1064	ipconfig.exe
3008	ipconfig.exe
3064	ipconfig.exe
4824	ipconfig.exe
3088	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134281668441232674"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1079202589-886135813-2527035092-1000\{96656B3E-01C4-458A-8240-F6737A250C97}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3360	hbzurmkhczxupmke.exe
3360	hbzurmkhczxupmke.exe
3360	hbzurmkhczxupmke.exe
3360	hbzurmkhczxupmke.exe
3360	hbzurmkhczxupmke.exe
3360	hbzurmkhczxupmke.exe
3360	hbzurmkhczxupmke.exe
3360	hbzurmkhczxupmke.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	2416	i_pjhezwrmjh.exe
Token: SeDebugPrivilege	5800	i_eywrpjezwr.exe
Token: SeDebugPrivilege	5644	i_tomgeytqoj.exe
Token: SeDebugPrivilege	1320	i_eywigbytql.exe
Token: SeDebugPrivilege	1936	i_aytqoigayv.exe
Token: SeDebugPrivilege	5136	i_nifaysqkif.exe
Token: SeDebugPrivilege	4304	i_sqkicavsnk.exe
Token: SeDebugPrivilege	4756	i_smkfcxupnh.exe
Token: SeDebugPrivilege	2896	i_hczusmkecw.exe
Token: SeDebugPrivilege	6136	i_jhbzurmjec.exe
Token: SeDebugPrivilege	6132	i_mgeywuomge.exe
Token: SeDebugPrivilege	5888	i_tqljgbytql.exe
Token: SeDebugPrivilege	2108	i_qoigaysqlf.exe
Token: SeDebugPrivilege	5912	i_kigaysqkic.exe
Token: SeDebugPrivilege	2580	i_fdxvpnifdx.exe
Token: SeDebugPrivilege	616	i_mkhcausmkf.exe
Token: SeDebugPrivilege	4356	i_trmjebwtrm.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3828	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4308 wrote to memory of 3360	4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	87
PID 4308 wrote to memory of 6096	4308	2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 6096 wrote to memory of 3828	6096	iexplore.exe	89
PID 3828 wrote to memory of 932	3828	msedge.exe	90
PID 3828 wrote to memory of 5248	3828	msedge.exe	91
PID 3828 wrote to memory of 4600	3828	msedge.exe	93
PID 3828 wrote to memory of 5248	3828	msedge.exe	91
PID 3828 wrote to memory of 5248	3828	msedge.exe	91
PID 3828 wrote to memory of 4512	3828	msedge.exe	94
PID 3828 wrote to memory of 4512	3828	msedge.exe	94
PID 3828 wrote to memory of 5492	3828	msedge.exe	95
PID 3828 wrote to memory of 2912	3828	msedge.exe	96
PID 3828 wrote to memory of 5492	3828	msedge.exe	95
PID 3828 wrote to memory of 5492	3828	msedge.exe	95
PID 3828 wrote to memory of 2912	3828	msedge.exe	96
PID 3828 wrote to memory of 2912	3828	msedge.exe	96
PID 3828 wrote to memory of 400	3828	msedge.exe	97
PID 3828 wrote to memory of 124	3828	msedge.exe	98
PID 3828 wrote to memory of 400	3828	msedge.exe	97
PID 3828 wrote to memory of 400	3828	msedge.exe	97
PID 3828 wrote to memory of 124	3828	msedge.exe	98
PID 3828 wrote to memory of 124	3828	msedge.exe	98
PID 3828 wrote to memory of 2824	3828	msedge.exe	100
PID 3828 wrote to memory of 2824	3828	msedge.exe	100
PID 3360 wrote to memory of 3620	3360	hbzurmkhczxupmke.exe	103
PID 3828 wrote to memory of 2564	3828	msedge.exe	105
PID 3828 wrote to memory of 6048	3828	msedge.exe	106
PID 3828 wrote to memory of 2564	3828	msedge.exe	105
PID 3828 wrote to memory of 6048	3828	msedge.exe	106
PID 5764 wrote to memory of 3696	5764	pjhezwrmjh.exe	108
PID 3828 wrote to memory of 620	3828	msedge.exe	112
PID 3828 wrote to memory of 2060	3828	msedge.exe	142
PID 3828 wrote to memory of 2060	3828	msedge.exe	142
PID 3828 wrote to memory of 1052	3828	msedge.exe	116
PID 3828 wrote to memory of 1052	3828	msedge.exe	116
PID 3360 wrote to memory of 3076	3360	hbzurmkhczxupmke.exe	117
PID 3360 wrote to memory of 3000	3360	hbzurmkhczxupmke.exe	121
PID 4956 wrote to memory of 2120	4956	eywrpjezwr.exe	123
PID 3360 wrote to memory of 3704	3360	hbzurmkhczxupmke.exe	126
PID 3360 wrote to memory of 4668	3360	hbzurmkhczxupmke.exe	130
PID 5792 wrote to memory of 4892	5792	tomgeytqoj.exe	132
PID 3360 wrote to memory of 5724	3360	hbzurmkhczxupmke.exe	135
PID 3360 wrote to memory of 1536	3360	hbzurmkhczxupmke.exe	140
PID 5368 wrote to memory of 2060	5368	eywigbytql.exe	142
PID 3360 wrote to memory of 4796	3360	hbzurmkhczxupmke.exe	145
PID 3828 wrote to memory of 4364	3828	msedge.exe	147
PID 3828 wrote to memory of 5852	3828	msedge.exe	148
PID 3828 wrote to memory of 5912	3828	msedge.exe	149
PID 3360 wrote to memory of 5272	3360	hbzurmkhczxupmke.exe	152
PID 4924 wrote to memory of 5308	4924	aytqoigayv.exe	154
PID 3360 wrote to memory of 4688	3360	hbzurmkhczxupmke.exe	157
PID 3360 wrote to memory of 1624	3360	hbzurmkhczxupmke.exe	161
PID 1620 wrote to memory of 3636	1620	nifaysqkif.exe	163
PID 3360 wrote to memory of 4832	3360	hbzurmkhczxupmke.exe	166
PID 3360 wrote to memory of 5864	3360	hbzurmkhczxupmke.exe	170
PID 1300 wrote to memory of 5392	1300	sqkicavsnk.exe	172
PID 3360 wrote to memory of 4216	3360	hbzurmkhczxupmke.exe	175
PID 3360 wrote to memory of 1100	3360	hbzurmkhczxupmke.exe	179
PID 5292 wrote to memory of 4880	5292	smkfcxupnh.exe	181
PID 3828 wrote to memory of 2876	3828	msedge.exe	184
PID 3828 wrote to memory of 2876	3828	msedge.exe	184
PID 3360 wrote to memory of 4936	3360	hbzurmkhczxupmke.exe	186
PID 3360 wrote to memory of 700	3360	hbzurmkhczxupmke.exe	192
PID 6092 wrote to memory of 1616	6092	hczusmkecw.exe	194

