317821ee972ff808899dd74bc4c3205c52efa2b02306ea01b708fe19005bfe76

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 13:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 722KB
Sample260806-qvskcsscqh
SHA256 317821ee972ff808899dd74bc4c3205c52efa2b02306ea01b708fe19005bfe76
MD5 48d7a0a820de523ad84bb728243f1fed
SHA1 3664cdaac635627f8c943602abc025f724293f25
SHA512 2e50eea9fcbf83ecb48ba09773b3d1dd42c85f6b9745a181aaaed0c3b60b7173593fd51a253e07fbee5e992cf3953ae308ff297119faf27cb86628044b9e653e
SSDEEP 12288:uflfAsiVGjSGecvXAflfAsiVGjSGecvX:KMcfcMcf
TLSH
T1A4F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
5324	bztrmjebztrmjgec.exe
3340	bztrmjebztrmjgec.sys
5388	CreateProcess.exe
2812	mheywrojhb.exe
2772	CreateProcess.exe
4520	CreateProcess.exe
1704	i_mheywrojhb.exe
1728	wromgeuolg.sys
1588	CreateProcess.exe
4140	jgbywqojdb.exe
5284	CreateProcess.exe
4772	CreateProcess.exe
5768	i_jgbywqojdb.exe
1140	btrljdbvto.sys
1328	CreateProcess.exe
4176	wigdyvtqoi.exe
3044	CreateProcess.exe
5708	CreateProcess.exe
1144	i_wigdyvtqoi.exe
3556	tqlidbvtnl.sys
1728	CreateProcess.exe
1792	lgdywqoiga.exe
2312	CreateProcess.exe
1324	CreateProcess.exe
5828	i_lgdywqoiga.exe
3904	vpnlidaysq.sys
5300	CreateProcess.exe
916	qkigayvtnl.exe
5992	CreateProcess.exe
2292	CreateProcess.exe
3448	i_qkigayvtnl.exe
6012	kfaxvpnhfa.sys
2624	CreateProcess.exe
3012	cxvpkhfaxs.exe
1096	CreateProcess.exe
4312	CreateProcess.exe
1848	i_cxvpkhfaxs.exe
1908	vpnhfcausm.sys
5776	CreateProcess.exe
3004	nkeczxupmk.exe
4332	CreateProcess.exe
3264	CreateProcess.exe
4204	i_nkeczxupmk.exe
3484	urpkhcausm.sys
2596	CreateProcess.exe
616	usmkfzxrpm.exe
4400	CreateProcess.exe
4064	CreateProcess.exe
4764	i_usmkfzxrpm.exe
3556	mkecwurmjh.sys
4844	CreateProcess.exe
3512	ecwurmjhbz.exe
5736	CreateProcess.exe
3336	CreateProcess.exe
1496	i_ecwurmjhbz.exe
3280	bztrmjebwu.sys
2128	CreateProcess.exe
2932	ztrljebwto.exe
5580	CreateProcess.exe
4452	CreateProcess.exe
3504	i_ztrljebwto.exe
5704	bywtoljdbz.sys
4764	CreateProcess.exe
1664	tqoigdbytq.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2192_1497423380\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2192_422452262\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2192_229625398\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2192_1184716928\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2192_1184716928\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2192_1184716928\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2192_422452262\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2192_229625398\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2192_1184716928\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytqlidbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqnigaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljhezwuomj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdywqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbzlgebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbzlgebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqnigaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrmjebztrmjgec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdywqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrljebwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upmhezxupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mheywrojhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wigdyvtqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqoigdbytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkfzxrpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaxvqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxvpkhfaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrljebwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaxvqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausmkecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmhezxupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgbywqojdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkigayvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkigayvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkeczxupmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkfzxrpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqoigdbytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausmkecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mheywrojhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwurmjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytqlidbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicsmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicsmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljhezwuomj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgbywqojdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wigdyvtqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxvpkhfaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkeczxupmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwurmjhbz.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
552	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1036	ipconfig.exe
3504	ipconfig.exe
4136	ipconfig.exe
5216	ipconfig.exe
4132	ipconfig.exe
4852	ipconfig.exe
5820	ipconfig.exe
6080	ipconfig.exe
1848	ipconfig.exe
548	ipconfig.exe
4796	ipconfig.exe
5768	ipconfig.exe
460	ipconfig.exe
5500	ipconfig.exe
5788	ipconfig.exe
2532	ipconfig.exe
4332	ipconfig.exe
6024	ipconfig.exe
2560	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304969300726701"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{199B1154-BECB-4DB1-812D-71B681A800C8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5324	bztrmjebztrmjgec.exe
5324	bztrmjebztrmjgec.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5324	bztrmjebztrmjgec.exe
5324	bztrmjebztrmjgec.exe
5324	bztrmjebztrmjgec.exe
5324	bztrmjebztrmjgec.exe
5324	bztrmjebztrmjgec.exe
5324	bztrmjebztrmjgec.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1704	i_mheywrojhb.exe
Token: SeDebugPrivilege	5768	i_jgbywqojdb.exe
Token: SeDebugPrivilege	1144	i_wigdyvtqoi.exe
Token: SeDebugPrivilege	5828	i_lgdywqoiga.exe
Token: SeDebugPrivilege	3448	i_qkigayvtnl.exe
Token: SeDebugPrivilege	1848	i_cxvpkhfaxs.exe
Token: SeDebugPrivilege	4204	i_nkeczxupmk.exe
Token: SeDebugPrivilege	4764	i_usmkfzxrpm.exe
Token: SeDebugPrivilege	1496	i_ecwurmjhbz.exe
Token: SeDebugPrivilege	3504	i_ztrljebwto.exe
Token: SeDebugPrivilege	1560	i_tqoigdbytq.exe
Token: SeDebugPrivilege	5228	i_ytqlidbvtn.exe
Token: SeDebugPrivilege	5820	i_sqnigaysqk.exe
Token: SeDebugPrivilege	1192	i_ifaxvqkica.exe
Token: SeDebugPrivilege	2400	i_kicsmkecxu.exe
Token: SeDebugPrivilege	6136	i_ausmkecxup.exe
Token: SeDebugPrivilege	2580	i_upmhezxupm.exe
Token: SeDebugPrivilege	5848	i_ljhezwuomj.exe
Token: SeDebugPrivilege	4636	i_ljdbzlgebw.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2192	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4336 wrote to memory of 5324	4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 4336 wrote to memory of 1104	4336	2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 1104 wrote to memory of 2192	1104	iexplore.exe	91
PID 2192 wrote to memory of 4856	2192	msedge.exe	92
PID 2192 wrote to memory of 552	2192	msedge.exe	93
PID 2192 wrote to memory of 3216	2192	msedge.exe	95
PID 2192 wrote to memory of 3216	2192	msedge.exe	95
PID 2192 wrote to memory of 5816	2192	msedge.exe	94
PID 2192 wrote to memory of 5816	2192	msedge.exe	94
PID 2192 wrote to memory of 5816	2192	msedge.exe	94
PID 2192 wrote to memory of 4844	2192	msedge.exe	97
PID 2192 wrote to memory of 4844	2192	msedge.exe	97
PID 2192 wrote to memory of 4288	2192	msedge.exe	98
PID 2192 wrote to memory of 4844	2192	msedge.exe	97
PID 2192 wrote to memory of 4288	2192	msedge.exe	98
PID 2192 wrote to memory of 4288	2192	msedge.exe	98
PID 2192 wrote to memory of 2720	2192	msedge.exe	99
PID 2192 wrote to memory of 2720	2192	msedge.exe	99
PID 2192 wrote to memory of 2720	2192	msedge.exe	99
PID 2192 wrote to memory of 4616	2192	msedge.exe	100
PID 2192 wrote to memory of 4616	2192	msedge.exe	100
PID 2192 wrote to memory of 4616	2192	msedge.exe	100
PID 2192 wrote to memory of 5212	2192	msedge.exe	101
PID 2192 wrote to memory of 5212	2192	msedge.exe	101
PID 2192 wrote to memory of 1956	2192	msedge.exe	105
PID 2192 wrote to memory of 4584	2192	msedge.exe	106
PID 2192 wrote to memory of 1956	2192	msedge.exe	105
PID 2192 wrote to memory of 4584	2192	msedge.exe	106
PID 2192 wrote to memory of 5968	2192	msedge.exe	108
PID 5324 wrote to memory of 5388	5324	bztrmjebztrmjgec.exe	109
PID 2192 wrote to memory of 4812	2192	msedge.exe	111
PID 2192 wrote to memory of 4812	2192	msedge.exe	111
PID 2812 wrote to memory of 2772	2812	mheywrojhb.exe	114
PID 2192 wrote to memory of 4488	2192	msedge.exe	118
PID 2192 wrote to memory of 4488	2192	msedge.exe	118
PID 5324 wrote to memory of 4520	5324	bztrmjebztrmjgec.exe	119
PID 5324 wrote to memory of 1588	5324	bztrmjebztrmjgec.exe	123
PID 4140 wrote to memory of 5284	4140	jgbywqojdb.exe	125
