7111304c44b4035f68852270020953c6dffa46c855f18687486c5fe7b30ccb01

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 16:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 722KB
Sample260803-vf6kwstdnf
SHA256 7111304c44b4035f68852270020953c6dffa46c855f18687486c5fe7b30ccb01
MD5 c6e8c9586d5b11519ea53b0081b495b3
SHA1 c711c15af29a55f8bac2098372d4f48c6712e34e
SHA512 d2cc1c43bb93c1d8684b77a4e9d2254babf2808b602e65b71bbdace40b4a9c7fb9ef316d5023d90f95361434c995dc0e73e84aff896e2eb8f7894c7a7e5f561e
SSDEEP 12288:JflfAsiVGjSGecvXAflfAsiVGjSGecvX:BMcfcMcf
TLSH
T128F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4332	snkicaysqkidavsn.exe
4876	snkicaysqkidavsn.sys
4892	CreateProcess.exe
3444	vtnlfdxnhf.exe
2532	CreateProcess.exe
2732	CreateProcess.exe
5988	i_vtnlfdxnhf.exe
2120	faxspkicau.sys
2412	CreateProcess.exe
4580	zxvpnkfcxv.exe
1208	CreateProcess.exe
5676	CreateProcess.exe
4288	i_zxvpnkfcxv.exe
2620	pjhfcxupnk.sys
828	CreateProcess.exe
2288	pmkhczxrpj.exe
2072	CreateProcess.exe
5776	CreateProcess.exe
4936	i_pmkhczxrpj.exe
5340	jeczuomkec.sys
4128	CreateProcess.exe
5864	mkecwuomhe.exe
5636	CreateProcess.exe
1888	CreateProcess.exe
4524	i_mkecwuomhe.exe
824	bzurmjebzt.sys
2996	CreateProcess.exe
2564	rljdbztomg.exe
1204	CreateProcess.exe
2668	CreateProcess.exe
2708	i_rljdbztomg.exe
204	rljdbwtolj.sys
5608	CreateProcess.exe
4100	oljebwtroj.exe
6108	CreateProcess.exe
2728	CreateProcess.exe
3760	i_oljebwtroj.exe
1716	ywtoljdbvt.sys
1804	CreateProcess.exe
5464	dbvtnlgdyv.exe
5224	CreateProcess.exe
6072	CreateProcess.exe
1932	i_dbvtnlgdyv.exe
4608	vtnlfdyvqo.sys
1356	CreateProcess.exe
480	vtnlfdaysq.exe
960	CreateProcess.exe
940	CreateProcess.exe
4424	i_vtnlfdaysq.exe
4828	avtnlfdayv.sys
2548	CreateProcess.exe
4852	nlfdxvpnhf.exe
5836	CreateProcess.exe
1616	CreateProcess.exe
3408	i_nlfdxvpnhf.exe
1352	vpnlfcausn.sys
5820	CreateProcess.exe
4376	sqnhfaxvpn.exe
3244	CreateProcess.exe
4532	CreateProcess.exe
4912	i_sqnhfaxvpn.exe
4828	pkhfzxvpmk.sys
5824	CreateProcess.exe
4228	smkhczxvpn.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2900_1156167728\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2900_1754924518\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2900_1754924518\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2900_1219698740\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2900_198290584\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2900_198290584\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2900_198290584\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2900_1219698740\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2900_198290584\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gebwurpjge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davsnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtnlgdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojgbzwroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojgbzwroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbywto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oljebwtroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtnlgdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gebwurpjge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davsnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkicaysqkidavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlfdxnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxvpnkfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxvpnkfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmkhczxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmkecwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causnkfdav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkhfaxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkhczxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmkecwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlgdyvqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkhfaxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmkhczxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljdbztomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oljebwtroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdxnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecwuomhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecwuomhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlfdaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqnhfaxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbywto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqnhfaxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlgdyvqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causnkfdav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljdbztomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkhczxvpn.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3932	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2572	ipconfig.exe
2972	ipconfig.exe
5300	ipconfig.exe
5284	ipconfig.exe
5244	ipconfig.exe
3340	ipconfig.exe
4524	ipconfig.exe
3824	ipconfig.exe
1924	ipconfig.exe
1088	ipconfig.exe
2184	ipconfig.exe
3140	ipconfig.exe
2856	ipconfig.exe
5472	ipconfig.exe
4856	ipconfig.exe
5440	ipconfig.exe
4164	ipconfig.exe
2788	ipconfig.exe
4364	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302498280037598"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{702E5882-D7AB-4FB6-8FE4-B8D7E6B08E6A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4332	snkicaysqkidavsn.exe
4332	snkicaysqkidavsn.exe
4332	snkicaysqkidavsn.exe
4332	snkicaysqkidavsn.exe
4332	snkicaysqkidavsn.exe
4332	snkicaysqkidavsn.exe
4332	snkicaysqkidavsn.exe
4332	snkicaysqkidavsn.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	5988	i_vtnlfdxnhf.exe
Token: SeDebugPrivilege	4288	i_zxvpnkfcxv.exe
Token: SeDebugPrivilege	4936	i_pmkhczxrpj.exe
Token: SeDebugPrivilege	4524	i_mkecwuomhe.exe
Token: SeDebugPrivilege	2708	i_rljdbztomg.exe
Token: SeDebugPrivilege	3760	i_oljebwtroj.exe
Token: SeDebugPrivilege	1932	i_dbvtnlgdyv.exe
Token: SeDebugPrivilege	4424	i_vtnlfdaysq.exe
Token: SeDebugPrivilege	3408	i_nlfdxvpnhf.exe
Token: SeDebugPrivilege	4912	i_sqnhfaxvpn.exe
Token: SeDebugPrivilege	3736	i_smkhczxvpn.exe
Token: SeDebugPrivilege	3464	i_rmkecwuomh.exe
Token: SeDebugPrivilege	2472	i_gebwurpjge.exe
Token: SeDebugPrivilege	4856	i_trljdbywto.exe
Token: SeDebugPrivilege	1656	i_nlgdyvqoig.exe
Token: SeDebugPrivilege	1784	i_davsnlfdxv.exe
Token: SeDebugPrivilege	3468	i_causnkfdav.exe
Token: SeDebugPrivilege	1896	i_spkhfaxspk.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2900	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 4332	4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 4216 wrote to memory of 4204	4216	2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 4204 wrote to memory of 2900	4204	iexplore.exe	91
PID 2900 wrote to memory of 4784	2900	msedge.exe	92
PID 2900 wrote to memory of 1740	2900	msedge.exe	94
PID 2900 wrote to memory of 3932	2900	msedge.exe	95
PID 2900 wrote to memory of 1740	2900	msedge.exe	94
PID 2900 wrote to memory of 1740	2900	msedge.exe	94
PID 2900 wrote to memory of 4928	2900	msedge.exe	96
PID 2900 wrote to memory of 4928	2900	msedge.exe	96
PID 2900 wrote to memory of 2784	2900	msedge.exe	97
PID 2900 wrote to memory of 2784	2900	msedge.exe	97
PID 2900 wrote to memory of 2784	2900	msedge.exe	97
PID 2900 wrote to memory of 1676	2900	msedge.exe	98
PID 2900 wrote to memory of 1676	2900	msedge.exe	98
PID 2900 wrote to memory of 1676	2900	msedge.exe	98
PID 2900 wrote to memory of 1880	2900	msedge.exe	99
PID 2900 wrote to memory of 1880	2900	msedge.exe	99
PID 2900 wrote to memory of 1880	2900	msedge.exe	99
PID 2900 wrote to memory of 2088	2900	msedge.exe	100
PID 2900 wrote to memory of 2088	2900	msedge.exe	100
PID 2900 wrote to memory of 2088	2900	msedge.exe	100
PID 2900 wrote to memory of 6120	2900	msedge.exe	103
PID 2900 wrote to memory of 6120	2900	msedge.exe	103
PID 2900 wrote to memory of 3100	2900	msedge.exe	106
PID 2900 wrote to memory of 3100	2900	msedge.exe	106
PID 2900 wrote to memory of 5264	2900	msedge.exe	107
PID 2900 wrote to memory of 5264	2900	msedge.exe	107
PID 2900 wrote to memory of 1456	2900	msedge.exe	109
PID 4332 wrote to memory of 4892	4332	snkicaysqkidavsn.exe	112
PID 2900 wrote to memory of 5068	2900	msedge.exe	114
PID 2900 wrote to memory of 5068	2900	msedge.exe	114
PID 3444 wrote to memory of 2532	3444	vtnlfdxnhf.exe	116
PID 2900 wrote to memory of 2340	2900	msedge.exe	119
PID 2900 wrote to memory of 2340	2900	msedge.exe	119
PID 4332 wrote to memory of 2732	4332	snkicaysqkidavsn.exe	120
PID 4332 wrote to memory of 2412	4332	snkicaysqkidavsn.exe	124
PID 4580 wrote to memory of 1208	4580	zxvpnkfcxv.exe	126
PID 4332 wrote to memory of 5676	4332	snkicaysqkidavsn.exe	129
PID 4332 wrote to memory of 828	4332	snkicaysqkidavsn.exe	133
PID 2288 wrote to memory of 2072	2288	pmkhczxrpj.exe	135
PID 4332 wrote to memory of 5776	4332	snkicaysqkidavsn.exe	138
PID 4332 wrote to memory of 4128	4332	snkicaysqkidavsn.exe	143
PID 5864 wrote to memory of 5636	5864	mkecwuomhe.exe	145
PID 4332 wrote to memory of 1888	4332	snkicaysqkidavsn.exe	148
PID 2900 wrote to memory of 4564	2900	msedge.exe	150
PID 2900 wrote to memory of 4444	2900	msedge.exe	151
PID 2900 wrote to memory of 1324	2900	msedge.exe	152
PID 2900 wrote to memory of 5848	2900	msedge.exe	155
PID 2900 wrote to memory of 5848	2900	msedge.exe	155
PID 4332 wrote to memory of 2996	4332	snkicaysqkidavsn.exe	156
PID 2564 wrote to memory of 1204	2564	rljdbztomg.exe	158
PID 4332 wrote to memory of 2668	4332	snkicaysqkidavsn.exe	161
PID 4332 wrote to memory of 5608	4332	snkicaysqkidavsn.exe	165
PID 4100 wrote to memory of 6108	4100	oljebwtroj.exe	167
PID 4332 wrote to memory of 2728	4332	snkicaysqkidavsn.exe	170
PID 4332 wrote to memory of 1804	4332	snkicaysqkidavsn.exe	174
PID 5464 wrote to memory of 5224	5464	dbvtnlgdyv.exe	176
PID 4332 wrote to memory of 6072	4332	snkicaysqkidavsn.exe	179
PID 4332 wrote to memory of 1356	4332	snkicaysqkidavsn.exe	183
PID 480 wrote to memory of 960	480	vtnlfdaysq.exe	185
PID 4332 wrote to memory of 940	4332	snkicaysqkidavsn.exe	188
PID 2900 wrote to memory of 4176	2900	msedge.exe	190
PID 2900 wrote to memory of 4176	2900	msedge.exe	190