C:\Users\Admin\AppData\Local\Temp\2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_07914be17ea9c9763d268417eee4e2ef_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Temp\hbzurmkhczxupmke.exe
  C:\Temp\hbzurmkhczxupmke.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3360
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhezwrmjh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3620
  - - C:\Temp\pjhezwrmjh.exe
      C:\Temp\pjhezwrmjh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5764
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3696
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2408
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjhezwrmjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3076
  - - C:\Temp\i_pjhezwrmjh.exe
      C:\Temp\i_pjhezwrmjh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eywrpjezwr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3000
  - - C:\Temp\eywrpjezwr.exe
      C:\Temp\eywrpjezwr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4956
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2120
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eywrpjezwr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3704
  - - C:\Temp\i_eywrpjezwr.exe
      C:\Temp\i_eywrpjezwr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5800
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tomgeytqoj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4668
  - - C:\Temp\tomgeytqoj.exe
      C:\Temp\tomgeytqoj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5792
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4892
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1412
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tomgeytqoj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5724
  - - C:\Temp\i_tomgeytqoj.exe
      C:\Temp\i_tomgeytqoj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5644
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eywigbytql.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1536
  - - C:\Temp\eywigbytql.exe
      C:\Temp\eywigbytql.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5368
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2060
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3008
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eywigbytql.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4796
  - - C:\Temp\i_eywigbytql.exe
      C:\Temp\i_eywigbytql.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1320
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aytqoigayv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5272
  - - C:\Temp\aytqoigayv.exe
      C:\Temp\aytqoigayv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4924
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5308
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aytqoigayv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4688
  - - C:\Temp\i_aytqoigayv.exe
      C:\Temp\i_aytqoigayv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1936
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nifaysqkif.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1624
  - - C:\Temp\nifaysqkif.exe
      C:\Temp\nifaysqkif.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1620
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3636
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4824
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nifaysqkif.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4832
  - - C:\Temp\i_nifaysqkif.exe
      C:\Temp\i_nifaysqkif.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5136
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqkicavsnk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5864
  - - C:\Temp\sqkicavsnk.exe
      C:\Temp\sqkicavsnk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1300
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5392
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2144
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqkicavsnk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4216
  - - C:\Temp\i_sqkicavsnk.exe
      C:\Temp\i_sqkicavsnk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4304
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\smkfcxupnh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1100
  - - C:\Temp\smkfcxupnh.exe
      C:\Temp\smkfcxupnh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5292
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4880
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3328
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_smkfcxupnh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4936
  - - C:\Temp\i_smkfcxupnh.exe
      C:\Temp\i_smkfcxupnh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4756
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hczusmkecw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:700
  - - C:\Temp\hczusmkecw.exe
      C:\Temp\hczusmkecw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6092
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1616
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1936
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hczusmkecw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4748
  - - C:\Temp\i_hczusmkecw.exe
      C:\Temp\i_hczusmkecw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhbzurmjec.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:568
  - - C:\Temp\jhbzurmjec.exe
      C:\Temp\jhbzurmjec.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4840
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3260
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3088
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhbzurmjec.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2160
  - - C:\Temp\i_jhbzurmjec.exe
      C:\Temp\i_jhbzurmjec.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6136
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mgeywuomge.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4940
  - - C:\Temp\mgeywuomge.exe
      C:\Temp\mgeywuomge.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3168
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1544
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3408
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mgeywuomge.exe ups_ins
    3⤵
    PID:1980
  - - C:\Temp\i_mgeywuomge.exe
      C:\Temp\i_mgeywuomge.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6132
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqljgbytql.exe ups_run
    3⤵
    PID:3848
  - - C:\Temp\tqljgbytql.exe
      C:\Temp\tqljgbytql.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4244
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6048
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqljgbytql.exe ups_ins
    3⤵
    PID:4272
  - - C:\Temp\i_tqljgbytql.exe
      C:\Temp\i_tqljgbytql.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5888
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoigaysqlf.exe ups_run
    3⤵
    PID:3268
  - - C:\Temp\qoigaysqlf.exe
      C:\Temp\qoigaysqlf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3784
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4632
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5484
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoigaysqlf.exe ups_ins
    3⤵
    PID:2144
  - - C:\Temp\i_qoigaysqlf.exe
      C:\Temp\i_qoigaysqlf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2108
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kigaysqkic.exe ups_run
    3⤵
    PID:4304
  - - C:\Temp\kigaysqkic.exe
      C:\Temp\kigaysqkic.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1368
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4684
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4852
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kigaysqkic.exe ups_ins
    3⤵
    PID:2052
  - - C:\Temp\i_kigaysqkic.exe
      C:\Temp\i_kigaysqkic.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5912
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdxvpnifdx.exe ups_run
