f87255b995012e62b6612f8eb93ee8f0a83b36ceadb3147f3e323dc1c5ab8faa

Analysis

max time kernel
149s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 08:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 722KB
Sample260816-kfpl9scc67
SHA256 f87255b995012e62b6612f8eb93ee8f0a83b36ceadb3147f3e323dc1c5ab8faa
MD5 155cd8832f51b2c0c9145546d90c7758
SHA1 2aa41c911ae8c63f7c81e835372725cdfc627e01
SHA512 05ee9e5875da181d98ab683f3f88a7cfb03c7b5c20cc70f7157b402c65e15a3cf4080d8c4ad7531aff6855edd4ddd1edd3059c4d667833cf4ee2a0f00941d51c
SSDEEP 12288:uflfAsiVGjSGecvXAflfAsiVGjSGecvX:KMcfcMcf
TLSH
T1E7F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3492	omgeywqojdbwtomg.exe
2676	omgeywqojdbwtomg.sys
1068	CreateProcess.exe
2864	rljgbywoig.exe
1892	CreateProcess.exe
2416	CreateProcess.exe
5136	i_rljgbywoig.exe
2972	vnlidbytql.sys
4724	CreateProcess.exe
2776	nlgdyvtnlj.exe
6088	CreateProcess.exe
4636	CreateProcess.exe
5912	i_nlgdyvtnlj.exe
1716	lidaysqkid.sys
1036	CreateProcess.exe
3016	icavsqkida.exe
4700	CreateProcess.exe
6080	CreateProcess.exe
2296	i_icavsqkida.exe
3972	davtnlfdxv.sys
5092	CreateProcess.exe
2372	pnkfdxsqki.exe
4932	CreateProcess.exe
1480	CreateProcess.exe
5544	i_pnkfdxsqki.exe
5080	mkifaxvpmk.sys
3584	CreateProcess.exe
244	smkicaxupm.exe
6136	CreateProcess.exe
3856	CreateProcess.exe
716	i_smkicaxupm.exe
1708	upmkecxupm.sys
4300	CreateProcess.exe
1496	xusmkecxus.exe
1692	CreateProcess.exe
5312	CreateProcess.exe
2296	i_xusmkecxus.exe
4352	rmkecwuomg.sys
3396	CreateProcess.exe
4568	mjecwuomge.exe
5632	CreateProcess.exe
2672	CreateProcess.exe
4336	i_mjecwuomge.exe
796	zwurmjebzt.sys
4440	CreateProcess.exe
4952	romjdbwtrl.exe
3872	CreateProcess.exe
2432	CreateProcess.exe
1364	i_romjdbwtrl.exe
4944	ztrljdbwto.sys
3200	CreateProcess.exe
1052	tqojgbztol.exe
2400	CreateProcess.exe
5464	CreateProcess.exe
5172	i_tqojgbztol.exe
3048	oljgbywtnl.sys
4596	CreateProcess.exe
4544	gdyvtolgdy.exe
5340	CreateProcess.exe
4352	CreateProcess.exe
3760	i_gdyvtolgdy.exe
916	aysqkigdbv.sys
5300	CreateProcess.exe
2316	ysqnlidayv.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5400_1789127456\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5400_72646216\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5400_72646216\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5400_702380261\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5400_1789127456\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	romjdbwtrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfcausmkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljhbzurmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkicaxupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjecwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqojgbztol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igdbvtqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqlidavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicaxspnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjhbzuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicaxspnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icavsqkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xusmkecxus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfcausmkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mheczurpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljhbzurmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqlidavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljgbywoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdyvtolgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdyvtolgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfaxvpnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjhbzuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igdbvtqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgeywqojdbwtomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlgdyvtnlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnkfdxsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfaxvpnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkicaxupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_romjdbwtrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqnlidayv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljgbywoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icavsqkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjecwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqojgbztol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqnlidayv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mheczurpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlgdyvtnlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnkfdxsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xusmkecxus.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4360	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
724	ipconfig.exe
304	ipconfig.exe
4552	ipconfig.exe
4092	ipconfig.exe
936	ipconfig.exe
852	ipconfig.exe
2976	ipconfig.exe
5504	ipconfig.exe
5600	ipconfig.exe
1672	ipconfig.exe
4116	ipconfig.exe
2684	ipconfig.exe
5792	ipconfig.exe
1716	ipconfig.exe
4808	ipconfig.exe
4848	ipconfig.exe
2496	ipconfig.exe
200	ipconfig.exe
