fb0837a019728698b8457d26563920b23d34a357e53623fe601d0b98bbf326cd

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/07/2026, 06:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 722KB
Sample260713-hh12zaey9y
SHA256 fb0837a019728698b8457d26563920b23d34a357e53623fe601d0b98bbf326cd
MD5 93bfe3575ec197ec3ff4110e8fb0e066
SHA1 360620833b5d9d964269a729f143e3d2e320ccc8
SHA512 e8d68ffbf94fab35af087be815dcbf86be4aa796f4db13b8cab9137f1e8816dcd1a35f729fe952985847ff8b88ded0a180db4b6df7f0112da9a07e8f09364e6f
SSDEEP 12288:KflfAsiVGjSGecvXAflfAsiVGjSGecvX:GMcfcMcf
TLSH
T14FF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4812	jhbztrljebwuomge.exe
3524	jhbztrljebwuomge.sys
3576	CreateProcess.exe
1724	mjhbztrojg.exe
4528	CreateProcess.exe
3356	CreateProcess.exe
3940	i_mjhbztrojg.exe
6040	trljebwtol.sys
1504	CreateProcess.exe
1640	jebwtomgey.exe
1044	CreateProcess.exe
5080	CreateProcess.exe
4432	i_jebwtomgey.exe
5324	vtnlgdyvtn.sys
436	CreateProcess.exe
4788	nlgdyvqoig.exe
8	CreateProcess.exe
3504	CreateProcess.exe
4984	i_nlgdyvqoig.exe
4500	qoigaysqli.sys
3684	CreateProcess.exe
1796	xvqnigavtq.exe
4808	CreateProcess.exe
4128	CreateProcess.exe
2952	i_xvqnigavtq.exe
4480	idavsnlfdx.sys
2892	CreateProcess.exe
3108	xvpnifaysq.exe
4972	CreateProcess.exe
5624	CreateProcess.exe
5108	i_xvpnifaysq.exe
1004	sqkicausnk.sys
3056	CreateProcess.exe
2444	icausmkfcx.exe
4692	CreateProcess.exe
1272	CreateProcess.exe
4752	i_icausmkfcx.exe
2656	khczusmkec.sys
4504	CreateProcess.exe
2756	zxupnhfzxr.exe
4640	CreateProcess.exe
2320	CreateProcess.exe
2688	i_zxupnhfzxr.exe
4284	upmhfrpjhc.sys
4296	CreateProcess.exe
5564	zwrpjhezwu.exe
4840	CreateProcess.exe
3088	CreateProcess.exe
1352	i_zwrpjhezwu.exe
4784	zxrojhbztr.sys
4496	CreateProcess.exe
4228	gbztrljdbw.exe
2568	CreateProcess.exe
3944	CreateProcess.exe
832	i_gbztrljdbw.exe
2308	geywqojgbz.sys
5964	CreateProcess.exe
1436	ztrljebwuo.exe
2648	CreateProcess.exe
5324	CreateProcess.exe
2500	i_ztrljebwuo.exe
1204	ljdbvtolge.sys
3412	CreateProcess.exe
1644	aywqoigeyw.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_2103610374\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1302955463\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5560_1302955463\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvqnigavtq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icausmkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwrpjhezwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlgdyvqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxupnhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwrpjhezwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifdyvqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxrpkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwqojgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaytqolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjhbztrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbztrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjhbztrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebwtomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnifaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnifaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aywqoigeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aywqoigeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkezwupmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaytqolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbztrljebwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbztrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfaxsqnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfaxsqnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axsqkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgeywrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlgdyvqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrljebwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrljebwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifdyvqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axsqkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwqojgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebwtomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvqnigavtq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icausmkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxupnhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkezwupmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgeywrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxrpkhca.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3840	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5788	ipconfig.exe
2528	ipconfig.exe
3004	ipconfig.exe
3104	ipconfig.exe
3008	ipconfig.exe
1232	ipconfig.exe
5008	ipconfig.exe
4044	ipconfig.exe
5124	ipconfig.exe
5808	ipconfig.exe
3464	ipconfig.exe
2320	ipconfig.exe
2172	ipconfig.exe
700	ipconfig.exe
4432	ipconfig.exe
4976	ipconfig.exe
1160	ipconfig.exe
3800	ipconfig.exe
