a6307df6538f54a50f9e5745dacd782695e816775c4e7f2f46add413b8e402f8

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 722KB
Sample260809-vs627abe86
SHA256 a6307df6538f54a50f9e5745dacd782695e816775c4e7f2f46add413b8e402f8
MD5 07c1c31ecb8dd9ed905587d71701f0e5
SHA1 5378827e8a52edbcd43c06ef57ff235c41484117
SHA512 ef817213542792d7c2b2ad2534b0c4a97a15b1c1949b0c4449c21000dd19a97062c328f2ed29d1070f9a44b04e947144595430516ffd3743906730fe4e67ebdd
SSDEEP 12288:/flfAsiVGjSGecvXAflfAsiVGjSGecvX:nMcfcMcf
TLSH
T139F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1408	pjhbztrmjebwromj.exe
1084	pjhbztrmjebwromj.sys
4448	CreateProcess.exe
4452	rljebzwrpj.exe
6736	CreateProcess.exe
3268	CreateProcess.exe
5332	i_rljebzwrpj.exe
6308	rljebwuomg.sys
1528	CreateProcess.exe
848	eywqojgeyw.exe
4840	CreateProcess.exe
6872	CreateProcess.exe
7096	i_eywqojgeyw.exe
6920	bwqojgbytq.sys
7156	CreateProcess.exe
2732	olgdywqoig.exe
1940	CreateProcess.exe
7028	CreateProcess.exe
6976	i_olgdywqoig.exe
4828	gaytqljdbv.sys
5028	CreateProcess.exe
6276	ytqlidbvtq.exe
5436	CreateProcess.exe
5284	CreateProcess.exe
6900	i_ytqlidbvtq.exe
1188	fdxvqnifda.sys
3004	CreateProcess.exe
1888	aysqkifdav.exe
3116	CreateProcess.exe
6164	CreateProcess.exe
3220	i_aysqkifdav.exe
6040	qkifaxspki.sys
3660	CreateProcess.exe
2112	nkicauskic.exe
3152	CreateProcess.exe
2180	CreateProcess.exe
5984	i_nkicauskic.exe
2184	ausnkfcaus.sys
6956	CreateProcess.exe
2976	rpnhfzxrpk.exe
5560	CreateProcess.exe
5336	CreateProcess.exe
1484	i_rpnhfzxrpk.exe
6516	xrpjhczusm.sys
1796	CreateProcess.exe
3204	rpmhecaurm.exe
1504	CreateProcess.exe
5988	CreateProcess.exe
1700	i_rpmhecaurm.exe
6980	urmkecwuom.sys
2808	CreateProcess.exe
7064	pjhbzurmke.exe
4548	CreateProcess.exe
4884	CreateProcess.exe
4240	i_pjhbzurmke.exe
6968	jhbztrmjeb.sys
6044	CreateProcess.exe
2680	hbztrojgey.exe
1212	CreateProcess.exe
4764	CreateProcess.exe
6992	i_hbztrojgey.exe
3228	ojgdbwtolj.sys
5300	CreateProcess.exe
6216	qoigaywqoi.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6924_123258749\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6924_123258749\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6924_123258749\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6924_123258749\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6924_1696450488\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6924_1696450488\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6924_698220372\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6924_698220372\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6924_479241993\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6924_479241993\typosquatting_list.pb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpmhecaurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigaysqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspjhczuke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrljebwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytrljgbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytqlidbvtq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigaysqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bytrljgbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytqlidbvtq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqljdbnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axsqkicaxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causmkfcxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgdywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqkifdav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkicauskic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbztrojgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqljdbnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljebzwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywqojgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqkifdav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkicauskic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigaywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causmkfcxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhczurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgdywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpnhfzxrpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhbzurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhbzurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbztrojgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigaywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhczurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrljebwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljebzwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpnhfzxrpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axsqkicaxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspjhczuke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhbztrmjebwromj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywqojgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpmhecaurm.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3560	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
6920	ipconfig.exe
4768	ipconfig.exe
340	ipconfig.exe
6284	ipconfig.exe
8	ipconfig.exe
936	ipconfig.exe
616	ipconfig.exe
4740	ipconfig.exe
4844	ipconfig.exe
4584	ipconfig.exe
928	ipconfig.exe
1544	ipconfig.exe
3096	ipconfig.exe