    3⤵
    PID:4820
  - - C:\Temp\fdxvpnifdx.exe
      C:\Temp\fdxvpnifdx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4780
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5632
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1304
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdxvpnifdx.exe ups_ins
    3⤵
    PID:1168
  - - C:\Temp\i_fdxvpnifdx.exe
      C:\Temp\i_fdxvpnifdx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2580
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkhcausmkf.exe ups_run
    3⤵
    PID:4660
  - - C:\Temp\mkhcausmkf.exe
      C:\Temp\mkhcausmkf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4276
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4332
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkhcausmkf.exe ups_ins
    3⤵
    PID:5968
  - - C:\Temp\i_mkhcausmkf.exe
      C:\Temp\i_mkhcausmkf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:616
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwusmkecw.exe ups_run
    3⤵
    PID:3916
  - - C:\Temp\ecwusmkecw.exe
      C:\Temp\ecwusmkecw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4468
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5752
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4404
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwusmkecw.exe ups_ins
    3⤵
    PID:1864
  - - C:\Temp\i_ecwusmkecw.exe
      C:\Temp\i_ecwusmkecw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      PID:4852
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trmjebwtrm.exe ups_run
    3⤵
    PID:1500
  - - C:\Temp\trmjebwtrm.exe
      C:\Temp\trmjebwtrm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3452
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1696
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trmjebwtrm.exe ups_ins
    3⤵
    PID:3952
  - - C:\Temp\i_trmjebwtrm.exe
      C:\Temp\i_trmjebwtrm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4356
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ebwuomgeyw.exe ups_run
    3⤵
    PID:2668
  - - C:\Temp\ebwuomgeyw.exe
      C:\Temp\ebwuomgeyw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4504
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3496
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4172
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:6096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7fffddbac188,0x7fffddbac194,0x7fffddbac1a0
      4⤵
      PID:932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,1098615686520332897,2617213901263227018,262144 --field-trial-handle=2304,i,16252877860055477380,15383567141869399813,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
      4⤵
      PID:5248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,16942795057019203279,9767464203828173982,524288 --field-trial-handle=2304,i,16252877860055477380,15383567141869399813,262144 --variations-seed-version --mojo-platform-channel-handle=1820 /prefetch:11
      4⤵
      System Time Discovery
      PID:4600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,12116819353293874549,5752905349284957250,524288 --field-trial-handle=2304,i,16252877860055477380,15383567141869399813,262144 --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:13
      4⤵
      PID:4512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3528,i,9659398560298302165,3023180732683155102,2097152 --field-trial-handle=2304,i,16252877860055477380,15383567141869399813,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
      4⤵
      PID:5492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3532,i,9927321824571583918,13069295833087817742,2097152 --field-trial-handle=2304,i,16252877860055477380,15383567141869399813,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
      4⤵
      PID:2912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,12467208011131541266,5968652467418436930,2097152 --field-trial-handle=2304,i,16252877860055477380,15383567141869399813,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
      4⤵
      PID:400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,4612316809197215121,12723650579687912679,2097152 --field-trial-handle=2304,i,16252877860055477380,15383567141869399813,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:9
      4⤵
      PID:124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,785473675431305178,5858475010542662168,524288 --field-trial-handle=2304,i,16252877860055477380,15383567141869399813,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:14
      4⤵
      PID:2824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,6046339521807345691,8580947623402997367,524288 --field-trial-handle=2304,i,16252877860055477380,15383567141869399813,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
      4⤵
      PID:2564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,12008576810399168543,17207091841818848439,524288 --field-trial-handle=2304,i,16252877860055477380,15383567141869399813,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
      4⤵
      PID:6048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,17933492981007623086,14346056450709190666,524288 --field-trial-handle=2304,i,16252877860055477380,15383567141869399813,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
      4⤵
      PID:4916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,17933492981007623086,14346056450709190666,524288 --field-trial-handle=2304,i,16252877860055477380,15383567141869399813,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
      4⤵
      PID:620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,13238783176453337192,10736078052160652,524288 --field-trial-handle=2304,i,16252877860055477380,15383567141869399813,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
      4⤵
      PID:2060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,18037655434841438232,5471880731855777878,524288 --field-trial-handle=2304,i,16252877860055477380,15383567141869399813,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
      4⤵
      PID:1052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=744,i,9627314445926662819,6140056254426228389,524288 --field-trial-handle=2304,i,16252877860055477380,15383567141869399813,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:14
      4⤵
      PID:4364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,8964959068064487403,15542927035171234965,524288 --field-trial-handle=2304,i,16252877860055477380,15383567141869399813,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:14
      4⤵
      PID:5852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,12819561551406955142,2668471743914603377,524288 --field-trial-handle=2304,i,16252877860055477380,15383567141869399813,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
      4⤵
      PID:5912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,16083071230797866271,13942440797697456682,524288 --field-trial-handle=2304,i,16252877860055477380,15383567141869399813,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
      4⤵
      PID:2876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,8398169791246123382,1659377034687814007,524288 --field-trial-handle=2304,i,16252877860055477380,15383567141869399813,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
      4⤵
      PID:4612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6796,i,4532618981469514102,7360025369331293082,524288 --field-trial-handle=2304,i,16252877860055477380,15383567141869399813,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:14
      4⤵
      PID:4180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6804,i,13610437304722955428,8571517751465711642,262144 --field-trial-handle=2304,i,16252877860055477380,15383567141869399813,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:10
      4⤵
      PID:5512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6804,i,5357552883275291461,9713133467454871385,524288 --field-trial-handle=2304,i,16252877860055477380,15383567141869399813,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:14
      4⤵
      PID:896