5208	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313427796902496"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3611646547-550105268-947503007-1000\{581CD54F-74CE-431F-90F4-9943E9AB1D83}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3492	omgeywqojdbwtomg.exe
3492	omgeywqojdbwtomg.exe
3492	omgeywqojdbwtomg.exe
3492	omgeywqojdbwtomg.exe
3492	omgeywqojdbwtomg.exe
3492	omgeywqojdbwtomg.exe
3492	omgeywqojdbwtomg.exe
3492	omgeywqojdbwtomg.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5400	msedge.exe
5400	msedge.exe
5400	msedge.exe
5400	msedge.exe
5400	msedge.exe
5400	msedge.exe
5400	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5136	i_rljgbywoig.exe
Token: SeDebugPrivilege	5912	i_nlgdyvtnlj.exe
Token: SeDebugPrivilege	2296	i_icavsqkida.exe
Token: SeDebugPrivilege	5544	i_pnkfdxsqki.exe
Token: SeDebugPrivilege	716	i_smkicaxupm.exe
Token: SeDebugPrivilege	2296	i_xusmkecxus.exe
Token: SeDebugPrivilege	4336	i_mjecwuomge.exe
Token: SeDebugPrivilege	1364	i_romjdbwtrl.exe
Token: SeDebugPrivilege	5172	i_tqojgbztol.exe
Token: SeDebugPrivilege	3760	i_gdyvtolgdy.exe
Token: SeDebugPrivilege	5920	i_ysqnlidayv.exe
Token: SeDebugPrivilege	1064	i_nlfaxvpnif.exe
Token: SeDebugPrivilege	200	i_kicaxspnkf.exe
Token: SeDebugPrivilege	5072	i_nkfcausmkh.exe
Token: SeDebugPrivilege	5320	i_mheczurpjh.exe
Token: SeDebugPrivilege	5672	i_mjhbzuomge.exe
Token: SeDebugPrivilege	5272	i_rljhbzurmj.exe
Token: SeDebugPrivilege	4900	i_igdbvtqoig.exe
Token: SeDebugPrivilege	1048	i_aysqlidavs.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5400	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 3492	2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 2840 wrote to memory of 2944	2840	2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 2944 wrote to memory of 5400	2944	iexplore.exe	91
PID 5400 wrote to memory of 2780	5400	msedge.exe	92
PID 5400 wrote to memory of 4360	5400	msedge.exe	93
PID 5400 wrote to memory of 5900	5400	msedge.exe	95
PID 5400 wrote to memory of 5900	5400	msedge.exe	95
PID 5400 wrote to memory of 5584	5400	msedge.exe	94
PID 5400 wrote to memory of 5584	5400	msedge.exe	94
PID 5400 wrote to memory of 5584	5400	msedge.exe	94
PID 5400 wrote to memory of 936	5400	msedge.exe	96
PID 5400 wrote to memory of 936	5400	msedge.exe	96
PID 5400 wrote to memory of 936	5400	msedge.exe	96
PID 5400 wrote to memory of 1480	5400	msedge.exe	97
PID 5400 wrote to memory of 1480	5400	msedge.exe	97
PID 5400 wrote to memory of 1480	5400	msedge.exe	97
PID 5400 wrote to memory of 2776	5400	msedge.exe	99
PID 5400 wrote to memory of 2776	5400	msedge.exe	99
PID 5400 wrote to memory of 2776	5400	msedge.exe	99
PID 5400 wrote to memory of 1436	5400	msedge.exe	100
PID 5400 wrote to memory of 1436	5400	msedge.exe	100
PID 5400 wrote to memory of 1436	5400	msedge.exe	100
PID 5400 wrote to memory of 6124	5400	msedge.exe	101
PID 5400 wrote to memory of 6124	5400	msedge.exe	101
PID 5400 wrote to memory of 788	5400	msedge.exe	102
PID 5400 wrote to memory of 788	5400	msedge.exe	102
PID 5400 wrote to memory of 788	5400	msedge.exe	102
PID 5400 wrote to memory of 712	5400	msedge.exe	106
PID 5400 wrote to memory of 712	5400	msedge.exe	106
PID 5400 wrote to memory of 712	5400	msedge.exe	106
PID 3492 wrote to memory of 1068	3492	omgeywqojdbwtomg.exe	107
PID 5400 wrote to memory of 824	5400	msedge.exe	108
PID 5400 wrote to memory of 2924	5400	msedge.exe	109
PID 5400 wrote to memory of 824	5400	msedge.exe	108
PID 5400 wrote to memory of 2924	5400	msedge.exe	109
PID 2864 wrote to memory of 1892	2864	rljgbywoig.exe	112
PID 5400 wrote to memory of 1660	5400	msedge.exe	116
PID 5400 wrote to memory of 1692	5400	msedge.exe	117
PID 5400 wrote to memory of 1692	5400	msedge.exe	117
PID 5400 wrote to memory of 5780	5400	msedge.exe	120
PID 5400 wrote to memory of 5780	5400	msedge.exe	120
PID 3492 wrote to memory of 2416	3492	omgeywqojdbwtomg.exe	121
PID 3492 wrote to memory of 4724	3492	omgeywqojdbwtomg.exe	125
PID 2776 wrote to memory of 6088	2776	nlgdyvtnlj.exe	127
PID 3492 wrote to memory of 4636	3492	omgeywqojdbwtomg.exe	130
PID 3492 wrote to memory of 1036	3492	omgeywqojdbwtomg.exe	134
PID 3016 wrote to memory of 4700	3016	icavsqkida.exe	136
PID 3492 wrote to memory of 6080	3492	omgeywqojdbwtomg.exe	139
PID 3492 wrote to memory of 5092	3492	omgeywqojdbwtomg.exe	144
PID 2372 wrote to memory of 4932	2372	pnkfdxsqki.exe	146
PID 3492 wrote to memory of 1480	3492	omgeywqojdbwtomg.exe	149
PID 5400 wrote to memory of 2168	5400	msedge.exe	151
PID 5400 wrote to memory of 2680	5400	msedge.exe	152
PID 5400 wrote to memory of 1432	5400	msedge.exe	153
PID 3492 wrote to memory of 3584	3492	omgeywqojdbwtomg.exe	156
PID 244 wrote to memory of 6136	244	smkicaxupm.exe	158
PID 3492 wrote to memory of 3856	3492	omgeywqojdbwtomg.exe	161
PID 3492 wrote to memory of 4300	3492	omgeywqojdbwtomg.exe	165
PID 1496 wrote to memory of 1692	1496	xusmkecxus.exe	167
PID 3492 wrote to memory of 5312	3492	omgeywqojdbwtomg.exe	170
PID 3492 wrote to memory of 3396	3492	omgeywqojdbwtomg.exe	174
PID 4568 wrote to memory of 5632	4568	mjecwuomge.exe	176
PID 3492 wrote to memory of 2672	3492	omgeywqojdbwtomg.exe	179
PID 3492 wrote to memory of 4440	3492	omgeywqojdbwtomg.exe	183