C:\Users\Admin\AppData\Local\Temp\2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_c6e8c9586d5b11519ea53b0081b495b3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Temp\snkicaysqkidavsn.exe
  C:\Temp\snkicaysqkidavsn.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnlfdxnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4892
  - - C:\Temp\vtnlfdxnhf.exe
      C:\Temp\vtnlfdxnhf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3444
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2532
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnlfdxnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2732
  - - C:\Temp\i_vtnlfdxnhf.exe
      C:\Temp\i_vtnlfdxnhf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5988
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxvpnkfcxv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2412
  - - C:\Temp\zxvpnkfcxv.exe
      C:\Temp\zxvpnkfcxv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4580
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1208
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2972
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxvpnkfcxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5676
  - - C:\Temp\i_zxvpnkfcxv.exe
      C:\Temp\i_zxvpnkfcxv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4288
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmkhczxrpj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:828
  - - C:\Temp\pmkhczxrpj.exe
      C:\Temp\pmkhczxrpj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2288
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2072
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3140
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmkhczxrpj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5776
  - - C:\Temp\i_pmkhczxrpj.exe
      C:\Temp\i_pmkhczxrpj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4936
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkecwuomhe.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4128
  - - C:\Temp\mkecwuomhe.exe
      C:\Temp\mkecwuomhe.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5864
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5636
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3824
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkecwuomhe.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1888
  - - C:\Temp\i_mkecwuomhe.exe
      C:\Temp\i_mkecwuomhe.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rljdbztomg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2996
  - - C:\Temp\rljdbztomg.exe
      C:\Temp\rljdbztomg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2564
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1204
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1924
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rljdbztomg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2668
  - - C:\Temp\i_rljdbztomg.exe
      C:\Temp\i_rljdbztomg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oljebwtroj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5608
  - - C:\Temp\oljebwtroj.exe
      C:\Temp\oljebwtroj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4100
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6108
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oljebwtroj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2728
  - - C:\Temp\i_oljebwtroj.exe
      C:\Temp\i_oljebwtroj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3760
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbvtnlgdyv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1804
  - - C:\Temp\dbvtnlgdyv.exe
      C:\Temp\dbvtnlgdyv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5464
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5224
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5300
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbvtnlgdyv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6072
  - - C:\Temp\i_dbvtnlgdyv.exe
      C:\Temp\i_dbvtnlgdyv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1932
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnlfdaysq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1356
  - - C:\Temp\vtnlfdaysq.exe
      C:\Temp\vtnlfdaysq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:480
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:960
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5440
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnlfdaysq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:940
  - - C:\Temp\i_vtnlfdaysq.exe
      C:\Temp\i_vtnlfdaysq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4424
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlfdxvpnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2548
  - - C:\Temp\nlfdxvpnhf.exe
      C:\Temp\nlfdxvpnhf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4852
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5836
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4164
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlfdxvpnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1616
  - - C:\Temp\i_nlfdxvpnhf.exe
      C:\Temp\i_nlfdxvpnhf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3408
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqnhfaxvpn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5820
  - - C:\Temp\sqnhfaxvpn.exe
      C:\Temp\sqnhfaxvpn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4376
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3244
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5284
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqnhfaxvpn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4532
  - - C:\Temp\i_sqnhfaxvpn.exe
      C:\Temp\i_sqnhfaxvpn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4912
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\smkhczxvpn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5824
  - - C:\Temp\smkhczxvpn.exe
      C:\Temp\smkhczxvpn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4228
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:544
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5244
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_smkhczxvpn.exe ups_ins
    3⤵
    PID:3824
  - - C:\Temp\i_smkhczxvpn.exe
      C:\Temp\i_smkhczxvpn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3736
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rmkecwuomh.exe ups_run
    3⤵
    PID:3748
  - - C:\Temp\rmkecwuomh.exe
      C:\Temp\rmkecwuomh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5300
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2960
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rmkecwuomh.exe ups_ins
    3⤵
    PID:5772
  - - C:\Temp\i_rmkecwuomh.exe
      C:\Temp\i_rmkecwuomh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3464
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gebwurpjge.exe ups_run
    3⤵
    PID:5832
  - - C:\Temp\gebwurpjge.exe
      C:\Temp\gebwurpjge.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3696
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5196
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1088
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gebwurpjge.exe ups_ins
    3⤵
    PID:3124
  - - C:\Temp\i_gebwurpjge.exe
      C:\Temp\i_gebwurpjge.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2472
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rojgbzwroj.exe ups_run
    3⤵
    PID:1132
  - - C:\Temp\rojgbzwroj.exe
      C:\Temp\rojgbzwroj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4424
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5036
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3340
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rojgbzwroj.exe ups_ins
    3⤵
    PID:4868
  - - C:\Temp\i_rojgbzwroj.exe
      C:\Temp\i_rojgbzwroj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      PID:2120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trljdbywto.exe ups_run
    3⤵
    PID:3320
  - - C:\Temp\trljdbywto.exe
      C:\Temp\trljdbywto.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1748
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5616
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5472
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trljdbywto.exe ups_ins
    3⤵
    PID:1244
  - - C:\Temp\i_trljdbywto.exe