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4164

C:\Temp\hbzurmkhczxupmke.sys
C:\Temp\hbzurmkhczxupmke.sys
1⤵
- Executes dropped EXE
PID:1224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4840

C:\Temp\omgezwromg.sys
C:\Temp\omgezwromg.sys
1⤵
- Executes dropped EXE
PID:5596

C:\Temp\geywurmjeu.sys
C:\Temp\geywurmjeu.sys
1⤵
- Executes dropped EXE
PID:6060

C:\Temp\mgeywtolge.sys
C:\Temp\mgeywtolge.sys
1⤵
- Executes dropped EXE
PID:1300

C:\Temp\olgdywqoig.sys
C:\Temp\olgdywqoig.sys
1⤵
- Executes dropped EXE
PID:4320

C:\Temp\sqkidavtnl.sys
C:\Temp\sqkidavtnl.sys
1⤵
- Executes dropped EXE
PID:3404

C:\Temp\axspnhfaxv.sys
C:\Temp\axspnhfaxv.sys
1⤵
- Executes dropped EXE
PID:3716

C:\Temp\kfcxvpnhfa.sys
C:\Temp\kfcxvpnhfa.sys
1⤵
- Executes dropped EXE
PID:1772

C:\Temp\mjhczusmkh.sys
C:\Temp\mjhczusmkh.sys
1⤵
- Executes dropped EXE
PID:1404

C:\Temp\rmjecwuomh.sys
C:\Temp\rmjecwuomh.sys
1⤵
- Executes dropped EXE
PID:5960

C:\Temp\wqojgbztrl.sys
C:\Temp\wqojgbztrl.sys
1⤵
- Executes dropped EXE
PID:4536

C:\Temp\ljdbztrljd.sys
C:\Temp\ljdbztrljd.sys
1⤵
PID:5676

C:\Temp\daytqljday.sys
C:\Temp\daytqljday.sys
1⤵
PID:2684

C:\Temp\vtqlidavtn.sys
C:\Temp\vtqlidavtn.sys
1⤵
PID:2368

C:\Temp\nkicavsnlf.sys
C:\Temp\nkicavsnlf.sys
1⤵
PID:4808

C:\Temp\xupnhfzxup.sys
C:\Temp\xupnhfzxup.sys
1⤵
PID:5220

C:\Temp\usmkecxuhf.sys
C:\Temp\usmkecxuhf.sys
1⤵
PID:996

C:\Temp\mgeywuomje.sys
C:\Temp\mgeywuomje.sys
1⤵
PID:5912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aytqoigayv.exe

Path C:\Temp\aytqoigayv.exe
Size 722KB
SHA256 38b8df9d001cce53f4110c1ba597e50aaa466446001d21a63c301749616d68b1
MD5 241d0f40610f9b4e3452d56a6dbb4cb1
SHA1 6cea6f885c3a49b0dc70c6980b6aebac01655340
SHA512 486a501e833582910e5c58814a4e483af4e83be0a16dcde6c0fe2a444544cd4efe29db2e57f8454ce2dae6e4a0a036f28be722412926d998ab83cdddc9cef217
SSDEEP 12288:HflfAsiVGjSGecvXAflfAsiVGjSGecvX:/McfcMcf
TLSH
T138F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eywigbytql.exe

Path C:\Temp\eywigbytql.exe
Size 722KB
SHA256 ab28d8c45ea0751b0a6e4efbedeec7f34514d76d1dca787aa26017b27104708e
MD5 e48ef3d360dea638ddc59e18e7b8798a
SHA1 ff5cdfb493a9867427cfa7f4732c625b28635f49
SHA512 130f68f41bfea70ff538d3219b17a1aeb8e2721dc2c484d00d4b68ce0b38bb020d9141dec13d27107d3ce73266a7d52dba3fd03b17d8bab1b458142d6daa26d7
SSDEEP 12288:CflfAsiVGjSGecvXAflfAsiVGjSGecvX:uMcfcMcf
TLSH
T1E8F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eywrpjezwr.exe

Path C:\Temp\eywrpjezwr.exe
Size 722KB
SHA256 109729c1234dd0b7fccde60901eaaa9a764b80bbdbfca1e8872283c54d072374
MD5 7726b6d358bb265c0666af8cc558a187
SHA1 6fa0183c1c0e24839971818e192b20dc1fa9980d
SHA512 5d0ae31ff651d04a775e4ac0321c9e8cdaff10e63e32bcab33b4ca38d8d3bfcc38184e0e92c11a5e8280cd388e6cfc66b163fa5f630a0071b096ecaf0a0fe512
SSDEEP 12288:1flfAsiVGjSGecvXAflfAsiVGjSGecvX:dMcfcMcf
TLSH
T1A7F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywurmjeu.sys