C:\Users\Admin\AppData\Local\Temp\2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_155cd8832f51b2c0c9145546d90c7758_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Temp\omgeywqojdbwtomg.exe
  C:\Temp\omgeywqojdbwtomg.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3492
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rljgbywoig.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1068
  - - C:\Temp\rljgbywoig.exe
      C:\Temp\rljgbywoig.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2864
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1892
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4116
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rljgbywoig.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2416
  - - C:\Temp\i_rljgbywoig.exe
      C:\Temp\i_rljgbywoig.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5136
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlgdyvtnlj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4724
  - - C:\Temp\nlgdyvtnlj.exe
      C:\Temp\nlgdyvtnlj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2776
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6088
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2684
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlgdyvtnlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4636
  - - C:\Temp\i_nlgdyvtnlj.exe
      C:\Temp\i_nlgdyvtnlj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5912
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\icavsqkida.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1036
  - - C:\Temp\icavsqkida.exe
      C:\Temp\icavsqkida.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3016
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4700
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_icavsqkida.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6080
  - - C:\Temp\i_icavsqkida.exe
      C:\Temp\i_icavsqkida.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2296
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnkfdxsqki.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5092
  - - C:\Temp\pnkfdxsqki.exe
      C:\Temp\pnkfdxsqki.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2372
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4932
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5792
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnkfdxsqki.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1480
  - - C:\Temp\i_pnkfdxsqki.exe
      C:\Temp\i_pnkfdxsqki.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\smkicaxupm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3584
  - - C:\Temp\smkicaxupm.exe
      C:\Temp\smkicaxupm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:244
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6136
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5600
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_smkicaxupm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3856
  - - C:\Temp\i_smkicaxupm.exe
      C:\Temp\i_smkicaxupm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xusmkecxus.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4300
  - - C:\Temp\xusmkecxus.exe
      C:\Temp\xusmkecxus.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1496
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1692
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:936
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xusmkecxus.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5312
  - - C:\Temp\i_xusmkecxus.exe
      C:\Temp\i_xusmkecxus.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2296
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mjecwuomge.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3396
  - - C:\Temp\mjecwuomge.exe
      C:\Temp\mjecwuomge.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4568
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5632
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mjecwuomge.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2672
  - - C:\Temp\i_mjecwuomge.exe
      C:\Temp\i_mjecwuomge.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4336
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\romjdbwtrl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4440
  - - C:\Temp\romjdbwtrl.exe
      C:\Temp\romjdbwtrl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4952
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3872
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5208
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_romjdbwtrl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2432
  - - C:\Temp\i_romjdbwtrl.exe
      C:\Temp\i_romjdbwtrl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1364
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqojgbztol.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3200
  - - C:\Temp\tqojgbztol.exe
      C:\Temp\tqojgbztol.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1052
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2400
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqojgbztol.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5464
  - - C:\Temp\i_tqojgbztol.exe
      C:\Temp\i_tqojgbztol.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5172
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gdyvtolgdy.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4596
  - - C:\Temp\gdyvtolgdy.exe
      C:\Temp\gdyvtolgdy.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4544
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5340
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1672
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gdyvtolgdy.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4352
  - - C:\Temp\i_gdyvtolgdy.exe
      C:\Temp\i_gdyvtolgdy.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3760
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ysqnlidayv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5300
  - - C:\Temp\ysqnlidayv.exe
      C:\Temp\ysqnlidayv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2316
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3476
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:724
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ysqnlidayv.exe ups_ins
    3⤵
    PID:4280
  - - C:\Temp\i_ysqnlidayv.exe
      C:\Temp\i_ysqnlidayv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5920
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlfaxvpnif.exe ups_run
    3⤵
    PID:4856
  - - C:\Temp\nlfaxvpnif.exe
      C:\Temp\nlfaxvpnif.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1716
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2040
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:852
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlfaxvpnif.exe ups_ins
    3⤵
    PID:5028
  - - C:\Temp\i_nlfaxvpnif.exe
      C:\Temp\i_nlfaxvpnif.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kicaxspnkf.exe ups_run
    3⤵
    PID:4084
  - - C:\Temp\kicaxspnkf.exe
      C:\Temp\kicaxspnkf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2760
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3820
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:304
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kicaxspnkf.exe ups_ins
    3⤵
    PID:3112
  - - C:\Temp\i_kicaxspnkf.exe
      C:\Temp\i_kicaxspnkf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkfcausmkh.exe ups_run
    3⤵
    PID:2168
  - - C:\Temp\nkfcausmkh.exe
      C:\Temp\nkfcausmkh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1096
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1512
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkfcausmkh.exe ups_ins
    3⤵
    PID:1084
  - - C:\Temp\i_nkfcausmkh.exe
      C:\Temp\i_nkfcausmkh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5072
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mheczurpjh.exe ups_run
    3⤵
    PID:2232
  - - C:\Temp\mheczurpjh.exe
      C:\Temp\mheczurpjh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3464
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3008
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4552
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mheczurpjh.exe ups_ins
    3⤵
    PID:3212
  - - C:\Temp\i_mheczurpjh.exe