PID 5324 wrote to memory of 4772	5324	bztrmjebztrmjgec.exe	128
PID 5324 wrote to memory of 1328	5324	bztrmjebztrmjgec.exe	132
PID 4176 wrote to memory of 3044	4176	wigdyvtqoi.exe	134
PID 5324 wrote to memory of 5708	5324	bztrmjebztrmjgec.exe	137
PID 5324 wrote to memory of 1728	5324	bztrmjebztrmjgec.exe	142
PID 1792 wrote to memory of 2312	1792	lgdywqoiga.exe	144
PID 5324 wrote to memory of 1324	5324	bztrmjebztrmjgec.exe	147
PID 2192 wrote to memory of 3444	2192	msedge.exe	149
PID 2192 wrote to memory of 1228	2192	msedge.exe	150
PID 2192 wrote to memory of 1348	2192	msedge.exe	151
PID 5324 wrote to memory of 5300	5324	bztrmjebztrmjgec.exe	154
PID 916 wrote to memory of 5992	916	qkigayvtnl.exe	156
PID 5324 wrote to memory of 2292	5324	bztrmjebztrmjgec.exe	159
PID 5324 wrote to memory of 2624	5324	bztrmjebztrmjgec.exe	163
PID 3012 wrote to memory of 1096	3012	cxvpkhfaxs.exe	165
PID 5324 wrote to memory of 4312	5324	bztrmjebztrmjgec.exe	168
PID 5324 wrote to memory of 5776	5324	bztrmjebztrmjgec.exe	172
PID 3004 wrote to memory of 4332	3004	nkeczxupmk.exe	174
PID 5324 wrote to memory of 3264	5324	bztrmjebztrmjgec.exe	177
PID 5324 wrote to memory of 2596	5324	bztrmjebztrmjgec.exe	181
PID 616 wrote to memory of 4400	616	usmkfzxrpm.exe	183
PID 5324 wrote to memory of 4064	5324	bztrmjebztrmjgec.exe	186
PID 2192 wrote to memory of 1140	2192	msedge.exe	188
PID 2192 wrote to memory of 1140	2192	msedge.exe	188
PID 5324 wrote to memory of 4844	5324	bztrmjebztrmjgec.exe	194
PID 3512 wrote to memory of 5736	3512	ecwurmjhbz.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_48d7a0a820de523ad84bb728243f1fed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Temp\bztrmjebztrmjgec.exe
  C:\Temp\bztrmjebztrmjgec.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5324
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mheywrojhb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5388
  - - C:\Temp\mheywrojhb.exe
      C:\Temp\mheywrojhb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2812
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2772
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4852
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mheywrojhb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4520
  - - C:\Temp\i_mheywrojhb.exe
      C:\Temp\i_mheywrojhb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgbywqojdb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1588
  - - C:\Temp\jgbywqojdb.exe
      C:\Temp\jgbywqojdb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4140
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5284
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2532
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgbywqojdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4772
  - - C:\Temp\i_jgbywqojdb.exe
      C:\Temp\i_jgbywqojdb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5768
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wigdyvtqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1328
  - - C:\Temp\wigdyvtqoi.exe
      C:\Temp\wigdyvtqoi.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4176
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3044
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1036
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wigdyvtqoi.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5708
  - - C:\Temp\i_wigdyvtqoi.exe
      C:\Temp\i_wigdyvtqoi.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1144
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lgdywqoiga.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1728
  - - C:\Temp\lgdywqoiga.exe
      C:\Temp\lgdywqoiga.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1792
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2312
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lgdywqoiga.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1324
  - - C:\Temp\i_lgdywqoiga.exe
      C:\Temp\i_lgdywqoiga.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qkigayvtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5300
  - - C:\Temp\qkigayvtnl.exe
      C:\Temp\qkigayvtnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:916
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5992
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5768
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qkigayvtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2292
  - - C:\Temp\i_qkigayvtnl.exe
      C:\Temp\i_qkigayvtnl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cxvpkhfaxs.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2624
  - - C:\Temp\cxvpkhfaxs.exe
      C:\Temp\cxvpkhfaxs.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3012
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1096
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5820
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cxvpkhfaxs.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4312
  - - C:\Temp\i_cxvpkhfaxs.exe
      C:\Temp\i_cxvpkhfaxs.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1848
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkeczxupmk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5776
  - - C:\Temp\nkeczxupmk.exe
      C:\Temp\nkeczxupmk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3004
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4332
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6080
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkeczxupmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3264
  - - C:\Temp\i_nkeczxupmk.exe
      C:\Temp\i_nkeczxupmk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4204
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usmkfzxrpm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2596
  - - C:\Temp\usmkfzxrpm.exe
      C:\Temp\usmkfzxrpm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:616
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4400
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3504
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usmkfzxrpm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4064
  - - C:\Temp\i_usmkfzxrpm.exe
      C:\Temp\i_usmkfzxrpm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4764
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwurmjhbz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4844
  - - C:\Temp\ecwurmjhbz.exe
      C:\Temp\ecwurmjhbz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3512
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5736
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1848
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwurmjhbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3336
  - - C:\Temp\i_ecwurmjhbz.exe
      C:\Temp\i_ecwurmjhbz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1496
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ztrljebwto.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2128
  - - C:\Temp\ztrljebwto.exe
      C:\Temp\ztrljebwto.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2932
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5580
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:548
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ztrljebwto.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4452
  - - C:\Temp\i_ztrljebwto.exe
      C:\Temp\i_ztrljebwto.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3504
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqoigdbytq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4764
  - - C:\Temp\tqoigdbytq.exe
      C:\Temp\tqoigdbytq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1664
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1144
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqoigdbytq.exe ups_ins
    3⤵
    PID:4388
  - - C:\Temp\i_tqoigdbytq.exe
      C:\Temp\i_tqoigdbytq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ytqlidbvtn.exe ups_run
    3⤵
    PID:5796
  - - C:\Temp\ytqlidbvtn.exe
      C:\Temp\ytqlidbvtn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:708
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4600
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6024
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ytqlidbvtn.exe ups_ins
    3⤵
    PID:2936
  - - C:\Temp\i_ytqlidbvtn.exe
      C:\Temp\i_ytqlidbvtn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5228
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqnigaysqk.exe ups_run
    3⤵
    PID:2040
  - - C:\Temp\sqnigaysqk.exe
      C:\Temp\sqnigaysqk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1244
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5268
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4132
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqnigaysqk.exe ups_ins
    3⤵
    PID:2436
  - - C:\Temp\i_sqnigaysqk.exe
      C:\Temp\i_sqnigaysqk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5820
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ifaxvqkica.exe ups_run
    3⤵
    PID:5900