      C:\Temp\i_trljdbywto.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlgdyvqoig.exe ups_run
    3⤵
    PID:2632
  - - C:\Temp\nlgdyvqoig.exe
      C:\Temp\nlgdyvqoig.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1324
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4080
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlgdyvqoig.exe ups_ins
    3⤵
    PID:3084
  - - C:\Temp\i_nlgdyvqoig.exe
      C:\Temp\i_nlgdyvqoig.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1656
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\davsnlfdxv.exe ups_run
    3⤵
    PID:3164
  - - C:\Temp\davsnlfdxv.exe
      C:\Temp\davsnlfdxv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:992
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1960
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2184
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_davsnlfdxv.exe ups_ins
    3⤵
    PID:2444
  - - C:\Temp\i_davsnlfdxv.exe
      C:\Temp\i_davsnlfdxv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1784
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\causnkfdav.exe ups_run
    3⤵
    PID:4604
  - - C:\Temp\causnkfdav.exe
      C:\Temp\causnkfdav.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2540
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4872
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2788
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_causnkfdav.exe ups_ins
    3⤵
    PID:1660
  - - C:\Temp\i_causnkfdav.exe
      C:\Temp\i_causnkfdav.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3468
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spkhfaxspk.exe ups_run
    3⤵
    PID:1800
  - - C:\Temp\spkhfaxspk.exe
      C:\Temp\spkhfaxspk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4796
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5872
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4364
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spkhfaxspk.exe ups_ins
    3⤵
    PID:2188
  - - C:\Temp\i_spkhfaxspk.exe
      C:\Temp\i_spkhfaxspk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kecxupmhez.exe ups_run
    3⤵
    PID:1584
  - - C:\Temp\kecxupmhez.exe
      C:\Temp\kecxupmhez.exe ups_run
      4⤵
      PID:5316
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffd5d4ec188,0x7ffd5d4ec194,0x7ffd5d4ec1a0
      4⤵
      PID:4784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2036,i,17906965606358280598,2116045605463113208,262144 --field-trial-handle=2512,i,7447288875238587785,12460488081907205678,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:2
      4⤵
      PID:1740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2180,i,18117805668729328105,15225470453049966896,524288 --field-trial-handle=2512,i,7447288875238587785,12460488081907205678,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:11
      4⤵
      System Time Discovery
      PID:3932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,17811237064968592577,5311784709175065586,524288 --field-trial-handle=2512,i,7447288875238587785,12460488081907205678,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:13
      4⤵
      PID:4928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,10655447894279173202,15949902344285083320,2097152 --field-trial-handle=2512,i,7447288875238587785,12460488081907205678,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:2784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,4050266807791697641,2604367649874640015,2097152 --field-trial-handle=2512,i,7447288875238587785,12460488081907205678,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
      4⤵
      PID:1676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,3869044084928070233,4245200604742028519,2097152 --field-trial-handle=2512,i,7447288875238587785,12460488081907205678,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:9
      4⤵
      PID:1880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4300,i,15724701944663680403,15911317385392412382,2097152 --field-trial-handle=2512,i,7447288875238587785,12460488081907205678,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:1
      4⤵
      PID:2088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,14088735488320806720,759471290436648643,524288 --field-trial-handle=2512,i,7447288875238587785,12460488081907205678,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:14
      4⤵
      PID:6120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,10868037613126116173,8436854618507813035,524288 --field-trial-handle=2512,i,7447288875238587785,12460488081907205678,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
      4⤵
      PID:3100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,7457319028923562008,1475217169745060006,524288 --field-trial-handle=2512,i,7447288875238587785,12460488081907205678,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:14
      4⤵
      PID:5264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,7291365379240748923,5735309441689285742,524288 --field-trial-handle=2512,i,7447288875238587785,12460488081907205678,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
      4⤵
      PID:1168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,7291365379240748923,5735309441689285742,524288 --field-trial-handle=2512,i,7447288875238587785,12460488081907205678,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
      4⤵
      PID:1456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,4336051120268880373,15047151825329340401,524288 --field-trial-handle=2512,i,7447288875238587785,12460488081907205678,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
      4⤵
      PID:5068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,16683566133497642211,12028018079853185478,524288 --field-trial-handle=2512,i,7447288875238587785,12460488081907205678,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
      4⤵
      PID:2340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,13952700867029925168,13256093869251911287,524288 --field-trial-handle=2512,i,7447288875238587785,12460488081907205678,262144 --variations-seed-version --mojo-platform-channel-handle=1208 /prefetch:14
      4⤵
      PID:4564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,5068096565214133975,9967175835401258928,524288 --field-trial-handle=2512,i,7447288875238587785,12460488081907205678,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:14
      4⤵
      PID:4444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,14234800078586252377,17583621492471293263,524288 --field-trial-handle=2512,i,7447288875238587785,12460488081907205678,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:14
      4⤵
      PID:1324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1248,i,11265112889981397225,2608630517502934029,524288 --field-trial-handle=2512,i,7447288875238587785,12460488081907205678,262144 --variations-seed-version --mojo-platform-channel-handle=1284 /prefetch:14
      4⤵
      PID:5848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,6168936373345202991,14218008570807599064,524288 --field-trial-handle=2512,i,7447288875238587785,12460488081907205678,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:14
      4⤵
      PID:4176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,775400146247601383,34392539239846236,524288 --field-trial-handle=2512,i,7447288875238587785,12460488081907205678,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
      4⤵
      PID:4680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=916,i,5883223528272042118,14782499082171517523,524288 --field-trial-handle=2512,i,7447288875238587785,12460488081907205678,262144 --variations-seed-version --mojo-platform-channel-handle=912 /prefetch:14
      4⤵
      PID:2992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,3103179616358609947,6758047456444063875,524288 --field-trial-handle=2512,i,7447288875238587785,12460488081907205678,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:14
      4⤵
      PID:3872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5588,i,111866268805053569,3651531306700559794,262144 --field-trial-handle=2512,i,7447288875238587785,12460488081907205678,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:10
      4⤵
      PID:2684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3564,i,5785046568143888180,13023129376510343802,524288 --field-trial-handle=2512,i,7447288875238587785,12460488081907205678,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
      4⤵
      PID:5804