2828	ipconfig.exe
5908	ipconfig.exe
6484	ipconfig.exe
3280	ipconfig.exe
7072	ipconfig.exe
5536	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307693830626752"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{7874D7E3-C175-4686-A02B-6AEC81F3174F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1408	pjhbztrmjebwromj.exe
1408	pjhbztrmjebwromj.exe
1408	pjhbztrmjebwromj.exe
1408	pjhbztrmjebwromj.exe
1408	pjhbztrmjebwromj.exe
1408	pjhbztrmjebwromj.exe
1408	pjhbztrmjebwromj.exe
1408	pjhbztrmjebwromj.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
6924	msedge.exe
6924	msedge.exe
6924	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5332	i_rljebzwrpj.exe
Token: SeDebugPrivilege	7096	i_eywqojgeyw.exe
Token: SeDebugPrivilege	6976	i_olgdywqoig.exe
Token: SeDebugPrivilege	6900	i_ytqlidbvtq.exe
Token: SeDebugPrivilege	3220	i_aysqkifdav.exe
Token: SeDebugPrivilege	5984	i_nkicauskic.exe
Token: SeDebugPrivilege	1484	i_rpnhfzxrpk.exe
Token: SeDebugPrivilege	1700	i_rpmhecaurm.exe
Token: SeDebugPrivilege	4240	i_pjhbzurmke.exe
Token: SeDebugPrivilege	6992	i_hbztrojgey.exe
Token: SeDebugPrivilege	5060	i_qoigaywqoi.exe
Token: SeDebugPrivilege	6548	i_tqljdbnlfd.exe
Token: SeDebugPrivilege	3096	i_oigaysqlid.exe
Token: SeDebugPrivilege	4744	i_axsqkicaxv.exe
Token: SeDebugPrivilege	6340	i_causmkfcxu.exe
Token: SeDebugPrivilege	6812	i_xspjhczuke.exe
Token: SeDebugPrivilege	4972	i_pjhczurmke.exe
Token: SeDebugPrivilege	5156	i_bztrljebwt.exe
Token: SeDebugPrivilege	7116	i_bytrljgbyt.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6924	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6080 wrote to memory of 1408	6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 6080 wrote to memory of 6512	6080	2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	91
PID 6512 wrote to memory of 6924	6512	iexplore.exe	92
PID 6924 wrote to memory of 3108	6924	msedge.exe	93
PID 6924 wrote to memory of 5508	6924	msedge.exe	94
PID 6924 wrote to memory of 3560	6924	msedge.exe	95
PID 6924 wrote to memory of 5508	6924	msedge.exe	94
PID 6924 wrote to memory of 5508	6924	msedge.exe	94
PID 6924 wrote to memory of 1360	6924	msedge.exe	96
PID 6924 wrote to memory of 1360	6924	msedge.exe	96
PID 6924 wrote to memory of 768	6924	msedge.exe	97
PID 6924 wrote to memory of 768	6924	msedge.exe	97
PID 6924 wrote to memory of 1468	6924	msedge.exe	98
PID 6924 wrote to memory of 768	6924	msedge.exe	97
PID 6924 wrote to memory of 1468	6924	msedge.exe	98
PID 6924 wrote to memory of 1468	6924	msedge.exe	98
PID 1408 wrote to memory of 4448	1408	pjhbztrmjebwromj.exe	102
PID 6924 wrote to memory of 6224	6924	msedge.exe	104
PID 6924 wrote to memory of 6224	6924	msedge.exe	104
PID 6924 wrote to memory of 7112	6924	msedge.exe	105
PID 6924 wrote to memory of 7112	6924	msedge.exe	105
PID 6924 wrote to memory of 3724	6924	msedge.exe	108
PID 4452 wrote to memory of 6736	4452	rljebzwrpj.exe	109
PID 1408 wrote to memory of 3268	1408	pjhbztrmjebwromj.exe	114
PID 1408 wrote to memory of 1528	1408	pjhbztrmjebwromj.exe	118
PID 848 wrote to memory of 4840	848	eywqojgeyw.exe	120
PID 1408 wrote to memory of 6872	1408	pjhbztrmjebwromj.exe	123
PID 1408 wrote to memory of 7156	1408	pjhbztrmjebwromj.exe	127
PID 2732 wrote to memory of 1940	2732	olgdywqoig.exe	129
PID 1408 wrote to memory of 7028	1408	pjhbztrmjebwromj.exe	132
PID 1408 wrote to memory of 5028	1408	pjhbztrmjebwromj.exe	137
PID 6276 wrote to memory of 5436	6276	ytqlidbvtq.exe	139
PID 1408 wrote to memory of 5284	1408	pjhbztrmjebwromj.exe	142
PID 6924 wrote to memory of 6444	6924	msedge.exe	144
PID 6924 wrote to memory of 2340	6924	msedge.exe	145
PID 6924 wrote to memory of 1708	6924	msedge.exe	146
PID 1408 wrote to memory of 3004	1408	pjhbztrmjebwromj.exe	149
PID 1888 wrote to memory of 3116	1888	aysqkifdav.exe	151
PID 1408 wrote to memory of 6164	1408	pjhbztrmjebwromj.exe	154
PID 1408 wrote to memory of 3660	1408	pjhbztrmjebwromj.exe	158
PID 2112 wrote to memory of 3152	2112	nkicauskic.exe	160
PID 1408 wrote to memory of 2180	1408	pjhbztrmjebwromj.exe	163
PID 1408 wrote to memory of 6956	1408	pjhbztrmjebwromj.exe	167
PID 2976 wrote to memory of 5560	2976	rpnhfzxrpk.exe	169
PID 1408 wrote to memory of 5336	1408	pjhbztrmjebwromj.exe	172
PID 1408 wrote to memory of 1796	1408	pjhbztrmjebwromj.exe	176
PID 3204 wrote to memory of 1504	3204	rpmhecaurm.exe	178
PID 1408 wrote to memory of 5988	1408	pjhbztrmjebwromj.exe	181
PID 6924 wrote to memory of 2824	6924	msedge.exe	183
PID 6924 wrote to memory of 2824	6924	msedge.exe	183
PID 1408 wrote to memory of 2808	1408	pjhbztrmjebwromj.exe	188
PID 7064 wrote to memory of 4548	7064	pjhbzurmke.exe	190
PID 1408 wrote to memory of 4884	1408	pjhbztrmjebwromj.exe	193
PID 1408 wrote to memory of 6044	1408	pjhbztrmjebwromj.exe	197
PID 2680 wrote to memory of 1212	2680	hbztrojgey.exe	199
PID 6924 wrote to memory of 5724	6924	msedge.exe	202
PID 6924 wrote to memory of 5724	6924	msedge.exe	202
PID 1408 wrote to memory of 4764	1408	pjhbztrmjebwromj.exe	203
PID 1408 wrote to memory of 5300	1408	pjhbztrmjebwromj.exe	207
PID 6216 wrote to memory of 1188	6216	qoigaywqoi.exe	209
PID 1408 wrote to memory of 6940	1408	pjhbztrmjebwromj.exe	212
PID 1408 wrote to memory of 2500	1408	pjhbztrmjebwromj.exe	216
PID 2820 wrote to memory of 6612	2820	tqljdbnlfd.exe	218
PID 1408 wrote to memory of 2988	1408	pjhbztrmjebwromj.exe	221