2084	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134283987117011132"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3611646547-550105268-947503007-1000\{90249FA0-BCD1-41F0-90EE-5FBCA61A3839}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4812	jhbztrljebwuomge.exe
4812	jhbztrljebwuomge.exe
4812	jhbztrljebwuomge.exe
4812	jhbztrljebwuomge.exe
4812	jhbztrljebwuomge.exe
4812	jhbztrljebwuomge.exe
4812	jhbztrljebwuomge.exe
4812	jhbztrljebwuomge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3940	i_mjhbztrojg.exe
Token: SeDebugPrivilege	4432	i_jebwtomgey.exe
Token: SeDebugPrivilege	4984	i_nlgdyvqoig.exe
Token: SeDebugPrivilege	2952	i_xvqnigavtq.exe
Token: SeDebugPrivilege	5108	i_xvpnifaysq.exe
Token: SeDebugPrivilege	4752	i_icausmkfcx.exe
Token: SeDebugPrivilege	2688	i_zxupnhfzxr.exe
Token: SeDebugPrivilege	1352	i_zwrpjhezwu.exe
Token: SeDebugPrivilege	832	i_gbztrljdbw.exe
Token: SeDebugPrivilege	2500	i_ztrljebwuo.exe
Token: SeDebugPrivilege	912	i_aywqoigeyw.exe
Token: SeDebugPrivilege	1716	i_ifdyvqniga.exe
Token: SeDebugPrivilege	3352	i_hfaxsqnifa.exe
Token: SeDebugPrivilege	5848	i_axsqkicaus.exe
Token: SeDebugPrivilege	3724	i_hfzxrpkhca.exe
Token: SeDebugPrivilege	2864	i_mkezwupmhf.exe
Token: SeDebugPrivilege	2608	i_omgeywrojh.exe
Token: SeDebugPrivilege	2484	i_zwqojgbztr.exe
Token: SeDebugPrivilege	2736	i_gaytqolgey.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5560	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3328 wrote to memory of 4812	3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 3328 wrote to memory of 3456	3328	2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 3456 wrote to memory of 5560	3456	iexplore.exe	90
PID 5560 wrote to memory of 1844	5560	msedge.exe	91
PID 5560 wrote to memory of 3788	5560	msedge.exe	92
PID 5560 wrote to memory of 3840	5560	msedge.exe	93
PID 5560 wrote to memory of 3788	5560	msedge.exe	92
PID 5560 wrote to memory of 3788	5560	msedge.exe	92
PID 5560 wrote to memory of 6004	5560	msedge.exe	94
PID 5560 wrote to memory of 6004	5560	msedge.exe	94
PID 5560 wrote to memory of 5856	5560	msedge.exe	96
PID 5560 wrote to memory of 5856	5560	msedge.exe	96
PID 5560 wrote to memory of 5856	5560	msedge.exe	96
PID 5560 wrote to memory of 1960	5560	msedge.exe	97
PID 5560 wrote to memory of 1960	5560	msedge.exe	97
PID 5560 wrote to memory of 1960	5560	msedge.exe	97
PID 5560 wrote to memory of 3936	5560	msedge.exe	98
PID 5560 wrote to memory of 2288	5560	msedge.exe	99
PID 5560 wrote to memory of 3936	5560	msedge.exe	98
PID 5560 wrote to memory of 3936	5560	msedge.exe	98
PID 5560 wrote to memory of 2288	5560	msedge.exe	99
PID 5560 wrote to memory of 2288	5560	msedge.exe	99
PID 5560 wrote to memory of 3056	5560	msedge.exe	100
PID 5560 wrote to memory of 3056	5560	msedge.exe	100
PID 4812 wrote to memory of 3576	4812	jhbztrljebwuomge.exe	104
PID 5560 wrote to memory of 1072	5560	msedge.exe	107
PID 5560 wrote to memory of 5564	5560	msedge.exe	108
PID 5560 wrote to memory of 1072	5560	msedge.exe	107
PID 5560 wrote to memory of 5564	5560	msedge.exe	108
PID 1724 wrote to memory of 4528	1724	mjhbztrojg.exe	109
PID 5560 wrote to memory of 1232	5560	msedge.exe	113
PID 5560 wrote to memory of 956	5560	msedge.exe	114
PID 5560 wrote to memory of 956	5560	msedge.exe	114
PID 5560 wrote to memory of 1688	5560	msedge.exe	115
PID 5560 wrote to memory of 1688	5560	msedge.exe	115
PID 4812 wrote to memory of 3356	4812	jhbztrljebwuomge.exe	118
PID 4812 wrote to memory of 1504	4812	jhbztrljebwuomge.exe	122
PID 1640 wrote to memory of 1044	1640	jebwtomgey.exe	124
PID 4812 wrote to memory of 5080	4812	jhbztrljebwuomge.exe	127
PID 4812 wrote to memory of 436	4812	jhbztrljebwuomge.exe	131
PID 4788 wrote to memory of 8	4788	nlgdyvqoig.exe	133
PID 4812 wrote to memory of 3504	4812	jhbztrljebwuomge.exe	136
PID 5560 wrote to memory of 4780	5560	msedge.exe	138
PID 5560 wrote to memory of 4780	5560	msedge.exe	138
PID 5560 wrote to memory of 4780	5560	msedge.exe	138
PID 5560 wrote to memory of 1600	5560	msedge.exe	142
PID 5560 wrote to memory of 1600	5560	msedge.exe	142
PID 5560 wrote to memory of 1600	5560	msedge.exe	142
PID 4812 wrote to memory of 3684	4812	jhbztrljebwuomge.exe	143
PID 1796 wrote to memory of 4808	1796	xvqnigavtq.exe	145
PID 4812 wrote to memory of 4128	4812	jhbztrljebwuomge.exe	148
PID 5560 wrote to memory of 6024	5560	msedge.exe	150
PID 5560 wrote to memory of 1716	5560	msedge.exe	151
PID 5560 wrote to memory of 4344	5560	msedge.exe	152
PID 4812 wrote to memory of 2892	4812	jhbztrljebwuomge.exe	155
PID 3108 wrote to memory of 4972	3108	xvpnifaysq.exe	157
PID 4812 wrote to memory of 5624	4812	jhbztrljebwuomge.exe	160
PID 4812 wrote to memory of 3056	4812	jhbztrljebwuomge.exe	164
PID 2444 wrote to memory of 4692	2444	icausmkfcx.exe	166
PID 4812 wrote to memory of 1272	4812	jhbztrljebwuomge.exe	169
PID 4812 wrote to memory of 4504	4812	jhbztrljebwuomge.exe	173
PID 2756 wrote to memory of 4640	2756	zxupnhfzxr.exe	175
PID 4812 wrote to memory of 2320	4812	jhbztrljebwuomge.exe	178
PID 4812 wrote to memory of 4296	4812	jhbztrljebwuomge.exe	182