Path C:\Temp\geywurmjeu.sys
Size 293KB
SHA256 920beda90f5795f6f09cdcf6ac5a92a30efca84a1ec8f50047c31340586392b4
MD5 f27ff8306df28147b7290f64b8c57c5f
SHA1 e4fdf44778488b412444deafa9e12c783bbfb432
SHA512 3bf09c54133cc29980477b1fb4d3a84cee56d761ca93b656221b0ea588a8e1868057cd1a87f2b2b5e9d02f2d3578d6edf543e5554d7b7644f09571beab00a234
SSDEEP 3072:NtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:NIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E9545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbzurmkhczxupmke.exe

Path C:\Temp\hbzurmkhczxupmke.exe
Size 722KB
SHA256 f9f70c030bd217c9dabbc4cf7f8d7334b67d1b06ff44ba79467e5327a7a2772a
MD5 e11c6ff2ad6a70450a7d7a8d9162734f
SHA1 5f0f40d10abb2b34c4adc3e4de07889c3e693e3b
SHA512 2706e305773d9ac9c70f5c7d2e6d6d0fbf6f9da510db7482ca371f0d3fa3308d13613d090a873b31a8e47991fd7b96a9cbb8109a7adc116c31c87acaadc839d6
SSDEEP 12288:aflfAsiVGjSGecvXAflfAsiVGjSGecvX:2McfcMcf
TLSH
T16AF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbzurmkhczxupmke.sys

Path C:\Temp\hbzurmkhczxupmke.sys
Size 293KB
SHA256 a56288a6e51459992cf158269211f0ea5c6fe5d667b120e99cdbb9dd1254e430
MD5 84bf3a16e2c344e83e279ade707dd620
SHA1 8d2883c5a3fa7c948893e38332621becbb2e1e91
SHA512 74f4db636e632db53baa8d28829a4af1c9ca33fbe9d952cd1c3e964aa7409d5eb2d237ff9d7a424a27eb6f8977f8271dc33447307888bc9a3122f0aa6941e703
SSDEEP 3072:jtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:jIJjiJcbI03GBc3ucY5DCSj
TLSH
T188545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_aytqoigayv.exe

Path C:\Temp\i_aytqoigayv.exe
Size 722KB
SHA256 85902114f23fd4d207b824655d55942caaea3c796fbe4c70f9b571555e25626d
MD5 080e4b1a84a4eb6b036706bb46d65c09
SHA1 25b3b8e21ecf64f000a58df2ee8fe8f2efbed4a4
SHA512 cbf15894796ce3371309e9412231da1d100f878d41acf0389dba9ca5c2115f80e6afa3385f89d8ac6ec95a6be8c1e87e9ddcd8bfc45d32fee174d5d347194691
SSDEEP 12288:dflfAsiVGjSGecvXAflfAsiVGjSGecvX:VMcfcMcf
TLSH
T1D6F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_eywigbytql.exe

Path C:\Temp\i_eywigbytql.exe
Size 722KB
SHA256 09b80e20ade1617a32a6c5076d6634e03a7773434f8009936698be6f61b0771d
MD5 6ce5aba1350ed64644d3487e77b668af
SHA1 f3606142745e3bb8bec53a40b1579d782844cc36
SHA512 8777e2db2381488facde4868ad763db841ffe2b201f0281c0e583ee01c84e0a09acb14f797e222ad4052c8aa66ffb60a80176b114e394d55a454040d4400e171
SSDEEP 12288:PflfAsiVGjSGecvXAflfAsiVGjSGecvX:XMcfcMcf
TLSH
T16BF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_eywrpjezwr.exe

Path C:\Temp\i_eywrpjezwr.exe
Size 722KB
SHA256 0c14ff01f0a014b7c0016c6a43a99e5fe9f06136f5751b5476526bc3478139fe
MD5 586026256030ab9472797205a2800004
SHA1 632e01a8205bc0a8d0150750d889cc00392ce777
SHA512 7c928a472c889b1998e6c4ae04c21578eed8e78ed22fb53fb8378c5b5efd95fa4a372fbc86032b76e6d5c808aa5e71b797eb63997ba3144152d934b5da268f7d
SSDEEP 12288:MflfAsiVGjSGecvXAflfAsiVGjSGecvX:YMcfcMcf
TLSH
T159F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pjhezwrmjh.exe

Path C:\Temp\i_pjhezwrmjh.exe
Size 722KB
SHA256 8e5d55be0b21399a0b07f8a9b234408a08d6e10f93b545ca3909b5cf6b3fdb49
MD5 fe5fcba46eede8fe8cf6c07cf28f832b
SHA1 15d1d8ebc5b49675cf9326b23bcd2fb960304c48
SHA512 350a6d0c0905aeaed3b0e28e33c163dbb85a78462031399af1c6fbdc6bdce3ec9444af6f11de3c69ea7f8fd34af9b827d43a9d06bff635f9f68b7822256f4357
SSDEEP 12288:kflfAsiVGjSGecvXAflfAsiVGjSGecvX:AMcfcMcf
TLSH
T15EF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tomgeytqoj.exe

Path C:\Temp\i_tomgeytqoj.exe
Size 722KB
SHA256 c79e29a6c429e12d26197daa345ae659b35426da480b66d1f438b8ae26897640
MD5 1cf1678c95908f32e6c36ea30e39bdb8
SHA1 cdd33d9ce556cfec5f96ac2a5e650dd111cf5145
SHA512 1ea11a47900d4a6885df7e503991dbdee08b25a7dbbd8a99ffc83bf5d775c0e0dfd1e9594b686617355a6c5a51b9f5d7c6df243a91e653991e28f13742b9fd9f
SSDEEP 12288:PflfAsiVGjSGecvXAflfAsiVGjSGecvX:XMcfcMcf
TLSH
T1D8F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgeywtolge.sys