  - - C:\Temp\ifaxvqkica.exe
      C:\Temp\ifaxvqkica.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1924
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5940
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5788
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ifaxvqkica.exe ups_ins
    3⤵
    PID:5380
  - - C:\Temp\i_ifaxvqkica.exe
      C:\Temp\i_ifaxvqkica.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1192
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kicsmkecxu.exe ups_run
    3⤵
    PID:4804
  - - C:\Temp\kicsmkecxu.exe
      C:\Temp\kicsmkecxu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5056
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5852
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kicsmkecxu.exe ups_ins
    3⤵
    PID:1544
  - - C:\Temp\i_kicsmkecxu.exe
      C:\Temp\i_kicsmkecxu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2400
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ausmkecxup.exe ups_run
    3⤵
    PID:1084
  - - C:\Temp\ausmkecxup.exe
      C:\Temp\ausmkecxup.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1576
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5068
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4136
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ausmkecxup.exe ups_ins
    3⤵
    PID:4624
  - - C:\Temp\i_ausmkecxup.exe
      C:\Temp\i_ausmkecxup.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6136
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\upmhezxupm.exe ups_run
    3⤵
    PID:1268
  - - C:\Temp\upmhezxupm.exe
      C:\Temp\upmhezxupm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2680
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4100
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5500
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_upmhezxupm.exe ups_ins
    3⤵
    PID:5540
  - - C:\Temp\i_upmhezxupm.exe
      C:\Temp\i_upmhezxupm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2580
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljhezwuomj.exe ups_run
    3⤵
    PID:3816
  - - C:\Temp\ljhezwuomj.exe
      C:\Temp\ljhezwuomj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5116
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1844
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljhezwuomj.exe ups_ins
    3⤵
    PID:6024
  - - C:\Temp\i_ljhezwuomj.exe
      C:\Temp\i_ljhezwuomj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5848
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdbzlgebw.exe ups_run
    3⤵
    PID:1224
  - - C:\Temp\ljdbzlgebw.exe
      C:\Temp\ljdbzlgebw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:796
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4304
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5216
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdbzlgebw.exe ups_ins
    3⤵
    PID:4768
  - - C:\Temp\i_ljdbzlgebw.exe
      C:\Temp\i_ljdbzlgebw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4636
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x2c8,0x7ffab109c188,0x7ffab109c194,0x7ffab109c1a0
      4⤵
      PID:4856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2168,i,4100889888646358310,2824162200699046346,524288 --field-trial-handle=2476,i,969610957371867997,18182889179978248198,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:11
      4⤵
      System Time Discovery
      PID:552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1896,i,11637053857145964657,14951223399757110798,262144 --field-trial-handle=2476,i,969610957371867997,18182889179978248198,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:2
      4⤵
      PID:5816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2384,i,3527695374974383104,4050974606813782294,524288 --field-trial-handle=2476,i,969610957371867997,18182889179978248198,262144 --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:13
      4⤵
      PID:3216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3608,i,1848568583367956715,8346198515767681796,2097152 --field-trial-handle=2476,i,969610957371867997,18182889179978248198,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      PID:4844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3620,i,1863035679591348693,6079502252762250897,2097152 --field-trial-handle=2476,i,969610957371867997,18182889179978248198,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
      4⤵
      PID:4288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,10515528585371008031,6098988485345874991,2097152 --field-trial-handle=2476,i,969610957371867997,18182889179978248198,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:1
      4⤵
      PID:2720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4356,i,17308101918653180612,9723155470051599185,2097152 --field-trial-handle=2476,i,969610957371867997,18182889179978248198,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:9
      4⤵
      PID:4616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,2802399339704891305,10470096943605320808,524288 --field-trial-handle=2476,i,969610957371867997,18182889179978248198,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
      4⤵
      PID:5212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,13477244393451046407,15531364114309209505,524288 --field-trial-handle=2476,i,969610957371867997,18182889179978248198,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:14
      4⤵
      PID:1956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,18135272700606566275,3477615797660154283,524288 --field-trial-handle=2476,i,969610957371867997,18182889179978248198,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:14
      4⤵
      PID:4584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,18160725316491523013,5382423950200731784,524288 --field-trial-handle=2476,i,969610957371867997,18182889179978248198,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
      4⤵
      PID:2376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,18160725316491523013,5382423950200731784,524288 --field-trial-handle=2476,i,969610957371867997,18182889179978248198,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
      4⤵
      PID:5968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,13876239791015713307,7879136770373818791,524288 --field-trial-handle=2476,i,969610957371867997,18182889179978248198,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
      4⤵
      PID:4812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,11193990942985015105,7555835207399252196,524288 --field-trial-handle=2476,i,969610957371867997,18182889179978248198,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
      4⤵
      PID:4488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1412,i,6833565517526168472,1438816580009566623,524288 --field-trial-handle=2476,i,969610957371867997,18182889179978248198,262144 --variations-seed-version --mojo-platform-channel-handle=1272 /prefetch:14
      4⤵
      PID:3444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1428,i,14938413793164494677,7609922135732035391,524288 --field-trial-handle=2476,i,969610957371867997,18182889179978248198,262144 --variations-seed-version --mojo-platform-channel-handle=752 /prefetch:14
      4⤵
      PID:1228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1444,i,8067129959689648433,10285621510370973270,524288 --field-trial-handle=2476,i,969610957371867997,18182889179978248198,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:14
      4⤵
      PID:1348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,7877769971889433943,996408093298306147,524288 --field-trial-handle=2476,i,969610957371867997,18182889179978248198,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:14
      4⤵
      PID:1140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,522858226886940113,14831938200760550154,524288 --field-trial-handle=2476,i,969610957371867997,18182889179978248198,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:14
      4⤵
      PID:5972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,4844333929849750453,16851366707384135172,524288 --field-trial-handle=2476,i,969610957371867997,18182889179978248198,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:14
      4⤵
      PID:5940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,14124078425859836673,9232070121265048107,524288 --field-trial-handle=2476,i,969610957371867997,18182889179978248198,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:14
      4⤵
      PID:4840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6504,i,17290111196179326011,6320548141447546314,262144 --field-trial-handle=2476,i,969610957371867997,18182889179978248198,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:10
      4⤵
      PID:5864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4804,i,3355499442672487963,11413233323855075377,524288 --field-trial-handle=2476,i,969610957371867997,18182889179978248198,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
      4⤵
      PID:4180