      C:\Temp\i_mheczurpjh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5320
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mjhbzuomge.exe ups_run
    3⤵
    PID:2740
  - - C:\Temp\mjhbzuomge.exe
      C:\Temp\mjhbzuomge.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:852
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5912
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4848
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mjhbzuomge.exe ups_ins
    3⤵
    PID:3948
  - - C:\Temp\i_mjhbzuomge.exe
      C:\Temp\i_mjhbzuomge.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5672
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rljhbzurmj.exe ups_run
    3⤵
    PID:4132
  - - C:\Temp\rljhbzurmj.exe
      C:\Temp\rljhbzurmj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4324
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1776
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2496
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rljhbzurmj.exe ups_ins
    3⤵
    PID:3640
  - - C:\Temp\i_rljhbzurmj.exe
      C:\Temp\i_rljhbzurmj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igdbvtqoig.exe ups_run
    3⤵
    PID:4808
  - - C:\Temp\igdbvtqoig.exe
      C:\Temp\igdbvtqoig.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:796
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5976
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2976
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igdbvtqoig.exe ups_ins
    3⤵
    PID:1712
  - - C:\Temp\i_igdbvtqoig.exe
      C:\Temp\i_igdbvtqoig.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4900
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aysqlidavs.exe ups_run
    3⤵
    PID:1948
  - - C:\Temp\aysqlidavs.exe
      C:\Temp\aysqlidavs.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5644
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4308
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5504
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aysqlidavs.exe ups_ins
    3⤵
    PID:1060
  - - C:\Temp\i_aysqlidavs.exe
      C:\Temp\i_aysqlidavs.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1048
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffd082bc188,0x7ffd082bc194,0x7ffd082bc1a0
      4⤵
      PID:2780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,8742914347766120590,11060452500985493283,524288 --field-trial-handle=2324,i,3155328536043173796,15294075686984236326,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:11
      4⤵
      System Time Discovery
      PID:4360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,330787255897943451,12768623856447708305,262144 --field-trial-handle=2324,i,3155328536043173796,15294075686984236326,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
      4⤵
      PID:5584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2452,i,16992768127952303645,12110155272990565967,524288 --field-trial-handle=2324,i,3155328536043173796,15294075686984236326,262144 --variations-seed-version --mojo-platform-channel-handle=2820 /prefetch:13
      4⤵
      PID:5900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,10189731961313186169,2679745658665280503,2097152 --field-trial-handle=2324,i,3155328536043173796,15294075686984236326,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
      4⤵
      PID:936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,8650000945821031081,14935919828986669938,2097152 --field-trial-handle=2324,i,3155328536043173796,15294075686984236326,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
      4⤵
      PID:1480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,14109473156216299251,3426278271364548298,2097152 --field-trial-handle=2324,i,3155328536043173796,15294075686984236326,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:1
      4⤵
      PID:2776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,3300984897003306561,8402580292992290670,2097152 --field-trial-handle=2324,i,3155328536043173796,15294075686984236326,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:9
      4⤵
      PID:1436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3668,i,15684069204441491207,4780217899652250595,524288 --field-trial-handle=2324,i,3155328536043173796,15294075686984236326,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:14
      4⤵
      PID:6124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3580,i,13489232061796609389,12455265617867045110,2097152 --field-trial-handle=2324,i,3155328536043173796,15294075686984236326,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:1
      4⤵
      PID:788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5440,i,11539747094675370941,2911604345880554832,2097152 --field-trial-handle=2324,i,3155328536043173796,15294075686984236326,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:1
      4⤵
      PID:712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,10406692060641446302,15898778856315337390,524288 --field-trial-handle=2324,i,3155328536043173796,15294075686984236326,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
      4⤵
      PID:824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,5490506645773208812,2721283798373975440,524288 --field-trial-handle=2324,i,3155328536043173796,15294075686984236326,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:14
      4⤵
      PID:2924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,15924465129250338027,5710764439766414762,524288 --field-trial-handle=2324,i,3155328536043173796,15294075686984236326,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
      4⤵
      PID:1328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,15924465129250338027,5710764439766414762,524288 --field-trial-handle=2324,i,3155328536043173796,15294075686984236326,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
      4⤵
      PID:1660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,8013762218893217812,1708232259435778811,524288 --field-trial-handle=2324,i,3155328536043173796,15294075686984236326,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
      4⤵
      PID:1692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,5575698089238533149,3145906231233047731,524288 --field-trial-handle=2324,i,3155328536043173796,15294075686984236326,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:14
      4⤵
      PID:5780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,4362115714563910053,4469812593179226936,524288 --field-trial-handle=2324,i,3155328536043173796,15294075686984236326,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
      4⤵
      PID:2168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,1887893243917142457,8317390673714204587,524288 --field-trial-handle=2324,i,3155328536043173796,15294075686984236326,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:14
      4⤵
      PID:2680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,11347621844155799559,15020097409776597464,524288 --field-trial-handle=2324,i,3155328536043173796,15294075686984236326,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
      4⤵
      PID:1432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2000,i,3655722726808020033,11415856222282973268,524288 --field-trial-handle=2324,i,3155328536043173796,15294075686984236326,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14
      4⤵
      PID:1800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,10089465366551962347,6681949800640466238,524288 --field-trial-handle=2324,i,3155328536043173796,15294075686984236326,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:14
      4⤵
      PID:3976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,2793275867591209988,7948728245070816943,524288 --field-trial-handle=2324,i,3155328536043173796,15294075686984236326,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
      4⤵
      PID:6052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5976,i,14095350093771486914,10219433876181180347,262144 --field-trial-handle=2324,i,3155328536043173796,15294075686984236326,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:10
      4⤵
      PID:1188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=932,i,17572464659758126731,13678107051854415142,524288 --field-trial-handle=2324,i,3155328536043173796,15294075686984236326,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
      4⤵
      PID:6124