C:\Users\Admin\AppData\Local\Temp\2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_07c1c31ecb8dd9ed905587d71701f0e5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6080
- C:\Temp\pjhbztrmjebwromj.exe
  C:\Temp\pjhbztrmjebwromj.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rljebzwrpj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4448
  - - C:\Temp\rljebzwrpj.exe
      C:\Temp\rljebzwrpj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4452
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6736
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:8
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rljebzwrpj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3268
  - - C:\Temp\i_rljebzwrpj.exe
      C:\Temp\i_rljebzwrpj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eywqojgeyw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1528
  - - C:\Temp\eywqojgeyw.exe
      C:\Temp\eywqojgeyw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:848
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4840
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:928
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eywqojgeyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6872
  - - C:\Temp\i_eywqojgeyw.exe
      C:\Temp\i_eywqojgeyw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:7096
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\olgdywqoig.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:7156
  - - C:\Temp\olgdywqoig.exe
      C:\Temp\olgdywqoig.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2732
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1940
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:936
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_olgdywqoig.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:7028
  - - C:\Temp\i_olgdywqoig.exe
      C:\Temp\i_olgdywqoig.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6976
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ytqlidbvtq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5028
  - - C:\Temp\ytqlidbvtq.exe
      C:\Temp\ytqlidbvtq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6276
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5436
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6484
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ytqlidbvtq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5284
  - - C:\Temp\i_ytqlidbvtq.exe
      C:\Temp\i_ytqlidbvtq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6900
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aysqkifdav.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3004
  - - C:\Temp\aysqkifdav.exe
      C:\Temp\aysqkifdav.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1888
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3116
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aysqkifdav.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6164
  - - C:\Temp\i_aysqkifdav.exe
      C:\Temp\i_aysqkifdav.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3220
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkicauskic.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3660
  - - C:\Temp\nkicauskic.exe
      C:\Temp\nkicauskic.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2112
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3152
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3280
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkicauskic.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2180
  - - C:\Temp\i_nkicauskic.exe
      C:\Temp\i_nkicauskic.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpnhfzxrpk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6956
  - - C:\Temp\rpnhfzxrpk.exe
      C:\Temp\rpnhfzxrpk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2976
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5560
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3096
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpnhfzxrpk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5336
  - - C:\Temp\i_rpnhfzxrpk.exe
      C:\Temp\i_rpnhfzxrpk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1484
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpmhecaurm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1796
  - - C:\Temp\rpmhecaurm.exe
      C:\Temp\rpmhecaurm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3204
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1504
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:7072
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpmhecaurm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5988
  - - C:\Temp\i_rpmhecaurm.exe
      C:\Temp\i_rpmhecaurm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1700
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhbzurmke.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2808
  - - C:\Temp\pjhbzurmke.exe
      C:\Temp\pjhbzurmke.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:7064
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4548
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:616
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjhbzurmke.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4884
  - - C:\Temp\i_pjhbzurmke.exe
      C:\Temp\i_pjhbzurmke.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hbztrojgey.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6044
  - - C:\Temp\hbztrojgey.exe
      C:\Temp\hbztrojgey.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2680
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1212
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4740
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hbztrojgey.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4764
  - - C:\Temp\i_hbztrojgey.exe
      C:\Temp\i_hbztrojgey.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6992
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoigaywqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5300
  - - C:\Temp\qoigaywqoi.exe
      C:\Temp\qoigaywqoi.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6216
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1188
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4844
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoigaywqoi.exe ups_ins
    3⤵
    PID:6940
  - - C:\Temp\i_qoigaywqoi.exe
      C:\Temp\i_qoigaywqoi.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqljdbnlfd.exe ups_run
    3⤵
    PID:2500
  - - C:\Temp\tqljdbnlfd.exe
      C:\Temp\tqljdbnlfd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2820
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6612
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqljdbnlfd.exe ups_ins
    3⤵
    PID:2988
  - - C:\Temp\i_tqljdbnlfd.exe
      C:\Temp\i_tqljdbnlfd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6548
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oigaysqlid.exe ups_run
    3⤵
    PID:6480
  - - C:\Temp\oigaysqlid.exe
      C:\Temp\oigaysqlid.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5836
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5548
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6284
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oigaysqlid.exe ups_ins
    3⤵
    PID:4088
  - - C:\Temp\i_oigaysqlid.exe
      C:\Temp\i_oigaysqlid.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3096
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\axsqkicaxv.exe ups_run
    3⤵
    PID:6516
  - - C:\Temp\axsqkicaxv.exe
      C:\Temp\axsqkicaxv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5964
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3812
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_axsqkicaxv.exe ups_ins
    3⤵
    PID:5420
  - - C:\Temp\i_axsqkicaxv.exe
      C:\Temp\i_axsqkicaxv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4744
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\causmkfcxu.exe ups_run
    3⤵
    PID:4300
  - - C:\Temp\causmkfcxu.exe
      C:\Temp\causmkfcxu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2000
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1700
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6920
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_causmkfcxu.exe ups_ins
    3⤵
    PID:5616
  - - C:\Temp\i_causmkfcxu.exe
      C:\Temp\i_causmkfcxu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6340
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xspjhczuke.exe ups_run
    3⤵
    PID:4556
  - - C:\Temp\xspjhczuke.exe
      C:\Temp\xspjhczuke.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3524
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6092
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4768
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xspjhczuke.exe ups_ins
    3⤵
    PID:4892
  - - C:\Temp\i_xspjhczuke.exe
      C:\Temp\i_xspjhczuke.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhczurmke.exe ups_run
    3⤵
    PID:5996
  - - C:\Temp\pjhczurmke.exe
      C:\Temp\pjhczurmke.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5108
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2080
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5536
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjhczurmke.exe ups_ins
    3⤵
    PID:2628
  - - C:\Temp\i_pjhczurmke.exe
      C:\Temp\i_pjhczurmke.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4972
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bztrljebwt.exe ups_run
    3⤵
    PID:1084
  - - C:\Temp\bztrljebwt.exe
      C:\Temp\bztrljebwt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6220
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6176
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4584
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bztrljebwt.exe ups_ins
    3⤵
    PID:5344
  - - C:\Temp\i_bztrljebwt.exe
      C:\Temp\i_bztrljebwt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5156
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bytrljgbyt.exe ups_run
    3⤵
    PID:2920
  - - C:\Temp\bytrljgbyt.exe
      C:\Temp\bytrljgbyt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2784
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3772
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:340
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bytrljgbyt.exe ups_ins
    3⤵
    PID:8
  - - C:\Temp\i_bytrljgbyt.exe
      C:\Temp\i_bytrljgbyt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:7116
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:6512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:6924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff9339ac188,0x7ff9339ac194,0x7ff9339ac1a0
      4⤵
      PID:3108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,1968240789109273348,12778092124589207557,262144 --field-trial-handle=2320,i,15893844569764593214,9309676627625800826,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
      4⤵
      PID:5508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,13295123431463984466,8965812653145593541,524288 --field-trial-handle=2320,i,15893844569764593214,9309676627625800826,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:11
      4⤵
      System Time Discovery
      PID:3560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2364,i,13788643170514412080,9255841669769400920,524288 --field-trial-handle=2320,i,15893844569764593214,9309676627625800826,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:13
      4⤵
      PID:1360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,1572482835672650492,5072472875816135867,2097152 --field-trial-handle=2320,i,15893844569764593214,9309676627625800826,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
      4⤵
      PID:768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3564,i,1900243296658884999,181292874116838210,2097152 --field-trial-handle=2320,i,15893844569764593214,9309676627625800826,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
      4⤵
      PID:1468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,4890705911270218874,9335708609104318238,524288 --field-trial-handle=2320,i,15893844569764593214,9309676627625800826,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
      4⤵
      PID:6224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,17382981202963740105,134430937389420027,524288 --field-trial-handle=2320,i,15893844569764593214,9309676627625800826,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:14
      4⤵
      PID:7112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,10374810908506910834,10606528095148997335,524288 --field-trial-handle=2320,i,15893844569764593214,9309676627625800826,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:14
      4⤵
      PID:4272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,10374810908506910834,10606528095148997335,524288 --field-trial-handle=2320,i,15893844569764593214,9309676627625800826,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:14
      4⤵
      PID:3724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4924,i,12730304781299656855,12832703196741193782,524288 --field-trial-handle=2320,i,15893844569764593214,9309676627625800826,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:14
      4⤵
      PID:6444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,7842137783437841884,4378652223341264134,524288 --field-trial-handle=2320,i,15893844569764593214,9309676627625800826,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:14
      4⤵
      PID:2340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,8761456779581084832,15672968726534452700,524288 --field-trial-handle=2320,i,15893844569764593214,9309676627625800826,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
      4⤵
      PID:1708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,7793293480183107408,16573467531994167813,524288 --field-trial-handle=2320,i,15893844569764593214,9309676627625800826,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:14
      4⤵
      PID:2824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,15965282676661705407,2877902970692587987,524288 --field-trial-handle=2320,i,15893844569764593214,9309676627625800826,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:14
      4⤵
      PID:5724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,8190987049818626988,10965185455340810152,524288 --field-trial-handle=2320,i,15893844569764593214,9309676627625800826,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:14
      4⤵
      PID:5016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,13782680038967099826,17420468355930761180,524288 --field-trial-handle=2320,i,15893844569764593214,9309676627625800826,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:14
      4⤵
      PID:5416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6756,i,8565198663724992419,14329128577869449997,262144 --field-trial-handle=2320,i,15893844569764593214,9309676627625800826,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:10
      4⤵
      PID:6908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,12039745239996010508,13778192036296511916,524288 --field-trial-handle=2320,i,15893844569764593214,9309676627625800826,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
      4⤵
      PID:4484