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:264

C:\Temp\bztrmjebztrmjgec.sys
C:\Temp\bztrmjebztrmjgec.sys
1⤵
- Executes dropped EXE
PID:3340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1112

C:\Temp\wromgeuolg.sys
C:\Temp\wromgeuolg.sys
1⤵
- Executes dropped EXE
PID:1728

C:\Temp\btrljdbvto.sys
C:\Temp\btrljdbvto.sys
1⤵
- Executes dropped EXE
PID:1140

C:\Temp\tqlidbvtnl.sys
C:\Temp\tqlidbvtnl.sys
1⤵
- Executes dropped EXE
PID:3556

C:\Temp\vpnlidaysq.sys
C:\Temp\vpnlidaysq.sys
1⤵
- Executes dropped EXE
PID:3904

C:\Temp\kfaxvpnhfa.sys
C:\Temp\kfaxvpnhfa.sys
1⤵
- Executes dropped EXE
PID:6012

C:\Temp\vpnhfcausm.sys
C:\Temp\vpnhfcausm.sys
1⤵
- Executes dropped EXE
PID:1908

C:\Temp\urpkhcausm.sys
C:\Temp\urpkhcausm.sys
1⤵
- Executes dropped EXE
PID:3484

C:\Temp\mkecwurmjh.sys
C:\Temp\mkecwurmjh.sys
1⤵
- Executes dropped EXE
PID:3556

C:\Temp\bztrmjebwu.sys
C:\Temp\bztrmjebwu.sys
1⤵
- Executes dropped EXE
PID:3280

C:\Temp\bywtoljdbz.sys
C:\Temp\bywtoljdbz.sys
1⤵
- Executes dropped EXE
PID:5704

C:\Temp\bytqljgayt.sys
C:\Temp\bytqljgayt.sys
1⤵
PID:4392

C:\Temp\yvtnlfdyvt.sys
C:\Temp\yvtnlfdyvt.sys
1⤵
PID:3144

C:\Temp\sqdavsnkfd.sys
C:\Temp\sqdavsnkfd.sys
1⤵
PID:3776

C:\Temp\khfaxvpnkf.sys
C:\Temp\khfaxvpnkf.sys
1⤵
PID:5532

C:\Temp\czxrpnhfzx.sys
C:\Temp\czxrpnhfzx.sys
1⤵
PID:1284

C:\Temp\zwupmhfzur.sys
C:\Temp\zwupmhfzur.sys
1⤵
PID:4976

C:\Temp\trpjzwuomg.sys
C:\Temp\trpjzwuomg.sys
1⤵
PID:5972

C:\Temp\rojhbztrlj.sys
C:\Temp\rojhbztrlj.sys
1⤵
PID:1136

C:\Temp\jdbywtoljd.sys
C:\Temp\jdbywtoljd.sys
1⤵
PID:1112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