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6056

C:\Temp\omgeywqojdbwtomg.sys
C:\Temp\omgeywqojdbwtomg.sys
1⤵
- Executes dropped EXE
PID:2676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3876

C:\Temp\vnlidbytql.sys
C:\Temp\vnlidbytql.sys
1⤵
- Executes dropped EXE
PID:2972

C:\Temp\lidaysqkid.sys
C:\Temp\lidaysqkid.sys
1⤵
- Executes dropped EXE
PID:1716

C:\Temp\davtnlfdxv.sys
C:\Temp\davtnlfdxv.sys
1⤵
- Executes dropped EXE
PID:3972

C:\Temp\mkifaxvpmk.sys
C:\Temp\mkifaxvpmk.sys
1⤵
- Executes dropped EXE
PID:5080

C:\Temp\upmkecxupm.sys
C:\Temp\upmkecxupm.sys
1⤵
- Executes dropped EXE
PID:1708

C:\Temp\rmkecwuomg.sys
C:\Temp\rmkecwuomg.sys
1⤵
- Executes dropped EXE
PID:4352

C:\Temp\zwurmjebzt.sys
C:\Temp\zwurmjebzt.sys
1⤵
- Executes dropped EXE
PID:796

C:\Temp\ztrljdbwto.sys
C:\Temp\ztrljdbwto.sys
1⤵
- Executes dropped EXE
PID:4944

C:\Temp\oljgbywtnl.sys
C:\Temp\oljgbywtnl.sys
1⤵
- Executes dropped EXE
PID:3048

C:\Temp\aysqkigdbv.sys
C:\Temp\aysqkigdbv.sys
1⤵
- Executes dropped EXE
PID:916

C:\Temp\aytnlfdavt.sys
C:\Temp\aytnlfdavt.sys
1⤵
PID:3568

C:\Temp\nkfdxvpnif.sys
C:\Temp\nkfdxvpnif.sys
1⤵
PID:1128

C:\Temp\khcausmkec.sys
C:\Temp\khcausmkec.sys
1⤵
PID:932

C:\Temp\jhbzxrpjhf.sys
C:\Temp\jhbzxrpjhf.sys
1⤵
PID:4508

C:\Temp\wuomkhczur.sys
C:\Temp\wuomkhczur.sys
1⤵
PID:3420

C:\Temp\wrojgbztrl.sys
C:\Temp\wrojgbztrl.sys
1⤵
PID:3884

C:\Temp\lgebwtrlig.sys
C:\Temp\lgebwtrlig.sys
1⤵
PID:5556

C:\Temp\gdbvtnlgdy.sys
C:\Temp\gdbvtnlgdy.sys
1⤵
PID:2832

C:\Temp\lfdbytqnig.sys
C:\Temp\lfdbytqnig.sys
1⤵
PID:3668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

davtnlfdxv.sys

Path C:\Temp\davtnlfdxv.sys
Size 293KB
SHA256 7d06c05593a5dcdde104d5a7818950b08b520c77a14624636a5f33bd4879b27a
MD5 78a81280ccfa56cda3ff264b481553e2
SHA1 0d286f9a1d5758bdcf4138252597ea7b0319988f
SHA512 a0464b406fcec0ebbd67e70e2a5ad60712e83a05ef748853c24d4632e083cc3e7d8da1b2e4136777692a0c47495b4777b4d43b0ff49e3776132e1a3b18fb2f2f
SSDEEP 3072:0tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:0IJjiJcbI03GBc3ucY5DCSj
TLSH
T168545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_icavsqkida.exe

Path C:\Temp\i_icavsqkida.exe
Size 722KB
SHA256 67c326b9c17f26c2c94b1847b6b1917e19286e4020e1c50fbaab5d754c8eae88
MD5 4dd4f32c09b4368919ad33667c74141d
SHA1 ecd3fa7f1bb1f73583b56f104d02413e208652b7
SHA512 07e7a56be4e34e1630bd13ca25c035984d2c75b237273b0e2f4ef2d07cdfeadbd86288c65227c03e0bf7b51d8bc9897ff765edbde89c15f8ef72083f03e463d7
SSDEEP 12288:+flfAsiVGjSGecvXAflfAsiVGjSGecvX:6McfcMcf
TLSH
T1C3F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nlgdyvtnlj.exe

Path C:\Temp\i_nlgdyvtnlj.exe
Size 722KB
SHA256 2782b1f6cce01940fc4bc74b9920c4d0786f6bbb1bb45a9f28b19756ccac30c4
MD5 47d54c5f2dc04749f29c0809800dbaeb
SHA1 cccaa897faabefc0682c0ba1ddb6e03d6a46507a
SHA512 f0c2ba2dccf05d69f29abb8a0801bb66bbacc474274ba40b84b22d083afe8dc88726232616eb5a9656ce407ba659157143baff872024010612fd266fcf18c58a
SSDEEP 12288:iflfAsiVGjSGecvXAflfAsiVGjSGecvX:OMcfcMcf
TLSH
T1D4F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pnkfdxsqki.exe

Path C:\Temp\i_pnkfdxsqki.exe
Size 722KB
SHA256 5012d784592ef2a9146012755dcf8ee970de061a2f5e11e965c8b71474d5215a
MD5 8dc8f63eca6fd1a22165cbac0a84c66d
SHA1 e0ff66e9df075e4a79c2012c097348e3d79e54f4
SHA512 9fa50e6e6b6faf7422be2d9c43f1bf439d0fe93f8f33c4969f3d8d3ea027cef57edc074720827118b58a1bc6c1e83570bb2a4d6d4f0ce46e6dedea60006b3c61
SSDEEP 12288:gflfAsiVGjSGecvXAflfAsiVGjSGecvX:8McfcMcf
TLSH
T163F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rljgbywoig.exe

Path C:\Temp\i_rljgbywoig.exe
Size 722KB
SHA256 ed42462df4ecf39abcf9ac5a56507cdfb144fcbd989a6f7c5b47eb40399b810d
MD5 7b988f23b68662b6de69f859853d48f8
SHA1 d4a00a0266e8ed434f1dd3078cb21faa2953f70a
SHA512 b467b0f152e324e746711cc0201d1e9dd62710215b686dc54d839e75af13af18a6dee54eb4bfaa2d452056b6723df6cdcb7da134b781f1109b5e87c9ab118c12
SSDEEP 12288:gflfAsiVGjSGecvXAflfAsiVGjSGecvX:8McfcMcf
TLSH
T146F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_smkicaxupm.exe

Path C:\Temp\i_smkicaxupm.exe
Size 722KB
SHA256 eb22a13d0ecab768edc60d8fe0ff671c3c178808c7f9cbfbcf132c9a9875de0f
MD5 54756feaf3d4e1490f961773a94fb4b9
SHA1 9fb079e899010a914f5a00e7a8d9b034eff16f7a
SHA512 754bf6c1e6cea66f4458b9095a7936308846a9cad6a13930b82bf1e49a3b33bc666d5687ba5b5c2f748a7a5e019e3d12d85b1e48d99230fea7759b7cb0d08b9c
SSDEEP 12288:AflfAsiVGjSGecvXAflfAsiVGjSGecvX:cMcfcMcf
TLSH
T1CDF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icavsqkida.exe