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3116

C:\Temp\pjhbztrmjebwromj.sys
C:\Temp\pjhbztrmjebwromj.sys
1⤵
- Executes dropped EXE
PID:1084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5364

C:\Temp\rljebwuomg.sys
C:\Temp\rljebwuomg.sys
1⤵
- Executes dropped EXE
PID:6308

C:\Temp\bwqojgbytq.sys
C:\Temp\bwqojgbytq.sys
1⤵
- Executes dropped EXE
PID:6920

C:\Temp\gaytqljdbv.sys
C:\Temp\gaytqljdbv.sys
1⤵
- Executes dropped EXE
PID:4828

C:\Temp\fdxvqnifda.sys
C:\Temp\fdxvqnifda.sys
1⤵
- Executes dropped EXE
PID:1188

C:\Temp\qkifaxspki.sys
C:\Temp\qkifaxspki.sys
1⤵
- Executes dropped EXE
PID:6040

C:\Temp\ausnkfcaus.sys
C:\Temp\ausnkfcaus.sys
1⤵
- Executes dropped EXE
PID:2184

C:\Temp\xrpjhczusm.sys
C:\Temp\xrpjhczusm.sys
1⤵
- Executes dropped EXE
PID:6516

C:\Temp\urmkecwuom.sys
C:\Temp\urmkecwuom.sys
1⤵
- Executes dropped EXE
PID:6980

C:\Temp\jhbztrmjeb.sys
C:\Temp\jhbztrmjeb.sys
1⤵
- Executes dropped EXE
PID:6968

C:\Temp\ojgdbwtolj.sys
C:\Temp\ojgdbwtolj.sys
1⤵
- Executes dropped EXE
PID:3228

C:\Temp\tqljdbytrl.sys
C:\Temp\tqljdbytrl.sys
1⤵
PID:1084

C:\Temp\sqlidavtql.sys
C:\Temp\sqlidavtql.sys
1⤵
PID:3532

C:\Temp\axvpnkicau.sys
C:\Temp\axvpnkicau.sys
1⤵
PID:6780

C:\Temp\nhfzxspkic.sys
C:\Temp\nhfzxspkic.sys
1⤵
PID:6552

C:\Temp\xusmkhczxu.sys
C:\Temp\xusmkhczxu.sys
1⤵
PID:6976

C:\Temp\rpjhbzurmj.sys
C:\Temp\rpjhbzurmj.sys
1⤵
PID:2800

C:\Temp\bztrmjhezw.sys
C:\Temp\bztrmjhezw.sys
1⤵
PID:4480

C:\Temp\ojhbztrljd.sys
C:\Temp\ojhbztrljd.sys
1⤵
PID:6616

C:\Temp\eywqoigbyt.sys
C:\Temp\eywqoigbyt.sys
1⤵
PID:5672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CreateProcess.exe

Path C:\Temp\CreateProcess.exe
Size 3KB
SHA256 644310d81cf5f76e0657e637c7177985a10859b99e91bfc138153496a7cef3a1
MD5 5a6fbb573fdd86257a367b3b35cf8893
SHA1 ca897304a9cb3a6c3dd10f6337a3cee7859cfbf7
SHA512 aeef5a7b6f9f6834a98810ca9b4a3997cb3feeb1a359195e353c3b390491465f7c9a933a9f3b4204311f3f7e3c4ecf7bcd17b5c8a0baabc6cb1e31e6687c24be
TLSH
T12171238357B8C5B3C5DE5FF502835648F5FF22380B6330340B555546AB30A3A24B8F48
MD5 SHA1 SHA512 TLSH