btrljdbvto.sys

Path C:\Temp\btrljdbvto.sys
Size 293KB
SHA256 08466013f44f8a6f67ba9ff2daabc1a41fc1957d35bc1d08908161e6de65c42b
MD5 c1f362b2a3a34bfbc44a22263f761b62
SHA1 1e81d47a785c639f8c47446a49a1d871f96be771
SHA512 19d4eeffc0a0df51346b1bda12016b76701d7c35d0269c7b1dd0b9cad19b7c37ad0cbefd7e280d1a29c4151dd7ad72da26c494799020a0e1cfb6e669675df3cc
SSDEEP 3072:ctKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:cIJjiJcbI03GBc3ucY5DCSj
TLSH
T147545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztrmjebztrmjgec.exe

Path C:\Temp\bztrmjebztrmjgec.exe
Size 722KB
SHA256 09a08b07ffd4c65a6a151301364bbf2d0369f1f7cdc3fe793bd01a36dc5bacab
MD5 66df6b631f8b0ff539637bca9577479d
SHA1 381d34ed966b6c27518e90f12ec08cef47989f2d
SHA512 02ad02b1e3ee74dc2dce2bc92fa3860373af3863d1a3f89e45dcbb8a1f9541b4f03b807358292924dc969f5d73184ffb595bd84153fe223d8ec41629093d375f
SSDEEP 12288:hflfAsiVGjSGecvXAflfAsiVGjSGecvX:JMcfcMcf
TLSH
T1BDF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztrmjebztrmjgec.sys

Path C:\Temp\bztrmjebztrmjgec.sys
Size 293KB
SHA256 9311f89d6844ebb374a1800394b0b097b2e23b72067856e916b5950916a3fa33
MD5 21ab203c42977176daac824ee71ebd32
SHA1 6247f28d21ac852a8cbdc1a2c86d1a7a6f24be52
SHA512 d138cc08a70267fb72f943090f4b37d0601a72052bb48cdc6567f3ed56eb0b8092c19f12813f3731c53c10805dd172464b72b37ae8dfc03d134901f05b6c2c45
SSDEEP 3072:itKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:iIJjiJcbI03GBc3ucY5DCSj
TLSH
T10D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxvpkhfaxs.exe

Path C:\Temp\cxvpkhfaxs.exe
Size 722KB
SHA256 58611a458949a5fa542c46df9fc02360b1622d55e96eaec71ffd98a48dec1e4d
MD5 764a4d58dac87d075f5be1fe365344f6
SHA1 8fcf58440cb8cb4b7d1e3ed0403bcbaf39c84a1e
SHA512 a509d89403ba6b76e8d989e0f5492aeb1e6817cb4e22f8595b8190da828209e783f34a1f5b2e7b52aa592f51e649d7c1075e6b299b68ab8827b8e28b088d9537
SSDEEP 12288:7flfAsiVGjSGecvXAflfAsiVGjSGecvX:TMcfcMcf
TLSH
T18CF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jgbywqojdb.exe

Path C:\Temp\i_jgbywqojdb.exe
Size 722KB
SHA256 4b71a26e115a72daf3c89d70131e159b0b333267e63725098eb07abe91bbd2c8
MD5 d2cc0bc2730f082ac9f4d71b01773ca2
SHA1 8f07589cf53392f7cc03d345f26b5d649d3caf56
SHA512 ffa28dbc67846fd5912861d1998d093b652afc1de36990b2eb0b6f1544864c66d5b57ee0e8159f6df3eeda91b1797ac7ae7fbed47abaa775e03a9a96111f1ed2
SSDEEP 12288:WflfAsiVGjSGecvXAflfAsiVGjSGecvX:CMcfcMcf
TLSH
T1B1F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lgdywqoiga.exe

Path C:\Temp\i_lgdywqoiga.exe
Size 722KB
SHA256 c4f31e5f0015ee109e75d70cd19598add12ef3240e8640834a62f17afdeff2ea
MD5 faab5f38545248e5484321f1783d2431
SHA1 dbb9a411b70a5906e1d8143c185f00059f6e5d33
SHA512 9bcf5262348eae0f481eb0a68833c7283fa5154c2fc4f4285bfa9c5f883dc8af13e5cc98c878b6741d30dde0bdc3a41b8f2664876d46163df8f5353709684b22
SSDEEP 12288:gflfAsiVGjSGecvXAflfAsiVGjSGecvX:8McfcMcf
TLSH
T1B7F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mheywrojhb.exe

Path C:\Temp\i_mheywrojhb.exe
Size 722KB
SHA256 0a8182c2def0fd6e6100fb1ef6621776e7ec096341479ec9939acc5231f7cbc8
MD5 61c420356b57466bbeb5197b2af130be
SHA1 ecaa3819d4d2b7b82f116e63c06b3df03a9b7cfd
SHA512 0e50851cac93c9c15d65b7b1ca615aab3c270572e9022418b03c1dd3068ae26c45e31d5eb28af13fd37f94bfc6c63a375ba9f5aec94f0663f432acbd7a654c4f
SSDEEP 12288:MflfAsiVGjSGecvXAflfAsiVGjSGecvX:YMcfcMcf
TLSH
T12AF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qkigayvtnl.exe