C:\Users\Admin\AppData\Local\Temp\2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-13_93bfe3575ec197ec3ff4110e8fb0e066_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Temp\jhbztrljebwuomge.exe
  C:\Temp\jhbztrljebwuomge.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mjhbztrojg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3576
  - - C:\Temp\mjhbztrojg.exe
      C:\Temp\mjhbztrojg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1724
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4528
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2320
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mjhbztrojg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3356
  - - C:\Temp\i_mjhbztrojg.exe
      C:\Temp\i_mjhbztrojg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3940
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jebwtomgey.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1504
  - - C:\Temp\jebwtomgey.exe
      C:\Temp\jebwtomgey.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1640
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1044
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4044
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jebwtomgey.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5080
  - - C:\Temp\i_jebwtomgey.exe
      C:\Temp\i_jebwtomgey.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4432
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlgdyvqoig.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:436
  - - C:\Temp\nlgdyvqoig.exe
      C:\Temp\nlgdyvqoig.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4788
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:8
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3004
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlgdyvqoig.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3504
  - - C:\Temp\i_nlgdyvqoig.exe
      C:\Temp\i_nlgdyvqoig.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvqnigavtq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3684
  - - C:\Temp\xvqnigavtq.exe
      C:\Temp\xvqnigavtq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1796
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4808
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3104
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvqnigavtq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4128
  - - C:\Temp\i_xvqnigavtq.exe
      C:\Temp\i_xvqnigavtq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2952
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvpnifaysq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2892
  - - C:\Temp\xvpnifaysq.exe
      C:\Temp\xvpnifaysq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3108
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4972
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2172
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvpnifaysq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5624
  - - C:\Temp\i_xvpnifaysq.exe
      C:\Temp\i_xvpnifaysq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5108
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\icausmkfcx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3056
  - - C:\Temp\icausmkfcx.exe
      C:\Temp\icausmkfcx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2444
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4692
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:700
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_icausmkfcx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1272
  - - C:\Temp\i_icausmkfcx.exe
      C:\Temp\i_icausmkfcx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4752
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxupnhfzxr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4504
  - - C:\Temp\zxupnhfzxr.exe
      C:\Temp\zxupnhfzxr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2756
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4640
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxupnhfzxr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2320
  - - C:\Temp\i_zxupnhfzxr.exe
      C:\Temp\i_zxupnhfzxr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2688
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwrpjhezwu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4296
  - - C:\Temp\zwrpjhezwu.exe
      C:\Temp\zwrpjhezwu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5564
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4840
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4432
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwrpjhezwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3088
  - - C:\Temp\i_zwrpjhezwu.exe
      C:\Temp\i_zwrpjhezwu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gbztrljdbw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4496
  - - C:\Temp\gbztrljdbw.exe
      C:\Temp\gbztrljdbw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4228
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2568
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2084
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gbztrljdbw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3944
  - - C:\Temp\i_gbztrljdbw.exe
      C:\Temp\i_gbztrljdbw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:832
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ztrljebwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5964
  - - C:\Temp\ztrljebwuo.exe
      C:\Temp\ztrljebwuo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1436
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2648
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5788
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ztrljebwuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5324
  - - C:\Temp\i_ztrljebwuo.exe
      C:\Temp\i_ztrljebwuo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2500
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aywqoigeyw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3412
  - - C:\Temp\aywqoigeyw.exe
      C:\Temp\aywqoigeyw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1644
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6088
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4976
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aywqoigeyw.exe ups_ins
    3⤵
    PID:2428
  - - C:\Temp\i_aywqoigeyw.exe
      C:\Temp\i_aywqoigeyw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:912
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ifdyvqniga.exe ups_run
    3⤵
    PID:2084
  - - C:\Temp\ifdyvqniga.exe
      C:\Temp\ifdyvqniga.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:200
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1408
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3008
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ifdyvqniga.exe ups_ins
    3⤵
    PID:832
  - - C:\Temp\i_ifdyvqniga.exe
      C:\Temp\i_ifdyvqniga.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfaxsqnifa.exe ups_run
    3⤵
    PID:6096
  - - C:\Temp\hfaxsqnifa.exe
      C:\Temp\hfaxsqnifa.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2988
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5472
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfaxsqnifa.exe ups_ins
    3⤵
    PID:5704
  - - C:\Temp\i_hfaxsqnifa.exe
      C:\Temp\i_hfaxsqnifa.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\axsqkicaus.exe ups_run
    3⤵
    PID:5448
  - - C:\Temp\axsqkicaus.exe
      C:\Temp\axsqkicaus.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4420
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4844
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1160
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_axsqkicaus.exe ups_ins
    3⤵
    PID:3008
  - - C:\Temp\i_axsqkicaus.exe
      C:\Temp\i_axsqkicaus.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5848
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfzxrpkhca.exe ups_run
    3⤵
    PID:3432
  - - C:\Temp\hfzxrpkhca.exe
      C:\Temp\hfzxrpkhca.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4688
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5944
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3800
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfzxrpkhca.exe ups_ins
    3⤵
    PID:1716
  - - C:\Temp\i_hfzxrpkhca.exe
      C:\Temp\i_hfzxrpkhca.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3724
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkezwupmhf.exe ups_run
    3⤵
    PID:1180
  - - C:\Temp\mkezwupmhf.exe
      C:\Temp\mkezwupmhf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4200
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3928
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1232
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkezwupmhf.exe ups_ins
    3⤵
    PID:1952
  - - C:\Temp\i_mkezwupmhf.exe
      C:\Temp\i_mkezwupmhf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omgeywrojh.exe ups_run
    3⤵
    PID:5676
  - - C:\Temp\omgeywrojh.exe
      C:\Temp\omgeywrojh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1732
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:900
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3464
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omgeywrojh.exe ups_ins
    3⤵
    PID:1096
  - - C:\Temp\i_omgeywrojh.exe
      C:\Temp\i_omgeywrojh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2608
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwqojgbztr.exe ups_run
    3⤵
    PID:4380
  - - C:\Temp\zwqojgbztr.exe
      C:\Temp\zwqojgbztr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4264
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3280
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2528
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwqojgbztr.exe ups_ins
    3⤵
    PID:2268
  - - C:\Temp\i_zwqojgbztr.exe
      C:\Temp\i_zwqojgbztr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2484
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gaytqolgey.exe ups_run
    3⤵
    PID:5952
  - - C:\Temp\gaytqolgey.exe
      C:\Temp\gaytqolgey.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3656
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3324
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5008
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gaytqolgey.exe ups_ins
    3⤵
    PID:5328
  - - C:\Temp\i_gaytqolgey.exe
      C:\Temp\i_gaytqolgey.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2736
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x364,0x7ff92d78c188,0x7ff92d78c194,0x7ff92d78c1a0
      4⤵
      PID:1844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,14641042802733134818,10307754368182494716,262144 --field-trial-handle=2928,i,6400405338016192328,13432688770958040529,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:2
      4⤵
      PID:3788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,14816377741355953497,8639332519247209562,524288 --field-trial-handle=2928,i,6400405338016192328,13432688770958040529,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:11
      4⤵
      System Time Discovery
      PID:3840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,17496431450966189675,12577722325461413780,524288 --field-trial-handle=2928,i,6400405338016192328,13432688770958040529,262144 --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:13
      4⤵
      PID:6004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,1029560184011005411,10226431853189703785,2097152 --field-trial-handle=2928,i,6400405338016192328,13432688770958040529,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
      4⤵
      PID:5856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,2433976415677792525,9037906931957573811,2097152 --field-trial-handle=2928,i,6400405338016192328,13432688770958040529,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
      4⤵
      PID:1960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,13728475820332846220,16974714718803706076,2097152 --field-trial-handle=2928,i,6400405338016192328,13432688770958040529,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:9
      4⤵
      PID:3936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4324,i,10157309204029085771,3531512648210925106,2097152 --field-trial-handle=2928,i,6400405338016192328,13432688770958040529,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:1
      4⤵
      PID:2288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3716,i,9116112071011678165,16810395398285451558,524288 --field-trial-handle=2928,i,6400405338016192328,13432688770958040529,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:14
      4⤵
      PID:3056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3796,i,13943517891546130517,8926270254699237580,524288 --field-trial-handle=2928,i,6400405338016192328,13432688770958040529,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
      4⤵
      PID:1072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,275157403876917305,2711291656134569285,524288 --field-trial-handle=2928,i,6400405338016192328,13432688770958040529,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
      4⤵
      PID:5564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,3036920976767084797,17440159186756280756,524288 --field-trial-handle=2928,i,6400405338016192328,13432688770958040529,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
      4⤵
      PID:4284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,3036920976767084797,17440159186756280756,524288 --field-trial-handle=2928,i,6400405338016192328,13432688770958040529,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
      4⤵
      PID:1232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,1717700736912312643,4710812482354865930,524288 --field-trial-handle=2928,i,6400405338016192328,13432688770958040529,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
      4⤵
      PID:956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,15213105506047024407,1890009355390841799,524288 --field-trial-handle=2928,i,6400405338016192328,13432688770958040529,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:14
      4⤵
      PID:1688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4804,i,7618450830642984751,17011736419267489797,2097152 --field-trial-handle=2928,i,6400405338016192328,13432688770958040529,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
      4⤵
      PID:4780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3756,i,12647703644674166953,4023448245986688174,2097152 --field-trial-handle=2928,i,6400405338016192328,13432688770958040529,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
      4⤵
      PID:1600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,572468508140296513,6536860486339646585,524288 --field-trial-handle=2928,i,6400405338016192328,13432688770958040529,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:14
      4⤵
      PID:6024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,16450726235569985516,11082921705999008768,524288 --field-trial-handle=2928,i,6400405338016192328,13432688770958040529,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:14
      4⤵
      PID:1716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,9799439390079082309,881943453755973581,524288 --field-trial-handle=2928,i,6400405338016192328,13432688770958040529,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:14
      4⤵
      PID:4344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6832,i,211622323153539092,6623801662957408258,524288 --field-trial-handle=2928,i,6400405338016192328,13432688770958040529,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:14
      4⤵
      PID:6028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=884,i,14526879491278444165,9909400669623596525,524288 --field-trial-handle=2928,i,6400405338016192328,13432688770958040529,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:14
      4⤵
      PID:252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6628,i,14693126093897671632,642021765740639025,262144 --field-trial-handle=2928,i,6400405338016192328,13432688770958040529,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:10
      4⤵
      PID:3608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,2117010907708946928,13993894463141004126,524288 --field-trial-handle=2928,i,6400405338016192328,13432688770958040529,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:14
      4⤵
      PID:912