Path C:\Temp\mgeywtolge.sys
Size 293KB
SHA256 9c385aed559923fd9d43c88034d145f6379d271fbe82eb3d441bcf05010fa861
MD5 59003cc4e01012214945cf7b98371803
SHA1 e38b44411e59e913264af0c303cc1f736fc3ec74
SHA512 46fc2648023d240c77817c93f4c7c5b6aad653ebb76c504f15d798cb32080618ae8ef92043c31ad4b0b0fc3b66f5261c5c37486162bd7d5778db98a0b8c71607
SSDEEP 3072:GtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:GIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A1545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nifaysqkif.exe

Path C:\Temp\nifaysqkif.exe
Size 722KB
SHA256 6da9f1efc8b1ca12b95a3a9b326fc0628149946604e6f9bba8927d343987eeb8
MD5 354bcf8195464b4aaa6ac9e809a31a19
SHA1 972f6e6085f5b04bd2fc1cf8d01a7e6274bbb3a2
SHA512 e2fbf945ab606f1e50da961b281c34e7fb8ba9e5f87f35db7b386bb1c6672c7496ab0da046bf641c4f8469dc7198b1b4bd1a51195429981f3fed064895e472bf
SSDEEP 12288:9flfAsiVGjSGecvXAflfAsiVGjSGecvX:1McfcMcf
TLSH
T1DFF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olgdywqoig.sys

Path C:\Temp\olgdywqoig.sys
Size 293KB
SHA256 1ef33a468802651cc9eacf720e929b3719cbfbd657d717547de03b39d07e8238
MD5 9a912f1c8b2cb0f7da28eb432e4c950a
SHA1 4b527f79f17ff1452a1559d934a832c8bc8155f7
SHA512 8d3eb6f739b6c8e43e192c082b2d0aa4a7f44616f4714ecd257e1de21e235865809924c8bcbbaeef681b5aa394f4beb33489d5347b55d7a4badf5a18922815fd
SSDEEP 3072:ntKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:nIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F6545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgezwromg.sys

Path C:\Temp\omgezwromg.sys
Size 293KB
SHA256 dec4408a70744b520c3ca8158ed3476d4d72920623eb652c2b90871bd248438e
MD5 0f31469ca53c2d3bf5cabd3755c87926
SHA1 e6aef3bddb4195d316f14f1cd598343af9176060
SHA512 03d6d2c5d19a6b8799e2591b539e534def1c2f15f66d2ca694108849a073c6119c7a081ef4590340915ca74ae2aee4b3441bde7d8c65cd364e2e3f4e9fc4ea8a
SSDEEP 3072:btKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:bIJjiJcbI03GBc3ucY5DCSj
TLSH
T1FA545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhezwrmjh.exe

Path C:\Temp\pjhezwrmjh.exe
Size 722KB
SHA256 9a694e2542273a5b0f14b5655752f9e4cbfe70cd92a24f1f39618522175babe7
MD5 be1221061dd8304a400d88a1e7e65e83
SHA1 32987d5212dd8f6421fae0abd686e7ffbfdfd149
SHA512 b1f33d753553ddcdeab118bc32b806397b4c1182346f6b0d895a72609f232818b9c72697806a76d2b98c5151f89289e2f575832622eb1efc4ca07b16d89b7ab1
SSDEEP 12288:tflfAsiVGjSGecvXAflfAsiVGjSGecvX:FMcfcMcf
TLSH
T16EF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkidavtnl.sys

Path C:\Temp\sqkidavtnl.sys
Size 293KB
SHA256 07476630ecd90c0930da86dffa12d34b6d9e83cbf67e3b23843e270617094b4a
MD5 7e2cdeb51cf34c522291c0e6965945f8
SHA1 71646d1784fcc1b72206a44f018485a5a2155d59
SHA512 2abd851490983ddff147f30360ec07086b7f62b1c6fc8a7bed08ef886fc4d2a51f1710d487b18ffae361078564f328d4b425b26206535c5f4a50d09aaef2c8eb
SSDEEP 3072:9tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:9IJjiJcbI03GBc3ucY5DCSj
TLSH
T102545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tomgeytqoj.exe