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4252

C:\Temp\snkicaysqkidavsn.sys
C:\Temp\snkicaysqkidavsn.sys
1⤵
- Executes dropped EXE
PID:4876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4076

C:\Temp\faxspkicau.sys
C:\Temp\faxspkicau.sys
1⤵
- Executes dropped EXE
PID:2120

C:\Temp\pjhfcxupnk.sys
C:\Temp\pjhfcxupnk.sys
1⤵
- Executes dropped EXE
PID:2620

C:\Temp\jeczuomkec.sys
C:\Temp\jeczuomkec.sys
1⤵
- Executes dropped EXE
PID:5340

C:\Temp\bzurmjebzt.sys
C:\Temp\bzurmjebzt.sys
1⤵
- Executes dropped EXE
PID:824

C:\Temp\rljdbwtolj.sys
C:\Temp\rljdbwtolj.sys
1⤵
- Executes dropped EXE
PID:204

C:\Temp\ywtoljdbvt.sys
C:\Temp\ywtoljdbvt.sys
1⤵
- Executes dropped EXE
PID:1716

C:\Temp\vtnlfdyvqo.sys
C:\Temp\vtnlfdyvqo.sys
1⤵
- Executes dropped EXE
PID:4608

C:\Temp\avtnlfdayv.sys
C:\Temp\avtnlfdayv.sys
1⤵
- Executes dropped EXE
PID:4828

C:\Temp\vpnlfcausn.sys
C:\Temp\vpnlfcausn.sys
1⤵
- Executes dropped EXE
PID:1352

C:\Temp\pkhfzxvpmk.sys
C:\Temp\pkhfzxvpmk.sys
1⤵
- Executes dropped EXE
PID:4828

C:\Temp\rpjhczxrpj.sys
C:\Temp\rpjhczxrpj.sys
1⤵
PID:4296

C:\Temp\wuomhecwuo.sys
C:\Temp\wuomhecwuo.sys
1⤵
PID:4408

C:\Temp\rljebwtomj.sys
C:\Temp\rljebwtomj.sys
1⤵
PID:5448

C:\Temp\qligdywtnl.sys
C:\Temp\qligdywtnl.sys
1⤵
PID:3408

C:\Temp\qkidayvqoi.sys
C:\Temp\qkidayvqoi.sys
1⤵
PID:3544

C:\Temp\cayvpnifay.sys
C:\Temp\cayvpnifay.sys
1⤵
PID:1716

C:\Temp\zxspkicaus.sys
C:\Temp\zxspkicaus.sys
1⤵
PID:2964

C:\Temp\kecwupmhfc.sys
C:\Temp\kecwupmhfc.sys
1⤵
PID:3532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bzurmjebzt.sys