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5952

C:\Temp\jhbztrljebwuomge.sys
C:\Temp\jhbztrljebwuomge.sys
1⤵
- Executes dropped EXE
PID:3524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4692

C:\Temp\trljebwtol.sys
C:\Temp\trljebwtol.sys
1⤵
- Executes dropped EXE
PID:6040

C:\Temp\vtnlgdyvtn.sys
C:\Temp\vtnlgdyvtn.sys
1⤵
- Executes dropped EXE
PID:5324

C:\Temp\qoigaysqli.sys
C:\Temp\qoigaysqli.sys
1⤵
- Executes dropped EXE
PID:4500

C:\Temp\idavsnlfdx.sys
C:\Temp\idavsnlfdx.sys
1⤵
- Executes dropped EXE
PID:4480

C:\Temp\sqkicausnk.sys
C:\Temp\sqkicausnk.sys
1⤵
- Executes dropped EXE
PID:1004

C:\Temp\khczusmkec.sys
C:\Temp\khczusmkec.sys
1⤵
- Executes dropped EXE
PID:2656

C:\Temp\upmhfrpjhc.sys
C:\Temp\upmhfrpjhc.sys
1⤵
- Executes dropped EXE
PID:4284

C:\Temp\zxrojhbztr.sys
C:\Temp\zxrojhbztr.sys
1⤵
- Executes dropped EXE
PID:4784

C:\Temp\geywqojgbz.sys
C:\Temp\geywqojgbz.sys
1⤵
- Executes dropped EXE
PID:2308

C:\Temp\ljdbvtolge.sys
C:\Temp\ljdbvtolge.sys
1⤵
- Executes dropped EXE
PID:1204

C:\Temp\tqlidaysql.sys
C:\Temp\tqlidaysql.sys
1⤵
PID:4352

C:\Temp\davtnlfdxv.sys
C:\Temp\davtnlfdxv.sys
1⤵
PID:5328

C:\Temp\hfaxspkica.sys
C:\Temp\hfaxspkica.sys
1⤵
PID:4536

C:\Temp\spkicausmk.sys
C:\Temp\spkicausmk.sys
1⤵
PID:2580

C:\Temp\urmkecwuom.sys
C:\Temp\urmkecwuom.sys
1⤵
PID:6136

C:\Temp\kecwuomhez.sys
C:\Temp\kecwuomhez.sys
1⤵
PID:4260

C:\Temp\jebwuomgey.sys
C:\Temp\jebwuomgey.sys
1⤵
PID:3184

C:\Temp\oigbytqljd.sys
C:\Temp\oigbytqljd.sys
1⤵
PID:2620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

i_jebwtomgey.exe

Path C:\Temp\i_jebwtomgey.exe
Size 722KB
SHA256 d6b472c161cc0dde8b8126f7018589cac9ec7251098300bf30a0749caacc91c7
MD5 2eba7b782324ff1b534e68d08c7484c1
SHA1 1ffb5f99b8e844a6ff2f20e0c752d6854b919fe3
SHA512 5d3386446cbb43a9ce6bc85e73ac11d7b3331bab5d3fca6dc958b65086579213bd724b5c4a69d52174304f50045758cc8686ea2e3a409aa482d89d5360206e92
SSDEEP 12288:EflfAsiVGjSGecvXAflfAsiVGjSGecvX:gMcfcMcf
TLSH
T1BCF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mjhbztrojg.exe