Path C:\Temp\tomgeytqoj.exe
Size 722KB
SHA256 b44be799eaaeccbd4ded54aad001c56cbcb28efee88694e56569eca099d7d0b1
MD5 8b20beed232720423824c4a6f5e7f9f3
SHA1 159eda6c9092cae20230be550374402251d8c9c5
SHA512 cca4f133d80235a2bfaf7534d80f8457f8468828184dcc54b2f25f6a42c17981987128353ada950acb22b3ede6fb3598faff488ca75bf6492cf98c132b08a6ec
SSDEEP 12288:cflfAsiVGjSGecvXAflfAsiVGjSGecvX:IMcfcMcf
TLSH
T13AF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0c59160a51f6f3c09faaf3593a45b43a14b1da3961c2cccaed8346e6543c20e0
MD5 a2b289a93fce671046a365170f24567f
SHA1 d545bd953aab467815db42a92fd1d54047d5e6af
SHA512 ce7bb8aa1a40366ad652feb8233f60cd807014cb9e8ca999c2c1931eeb40a4afa1dc2c94c60d58639e2cece8c73d3a46da7a30c651ca6da0834f57b890bd2572
TLSH
T1CFD092653BA04E08C5C4207628E1A6A6A2504A31642E024841A2F23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2c8f32a144eb654aedda78a1f08ed3379010427c319135c050a4f8d2a6ab8c06
MD5 0c6b8196ce229bcc9192c825894e7a0c
SHA1 32afe5bae744481b0628eb933a40c20c429e73ed
SHA512 55ef3fad5f311d1261d07e7324af778565e2867d90aab8eea17ed83b008e1806b5a8a57298ba7fc0f41367fe2f31b95603aeb3f9dd7922b7dfaa92281267a342
TLSH
T15BD0A9203B68AA84D298207658A04640A2640AA2786E4208A120A52CECB98C257BF9EB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2d6015222f1312f2737e561f5cb789cba16ddda90131d3af679ca4d112ce8de9
MD5 c1a7f665f2c508cc6aaf2ab720e9bbac
SHA1 f10047340073ccfd0dfa0a1ac50f19824703c6c6
SHA512 3b4b2c7997cc3a8e382662b8ab84779147222db6dcf3b614fe3750efba14aade687800978cd24780f580eacb766daa34fe0e560c30dde1f463983613dda767cb
TLSH
T188D092693B904E08C5C4207228E0A6A6A2604A31B82E024840A2B23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 0962a867c5b7fb17109e9f94bb9f97160cfc44acda722f8a33d6f7fd5cdf3954
MD5 70d26506cbd2b3206f0c1f0a5569168f
SHA1 76f34b1a6f33ce4505f7f9bf2b5c60ca427f3665
SHA512 81a7cbc13e5f77ebe53897351939de8b734918bdd4dac54604517834b98803756471812970444a40008f79b91c6fe16d4e34cb24f3d68371ce4ff111fcd89b8d
TLSH
T134512D97C3E68AA9C764E5F263E1087932F55052014FAB11B07D7EBC5A8AF1511DC43B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596894.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596894.TMP
Size 2KB
SHA256 f4eff01f9aab6258dea9321f05bd8f449180344a9c9a468a395c6ccc26b8bb44
MD5 0434a7e8e78884d32feac1588a65afdf
SHA1 a633e41f0d662bd4b54faa13f462498b234ca1ab
SHA512 152e7a50cf0b948e883ab84adc308de0d42438c56e6b7c1c205f043c9d5c89d8d1f5b0f260a662a5824fa044af4938561f73da20e5a2fe20915cb0ab39ec2277
TLSH
T194513E97C3E689A9C764E5F263E1087932F59492014FEB12B07D7EBC9A86F0511DC43B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 066d5e1d89cb861dce15134134e21688174e3bbce10f38533d9081aa741dd018
MD5 8bfe9233c89f5d8023355c3600204ac2
SHA1 8bfe200d13331fe81015fc41111e91fccbd806e1
SHA512 5f7e7707054ee7989d7a8a4e82167c568287169ad823a1e4dc7aa97c8652ab3588705b36eac67bf8777db4c71436b2c138dceebeb4b67346428c6db571aa1b23
TLSH
T15451F0F3C3E4866EC91156F0AA187E2BCE2D0955832C3D5AC9E4EF1B93E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 147ff979eb892ee9920ee166c0afac3fa37bcb86f1a12e88a56e2db4ba086328
MD5 cc37097f2c1ed23a31b6b1d9fb886ccd
SHA1 12ecc598b6f56ec5669c51805d551d34af87aa5e
SHA512 15393358b29f80a886317464b333a5d7d28a67279cf3b06cc146dfd441878a8256d7037eec3ed551cd34e88bd2819b28b34bbb1bd338aa5b7b986f7a40c4d8e6
SSDEEP 192:sxRiRCyM/jK1Ml8wCl/fOscikiZo6B1zoA8pi/g6+WNIYbnZ6XGxIgtJ:sxRic8l/fOsTkk5Yi/5Ie6A3
TLSH
T11052D9156A24597BCCDBD21DFA51BF93D6F91573A2901E44AAFC8A0C00F6AEC621381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 1d67e6aed353d5dfe5bc8ce8e142e18de01fb26466242bcc3f23cb65d088acf3
MD5 c268fdf72de20a4ea5b6178bae2cf616
SHA1 c32295cffc3e513f322a3b2d2516ebf654a442e2
SHA512 744561036590ff834087a179acfdecb3493aad7ad58ea9e8045d65f02137bb8024c2b90dc4f42f364a74f95978e22f498e2102f5b32e03e19c3c802b23fa5d3d
SSDEEP 192:sxRVRCyM/jK1Ml8UQtCl/fOsb6WikiZo6B1zoA8pw/g6+WNIYb/Z6XGxIgDsJ:sxRVcqMl/fOsYkk5Yw/5Ik6A8
TLSH
T1D562E9156A2459778CDBD21DFA51BF93D6F91573A2901E44AAFC8B0C00F6AEC621381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a192b126a3003046aa4fbf56cbff72a99df9a92209bd579b2d8301e38a510c56
MD5 0c8125af7715cfa6cc24193c5be13f6e
SHA1 373a90ceea5fcd9eebc3e05f810d935e7d7c071e
SHA512 a7b608f816664221ce0a23dc195405f0cacd52b61d941d1a16128ee713559eb4799924f5b91d2d9e4d883a8a79d17a9d3a1d28017b976be04859efe9b869e634
SSDEEP 192:sxRVRCyM/jK1Ml8wCl/fOsb6WikiZo6B1zoA8pi/g6+WNIYbnZ6XGxIgDsJ:sxRVc8l/fOsYkk5Yi/5Ie6A8
TLSH
T1D252E915AA3459778CDBD21DFA51BF93D6F91573A2901E44AAFC8B0C00F6AEC621381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 b78e29f07e9701ac403b2d1818a32cdad94961bb2b8ba8a93530f2f1b77719d6
MD5 415d6311dcf38b3d7ddd86e03d290208