Submit Download

ausnkfcaus.sys

Path C:\Temp\ausnkfcaus.sys
Size 293KB
SHA256 28d9272a7acd09ada80c7e37bf0e1d4dddabc6162be46f84119d4c176a1c9756
MD5 5abb1bef61cf94a2220fdad49f0e786c
SHA1 45d322aa0ad40466d24c56ac67136873a50adbb1
SHA512 91664974215a5c90449b508b06ccc21cee7a576c6695a13d28da2ec9d8325ba4165515caabeec05de5381f2cc1797b2453154763250cd2c7ecadbced4f1c58be
SSDEEP 3072:wtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:wIJjiJcbI03GBc3ucY5DCSj
TLSH
T165545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aysqkifdav.exe

Path C:\Temp\aysqkifdav.exe
Size 722KB
SHA256 f142483615f91069cf8081817f474a49100884580833b5518328a7f745231965
MD5 210ebebab8bae292c236c8b62d4c7ba9
SHA1 aa365696818fbf468ec6cae9508a3d38dfa2148b
SHA512 31452bc227994798c55a60a85bac17e9e0cb7eb2c985e488767dc1c1f537aa639437d16e3374eda20704a1e377c4f2c93f7c5868f3f98e690e7086022bcd0070
SSDEEP 12288:gflfAsiVGjSGecvXAflfAsiVGjSGecvX:8McfcMcf
TLSH
T1D9F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bwqojgbytq.sys

Path C:\Temp\bwqojgbytq.sys
Size 293KB
SHA256 0a7b8525ef1102258ff7881ed248d969f479e2a3124484b74e81460197b3b19c
MD5 13a25d9e36031f7f711eabe9f037ff90
SHA1 df2811042f675e0ee5f3ad4d3d71441b5098e6e8
SHA512 548e58d1d8f08d96449448fe3406711a98a341b63640819550265facace80a396ff2111d6cd99b1f73c7ba5f8d72ff8a755df38491ccc7a2ad9d656e906d2dd6
SSDEEP 3072:8tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:8IJjiJcbI03GBc3ucY5DCSj
TLSH
T16B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eywqojgeyw.exe

Path C:\Temp\eywqojgeyw.exe
Size 722KB
SHA256 3043303bfaa51acce84e6b1ce0fc013f2b26b27ae2e9f14e332b3b15c9538659
MD5 13595e3e56055a1792b8a84dd605c296
SHA1 435112d67d00f71be05b1154c0fc2c6a47b644eb
SHA512 8e616888a0654bd47842042ee6cb43adfd694da7e29df0e9e7328800c6389f4b0ecc5ff3ced0b6e05661ed33233f8e5c3bcdafff60a34c84b8755a78306d62b7
SSDEEP 12288:rflfAsiVGjSGecvXAflfAsiVGjSGecvX:jMcfcMcf
TLSH
T173F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvqnifda.sys

Path C:\Temp\fdxvqnifda.sys
Size 293KB
SHA256 b335f7e9cbeb286d6a7c414ec90f4241b7f8725a8496f55a6606b8f27f3c4a22
MD5 4e53df13545b149f2d7f2baaf2f16610
SHA1 d6cbe6db24b0a08090b7d3701b3f4ba30b942601
SHA512 d4909532b6c9b0754f81868cc8c883e9acf90e56f42d8b1cc143ca0fba186a6db3f452a2bead6007dda4650508aeaf4115cbc1fd1546adf7f5912cbeec90eb76
SSDEEP 3072:itKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:iIJjiJcbI03GBc3ucY5DCSj
TLSH
T13F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaytqljdbv.sys

Path C:\Temp\gaytqljdbv.sys
Size 293KB
SHA256 95a250c4eb7e86766caf192e6344dedd7ca6966d55080e0b59b0ea01ec21f044
MD5 4cf9a7bad968b6538a455d3a03a56cec
SHA1 ff89be635d8c7b17c7f50e190b8750722f71aafe
SHA512 a58691d5f9a2ae1730e81910e7aa9f4b4cdf734c9bf8afaf52f914e9f7297efc55260345b72bce8885542e91f05eac57c267c8ceec9248867bd3afcf10dc6ae4
SSDEEP 3072:/tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:/IJjiJcbI03GBc3ucY5DCSj
TLSH
T1D3545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_aysqkifdav.exe

Path C:\Temp\i_aysqkifdav.exe
Size 722KB
SHA256 8a06e135fe62090aeec6020a5c4fab8039783eddb15d302beb54073835514e82
MD5 b921e28fc2bdeffc30666aa9beab3d25
SHA1 6f2120194a96ba682b592ca53e91b2b736b4aaf9
SHA512 81cc88a98a632dc8b5919386e6c143ea3ade1e7566d4e18faefdda8674fb7578b316222bb0a15ce8c52008f4bfd4aa3fab2c2137d466e85a8d641bd3b3b9d97e
SSDEEP 12288:iflfAsiVGjSGecvXAflfAsiVGjSGecvX:OMcfcMcf
TLSH
T11CF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_eywqojgeyw.exe

Path C:\Temp\i_eywqojgeyw.exe
Size 722KB
SHA256 445553fb56f844629b895c9d2cbcf1aa1734d3b9d901a9666a654a2f28c7dd48
MD5 5401a2b57478194d3996aa16c8794030
SHA1 3d9fe20f8b4ffe282cc04e56dc29a6a43c82d551
SHA512 78740af342f90e3e74dc42d143bb922bd079823ea8b0973e1f746d78725e3abed4a71838ffdd23d2a3959180f53b56e4f0ac0a291d08eb0a25356f2056e4b6dc
SSDEEP 12288:iflfAsiVGjSGecvXAflfAsiVGjSGecvX:OMcfcMcf
TLSH
T1EEF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nkicauskic.exe

Path C:\Temp\i_nkicauskic.exe
Size 722KB
SHA256 c863ccc22da3c73a2d1ef9a7dc32667b0a83b0092675b3c7f2078dabb8a25ea3
MD5 289ab2defb33ee7e87677742c1a76ec1
SHA1 5b0275b6afac573a98dadc54f0dc3157cd19d38a
SHA512 ef577e477f054cd23f9e6ff2f7cc764eb668b524d4824aede96d12b03316b1934770a29a543e7ba416f3bcf0c697de475b2deebfb0a2fa6cbe63a179950fd516
SSDEEP 12288:aflfAsiVGjSGecvXAflfAsiVGjSGecvX:2McfcMcf
TLSH
T14FF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_olgdywqoig.exe