Path C:\Temp\i_mjhbztrojg.exe
Size 722KB
SHA256 f86109521fb2c31a7bb6ebecae3fd92e15eea8bb9417ae23b1515b511a1c47bd
MD5 ab19167e40f8cfdd49be80ddbddf9914
SHA1 7b440d04e338b63f62f33d965b70793884779379
SHA512 2eff2287a215d52830ca24bb6b48ffc9e2876e0cc18d5d40777988b43079b8e13ff28f538ae144d58e6d3eb3426ec9ac7eb75564e4f98cb439320a46ca66fe27
SSDEEP 12288:8flfAsiVGjSGecvXAflfAsiVGjSGecvX:oMcfcMcf
TLSH
T11AF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nlgdyvqoig.exe

Path C:\Temp\i_nlgdyvqoig.exe
Size 722KB
SHA256 3e29d91b0c1e9f59d410df2ea2cfdadd00e0b011971a6cfbe99fb9ce31cddf03
MD5 03c8c21629a368d6ed4ae93b345e712d
SHA1 fa9cf1595e32d9e90eabf8412f1ab78c19839658
SHA512 b2f06d5eec47d8dea5790a33be3ad0916d5207ae51f8cf1835d9783b99570baadfdf9371303e34b7ecb8af948171da7bed5bd4701fdf3e782b32dbfd47872f82
SSDEEP 12288:yflfAsiVGjSGecvXAflfAsiVGjSGecvX:+McfcMcf
TLSH
T1E7F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xvpnifaysq.exe

Path C:\Temp\i_xvpnifaysq.exe
Size 722KB
SHA256 45c046358ed4604efe78ac337bedababff53d25d004ad5bae5d29dd6c0b30c8e
MD5 3ae618ed230ec29f2dd503e003e8c1ff
SHA1 34453fe43eaa03fc317da4a54cf1af340998b508
SHA512 37705ba04377a772a1cb4d6c519b95472cee28e41bcb01bed0c9ca20fd49f651e3733af22bd115d32161f49dfd3d43ea634db9716438b0a96cd4183f6603441e
SSDEEP 12288:nflfAsiVGjSGecvXAflfAsiVGjSGecvX:fMcfcMcf
TLSH
T1A8F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xvqnigavtq.exe

Path C:\Temp\i_xvqnigavtq.exe
Size 722KB
SHA256 afbdd6081bf4d0e3f3da18df3a9089f6938721a791a988061e9aea0250e18ba2
MD5 30133698742d8d6e42649ced182fc022
SHA1 ac3221dfa0d3a7b0e0a9bcfa20bbd6c5b3ca00b4
SHA512 183a4fd587fecdcb83f6314cad51f3820bfba6d5231f6e909aeb7b82bac6c78967ece35e3974470dfb02471a0483a7a6b1a3ccdb0374be76ae268ad4612c519b
SSDEEP 12288:wflfAsiVGjSGecvXAflfAsiVGjSGecvX:sMcfcMcf
TLSH
T1E5F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icausmkfcx.exe

Path C:\Temp\icausmkfcx.exe
Size 722KB
SHA256 d4e6851177d4fa4ceb2ebe09e9583c20c7ff18b264bb56448ac3b426df1741e1
MD5 6203f6a904616deb5f38189b76d3d08d
SHA1 02277654032be66842f31463ff28d96a273f2d29
SHA512 f2feac15ca295a0f55be0347b6f2215e20c378bdd55d88a0da7dce904d2aa9c6d791537d0aa9bbcfcffca31edad9c2f6fe0d45ce13d56fc0f28e4a874161ab04
SSDEEP 12288:VflfAsiVGjSGecvXAflfAsiVGjSGecvX:9McfcMcf
TLSH
T109F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idavsnlfdx.sys

Path C:\Temp\idavsnlfdx.sys
Size 293KB
SHA256 4901ce50c570b473ab05a3cbadd1aada7eb319b70b199d3f7260ead3a5d4ab06
MD5 1972c3bce5b0e7f01ea6dd96abd56d17
SHA1 dc2d82602bc06470e29b9350c8cb23bf486c21f9
SHA512 08e27f5060dfc9051c774bd5684b28780cc3e8ce72c910685dc1a6acfed026b656ac2a1c68396f0ccdcca78e345d5bba1079cd33c119ca16d05b0e7e5585742b
SSDEEP 3072:ytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:yIJjiJcbI03GBc3ucY5DCSj
TLSH
T10F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jebwtomgey.exe

Path C:\Temp\jebwtomgey.exe
Size 722KB
SHA256 a7e5baeb05eb10090a2604157ab934176eb72251821bf8db79e79354d4b58ee1
MD5 7a40759e773a86de5b240f29a35096ac
SHA1 f98447870cbcac31b9c0532b67dad56a2c24546b
SHA512 14c13281cb6c35905a448c8d4b921b7f0d1a3d2f343895876519b967a336b60eb4fe5d8e9efad920c8e9fdba65095e03a9ad6c6d840029c736bb71f160d4a463
SSDEEP 12288:1flfAsiVGjSGecvXAflfAsiVGjSGecvX:dMcfcMcf
TLSH
T101F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbztrljebwuomge.exe

Path C:\Temp\jhbztrljebwuomge.exe
Size 722KB
SHA256 df61c76d5a87957a5cb9094e1852afc7edd36a0a492ea988fff9a6e7d2970348
MD5 05b2a30a1af963fd28e94de8b729e34d
SHA1 b08b6b7e8f182d64c0f385397a39288a1dfef80d
SHA512 4a61675895f10ce704d319a984ff55718eaed881bc4aa1f60ca87106a6bb320968bd4c01d0bb831932fff82397e111989821d602bd067d3b008782e03f8810bf
SSDEEP 12288:wflfAsiVGjSGecvXAflfAsiVGjSGecvX:sMcfcMcf
TLSH
T1FDF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbztrljebwuomge.sys