Path C:\Temp\i_qkigayvtnl.exe
Size 722KB
SHA256 95bfeb05ec398d92ff678d784ea7f237ca010af1b48102b1a0775414b8de5e24
MD5 082e54c0f4e11d5dcc176179d01a4b9c
SHA1 91f51c6b1cf29916d57344c600a206b4cbe6525c
SHA512 374c3c537967b1cac43cdf227c8767d602f1aff5d8f490ef078bebc209de820df21c5dc0835d63ed2431c37be6780fb6df981d56b4dbf4a48d75aa19b3c6ebcb
SSDEEP 12288:8flfAsiVGjSGecvXAflfAsiVGjSGecvX:oMcfcMcf
TLSH
T126F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wigdyvtqoi.exe

Path C:\Temp\i_wigdyvtqoi.exe
Size 722KB
SHA256 675b401d1e0de83289e091b63ce00086f82b6eb4947ff620cc394b97eaec6ebf
MD5 3b5e4eb77610020a15928c5d40917b58
SHA1 113a0c0db1083101e96c097562090299c3488926
SHA512 61f3bf2363b762a06ecb6d0e020771288e5b25607813bd79d5637706f09239771efdc89a285cf078fd8456c3adcd6958a8b7648a6c372c79f8fbca3899ecb956
SSDEEP 12288:RflfAsiVGjSGecvXAflfAsiVGjSGecvX:ZMcfcMcf
TLSH
T12DF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgbywqojdb.exe

Path C:\Temp\jgbywqojdb.exe
Size 722KB
SHA256 342be4bb78f2b82e809c1d9e9533b5def325af341fa93599374c43062bfa208c
MD5 77ccbe825c06f947fac6ac45e78ec6fe
SHA1 37168440445c349e28d019de5c67beadfb928440
SHA512 d428283653afcd37a41b8827c38709927fe7cd674baeafe269ca0356fb29ce142c3207c966a80626f25471b563bc4a58e767382ac9b8cf9da97fd8800e856779
SSDEEP 12288:mflfAsiVGjSGecvXAflfAsiVGjSGecvX:yMcfcMcf
TLSH
T10BF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfaxvpnhfa.sys

Path C:\Temp\kfaxvpnhfa.sys
Size 293KB
SHA256 6cef14ccb12d94ec6540a3648ebd0aef3b6928c9e481ebfe5d9af77e504e6ee3
MD5 ffa9f75df18325977127bde4ed31be7b
SHA1 ec2904399b618575a2803b347ec7c4dd471b1dc2
SHA512 377907c0745a15f17a3c800db68e97b86f92989bd02914747ff6728bd1fe75b2cfe738ec9b19c59f8ef75c1b23a3f77f73d8ab029ac4080e7d68d5078d38fd15
SSDEEP 3072:1tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:1IJjiJcbI03GBc3ucY5DCSj
TLSH
T117545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgdywqoiga.exe

Path C:\Temp\lgdywqoiga.exe
Size 722KB
SHA256 24c26aa525d6e0367d59eb8195aabf65f7b80d66f2b849fb195e78cdec1febc8
MD5 11e58dbdd2d3e80a2527f776f667b96a
SHA1 2ef072ca35771fe9de2bcdcce2971f9665bf9ade
SHA512 09d600eb1bcc25eaf57692697ae499f2308cca3641a6044b80628fd5a863a123679f34234e2678dc9492d0de626a37d5d0ba2267ba26a05c52b6d9abea843769
SSDEEP 12288:FflfAsiVGjSGecvXAflfAsiVGjSGecvX:NMcfcMcf
TLSH
T105F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mheywrojhb.exe

Path C:\Temp\mheywrojhb.exe
Size 722KB
SHA256 38aa525b4433c2de776b2e5b3e354f0f19c674700625b7b1b07f962420b0f5a6
MD5 d25cceeb725da960ade9ec944b2248ce
SHA1 5a5d9af6c9d8379cd7a04f3aef330b601c29bde2
SHA512 1766d3acbc4d8371e3d18a37ab5b70e89a359bfa3661aa6ff0450c5c5a074bf92c1c5f05c825d023dba2a06f1115e72e7b131d6283847f8c88e6fc23fab5f916
SSDEEP 12288:LflfAsiVGjSGecvXAflfAsiVGjSGecvX:DMcfcMcf
TLSH
T1FEF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkigayvtnl.exe

Path C:\Temp\qkigayvtnl.exe
Size 722KB
SHA256 976ddb4b36b1106e708c7c6b6b507e8f03264bf84c35a84e940849eebe5b0778
MD5 6979ffab801d23f3dd1a06805f431000
SHA1 05845b9ba7a1d761151ef8c40a16a7d113139258
SHA512 4588af0ee6da5e72ea2615db91da4b37224281814d9ab1794bcce83716f310bafff95040bd51e4391feebfc3e80f12899210d445fd62ff5b900658d426445aa6
SSDEEP 12288:JflfAsiVGjSGecvXAflfAsiVGjSGecvX:BMcfcMcf
TLSH
T144F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqlidbvtnl.sys

Path C:\Temp\tqlidbvtnl.sys
Size 293KB
SHA256 1726cf7f12d6c9f2edf2d55e1b4d6230f900804dac76868e35e1a9ba60c8a760
MD5 5d6d860b0875fef58970908b9c5c71da
SHA1 ea859df4766702d89b35669f5437b1f6d75f90ff
SHA512 8ea0cc156cc0828c11f8d947f5a3513c918a79962bc66f8bfe2d891e2ae10ea7c5026afd36943f94e2d4d0335ad10b7c6ee7d607a8dc67f1015e348a158f148b
SSDEEP 3072:HtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:HIJjiJcbI03GBc3ucY5DCSj
TLSH
T173545B44AAA4B0F6D9D5043C00EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpnlidaysq.sys