Path C:\Temp\i_olgdywqoig.exe
Size 722KB
SHA256 5806f2498b69565c7d6ea85584216300104879a42000474a0aef4eaa12078478
MD5 1dcfea4983726a633a0cd083e317cc1b
SHA1 cb16c5fcfe16a68892739ca522b59fdbd695b954
SHA512 17b6e4f95cc2f232b285418e6bfab1a1287ff7f493ab4e99245e30e669991f22ee390d85a17a189bdce548594054c2f9886cd0bf59b6e9a5d9185d6a33e43cf0
SSDEEP 12288:PflfAsiVGjSGecvXAflfAsiVGjSGecvX:XMcfcMcf
TLSH
T17AF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rljebzwrpj.exe

Path C:\Temp\i_rljebzwrpj.exe
Size 722KB
SHA256 c97a54cc1cbed8c4749fb015c7c2b96c22fb49b023aaa2a72d1cbf5db19b1466
MD5 f4bb48ed5bfd73dca85f877ca48fdba5
SHA1 ac439dfc9065c1b0d5c2baa223e681436af8cfe9
SHA512 b139b0635a84451d7ca5ed1a924fe42e48d22273c7f0cf2e35f5a47e9cca5d4a32811c5b0318f176e4e4e95fb379c0ab265a69edaa394e5ee3b95322c91db283
SSDEEP 12288:dflfAsiVGjSGecvXAflfAsiVGjSGecvX:VMcfcMcf
TLSH
T141F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ytqlidbvtq.exe

Path C:\Temp\i_ytqlidbvtq.exe
Size 722KB
SHA256 77d5ede95fbff32d77371de98f5889c61e4c6aaceec3a633fee9d798f4f4a976
MD5 1f9944435dd19fc9aeb46c3187019047
SHA1 d1dc8ec9b8fdac0d60b8c986d2fee9a0aecc8963
SHA512 dae7936fbb34cde1b44b7ea327e18f11a64dc36206691f5ff0a3fc87fdd0fe9e0d24f9e85a7de70de27600283b59f74dbf50f709ecd3b79e57f9229f2dfbacd7
SSDEEP 12288:6flfAsiVGjSGecvXAflfAsiVGjSGecvX:WMcfcMcf
TLSH
T167F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkicauskic.exe

Path C:\Temp\nkicauskic.exe
Size 722KB
SHA256 9cbb0a70b17332e1f758cb53052c708598fcbd88275c32c5e74846bef110bc8b
MD5 cc2f135d99f7afe92d7d933c3396e6ab
SHA1 804d457b4cdc6a8020436967be8769ddeedb0e7b
SHA512 228de17919fd7a14eeb021d4703de9027ccdc5dfd54604b8775c4905c729ca18f909a3bcd6afd10fda37580a56c4c8359a56aa58235beeba9970435975912912
SSDEEP 12288:MflfAsiVGjSGecvXAflfAsiVGjSGecvX:YMcfcMcf
TLSH
T1FAF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olgdywqoig.exe

Path C:\Temp\olgdywqoig.exe
Size 722KB
SHA256 854503c99d7d4319536fdac0759f94a7d56e2c3b4cb8599ff17fbe27f1d2fdc9
MD5 7ec07a524c0f46b886d9e66368ba5f5b
SHA1 e81fe03f2f5811ce9d4fd57a3bc8e01e21a3ff45
SHA512 24bfd6765c6f15910b5d15f67ef87414be8f61d98c6f579f69e31a034265167864fe9ae831c1fa7944742de9abe01e4f1f91ac082bcd8be327437e197f6a186e
SSDEEP 12288:JflfAsiVGjSGecvXAflfAsiVGjSGecvX:BMcfcMcf
TLSH
T1C1F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhbztrmjebwromj.exe

Path C:\Temp\pjhbztrmjebwromj.exe
Size 722KB
SHA256 da822468b7901a16584e68a5bcd2648769c7583a7ccff755b403a5952e7e20b6
MD5 4ff47578674e9ae0349617c8e38c432b
SHA1 35bc4df70632842f2f0fe9bfb5e58b94341d0e8b
SHA512 3cc09de2dc8259d69f3dc9f44529dac89de63c3e2ff2b3c1a965246b7e0cdea1ff0f1b297d360db929ffb175f63daaf3c2e6c2f06017d451a6859967f5f7fc0d
SSDEEP 12288:mflfAsiVGjSGecvXAflfAsiVGjSGecvX:yMcfcMcf
TLSH
T10AF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhbztrmjebwromj.sys

Path C:\Temp\pjhbztrmjebwromj.sys
Size 293KB
SHA256 de0400549f0665bad6e12f98baaf4599a56bff64323abfa3319528fb70893ac8
MD5 8da52903ddb0de12845ffc8e57bc80fd
SHA1 bd36234a91edb4808e97c4866bbd30277e659dee
SHA512 d0d395c657f29d056f2f95e9a8ff3610abdbfa76f8103968cfe42264606ce3103c70428ec858bb77cebc9ef1882f1432d62257c8c3819ad8616d8ec09b91f129
SSDEEP 3072:mtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9Edf:mIJjiJcbI03GBc3ucY5DCSj
TLSH
T1EE545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkifaxspki.sys

Path C:\Temp\qkifaxspki.sys
Size 293KB
SHA256 19036981807911fde9ba6e66a34cc765a11cb010657df1a16260d065b78a60e1
MD5 2ad98475ad95346a268c35f9cc6cf83a
SHA1 7d77d9f3ad806456909c0dbca2c0bff7d729a832
SHA512 d4f2315d4f5eead0eea7213f4310ef824d6332f1415a0321b3560c479cabf2e2d0c33aefe10e6d5743f1928faa51977f56bc80794c5131ae0b1838d4a10ea1d7
SSDEEP 3072:9tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:9IJjiJcbI03GBc3ucY5DCSj
TLSH
T18E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljebwuomg.sys