Path C:\Temp\icavsqkida.exe
Size 722KB
SHA256 01e1bc59b15572039d41eeb6627c3d54d79fc2d0c7db89a1b75a3aa43a356dd3
MD5 a01995c1b44ceaaa072d1c7f4c16cfb6
SHA1 9bfac5d72326ac6d25fddd6de599eebdc076b125
SHA512 f056bb6ea6195cde64c4a76c60505bd381d6e170d38615cd450735e7273d7f49964f0b50071bcc44eb9b82dfa84963fc7be4a9e76317f41d4cce2aaa63c9bd62
SSDEEP 12288:sflfAsiVGjSGecvXAflfAsiVGjSGecvX:4McfcMcf
TLSH
T1BCF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lidaysqkid.sys

Path C:\Temp\lidaysqkid.sys
Size 293KB
SHA256 fda7dd56c9dbc96ebe1c06a38118b81204fb7719871871648fb8bf6efb7bc821
MD5 396ddb2b88a8d5838ceaef8cdcebe29f
SHA1 bf2a0667b58710e130274936e4887a30dc0a96e1
SHA512 67cb154c68d19f7137c00705aa856571824015905c60fdf247d37871f333e1075dfc3f83b4f647d41cee3d6d51cb9895f51e2b5e372f6e788827d8a2845cfaae
SSDEEP 3072:XtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:XIJjiJcbI03GBc3ucY5DCSj
TLSH
T1B9545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkifaxvpmk.sys

Path C:\Temp\mkifaxvpmk.sys
Size 293KB
SHA256 2ffa60252413bc370b3d52c4d315943fb523c9a69c455265bf3a47266fe22071
MD5 87f655b4a2034b61b410018554112e6d
SHA1 9bc0deaaf593268390227b56e408ea808fb2da7e
SHA512 16b423e352ef040a501b0320f5ed0eaa9f172e7140589e553b897b55b702f6798d0564fa112b4bfa1ec82670ff6c5071367abd00141de8206add040a6b9a422c
SSDEEP 3072:htKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:hIJjiJcbI03GBc3ucY5DCSj
TLSH
T17C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlgdyvtnlj.exe

Path C:\Temp\nlgdyvtnlj.exe
Size 722KB
SHA256 7c7eefda26d4241fa0e3877a99431714e74182b7fa6ab1dc177f1eeb9cf88482
MD5 d1aae7da9a87924a51a6e2e38c2a785e
SHA1 1e553b48d0fc997cf83384d3b00522d6668ab869
SHA512 7daf087c42fbd7e1cc371926188590ce443297764171b638c405b273658f05bbfa8456c519036566d3862c3984039016fec12166af626fdf22abf7302a25ce4c
SSDEEP 12288:7flfAsiVGjSGecvXAflfAsiVGjSGecvX:TMcfcMcf
TLSH
T1BAF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgeywqojdbwtomg.exe

Path C:\Temp\omgeywqojdbwtomg.exe
Size 722KB
SHA256 d82a66ec678b132666a9131ca94cd0a4b26125a897cf33e7e148f44c7c560693
MD5 50da02a571f18e0d7b7c7af3c35043e7
SHA1 0c8e07c6d04964cb6823c8d8a4dfb50deeb7d34d
SHA512 980a9233980faa3c3ee5b6698b40c51fe898b24fdf4ed62c7fb0b31779a749c1e8ac584e1687f218551a29a634f452940d68bf5941d90d93c041042a13ef8b03
SSDEEP 12288:RflfAsiVGjSGecvXAflfAsiVGjSGecvX:ZMcfcMcf
TLSH
T166F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgeywqojdbwtomg.sys

Path C:\Temp\omgeywqojdbwtomg.sys
Size 293KB
SHA256 26fe79df9821d0031bde1f2d8644443dcbb76d3024df4c2563caa5ea43fc2200
MD5 f6e8e53f78a10f1c613705a42580f4bc
SHA1 6fb47a2817881d2f300423bfcd56c2c543f33471
SHA512 c384bde1542919d25a30e0d68e32619098e40ab74dd1ca5b36f6b96da1073350b25f161cc0c3d1f6f49523298b94186c385005844cb27335350ee52fc8dab293
SSDEEP 3072:QtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:QIJjiJcbI03GBc3ucY5DCSj
TLSH
T15F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnkfdxsqki.exe

Path C:\Temp\pnkfdxsqki.exe
Size 722KB
SHA256 4d74e20825a582466b574cef3284ac5c4ea500ed5d9e9bd91d98cb882341715e
MD5 3b0d85b8f88d3ed7d3a1e8f564350ac9
SHA1 9f31413ce68e83435e5361d0e9e2f0b39744adbc
SHA512 bf987cc615bea61bba34d6b0c6f07f57e6a725e2e2494a9ee77448878228a4141002f3f14720f86497257b19074e7a55530ec349fc18ed1f0e95c8ce5448a772
SSDEEP 12288:PflfAsiVGjSGecvXAflfAsiVGjSGecvX:XMcfcMcf
TLSH
T1CBF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljgbywoig.exe

Path C:\Temp\rljgbywoig.exe
Size 722KB
SHA256 95d07bfed82eef3e1d0be5aa658743d85af6f35296a10763e77159a153afde13
MD5 4290f2ddbbcd17f48e2d71821a09a6fa
SHA1 d67aa498e9738abdfbeca379c0c3823eab4880d3
SHA512 f592aade78986686eb0065169e137e8f5b3b92b64ca552d649c04929dccce4220a2fcba9a1245c48b724bdeac47b4549e4a984161d03f3fa02d229f0a700b2bc
SSDEEP 12288:OflfAsiVGjSGecvXAflfAsiVGjSGecvX:qMcfcMcf
TLSH
T15CF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smkicaxupm.exe