Path C:\Temp\jhbztrljebwuomge.sys
Size 293KB
SHA256 f6276393a457a5166f1e9fe1ee5c9f21d68c31173be884af9118229b17f6cd1b
MD5 7e1ed67df8c393c76037cf3b81cab7fc
SHA1 f6c402f2af65db4d7d60100c5603c2e2c810b3e2
SHA512 190dd362b3d13887d6a9f74a736f70d31812f45a5485c66d07627200012fac2f45e337c82c01e8bc4c4fe0bef0184605c23a96e7b9a563a4319d3f7e44fea8ed
SSDEEP 3072:FtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:FIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A2545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjhbztrojg.exe

Path C:\Temp\mjhbztrojg.exe
Size 722KB
SHA256 8bfcf5e071bb4c5ba01a25b513a6ba18eb165c35543dbda6b9f148754921659b
MD5 199a23f25e1365633eaf5e44703574ae
SHA1 0362c59a911e39f696e743ff3553378f7648d192
SHA512 1d6e6cc6dcee88eeabc7d00edff55839db808af0e58dff785eb62f50fb5380b76c37ad21d1e35bb886362ee2ef48035e36406c8e34c16ee7f1d78c012d21a603
SSDEEP 12288:+flfAsiVGjSGecvXAflfAsiVGjSGecvX:6McfcMcf
TLSH
T14AF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlgdyvqoig.exe

Path C:\Temp\nlgdyvqoig.exe
Size 722KB
SHA256 b7f5d4b56e9655db0149a165bfc248abf6613a0e87f7a8632f7bb26e4793bdc6
MD5 6ccdc7d87fee2475ebcffe686591a801
SHA1 d7b36ccc969b475e5e4a7d0f04a02e6bd25fc019
SHA512 de3ce8d0c0471cf89520efb664e68f2a06375867783ca1b92d6272d1fe33aac5fa0fa5d79f198e5ca296c06ba5c714ed192a4d2d62cbdf107efee4b10710e78d
SSDEEP 12288:uflfAsiVGjSGecvXAflfAsiVGjSGecvX:KMcfcMcf
TLSH
T116F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoigaysqli.sys

Path C:\Temp\qoigaysqli.sys
Size 293KB
SHA256 4eb19e16fa6871e625c00c965ad751ce3b8caa19e3c630b362f9ba104292d7d3
MD5 40c2096dc2c5cec10b8fec03decae087
SHA1 6bb49b5c4f1c64fc7138bf2eb85a8f4c88ad9b65
SHA512 6d111f53e0118503cf535fa40f52191b94d8aa76eff66a37cc7a75171447ab91307ce969cd6bd174c22a749c5895ce90bbaa71de9d6619db14477387767b241b
SSDEEP 3072:JtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:JIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A4545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkicausnk.sys

Path C:\Temp\sqkicausnk.sys
Size 293KB
SHA256 31c920f87822ec76bdff2a2654f6ade41558b3482ff0d01f544d113770024a53
MD5 40ce3637631410f6cd1edd4d25c9c022
SHA1 a30f0e93ae45d4a1a7e864740e754fb522ce4067
SHA512 4863abc85ebbd035fb95019cc3233d2419d3109439dc0bb3fe219029d0d3db1dacb280b63bf70f03bfe03a6f2c016bd4f99ff721f2640064b2671129b271b40e
SSDEEP 3072:ktKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:kIJjiJcbI03GBc3ucY5DCSj
TLSH
T196545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljebwtol.sys

Path C:\Temp\trljebwtol.sys
Size 293KB
SHA256 3d0051bf741c1ecb1067b09de9ef0a88cfb4c4c9f81e253e766cb343e69c0e6f
MD5 0b28af330cbe739974cdec5111de182c
SHA1 6598c1b4a38542bc9dc242c2749e75bccea37d21
SHA512 4f0b54677abeb277cb86d592abf30c3110e9a10cc2dd15c551fe68fb93ef926a1c3d5c504dbc8ceb9c9c9b2b6fd7b9062ed39a04e927dfdb1638226677acd0a4
SSDEEP 3072:gtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:gIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C5545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlgdyvtn.sys

Path C:\Temp\vtnlgdyvtn.sys
Size 293KB
SHA256 d6b40bc74f30f3ece8d3b02d39b88d5a436f68b21eb9cb3a5e62cf812283f965
MD5 f925a855d676cb0c57ce6d5e054596b8
SHA1 9d67b52b88c2041b3ef14c0e8fd6dbd431fc30bf
SHA512 905a231bf1cc92c0a22f33c1d2e3c1e28941b25dafd7a84e94f52902fdffb1f6131e86aea3bd70d08ac343e86c18edac2dc25db34f553177681af895252da8e8
SSDEEP 3072:6tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:6IJjiJcbI03GBc3ucY5DCSj
TLSH
T157545B44AAA4B0F6D9D5043C00EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvpnifaysq.exe

Path C:\Temp\xvpnifaysq.exe
Size 722KB
SHA256 d3b8349ed2736b2dfed0fb9a58502d8c130ad29a1874a46756bbb8dac1205d05
MD5 119b0878f974c5dc07e12ab0055de4db
SHA1 5aabc5fe1754f26b70a1c586251571fbf95288bb
SHA512 f9ac7fd37b54c98eca4f3ddf29703d5b50340facd0a1c0f3711b4ddb3bdaa8b59c6f8de6d2e6ece1df4d5b0b41e3f217e417dfd0fc08d1f15cc16858a9f7b7bf
SSDEEP 12288:sflfAsiVGjSGecvXAflfAsiVGjSGecvX:4McfcMcf
TLSH
T122F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvqnigavtq.exe