Path C:\Temp\rljebwuomg.sys
Size 293KB
SHA256 5f01ea9bafa21fd790f13d242aed24a7acc0f42a015c002865d40f8fb800a4f5
MD5 02f63f2c8182bb9d25b455199da74937
SHA1 67b6b549a9b61f5d06e20961a35f48a4f6f26e79
SHA512 ca798017f42dd0e4934583533a39e36cc396517c9a32d8731b248072dce689a77ea6b23a7aa734643c1e7909da96d52fbf9e7c0963fb573834b295c713be094e
SSDEEP 3072:utKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:uIJjiJcbI03GBc3ucY5DCSj
TLSH
T1DF545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljebzwrpj.exe

Path C:\Temp\rljebzwrpj.exe
Size 722KB
SHA256 b5ddee399ae4362ff3963f105719417285818f3f707f985c6a9c18a518b29c0d
MD5 b852a5063cf4c082f4073ac062432926
SHA1 1ce4ab1978c810862c7649ac4b4cb4d58ceb3367
SHA512 c113c9a4bc24b55b5d017b2515e83491b1f04dbc33c878525b8af35efd755fb1b2507df7d8345bf7da21209be332bb5cf7d874040a2c7265a9caec2b090502e2
SSDEEP 12288:QflfAsiVGjSGecvXAflfAsiVGjSGecvX:MMcfcMcf
TLSH
T1F1F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytqlidbvtq.exe

Path C:\Temp\ytqlidbvtq.exe
Size 722KB
SHA256 09423610a607bd64566eccb221def4551157a2b353c28a5952cc6b6378d336dc
MD5 eebd1b0877841ee822f1e1fd430db8ad
SHA1 9a65fb5722acab00af61bc9eaab7aa2f40c0aad3
SHA512 ab74c1f66eb77e49eb2325eacebe12d41af8a03d7086d01063966bec1c86bf49765b675707ae56503bd0b335a9af423fb53959dc20c8e53866bbf9aaae445f2d
SSDEEP 12288:SflfAsiVGjSGecvXAflfAsiVGjSGecvX:eMcfcMcf
TLSH
T1FEF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