Path C:\Temp\smkicaxupm.exe
Size 722KB
SHA256 4b0609628383eedbc7ebff71532746a5a1c64d7fbc6e6ffc041780f8b70e1981
MD5 e1fce476fea1aa97c6f63f71a62a8894
SHA1 04323c55b56ac7aca5ab6eb80f856fbf38091202
SHA512 47e47814404cd329607c50bfdbdce109bcb4614a3ef91f3a152c3f1e7bbe808b4595f66db0d25d7836bd4bb88993e08c99864cf5864cf924835fe0bab08ba049
SSDEEP 12288:OflfAsiVGjSGecvXAflfAsiVGjSGecvX:qMcfcMcf
TLSH
T1D8F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

upmkecxupm.sys

Path C:\Temp\upmkecxupm.sys
Size 293KB
SHA256 977103c7b70d415921aadd77652ac985805fb02d6584c4c94465aaa152834ded
MD5 2197db8dd8c4925d264c10423acf763f
SHA1 1f744870ccb9893248abbc68ee3aedb32b3c0c15
SHA512 42e822961f32fb68676bbfd5db52b96a6558e47174573e93b651a4dcc0b2df8a9a2e8b624400af49b25e97ef7944f59b2c60ab959a69013617504fe77077a76d
SSDEEP 3072:8tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:8IJjiJcbI03GBc3ucY5DCSj
TLSH
T182545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vnlidbytql.sys

Path C:\Temp\vnlidbytql.sys
Size 293KB
SHA256 c2f69b7a7373b9e066275c13097b25349d4bff8e95fbc9b7fd5f9a83c6e1a366
MD5 03f4e8c6f07f9fb58b6fcc52af29faf5
SHA1 af315a0a0b87a7174765dac63ceaadf70ddf5053
SHA512 1a9fd4959912bcd64bd97964f429c42daf2c62a44961429b6b313dbd9999f084276d011b300b24538791dcf2b9fbaa2c4fa86d29fd3857af426075dc048c0e77
SSDEEP 3072:KtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:KIJjiJcbI03GBc3ucY5DCSj
TLSH
T150545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xusmkecxus.exe