Path C:\Temp\xvqnigavtq.exe
Size 722KB
SHA256 b0a5a2efeffe68b4cfa68adf5ce63ec042686db17a00e539445fe909333ef528
MD5 25eda3e56d6c1a563ef7b13c3ce56b86
SHA1 20aa9f3749003781776b48ab50434f8cb2bfe4a4
SHA512 aa6dc028fd8a25ece63f395c7faf2b88c4779af1af5aaf49e7807fcb73960206c8bc262477b5aee9d36a6c1d77a71184c23acee9b5d56a89463170c91c707377
SSDEEP 12288:kflfAsiVGjSGecvXAflfAsiVGjSGecvX:AMcfcMcf
TLSH
T16AF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 22c1d58ffa7df77a7e0440ce3b2c474b1e03f30b60355bbf5dd6392fefb641fd
MD5 b9f45a900b1f64efbf90731f41c6ad44
SHA1 0c28e85e464e328fbbc07373b05113d39f83bdcc
SHA512 132313545c55ea809da0e811d6d5d324ecf5b6cfaefadb3fa4a29df5e6266dfeca7cffa4daf21754b4b37771504d3692189b5660a468784b5eaf80bf92f59ae0
TLSH
T11ED02BA033044C0CCE40203215B9A210720484204849031A8E41F02C8C6FD4387161F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee3af991fa1719733ca1e3ac746d5b605f4205e269bf244bd9ae780ceadb9bd8
MD5 a044f6413820c4c3fbd300ee9b379ebc
SHA1 94fc91536a25274f06d3a6e89322dec7fde7912e
SHA512 ced4374c54d7b4ea2b76afe4ca5d8841dfb55d8cb5db96de4ed49e64bd3850a817db5301787c268756641c94c0bf85eb4ee188f04fc891fa2e45ad48284985a5
TLSH
T13AD02BA433044D0CCE40203215B8A210720484209C49031A8D41B01C8C6FD4387171FB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4cd6398b89c22235bd3b765ba8f48714f356774981607fdd792f55a48ae481f4
MD5 a7cdc23955aac092c65f10cd94e34977
SHA1 04a0570d9e14bc6bb75eb66926d3140ccd9eb0d1
SHA512 b17609e7233dd87550f9c4d976b5cd8c6d3317c96a2c916d2b3431a8d52cefacae144e29e46de85b01c62193353d99c3c3b4cea564c423ca81566a955a13c609
TLSH
T13951E8D84323EBF1E767A9F168E5D4CC367088AA01CF7E0BF144693B5D9E78134A1625
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5992ef.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5992ef.TMP
Size 3KB
SHA256 a75f11e7af35a22f7f78cf3dd713b3cd65ee206da974e32e03189d90c287b265
MD5 c783e1682f57831678af7b94bcba57c1
SHA1 dc21bd09f16b1b50343d1cf374aa6edb08c7cf10
SHA512 3292f2bf75b4929510522ac80442f74ed9ea06313c3739cbb5ecb24629d75aed2eb6e0ed44a0fa584441381c90a818c285bd983ce63d2f243ba3f23ef3269397
TLSH
T11551D9D44323EBF1E767A9F168E1D4CC3670889A00CF7E0BF144697B5D9E78134A1624
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6eff18b348e9a6030a66350a7f3a5f813819a4c245cca61b96c779fa1c2dc7f2
MD5 efc31ed8147ef3df8c872d77dbc26ce9
SHA1 f20295d008d3f660904af717eacb89233645848b
SHA512 ad6264c1c37392fb579149c4655c13be1ad86a27b8ac9e3d05a57e39ad4411a52fba6c69f75a79e93b3bd3770a9ff1162f2aeb0aa3fa9888e5df2a1bcf9d8d81
TLSH
T16641BDF3C3E4866EC91196F0AA14BE2FCE1C0914432C3D5AC9E4AF5B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ef934ff1a8effb58887034895519d0eb06276ac43cf738e3a9179fba036c849e
MD5 3fe2d5f000771233c6bf41d3b4162244
SHA1 87b89518e57b8f7ba029e588e8933faa2de5c96c
SHA512 ba871128aaa1ef15f6e9a9d1f6b44211af3166940aeebcbaf540cfc680b1d471c2b357ab213fde11bf3977317eb40fa39e0e9bdd57823ed45f33df79b851fd38
SSDEEP 192:sxRFRsyM/jK1Ml8wCv/fMsnzlXjCZh3TzzoD8pi/g6+WNIYGP3kzGZIgtJ:sxRFO8v/fMsJXjEJTLi/5ICo3
TLSH
T15552D716AA385937CCDBD20DFA517F93D6F81573A1901E04AAFCDA0C40E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 099c0b77633552e7519bf08bfea1bde0af1e41037dcda687bcc97880ce9071d5
MD5 27e6450f660790711cf42d6d2a690e85
SHA1 df1025104b1094da68e3795aeaa15be07530c80f
SHA512 b6cd892626b6515417a198c576ce9943d6e16a303c390ade0227a099f16a553b0ef3a172c28a6495b353995960b4e67150bf75d13aebe640e89d777672c13d69
SSDEEP 192:sxRKRsyM/jK1Ml8wCv/fMsXzlXjCZh3TzzoD8pi/g6+WNIYGP3kzGZIgD4J:sxRKO8v/fMsZXjEJTLi/5ICo4
TLSH
T19362D716AA345937CCDBD209FA517F93D6F85473A2941E44AAFCDA0C40E6BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 33d8c6f692755154dbb5a487bfad2ae3ad0648b8c6fc4209ff6c976b85d4137f
MD5 06711eacdcad7bc72670a0c284ae8d38
SHA1 65c4cf6f980932254f923eed4a5a5ed7a15946b4
SHA512 f2547ee33c37c171608dcf54a13883df4bd075dff1c1e2ced418404d185fa85be760f91964538552a0d29008125e64b5b6e905b6bdc9a8cf6b6081befc5c3544
SSDEEP 192:sxRKRsyM/jK1Ml8UQFCv/fMsXzlXECZh3PzzoD8prA/g6+WNIYGGkzGZIgD+J:sxRKOqUv/fMsZXEEJPLk/5IVoW
TLSH
T19862D816AA245977DCDBD20DFA51BF93D6F85473A1941E04AAFCDA0C00E6BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 dd6e8926dd62dd07ed49b14ea0759689e5cd29404c4303abe826e64eb66df8bb
MD5 08cbc0449f8d65eb2ffb6d9c657c7991
SHA1 306174b6cd2a0e15da8a57a87e34a460e89fe9d6
SHA512 0d1206261478e8e570bbac634df87d00828c8ec4867c3d1284a379aef5175a15c6c5d0dd25e2d7e9133f833345d386f5a0950c9dc41b77fee9b1276854c1a92e
SSDEEP 768:UtiiB37pLuL7ANWgv7fgJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVMtxpN0CroYm5:UtiiBxE7ANWgv7fgJu1jaXtxf0Zj5
TLSH