447bbb73-721a-4848-b119-3113143d469e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\447bbb73-721a-4848-b119-3113143d469e.tmp
Size 32KB
SHA256 4965ffa92be5999106198906999dd9cde5960e771d2a3c840751c81af45603f6
MD5 21fc739b9aab186b54e874890571ddbb
SHA1 a09c6569525f637b9b39b67d918407c344b290ab
SHA512 7ab0fb760bdc965fa5f0b2f50fe11ccf4ba80e2085c262aef617e0a454705618a6322a6c8b54671f27c13efdfbf7949676bc8e84c384f744644021e633f95944
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCobbDwzroM4C:Ob4YZnE7yTWg1NfwBu1jaJobHwATC
TLSH
T160E2EC3B280CCB7E4F804ADDEC29BD9A6DA801CF5AD8C95447FA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 05942b819853b2e7bb9389f35db936b89040f16a79be9d1d643777f05fa1e74a
MD5 e4902a46f22a368a02103d8e92760324
SHA1 310e434bef0f056e6bda94800d17d79302c8abc8
SHA512 312fae74534429d9dc71bd5b0d378fc8f585addf2f48f1968f283429db358f60a5b723b67ad55a55e7c959c90186fd07cdb39bee75d55a1ac873490669808c5e
TLSH
T1F2E0E555D920AC2B29F92B586154074BE780235B3B50884B3A3D912D4FB0637468685C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 602da94150646601d5bede5ac6be7396fcfabf7e1a1a36de488fa98e408a525e
MD5 4622afae467fee25324b1d504a8391bf
SHA1 db190885f7429d0f72f765d50289482a469267a6
SHA512 4eaafcd718734f9824d989f16af664d1c8b67e02a31744ba0b5edbc47a3a6ee4860c6dad69f2f0dd1ea789263e207d63b827bff6187c663ee99f65d44926b31d
TLSH
T1704190F783F4856EDA1196F0AA18AE2FCE1D0515432C7DAAC5E0AE2793E3471E041A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 fa09188784e09ce263e1dcea046b2f660035b2f974078b794d4988ee9a6c4c05
MD5 ea06f8c25226911d5ccb233e43fd6b61
SHA1 e5853e6acb690e9c85eb9039699dada5f2c0c5b6
SHA512 db0df0a50628c2f1126db30cad8210aec596fda105a91665f84e6e53331ecf76460779c683cd9f762eb3b90420504c5a393b050e54b5de38ed321b2d22e63960
SSDEEP 384:sxRUhU8U/fqsFaN/RIGeR/5d/WEzsGQn+jX:sWRU/fvoWp/5hWEzsGQns
TLSH
T12E72E9156A349D7B9CCBD209FA567F93D3F81173A1905E54AAFC9A0C00E76ED211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 16d9a87dd9688fb21959d7cc1e3127e189bc7c9d306b9c216cf45b7e299f088c
MD5 ff64220974964f85b5a55db6b5dacb18
SHA1 7c3c9c1c1a9a8c92a499efd9c832d6b3d9773a07
SHA512 84b375e7581d98dc72337b9b68dd06066cc77730f6dfb9de34a120b732f59eb0f44be4cf4ffcb403944157d01fa8f52f2ca6b861ec8454f7fe213295f3a63883
SSDEEP 384:sxRUhUqnU/fqsJrN/RIGeR/5d/WE+sGQn+nB:sWDnU/fDBWp/5hWE+sGQna
TLSH
T19772F815AA349D7B9CDBD619FA567FA3D2F8117391501E44AAFC9A0C00EB6ED210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 44740064499d6f8a48bbe36aa7e3156aa685b18936ad4e08a3e91134a92578f0
MD5 862bcd679e2db86ee222aef6308430fa
SHA1 2d461796da0b90b17746633877c0cd58433002c9
SHA512 d2effee44c78aa631aa79943ef6d675b5150769c6f4e869e0bac3ed583e16c5aa3a5f06eb52c9e4bf9e2fe7af4440983e2f679658e391e7c136b8ec4f0d94a7c
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9pFX:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRa
TLSH
T128B26C11713F4690387EB90C91B9981F86C2B4637119F52F7BA802A65F67E138DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 d77598eb5b3b3f737c51e40ec752d852a9b45c5f7061b6fd6c43f1db6b96e75d
MD5 ea540b6c906ba4d6290a37e16fcdbc5e
SHA1 f4aec5ffa507904c975b0cc8987c0179916385ea
SHA512 df39ac358373e57895791c14af0a4335628dad8562b00cf9991603b992130d15b2eb1b8068fae9f5ae0d87f846e89e48c9083b20f4022bad90f35e8e08fc2053
SSDEEP 384:nyiFiZcIk8NLp8TUNTUlIRqPvuTJRCenf+GGeuXkdL9Q9nTKwBODNZOC1Wf8LEEB:5FQkQpwgguvPGeuUE9newBKZOwWo
TLSH
T15FE2E3F198D78973E89E4B87A73D6E0699FCD163B4885994B7D85D0CCC821BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 da8afcba1a876fc769e9b07ec1d0a802616c04baf7008be4030ca114b412dcfe
MD5 670c7727d78052e82a53557fbeee6ad7
SHA1 bc445d404661f1c7c25fc372f741c287244eb572
SHA512 77d8f45ed82fb3c19d65c5b9e572a36fc9b643c712ad4df3ed610d6d776b44b223edcb0dde8cac243ecb1a212f17e5f097bc9cca2d725b243752d561c69fe58f
SSDEEP 384:nQiF1tNn/s3n9Sn8NgP8TUNTUlIRiPvuTuARenf+GGeuXFLgOObjI9G6w7tr8LEk:rF1j+9SXPwgUu5yGeuhg29MZM
TLSH
T1CEC24A32EC59CEB7ECE68FD9B70A7A1AEEE0126785D85AD4DAD85D0C00871EC0307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 27c5db2d4b5600c01afc99971588df77e70ef6440cbc769c297c69fc7e93e34b
MD5 128fb6ec9f69b57a35e9e301f67a3599
SHA1 6502205738a0c91515ed4645f4b9af769a4fc1c3
SHA512 f44d1af7fc2f79eb69b1025553c0038951ed71cdc77f926d09389765166991ff00bb98202f3551cad7603bd904b92f5f6a1a65c91c8dd0cae3fc2799941eacbb
SSDEEP 384:noiFiZcIR8NLp8TUNTUlIRqPvuTJaCenf+GGeuXkdLp49nTKwBODNZOC1Wf8LEEB:zFQRQpwgguAPGeuUk9newBKZOwWo
TLSH
T12FD24B31EC68DDB7ACEA9FC9BB097647DEE4516398885AD8E6D89E0C00871DD070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 555e2034d4541736f24dd1a8067bf28ffb162a2623c7917985c308d7dd2b6e36
MD5 20c0eececeb9b5056c1071ba4d8594d8
SHA1 75b41a850b11af1057f95406cb82bdebd74d499d
SHA512 e8c666c33371ba6b856d37284a4b0bf7cd1ebfdcf8d3086fe4e986a4defa790a6a2ca7ef07a63154fdc015459c2042c867ddf291289ec40ce1c18f35a65146e1
SSDEEP 384:ntiF1tNn/s3n9Sn8Ngp8TUNTUlIRiPvuTLbCenf+GGeuXkdLpk9OObjI9G6w7trU:kF1j+9SXpwgUuLPGeuUY929MZM
TLSH
T1F5C23B32EC55CEB7ECE78FD9B70A7A5AEEE0126389885AD4E6D85D4C00871ED0707C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 76d002daa9152b30ecd61aca2cac6c3d77d9c8d1d81172815cc7d1bcb78a3f91
MD5 74cd99c5f447660e8fcd61c8a1324ee8
SHA1 b11857af5ced84f47a5dde1b8cf7708d0df22a24
SHA512 83e00a20f683cf0fbb181f3c4e162acd79229aee45cae2deb1a760e7ff6dbd96b8f86eb156668d4c1bca974b1b27755405297379662de82a292990dfdb3afa6b
SSDEEP 384:nmiFiZcIR8NLp8TUNTUlIRqPvuT/aCenf+GGeuXkdLp49nTKwBODNZOC1Wf8LEEB:NFQRQpwgguGPGeuUk9newBKZOwWo
TLSH
T11DD25B32EC68DDB7ECEA9FC9BB097607DEE4516394885AD8D6D89E0C00871DD070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 3b492072f2ba2c5475b288c855dae7f2f6c12060aacd884478799eccaac225c4
MD5 bb0982e30ee9f1627e5b7562f988a589
SHA1 d5a60b3072108c070e0ebd90d03debeec18a7fd0
SHA512 89118250d457c8d823aaa04e985ee7e9f45d1539e5ae94dfbf619671e4137c7543f0a4dd62a37af51282a74aa18f828234418775538665bd86a798961bdfe905
TLSH
T1B94141E04C391AD1D4FE0E6FB44739FC94ECD726F89830382898E9A8967A20D354083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 99cacc4da64f94fd1b772cf5a8283de6653ba282b1741319da07e7c339e5f329
MD5 c22653281c248c4aef29b939055d1085
SHA1 97fc37ed678a1211edf69661d8284a9fa3a41f69
SHA512 d45dcd5cd58481b85adfb3d461d7a194a7535f86c40bf6836daf36e55b210e20ebb15ac6a3046877ec77607c94325ee040fc6feac83bacdc7c4817c7b108c0eb
TLSH
T1F74121E05C3919D1D4FD0DBF788739FC95E8D722F49830382898E958967A21D358083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 0d852e179d452dbbdf34a431e20905aa18f912ad3fe2964ebb15c02c6df9f4d7
MD5 66ac37fc8fed13c79aff0afaae3cf89e
SHA1 8ea1e2464a35ea777e7486fd5bd82689bbd783aa
SHA512 1558c19dab1fd8c839b30eb248e1e3014dc62c2df4a57bc6b2e8a41954c13cfe45242c7987bee7fa2a5615243bd86596ea721f2750917c22ff1533c416223f4e
TLSH
T1194131E05C391AC1D4BE0D6F745729FC94E8D726F49434382899E9A8567A65D314083F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1084-334-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1084-57-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1188-222-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2184-271-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2800-392-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3228-317-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3532-352-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4480-415-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4828-208-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5672-438-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6040-235-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6308-193-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6308-152-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6516-276-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6516-281-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6552-376-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6616-427-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6780-372-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6920-209-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6920-187-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6968-285-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6976-387-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6980-280-0x0000000000010000-0x00000000000AB000-memory.dmp

Download