Path C:\Temp\vpnlidaysq.sys
Size 293KB
SHA256 54ace16d28eac4f34b423f3530bd083cfe02334c16a6a45627d6cc3554b0fda4
MD5 f22dffad9da193895339aef35b9be70b
SHA1 bdd2eb4edacf80502ff98f1930e3d9504f5d8e24
SHA512 7a489daf74d4d535d9238775f9ae5cceb82026c6b623c17658fe76ba6ffe8d418721fdfff6c9956a3c6e71419dd99146a14502fba0457d9ea120f4c841620d25
SSDEEP 3072:WtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:WIJjiJcbI03GBc3ucY5DCSj
TLSH
T11C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wigdyvtqoi.exe

Path C:\Temp\wigdyvtqoi.exe
Size 722KB
SHA256 8cb9564f741a164b57cff5997e6ef229a54e9522a7b322f9335a0ffcf9b9ce02
MD5 71d2effb712b953656c553ef1a004643
SHA1 59f6722709781585742fa5cae45bae2e0d1e17e4
SHA512 d23b92a349c94e517e318f92a46361cca0e91e2eb4cdc85659c3f04241e867e24c733765b6bb41c5d79f6c57c72e0b1e3a77f2d47551ab954e30b4f0c05044ed
SSDEEP 12288:YflfAsiVGjSGecvXAflfAsiVGjSGecvX:EMcfcMcf
TLSH
T16EF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wromgeuolg.sys