T116E20B7B680CCB7E4F804A9CEC29BD9E6DE801CB56D88D9447EA881C03C67EB55164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2ac05a9f-0029-401d-baa5-d4bd0abf5886.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2ac05a9f-0029-401d-baa5-d4bd0abf5886.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 52376913493226f95dcd8c67cf7be2db7fb4b70e6caf29de3514252feed2b693
MD5 9963b78c9fa28b17bdabbc821752607d
SHA1 2cfaaf784bb9c8f6fdb6028e12e94e9c9c5232cb
SHA512 c8523045b8e540363b18e1790d1aa5e1f929582f3a7a079d6b76a51f02365e565d2a50662f0c4651a5cb17f088ae7c62e218aeba3d1bcf35237fdca01578776d
SSDEEP 768:/Sj+9/3sJOvlYy1Hr7Hucys6BRvi82oP4/z6himo6Ub9M5:/h9/37C3imOz6ImoLb+5
TLSH
T1C0F2BF34E855CE72DCE7829DB14B3BE67EE01277858C1D84E9D9AF0D06C3B6D4316822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 8d2e32ac95009487233cbb0ce40dc4c1d95a9dbc741cf73cf0bbcdb541b9d2bf
MD5 6808616af925c1948ab5abd6120f5dfd
SHA1 939ba43cad038ef530a208b86533403b7aaccccc
SHA512 2d9bf94926158c634869139c33b027e3d3d652725c8243d59a6b30ba2c41ecd34f29f532a88b2fa3a681f984a2c6f9934360d6743b7579354ce468486e1ddc7a
SSDEEP 768:/lj+9/3IJOvlYy1Hr7Hucys6BRvi82oP4/z6himo6Ub9M5:/Q9/3fC3imOz6ImoLb+5
TLSH
T1BAF2BF34E855CE72DCE7829DB14B7BE67EE01277858C1D84E9DAAF0D06C3A6D4316822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 9d9d1af9590fa138d803789468560a44dde7758c22484c2892e09b0254672e34
MD5 71a8fa41ed8b6aa2ff7a2c18304d7739
SHA1 94253ce278caac87044ba8a6165df6398d578e48
SHA512 4823fcf1c58de05f1d2c494cf5b2f468c5d29fc823fcc3f4c4924bae38f3992fb6b5aeab9ff23879181ca453fc97c2e63452ffbd1a68c9d3b7ffdac8eee2954f
SSDEEP 768:C6j+9/3PJJvlYy1HZ7Hucys6BRvi82oP4/z6himo6Ub9M5:C59/3dI3imOz6ImoLb+5
TLSH
T19FF2BF34E855CE72DCE7C299B14A3BE67EE01277858C1D84E9DA9F0D06C3B6D4316822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3f1bfe987b3089718d035cec77ba4846831907470ce464645b122eae3eb80f02
MD5 c01f73313d5ecfb80544d6a82ee26abc
SHA1 596818233acac27fc2647306c94dc6642143e705
SHA512 a5ee9911efeb92bb1a3a0ecf8459e907091937193796935b2feede8abdb995ad1e2951b9a6f93c138e6659422efba6adc371583d4bf931c57a32433ef6c975f0
SSDEEP 768:xGrv+4UNbdS3A8LlYy1HC7Hucys6BRvi82oP4/z6himo+u2bwn+h:xGbsbw3AA33imOz6Imox0w+
TLSH
T1CE03BF36E4148973DCE7C288754A7A933FF4526386C91A80E6DE6B0E429BD5E130BC63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 7aa64eb8a8dca710ff0ca1a9f86b6af32cc6c4a6f16a92104677d3b99d58f2fd
MD5 450a32e0b52ed294335f93dd8d6fcc01
SHA1 891609fbe8e6d3ca50ebc181a5d7818bc705ff15
SHA512 56d7b7c05493309e9ea821558f1c4e96c670bb0d94b47249a7b599e11dd8314736a70eeb9ee48e9c4ecf75aa0012846e93ab9864e92049402905ef59aca92f55
SSDEEP 768:q5FKj+9R3lwglJJey5Hf7Hucys6BRvi82oP4/z6himo6Ub9M5:qx9R37u3imOz6ImoLb+5
TLSH
T1FE038D35D855CE77ECE787D9B34A7A96AEE01273858C5DC4EAD99F4C01C36AD030AC21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

f89879f7-4e7a-4f77-b3e8-96e847b29023.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f89879f7-4e7a-4f77-b3e8-96e847b29023.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5560_490662140\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 7efc03456646d4b7c3452f3d1e371ac7bfd5524f8999f4901cbf3a9b1cc912c3
MD5 dd85da40b3fdcc494eea21ae0e29f30a
SHA1 58b04cc036b33f7b9a1c5ca464cd384a5fdef602
SHA512 4ed6df2c24871222820b5e5395631e842326f4e48a50c441f017b6c2130f9f0f76009dfed46b167f1f568e6f8ee8942d336ad884dd15c5b0c6a21255c54ce3ac
TLSH
T1DD71008356B9C5F2C1AA5FF402835648F5BB22384B6370340B515546AB30A7E18B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1004-312-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1204-367-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2308-363-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2580-420-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2620-468-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2656-319-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3184-440-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3524-224-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3524-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4260-429-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4284-323-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4352-379-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4480-283-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4500-269-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4536-400-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4784-338-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5324-231-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5328-396-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6040-191-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6136-424-0x0000000000010000-0x00000000000AB000-memory.dmp

Download