Path C:\Temp\bzurmjebzt.sys
Size 293KB
SHA256 ba73798a75c65b379ede50a6e622068df8f45088422b067ead37aeb0b7243289
MD5 621276f5be1f82c1cde0329717c964a2
SHA1 a9abe8a8730d595eefbfc4cb4d5e60291df722ce
SHA512 65053862b171244f43ab6f3291e6c3c0f4c83f2799a3152a32c84a19b66340867f517b0343101a571a9d90dd373b3d3976b24d4a39effc8bcb16569d6ed14e01
SSDEEP 3072:ftKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:fIJjiJcbI03GBc3ucY5DCSj
TLSH
T150545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faxspkicau.sys

Path C:\Temp\faxspkicau.sys
Size 293KB
SHA256 732954d34d5ea1c343c85f5823b6fe881aaea985617d1f81e78f04718c030f3c
MD5 5387bccbf96f25112dc4036e64d64206
SHA1 954b900bb3c3b45ff600c4730c42e4a4740b9025
SHA512 2e06644554b422c0c8ac3e334a6acd0207668be30dfea71f2bfb627259e68fc4c6b487da3600805a6deabc9773c8167774cd5991a3bc76aba197d455449da9d9
SSDEEP 3072:xtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:xIJjiJcbI03GBc3ucY5DCSj
TLSH
T110545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mkecwuomhe.exe

Path C:\Temp\i_mkecwuomhe.exe
Size 722KB
SHA256 7365629ef23cc34dead7d6b6e524398a6eb453473734c72c33a059d090cbe42e
MD5 5ee85488e3a2f8714e662ac847eb1f49
SHA1 29a4ff83871d6e5e07f0f3cd5520053df9773959
SHA512 bc056a967997656e5d8896e08fb25f6f9e5b77c96482badccee6fb815e00ef75b958834d90bb62fc3d0b0c965945aea920363061c4ca9511c0057be86b77ec7d
SSDEEP 12288:lflfAsiVGjSGecvXAflfAsiVGjSGecvX:tMcfcMcf
TLSH
T109F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pmkhczxrpj.exe

Path C:\Temp\i_pmkhczxrpj.exe
Size 722KB
SHA256 8331552a68000d7dbf8a399352be3c3f9cf68f514eae6f541b6042c3ca47a32f
MD5 e141f0ceb69f7e10bc48e7419b63b3a4
SHA1 30bbba74eb42d5e024525b18206d70109dff44a6
SHA512 3fd6b5cb447a7027d90a7d77a4b07475c01b3f706e0b578dd1a08934278c49320b107cf08d41929ccd75c17fee1fc9755fd51dba5271d5e2e6103468a2ccbdad
SSDEEP 12288:1flfAsiVGjSGecvXAflfAsiVGjSGecvX:dMcfcMcf
TLSH
T11BF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rljdbztomg.exe

Path C:\Temp\i_rljdbztomg.exe
Size 722KB
SHA256 8ed09165c130561940473bd5297fb237ed20b9e6476ce4051f2a161bfa4c4e71
MD5 f7aa25caada4bbecda49fcc8ccc7356f
SHA1 46701460a065151f414d23ba3bce707d5f71dac1
SHA512 0a30f470370a6e00ff152d5b03bf75f08ee50e3d268081c70905a99264870942998146f02b6c727d95d09630d9253d9f5e1ca81c8ba2398bb163a3326b252dbf
SSDEEP 12288:MflfAsiVGjSGecvXAflfAsiVGjSGecvX:YMcfcMcf
TLSH
T1EBF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtnlfdxnhf.exe

Path C:\Temp\i_vtnlfdxnhf.exe
Size 722KB
SHA256 b9afeb1e83ea0ba07f3fb431efdd1b314f9ff56571d8d8016709c4896d3458ac
MD5 ae70521cd2f86f79b977897c18b56544
SHA1 209d3565dbf91e6ea928897c220675c91c643bbf
SHA512 85645cd0f9ccc15d01b633155362c6c5c422aa874b3eb3eec41bb5d1ddb6d67ff077d2540e3fa3936e98f7201a2fb8c4a6106d2f6ee7729fe9baabb6455ca4ec
SSDEEP 12288:eflfAsiVGjSGecvXAflfAsiVGjSGecvX:aMcfcMcf
TLSH
T1DAF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zxvpnkfcxv.exe

Path C:\Temp\i_zxvpnkfcxv.exe
Size 722KB
SHA256 2e55a3da55a02a0ca7c9877ef8a7f3be3801491233cd92c151ee566ae81c904f
MD5 0f522dc633be0e464adc8e6768c45d1f
SHA1 8fe5e77e02e035f9aaa24cf8362373a1c41f9823
SHA512 c8937085d281eb9857cc94e6d16e9fafe39d32e8e75956954837567c470b42f692a08b3f7f8087b460214804ff3ba0648a48d1dfb6c4eb45b9b3c7abdbaab02f
SSDEEP 12288:FflfAsiVGjSGecvXAflfAsiVGjSGecvX:NMcfcMcf
TLSH
T1EBF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jeczuomkec.sys

Path C:\Temp\jeczuomkec.sys
Size 293KB
SHA256 9ad597f57f9a2a3f077256ee50ed18616bd4b5203a5a01ed2a9fc92453ce1cbe
MD5 36b73e6ba05318f887de9f6e8cda882c
SHA1 4394634ed634c106e73a1033ea2bc6d5ce370738
SHA512 b057207ecb26cd1b57a991f681574add9536d4701b4d039d48cc44382f4e18ca61ac4080138e0c56d95de4f7bce6b125d8c32a5cfffc88845c71f34769f8a567
SSDEEP 3072:JtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:JIJjiJcbI03GBc3ucY5DCSj
TLSH
T1CF545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkecwuomhe.exe