SHA1 e89774ed3b2a353b73d658657d1a97aab6265ce0
SHA512 e8e89c872ecffe135e1e118dac86574d42a0e6ccfa03e80c1bb0d6d159ee45bf412b2341118f25f273063aae81afd5ebada4ba3ad46f4ce3cf984e185a98501e
SSDEEP 768:FW7pFD7pLuL70tWgikfn48F1+UoAYDCx9Tuqh0VfUC9xbog/OV/IBJ8WMrogZdrr:FW7pF1E70tWgikfn4u1jaIIByWX6pr
TLSH
T190E2EB3B680CCB7E4F404E9DEC29BD8A6D9801CF56D88D9447EA490C03C6BEB56165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a05ae.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a05ae.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6696ba87e2e5075038f131a9945231cb72e0d94760aa03d6c806fdbeefae6ffa
MD5 4ca45ba50602cdc953893e3a630c77c4
SHA1 44d2034befa28fbd2b0ee63aff3cae5f78007590
SHA512 bc6a1dba1535c61b252e7911e2bf872cc1f8df04b70e19d48cdb9848c0d823e1898dcef42b3a6d49746df4381b25327c46b10db5bda5c0f74f089ac082d95f90
SSDEEP 768:9rv+4UNbdC3JfxBqobGaYpZu4aWADIidy8LqzeVH1S1C:9bsbw3GpZzaNsuVLYEH1d
TLSH
T18903CF36E859CA739CF7A284B1877A0B7EF89163C6880BD488DD1B4E42DB4AD1307D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d4946ed720bf21c10231e342a03897f4a0af3966999690fade42822eb12c99f8
MD5 9c7275a9bc53e4ac456a8f3757f3af7e
SHA1 78d148b21210601cb24b4d3e86a4203843356784
SHA512 f0df395708c8c4ccb2290971c7ac612f4a40183613be844c110bd411ca4954937099c615b39770688dc33dadc3342083db1af91f50d9d07a624bf0a48222b039
SSDEEP 768:Dj+9p3LWqqBqobGaNAtZu4aWADIidy8LuTb9Mk:G9p3LJtZzaNsuVLEb+k
TLSH
T1CCF2AF79AC579E738CAA9294B2873B8ABEF451B3C4C90DC8C9DC5B4E05C35AD5306C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f93b8693a30fcffac2cc1b7ae18d6d9dd7f0274b17f8d62f64b9974df1baa2f8
MD5 588dbdffbdd4422ef2c6b58872729c23
SHA1 5f089e851fc1ab00a63f44f885e2a7916e1f4ce6
SHA512 46d7172dfbb292ea1fbd0cdbff0093d5955175111814eb1fb0c9c9aa265e5d6193d98219c1d789c130ef638af1f53ca56572739366387a83be977133163547bf
SSDEEP 768:erv+4UNbdH3LWYqBqobGaNStZu4aWADIidy8LuTt:ebsb93LZtZzaNsuVLEt
TLSH
T10E03BF75B859DE739CBAA284B2473647BEF851A384C90AD8C9DD0B4E04974EE230BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccfdc488-630b-431d-9353-8bf201f37669.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ccfdc488-630b-431d-9353-8bf201f37669.tmp
Size 39KB
SHA256 ebbe7180d1acf187993316eabefa478fee7583be826abd8af732b770c2286581
MD5 2332972d288a1e00e7a8c7b8625f0848
SHA1 452e65884e02d597d0d450f38d52f656744edf05
SHA512 ba0eaecd20d51b4c3a7fb7246809818ef65810b569e38074e91166c35a121a363bcba60fbc27ea9f737e0687a6d6115d0c8060fc0312a3536661cf16696c1e4e
SSDEEP 768:uF1j+9p37wgyWqBYvaNGtZu4aWADIidy8LuTb9Mk:L9p3Q6tZzaNsuVLEb+k
TLSH
T110038B7AE856CE77ACE79785B3463A8AEEF451A385C95CD8DACC1F4D00C31AD4306C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

cd17255b-f395-4b43-9018-f9e971caed8a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\cd17255b-f395-4b43-9018-f9e971caed8a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3828_1271537734\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 08375ba7a27ccad0a8cbf8747eaa6ea486cf00e2821c05b891400f1265e52acd
MD5 2491ded31802a3441b6b14a0bf94701a
SHA1 839971bdc61ebcfb071094cdd18969aa11d204b9
SHA512 fa0f3f6a041396fc26fe99a59e451f8a6b9682ed1565c6cffb7ad6ef6ba1ee87b4dd66d3a347823ab1b359e2fc99d15fa7fbe58d0ae354d8726cf9b0f6c3b939
TLSH
T1B97123835AB9DAF3C1DA5FF002835648F1FF223C072330714B515546AB30A7A58B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/996-454-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1224-63-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1300-269-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1404-339-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1772-324-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2368-439-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2368-416-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2684-405-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2684-417-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3404-310-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3716-320-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4320-281-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4320-311-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4536-372-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4808-437-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5220-443-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5596-193-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5676-384-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5912-484-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5960-364-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6060-241-0x0000000000010000-0x00000000000AB000-memory.dmp

Download