Path C:\Temp\wromgeuolg.sys
Size 293KB
SHA256 b8026fd2c2c802292b5326a25e36bb831f3917edb5f351e0e4f8115374ee1767
MD5 5624647e7ac6a20a90fa666a512a7a0a
SHA1 f12d2fd7f9b1a1a8980ead9363e57004258ad875
SHA512 80448ecbc9d53fc8abefeb1f8e01e41586fcc13dbb1509c0d879ee57a633c04ebfa61885b15b6a3bb52392023a593e46dd8933f8583be928c95acf519ab7e93b
SSDEEP 3072:PtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:PIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C4545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 965a370e59bc76dc8c091bd1029b8de8fd1805243ed1b80a5966cedc1937f40d
MD5 eb8d4501fac917baaa13ea6e86a891cb
SHA1 319dd0cbb9574dd9c40702d752585d27495772e7
SHA512 a8cfbcdec4e7d005fc3eae62432ca9cedde82d45d44300e32a0bf4ba5fcc297677d9f2a18b826f45e912b9156c5c5a799afd6030f18f19a1894b5cb39446d12f
TLSH
T11C41BA94C37168DBFBB4B9B123D2D59936F8A2588247EE51CC511C7AC907FB658C007B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 dd53a28f11ed7b28d0e4f010fdd6c70a3ebb3caaefd83396432dd281a0b14066
MD5 15563aedbd6573796aebb5f7b8a1b6b8
SHA1 87807a74a65abaae4d960078fa5b806dbed231ea
SHA512 6ea6cb52ea38c32c7c5b79dcccbfd7b6b4d17f476556b440f9cf1a87ccb21d1533700de17e6a340316401d60dbe8c4645b1b41a5c27c87671730c3b9d6a8417c
TLSH
T13F519FF3C2E8862D890156F4A7146E2BDE2D0914432C3D5AC9E4EF5BA3E2471D14155F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 5a920587aa6e91ea448559cf914f96da49c5f4cbf731a462605ddd52f693391f
MD5 12c57cf28cacb6cd608a6667cbb268c3
SHA1 ffea251000e513c3b355d9224f9964690cbf4426
SHA512 df0a20f5d4c2b332b796fbcaf7d0b223a6d7d6292f2bc2094a25644f993927bc01a0d0bfe10395eff958cee3f455a73bf282f9f33764c824df08f937e5c0011b
SSDEEP 192:sxRuJRECG/fKscpYZfSUozoA8p9B/g6+WNC1F/YD9zbSS+Ga/IgVcJ:sxRuJtG/fKscpm6SD/5+/USSUa
TLSH
T19042D855AD28A93B4CC7D21DBB26BF53D6F91132A1D41E48F6FC9A1C04EA7DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c9b3fa16fa1a4f86d102aec7df66e8e992215cde26de22cbe3cf5b6977c3a396
MD5 db4fd0538402022c948fa05447645dec
SHA1 288e3d57c2d23a5c4c90e736caa1dda7d60d7469
SHA512 ae3062c52566070e9921dc41fbf309644e65a545f9557b5d54a379e8b24c5108f0296ed653e29d5f99015f04d23f729796c6bc904ebaf3d3e125dd033ed204f6
SSDEEP 192:sxRueRECG/fKsapYZfSUozoA8p9B/g6+WNC1F/YD9zbSS+Ga/IgDwcJ:sxRuetG/fKsapm6SD/5+/USSUB
TLSH
T12442D755AD28693B4CCBD21DBB26BF53D6F91032A1D42E58B6FC9A1C04EB7CD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2a4ded7faa21eec31e1555dfd441b89694fd2cebe1745e029f5a41008c66c715
MD5 6108fb999d2e31fd4ae8a02e057987b4
SHA1 8cd510cdd51f17386fefd25d85771a541c88332c
SHA512 6772573962f4950b52feec1431901bd79d10d9e7f36964f47772fc12cafde53a7dd90b0b830a593037800851ffff55c9037270708c967523d733a8fe2c7f84c4
SSDEEP 192:sxRueRECG/fKsaUYZfSUozoA8p9B/g6+WNC1F/YD9qbSS+Ga/IgDCcJ:sxRuetG/fKsaUm6SD/5+/RSSU3
TLSH
T10442C755AD28693B5CCBD21DBB16BF53E2F91132A1D41E58A7FC9A1C04EB7CD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 009dc761c7268e4a0241ef308a898eb32bd372b43c6c1f1f4c3189e72ec6a866
MD5 5ba11abf8a68ffc201bb0a0be898f3ea
SHA1 4850a77cd29c1deae4492c33452f3d184a319684
SHA512 b1585419e82f74a3dc20b583ae0760b6aa2c97cd4951f982b6ddebc9c01560dee508bf8e0109296ff0e20c28f04bbdb33356b25e98cae8292737ea8290411dc8
SSDEEP 768:azfWML7pLuL7J0Wg/XfHf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDPYc16oropLIjt:azfWMdE7J0Wg/XfHfu1jacPYy6TpLw
TLSH
T1B0D2EA7B240CCE7F4F804A9DAD197EDF6DA802CB9698CD5047FE941C02C6BEA52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2b564fd02d032911ac0522243e5c2a19dc727a9ff05a51bada7a45ac41a8a322
MD5 16b6ff7d34e626fe373261e86e106a2e
SHA1 28df6df9454b9cb74c280c55254091180353d0b3
SHA512 57ec590cc283667321a816cc714a7655558ac30754bbfc941b126f3b4faac592060500196c970cfbef129a0e5d0ee4948d726b50b1ade9915aeb5781c54f7eeb
SSDEEP 96:KR+zC+4AwmWgFNg+mK4jg8mc2edse3HB+PrZ7/LWPM6gTLK4ygdLcBpk3qEgKtmq:C+zC+4AwRgFe+ujg8V2edse3HB+PrZ7t
TLSH
T19591E615317B42D0397E695881E98C1B93C278B27218F42B7B9802DB5F6BE534EFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a2442.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a2442.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c9b48eee5a8efc64939e0d221c4f73500941eec72b5cdb8da125469b9fa231d9
MD5 a5407754d3c716978a3b702306353f63
SHA1 3bce1120b3485344c2480f15a0fd09aecd02f7e6
SHA512 4de987b9a793925602e78f056bed01d3bafa453c32b35b3b4d8d9ec7f5f6cdc7c9b4b8aab464677bbd0da202c69d3b8a2142fb7745eb4c4020593315df79ee30
SSDEEP 768:lk3ygUi0nDrEnjN3Gac1F82M2ewBKZOa/:lk3y9DQnjMa72evZh
TLSH
T1BEF2AF702D69DCB34CEAE346B5437743AEF456A3D4D40AA8DADDAB0C15836D8270FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 7d67af0b4bc4ca00ff04973a0975b04a21b4a3a05a3508a8e94bd59824dd686b
MD5 2bda85a3f8ff453be66ccde6364433d8
SHA1 f7b33f85cac2cb8298614630e71c6029e5022fbc
SHA512 b73c3308dc124cf0e5e39ba95ef71d233cc374538aa0426757b1a6d11ad5ca3ee27f96e9d437b7c1db0d7ccee59cd2912875ddd05fec55ba18dd4456c473b149
SSDEEP 768:rrv+4UNbdS3Ami0nLrEnjN3Gac1ZeeVH1SCz:rbsbg33LQnjMaVEH1V
TLSH
T19903CF3269A89EB38CEBE38571877A037FF4525385940BA4C6CD6B0D06DB9DC130B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 5e50565aa83a72eef6abf350dcc39d1ea609d3e7a075c5bd79651a4de779cba9
MD5 fd2353e47a18bab34bb9edcda528786e
SHA1 fc4866310f2b3e3a7e453172453a6072d8255470
SHA512 b3f9ebd88e1147ffd94b14ea14f1fc82e9b60a5ec45c3e688ef10282f984e28e2aa2a142b12f20308ac9f1d3f143f3201d6aef9996824e08ad2e6306b616ce85
SSDEEP 768:Kk35gUi0nDrEnjN3Gac1F82M2ewBKZOa/:Kk359DQnjMa72evZh
TLSH
T1D8F2AF702C69DCB34CEAE346B5437743AEF456A3D4D40AA8DADDAB0C15836D8270FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 3c3a403c9de02468d344ae8c4bd86d6c9386e3c9e06a21fa68a08425664a39c9
MD5 c3e30c5af78b8fc3609114c58325a707
SHA1 14c843b98d456f6a41c38982ce94fe421e7b070d
SHA512 caff51ca1d644539ffc226316f7738dad48fd9449a730fec92be9536dd7fb623ca73132e7f167d51d184905b705bcddd7adf869ef841d62731859f5dfd942cd7
SSDEEP 768:Prv+4UNbdP3yaUi0nDrEnjN3Gac1F82M2ewBKZOaa:Pbsbx3yjDQnjMa72evZE
TLSH
T1BF13BF71796CDDB34DEAE285B147B643BFB4169388D40AA8DAC96B0C16875D9230FC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 74e1ce2798ee8bcda4f8cff82afe7a0863030e719caf35ea76e5e2ef4adc4703
MD5 09d3cf76be02b8263e979615d21d8eb0
SHA1 9ace78272d0b696f156fb75bf2f5f322871d32d8
SHA512 ebe25ad6e7a229d11c9a7b83f6b3c9eb2321f00153e5c1dfac38586c0413861b94fe71a27d77145fb78224d5b0b1fe3a6247dd612f2e3b61c85f4d3b593dcfc5
SSDEEP 768:TFQK3DwgVlWsnvrEnjN3Gac1F82M2ewBKZOa/:2K3rNvQnjMa72evZh
TLSH
T1FF1328F598E78977D8EE9383673E6E4299BCC253B4944994B7C85D0CCC825BFD30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2192_1522224134\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 bfa9c567d88084c90e5759d9eb7bae88343c836ad91b9a9e9f4f31b344ac6d71
MD5 b40f49496551d0f6e585356c8bb07006
SHA1 02559fac57fd4beab5d72e0d151824ab281ebd95
SHA512 84a6edc03a0fa5769c6a999db58f1e5f44a510456164a959c7a0b76153b329585c68645d0f0ea34fb8334cce2bd9e08dced43a02d9c1aea8c37e5ce6ac45eb89
TLSH
T13D71008356B9C5F2C1DA9FF402835248F5FB22380B63303547515556AA30A7A28B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1112-496-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1136-492-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1140-237-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1284-449-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1728-189-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1908-312-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3144-426-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3144-405-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3280-339-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3340-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3484-316-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3556-331-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3556-362-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3556-280-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3556-262-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3776-417-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3904-274-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4392-392-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4976-467-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5532-429-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5704-365-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5972-472-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6012-287-0x0000000000010000-0x00000000000AB000-memory.dmp

Download