Path C:\Temp\mkecwuomhe.exe
Size 722KB
SHA256 5e84fc795c0e34500b4c1283a7ff64ec22f5008f1cc3bc8cbd3b9c6cf1c3ba81
MD5 abf90ab42d88a751cda2cf0b3695d151
SHA1 c197414da4c52a5cd894660f62b14c79921e3751
SHA512 1fadc5f8ff72df871c87ac6cc2d130742ff4dd1aeeafc1832b693b45ea57515b4ec8df781c63bdc2fc30be3aecba488680871c8813385d9d3f3612f34efa0174
SSDEEP 12288:WflfAsiVGjSGecvXAflfAsiVGjSGecvX:CMcfcMcf
TLSH
T11FF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oljebwtroj.exe

Path C:\Temp\oljebwtroj.exe
Size 722KB
SHA256 06ba3f902fe59b27b1d31a86d58eb2dc14b826e5851675f8d6ce0b9765c8eec7
MD5 8a2022f8d760f9e186da2af0eaa294a7
SHA1 f3659166c9bb42f93a629f831b28c8feedac3730
SHA512 528fba17fc4052ac9a3a9b0c4f28b7ee36a860d9a8122924bc06402e2b4db712901189a2dd601712b003fafe8f528caab165698fe2084bc57dd68eafbe29d55d
SSDEEP 12288:UflfAsiVGjSGecvXAflfAsiVGjSGecvX:QMcfcMcf
TLSH
T1CEF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhfcxupnk.sys

Path C:\Temp\pjhfcxupnk.sys
Size 293KB
SHA256 b41fb6fd5a4be742433dac4d2fd98aa253a100a1dc9385b0e16e396d2d436a86
MD5 3dcf71d8c8f05db5f2e9e6f1938a30d2
SHA1 087da5da1d90ff7ba8af3fef92e6dcaa66536a84
SHA512 a65525d2e5cf1e8438cc645a9cd183f84688f85eaa1e19a2456686182f46b85617148deb06c50dfaface6e96d04a11a56567f14adec7efdb70ff23bd04d4ee06
SSDEEP 3072:BtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:BIJjiJcbI03GBc3ucY5DCSj
TLSH
T1BE545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmkhczxrpj.exe

Path C:\Temp\pmkhczxrpj.exe
Size 722KB
SHA256 0b661e7a14e4682b116575c731c4cd7c906abaaf6aa69ec4dcba7af55bc6cd91
MD5 b472ef06911a0e3bdd36e733c820dfe9
SHA1 be6983766e1417f72a574214a9198a2374a87dda
SHA512 c4128de84140bc5ecefc2d6376aa652c461a69d68b3ca99766742d4dc2b8e44ce032acf275f0ce23abd7f3fb98a77d26cf841078a8043932e636ab6a4af5a2b4
SSDEEP 12288:cflfAsiVGjSGecvXAflfAsiVGjSGecvX:IMcfcMcf
TLSH
T194F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljdbwtolj.sys

Path C:\Temp\rljdbwtolj.sys
Size 293KB
SHA256 71130ed9955bd94e64b88b7ab06a5145b2efd205d6be6f38205059f7282138d2
MD5 bcd7ec83cb27ef38e96d96c0d7493725
SHA1 89b831b1fb9406a237039893bfdf5eecf69f5170
SHA512 6ab13b097d5f09687865f0154a58f2c94f395400a6582afc614006428e77fc750a671f3dd51e7d47e3236595fe3ebcc7edd53464bd390d67eec244bb2dc58b00
SSDEEP 3072:jtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:jIJjiJcbI03GBc3ucY5DCSj
TLSH
T188545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljdbztomg.exe

Path C:\Temp\rljdbztomg.exe
Size 722KB
SHA256 c95a758e70617e58727130c85fa0c190adca9e74cf4f3ea8538d49ff0b4e2cb0
MD5 4685905cf6356ee57a211b9fec4a7b82
SHA1 a164a66e1948365c848931d16c2d9d55f790d593
SHA512 260594ddd5f78ba882922786e5f096c14041916e4390633892720618a0028f947eb860d3245cd29428120f0f3476bb34ed3be2bf4998ea09e28654a4843a6f5d
SSDEEP 12288:UflfAsiVGjSGecvXAflfAsiVGjSGecvX:QMcfcMcf
TLSH
T157F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snkicaysqkidavsn.exe

Path C:\Temp\snkicaysqkidavsn.exe
Size 722KB
SHA256 4e40169a858e1204638022a301ee68cfff2cba275d45bc4e3226bc6fd9b5d124
MD5 f2be86307137f98f91f6d1f22dc89286
SHA1 cfff157e6f61ea3913876b01e83cdd29e505e7bd
SHA512 d2bcec0575cf634065f70f29560100da02c32066affcb8c58b282bc3ee2c4095f2ab5508ba9a2dfcb1a4106258969afe3f37d75f46135a087e099506167dfab0
SSDEEP 12288:/flfAsiVGjSGecvXAflfAsiVGjSGecvX:nMcfcMcf
TLSH
T1B8F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snkicaysqkidavsn.sys

Path C:\Temp\snkicaysqkidavsn.sys
Size 293KB
SHA256 9d6b83f34017787fdf6a98916f53e1c1c67800b81457b248cc46bb537acaeb20
MD5 1fddde1b1044fb9936efa68b2d33ece2
SHA1 6420eafc4f55a4b6b52c227ade23fd05f3f1becf
SHA512 c2773496f9da88a82f2f0a0f22089df12da87062c7fcb4f09ed0a9e0b67633dc85f7deeb2e13b3548dd3d2944c0e9a1155db97d74d3b4cf8b240fee197af3405
SSDEEP 3072:ntKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:nIJjiJcbI03GBc3ucY5DCSj
TLSH
T1CF545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlfdxnhf.exe

Path C:\Temp\vtnlfdxnhf.exe
Size 722KB
SHA256 5410b58c7aac534a3859f913911f3e383951ffe21924493293fae73962e827cf
MD5 430898a319b47036ec9240b9959d616c
SHA1 ee264153aeeffbbdca86c9c6f501b421c36b872c
SHA512 3293c0a210ab09d800db0a720c9087b437b8bf44adf83740cf311ee18f5f569d26407c4ce94c7500757545624d346568e5a711cb4e354c23193109921e970766
SSDEEP 12288:8flfAsiVGjSGecvXAflfAsiVGjSGecvX:oMcfcMcf
TLSH
T1C7F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxvpnkfcxv.exe

Path C:\Temp\zxvpnkfcxv.exe
Size 722KB
SHA256 a8955218e4ed88ca233efeb62be5619af8d9cf05f1cf0412f240ec78e1c3aef3
MD5 521ce7ff48eb5d22af19963700bef580
SHA1 48c92f0a07d5f2ee96ac37c1984d85413fbf88a9
SHA512 2ad0aaf561162bd8a938a6309dbae973a9b9207a1a85ce962177129b5c24226d9115e715b4d71f782df06ae6929a873d74035cf31b20c5a44c48c34f8fd89bae
SSDEEP 12288:xflfAsiVGjSGecvXAflfAsiVGjSGecvX:5McfcMcf
TLSH
T166F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 b7467f16ee48f64594ec29a190ee4bb796db20f95c9bf02193fbc1049d7a367b
MD5 02d8b5cb9ca5370158f85b75ddb4435e
SHA1 4964ee5ec102617a2d140efaae0e855c9f6be003
SHA512 b4a249db57895a9f43867daad11520b4eb604a05eaa3b63a5a8af5a70b03b2a5d047cb2dada59cfe536fa54dbd1d0ce5fc93825f77c7151c9005bbf56a807db1
TLSH
T15B514073336C09D8EB2A857520E296B632F5C35E8707AE4282995CB77906F4052F2C5F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a18d9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a18d9.TMP
Size 2KB
SHA256 98d7c934b32230d94fdb34a9bcb15424144a8c405f42711722c1ae53bc7a809c
MD5 ad9a09c06f27cb17ab62d03841fb21d6
SHA1 0dfea7845400c4e6bbdb5d14809bc5cca28078f4
SHA512 ba49866d1b1e067da7cc3fc93b79e7c1eb696c01b00b9d19fdc754c4eaad48cdda540e323e2c44c88a5a064e8ae7f3a3beb9fef6b9835bed9af04d7d975f7055
TLSH
T1E6514173336D09D8EB2A847520E2D6B632F5C35E8707AE8282995CB77906F4052F2C5F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2ff8efb95099633075637c8e91a3561b52cf919a612d2ed50364a7be696be636
MD5 10fc64d78c9d45133948fff6e79eeae4
SHA1 64b051dcb49fe9e9e1a90ee5472fb5bfa6c31ca0
SHA512 1d823cf18058c15ef8de408264785a15c1e23a7f213939895ec921c3e1a79db94aa7c351e8b48980d95d78a822aea4295cd15a628afa789627b1f0b8dff5e440
TLSH
T1F241ADF3C3F8962E891156F4AA186E2BCE1D0955432C3D5AC8E4AF1BA3E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d65294fd6cc3f8aac36d58ed8160d99bc6c609d6d795e0b5ea9bc37d7d53f5b6
MD5 ac190a8bfe6ecade667a0d6b05152b8c
SHA1 eb57daf12826e7b4a6b85b12c29e889c7dfb4822
SHA512 b4d4e472df85e7f6a2884971de443f0fc1b207be9d5d7ef9c422fce1018eaac2a6a881f403a294a9819a2b549dcdc138017d412bcc8dcc9cb4669224b1dc843c
SSDEEP 192:sxRuRTCY/fasLsdZCVjlbdzoA8p9EB/g6+WNCRG/YD9rySVGTJIgVR5J:sxRuQY/fasLsTqjFQU/53/hS6T
TLSH
T17C42C7456D78AD3B4CCBD21EBB65BF53D2F9103260D11E58A6FC9A1C04EA6CD620790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 355e48eca9ac6374ba1175c5d6d09efefaef49b96e853e72e30803dfe8e9005e
MD5 40bbb9bc80a4c5efa0f130ba3b89decb
SHA1 1d46e1d3d82d3c185ebaf52f68f03e448febac66
SHA512 7d376e0b25504109a1981f83f2487d3e3fc2210507263cf1a5624db3c75778c84b30cbc689a0273ac1e52d51094e7fdeaa95e5e538e28163fe82301c9a630e0e
SSDEEP 192:sxRVRTCY/fasyHCXdZCVjlbdzoA8p9EB/g6+WNCRG/YD9YySVGTJIgDhR5J:sxRVQY/fasyHCXTqjFQU/53/CS67
TLSH
T1FE42D8456DB8AD3B4CCBD21EBB55BF53E2F9103260D11E58A6FC9A1C04E76CD620790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f82552f6b023d0681d4a9f4fe8df31d3624c31c5e52ecddf1d0b962b0ae9682d
MD5 4b15dfcf6d7d387f5afccbd83e77a528
SHA1 f63b909804685c6fe50d605d990adf210017fed7
SHA512 4282e51fe4c42b55273889b5d2218c771b9a8db04b9eaaf5537d9a88b41747e7cb32e727190c0816bd14e2f3e73c8fa21804ff3cac76ab8a2113ca85c7d15782
SSDEEP 192:sxRVRTCY/fasyHCsdZCVjlbdzoA8p9EB/g6+WNCRG/YD9rySVGTJIgDDR5J:sxRVQY/fasyHCsTqjFQU/53/hS69
TLSH
T12142D8056DB8AD3B4CCBD21EBB55BF53D2F9103260D11E58A6FC9A1C04EB6DD620790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 321cccb9b910ae293e98bcb6c703ef17cde8033402817fccfd971e25c404d82e
MD5 1fef48c1fd00a09d538f0dbcd5e3c634
SHA1 bfd9eb4d2cf7de83897d2268ba6e008184238794
SHA512 eb886d5e604e7cfac31971b873f2d72d9a2a5e275f425d89622370222f6fe2c347580e427497195edeb48f788a1aa3c61dbe2631f3a22330d5c2ceda531cc186
SSDEEP 768:azfWML7pLuL7J0Wg/XfHf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVcp3c16propLQi9:azfWMdE7J0Wg/XfHfu1jabp3y6CpLQS
TLSH
T109D2EA7B640CCE7F4F800ADDAD197E9F6DA802CB9698CD5047FE941C02C6BEA52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 167aaa3d34c0f9207a524293ecdb349be1b9cbb87b8daef6c1fc2ca786ac0af4
MD5 d9d0684ef87d68a3b3ba6239a648e8c2
SHA1 8d00809171b4d8c0f421aa336a3d511186e99db3
SHA512 0b7ae6ab5f9493945e1a5e04dd487a69b5476241c5683ac7f112997a715f3fc9b57f1ea4ac571089c8e6c4691752348b5d006066302b1c4479a2b1aa19bd568f
SSDEEP 96:KREFw0Oy2UWS/fg8UK4Rg2Uc00/uUJHoZs4q26gWeDzgggK41gCgcwgziIdckzJ/:CEFw0Oy2rS/I8oRg2700/uUJHoZs4q2W
TLSH
T1CE911300357F12807C7EB55D91A5991E82C17872716AB52F7BEC11A60F66E038CFEACD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c5b2fafa-b300-4b39-b2d2-c72a705ce897.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c5b2fafa-b300-4b39-b2d2-c72a705ce897.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 472e4953395816630adad4818322324631dadc76c839ab8e86960abfd6bbdcd7
MD5 89c58063e085fd4a6615684fbb749063
SHA1 cc005a91cb57038a5c1f69bced76709f43e3e869
SHA512 e5a759f78abc15153a5e507224ad0cd5ef3e5e8bc5b43067b9d9fb5677dc39235e13c2231deb9771978fce007c684888dbe9b8d43242d5c25ec4e23668359c82
SSDEEP 384:niZcIy38Ni3uDZzBbBpDWZlf8hyEGB5R/fUFy2rEoajo4cdR8eHhVODjYPNDUM2h:Qy3CJpoi0krEnjN3Gac1F2hy6Dq0WA
TLSH
T17FF2B03069E49DB34CEEE346B5473B43AEE0166385D40EE8D6DDB60C15832A9270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d4d93ecc5a072d255a9d45b15fc26c414036eb7610af7299b588775a97a868bf
MD5 9c65439578ec76cde63d486611f28aa9
SHA1 62ae687906aa13a6ec6bc75d298f2a4937224ae8
SHA512 571b0aa816a89f9bf3176085752ab7b6d5acbb3cefee683ce58eed2af1842f94f57e98e31013e60866cc100ba36cb95ddacba13a3cb922b6899c2c3f9d6edadd
SSDEEP 384:nzZcIy38NiiuDZzBbBpDWZlf8hyEGB5R/fUFy2rEoajo4cdR8eHhVODjYPNDUM2h:ry37Jpoi0krEnjN3Gac1F2hy6Dq0WA
TLSH
T1F5F2BF3069E49DB38CEEE346B5473B43AEE0166395D40EE8D6DDB70C15836A9270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 5ea3ee822477f53849e30c7eca7c9e06360f814179f43fda9e8590565ac05112
MD5 8880297365f199d4a5fcbc43aa458433
SHA1 5f8cb9a185b1ccdee937bd4381237db3feab0dce
SHA512 faebea6de5cfe00e37d86e2792c6804895ed271da8076f1d8045eb96f86f2a4ad5c8dc8e0521b43d8ffe82b22105d06cd23f4fdc2a520cd3d18f348e80b24102
SSDEEP 768:rrv+4UNbdS3himi0drEnjN3Gac1Z7eVH1SCz:rbsbg3zdQnjMakEH1V
TLSH
T19303CF3669A89EB38CEBD38571477A037FF4125386940BE4CADD6B0D029B5DC230B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 36d929ac221e050046a81bfbbb34ae037b8186662d8a16c1cf3309ad950d87d9
MD5 0c30c9162473e1b38e8be543915ddcfe
SHA1 0bb01ccda4ea6f7726253cf3eb52761d5ef6b5a1
SHA512 42401d5e5bd6bed0d8b237ff8fc726581b91436948e57488e73b2e1a542520b28aea4c1473c71903c6e25d01265c5b34fe75af19228a5c7062073ff74e169910
SSDEEP 768:0rv+4UNbd53AvVoi0krEnjN3Gac1F2MMlT:0bsbL3BkQnjMad1
TLSH
T1BE03BF3179A8DEB38CFAD385B14776437FF016A384C50AA4DAD9AA0C05875ED270B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 524369dede9e90b15912753d48964af42bfab17686aeda9ef8279402a8b5e803
MD5 15802aa0ae35ee09ea2d94b51066dc6d
SHA1 b52bfb0b370678c3ff623c39d4d06c40dc7b2855
SHA512 0651120c4f76ad48caddf254a5004bbe6d7d6daf096d78b1e7cb7868ac35e60e2112931b86ecaa4713c3caf3fe15684d2136b796932153fcc5e20a744302bc81
SSDEEP 768:kFQG3NwghJdTsnrEnjN3Gac1F2hy6Dq0WA:HG32nQnjMadTPV
TLSH
T13D1328F594D78976C8EE9387A73E6E0299BCC163B5984994B7C85D0CDC821BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

7ecc460f-5755-4501-a72b-d9d171e00d09.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7ecc460f-5755-4501-a72b-d9d171e00d09.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2900_2017370166\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 573b31425e99018752b45fcc8e5e8684214586b831fe4574dc8524a0810bb024
MD5 e350fea902812e365f4189d138bee4e8
SHA1 7aec418fb6604303a02580381073b20b2cfb3e71
SHA512 a75c60dce6ecc1ab48d0f22f287ca2edc51b769e37c39829f1c312b55834a7a30333dbb267b2442f3d5a5c4c5cc416bb76193ccd98bfe97852fc0c486dee6c78
TLSH
T1A371E74356ADC5B3C1DA5BF502835648F6FB127C4B6370144B555586AB3073954B8F18
MD5 SHA1 SHA512 TLSH

Submit Download

memory/204-302-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/824-277-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/824-311-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1352-344-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1716-319-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1716-472-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2120-189-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2620-237-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2964-476-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3408-447-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3532-493-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3544-452-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4296-415-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4296-393-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4408-413-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4608-323-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4608-341-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4828-373-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4828-339-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4876-222-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4876-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5340-265-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5448-418-0x0000000000010000-0x00000000000AB000-memory.dmp

Download