Path C:\Temp\xusmkecxus.exe
Size 722KB
SHA256 c5e67f9f3f6495d26bb6e040d7410e4cfcbe42a5ab84af04b4a2dc25f8927610
MD5 7970106a164d2b9db6fff7e37dc59efc
SHA1 4f4351b2a291a28090acbcfd8d2d9c04593b9719
SHA512 85b699631f447285702dccd18613a01bd7b247e9b97b20734fee1649267f1abf7a4b2fcb155529612ada6ec87fdb44e5454ae450ba67ae2bd500731f720ea700
SSDEEP 12288:UflfAsiVGjSGecvXAflfAsiVGjSGecvX:QMcfcMcf
TLSH
T1AAF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 22c1d58ffa7df77a7e0440ce3b2c474b1e03f30b60355bbf5dd6392fefb641fd
MD5 b9f45a900b1f64efbf90731f41c6ad44
SHA1 0c28e85e464e328fbbc07373b05113d39f83bdcc
SHA512 132313545c55ea809da0e811d6d5d324ecf5b6cfaefadb3fa4a29df5e6266dfeca7cffa4daf21754b4b37771504d3692189b5660a468784b5eaf80bf92f59ae0
TLSH
T11ED02BA033044C0CCE40203215B9A210720484204849031A8E41F02C8C6FD4387161F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee3af991fa1719733ca1e3ac746d5b605f4205e269bf244bd9ae780ceadb9bd8
MD5 a044f6413820c4c3fbd300ee9b379ebc
SHA1 94fc91536a25274f06d3a6e89322dec7fde7912e
SHA512 ced4374c54d7b4ea2b76afe4ca5d8841dfb55d8cb5db96de4ed49e64bd3850a817db5301787c268756641c94c0bf85eb4ee188f04fc891fa2e45ad48284985a5
TLSH
T13AD02BA433044D0CCE40203215B8A210720484209C49031A8D41B01C8C6FD4387171FB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 fa7430da19400eba602d103c6178e23831bbafb45e5cddd55d9b9bf943f2e989
MD5 650a055fc26f491a5497ddace06b976f
SHA1 2c8d0ac040a50385a742f356a131bd2c4610a08b
SHA512 6568a76fad5d023557a33135f5d8e18e8890987202dbe80829fa1dfa3ba2c058144a86942f412a8192576a505a98dcb35df852bc61a9dc9c0c791dd3d90d465b
TLSH
T1D351739143E32AD9F72D0BF262C71C5AF67777664683EE1200CA99364C0E72E8321DD5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59bd0d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59bd0d.TMP
Size 2KB
SHA256 d6b7a2123116ada1891d7b5bc8108dc3e7645394bdac88c72dc23e54aeafc0ab
MD5 eb8c23aaf9890bbd46cf2e36702fe7a0
SHA1 53874de51d1ca5c23545ca4e3798817d203ef375
SHA512 f3cda5e08aa7d412e1dbf9bd787bf0dc5dc53a03f7b4bab9c62e53a329b3ff67419c147de2fb942056af45459f1d681d8f35fcb04018649d7696e3c6c54d2301
TLSH
T19B51739143E32AD9F72D0AF262D71C5AF677B7AA4583DE1300CA59364C0E32E8321CD5
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 57388852d5ecc2b43428d36188fe790b7581578c3b7df632e17c4f6a35956d0b
MD5 2f1fbe456df34000b1d68e58f8009b31
SHA1 1c3b195cc1ffdc1f9be95fcf3b707541a0552aa8
SHA512 fb0cf5e5e10734003c1f886b71ee91cb9a6919012b375027c94b22e3876a294eafef7a29d6b7b8215f3c5fd7618d7e1a44d30197c7c69443e503c97d56455412
TLSH
T16941BEF783F4966E890196F4AA186F1BCE2C0511432C7C5AC9E4AE2793E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d6d65cb66aa53a4af4cae7efb3ce3d3e8291f72903cb7465619866cb03723848
MD5 f9257fdaf756414e276aece57820142b
SHA1 b5d4edbd39840ec76305b4780c87c5c7f401f4fd
SHA512 91d1e50d92efb0dc684153b5e92998bc489e83a08bb8b1eb0486c23bbef787b474a28b129bce4fe3fd4dadef288929052ee3853be7cf82a3f3cd75dd2ccef90a
SSDEEP 192:sxRGR1CQb/fu+sumE/aXZFFCHzszoD8p9dY/g6+WNCdGL/YGdfbjk2GrIgV/iJ:sxRGq2/fVsumEipFFKzEU/5R/gVB+
TLSH
T18D42DA156968A93B5CC7E25DFA657F53D6F91032A0D11E48EBFC8A0C05EB6DE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c1a21a482f0d3fa9bccab90c52ec03cd5ea2ebc7d7dc274d369d910ca2ef0f37
MD5 2b3774044e640c301330cb15240ef576
SHA1 396f2f9f12574cda80b35602bb733205112e7dca
SHA512 027c19cd00b10352bdc2c620122bd89ff9c14aeeefc00c975e740b2545ef3a69c31fb414154dafb2d5ade65b48d5d2985d877077ff445737d1e1a362a1f2ab5a
SSDEEP 192:sxRtR1CQb/fu+sbmE/aXZFFCHzszoD8p9dY/g6+WNCdGL/YGdfbjk2GrIgDl/iJ:sxRtq2/fVsbmEipFFKzEU/5R/gVN+
TLSH
T17542D9156968A93B5CC7E25DFA557F53D6F91032A0912E48ABFC8B0C05EB6DE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 13a58272a1615cebc29be50a5e458c60fcb627d10e44e449a0114cd93682deb7
MD5 27991363254332f04bc0f3747b0592e9
SHA1 e25a6975b8b76be722faca33148766ce2df9a5b1
SHA512 9c83587a7bd997eff01c7d0c0a384aefc7999435f6ef6f2aeb68cc4e1afb980762a6c94567cc8ee8363ee76a0ccb7721cf3e14dde1da597ea71401d792094229
SSDEEP 192:sxRtR1CQb/fu+sbmEXaXZFFCHzszoD8p9dY/g6+WNCdGL/YGd0Bk2GrIgD//iJ:sxRtq2/fVsbmEqpFFKzEU/5R/jVT+
TLSH
T18142D9156968A93B5CC7E24DBA557F53D7F91032A0912E48ABFC8B0C05EB6DE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 dc7cfb81e0bdcfff91316717165df3467f2150a11fae02dd1022a36615645ddc
MD5 0c6b8593ba0c391f8739b95568106aaa
SHA1 1fb7d44bd8be3b33bc4ca033919d61acd93fb690
SHA512 8fc80349089ef281133aa23424fef44dd69180b86b03b58bb0574300867641debec0c2f442ffce5c36f66b90681b8952af3b6d87ae0284a4b7316a42eba429b6
SSDEEP 768:UQYiV37pLuL78NWgv7fxJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVgD5pNKerol:UQYiVxE78NWgv7fxJu1jajD5fK1l
TLSH
T1B5D2DA7B640CCB7E4F804ADDAD197A9F6DA802CB9698CD8047FE941C02C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 423952290ef3e38e4ffd81ba397ba5217423bcb3ce678c2d602d17275e06114b
MD5 75f03b60c71e791dc8294c3bd60e274c
SHA1 19183c0fada9ffd300852c0ccee65f0178e24225
SHA512 9f9f5fbbccfe3c6de6edff40f2b218aed80f1db2e037f0edd3a312c9574e2a819d8d792308bbb923d45b37271fa5858d440aa3db4555f317d57b383850796e2c
SSDEEP 768:8C3TAqKSuSaCZ7Hucys6BRvi82oP4/z6himo6SPi9PHT:8C3TZXI3imOz6ImohP4
TLSH
T15F136CF098D79932E89E9387637D2E426EFCD263B0881944B7D95A0DCD8367FC216812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 08625f6919e001c29fb5df38abbb1919ae0518652297d945c1af9a58a321923d
MD5 bd29ffa944f525405c4182e9f3bc1213
SHA1 58fb5df3cb9d4d5a656e803ebb90d55aabb78b5b
SHA512 7932529f05b399657e045107a4edb0ce60440a5adbfc2a0a3e7239248328990dd1dadb6293540233d88b9ea89d5a01b295e9dd4a8b9f18da5981c47ef9c3fb12
SSDEEP 768:xGrv+4UNbdS32RSlYyJab7Hucys6BRvi82oP4/z6himo+m2bwn+h:xGbsbw32uP3imOz6ImoN0w+
TLSH
T17B03C035E4149D72ECE7C288B54A7BA37FF4522345C91A80E6DE1B0E429B95E131BC63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 631dde13fb3edad1d4f3857ba8524e3321e52d215fe698fd1da18753d17dc4bb
MD5 45f270c47797f9b01a0de553699155b1
SHA1 c7e799c72cc75b7f98329477fd89e68416f20a89
SHA512 3a74ac5227cb74d7a2b7ad5449d84a9c4c08c5cd41348a10a7fb54322bb74c926167052de0e7063f3c2908f72be292059052c826ec58ae20bb9a0a515cab57c8
SSDEEP 768:vrv+4UNbdC3xWqlYyJaCh7Hucys6BRvi82oP4/z6himo6SEe:vbsbw3x1XA3imOz6ImohEe
TLSH
T14603B030E858DE32ECE79288B1463B937FE5227744C90E94EADA5F4D02C759E131B863
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 7a976e060e7774026a33ae4fd29f5ea089143d41aa56878f480885a8cafa1cff
MD5 9605af85139ae0368a30da8af5639596
SHA1 82cff7b3c1acf7b98584321a9bbd8da1b322ef13
SHA512 e1fc5acbab0f01c70bcd87f5d768647e6f9e2ef874488d201be6502bf1a57da2bd7fcc77e8a1fac2ab36e9b9fe22b153ec45420f84f5155d1f01be748fd1b6da
SSDEEP 768:0rv+4UNbdS3FMlYyJaCs7Hucys6BRvi82oP4/z6himofS2bwn+h:0bsbw3UXJ3imOz6Imoq0w+
TLSH
T16203BF35E418DD32EDE79188B44A7BA37FF5127344890E80EADA5B4E4187A5F231B863
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 80666793a73f95f6a541520af2f2e55f7a868b934d78485f992337d0ed52a66d
MD5 d931d1441335df1a9600cb32c2f0b8a7
SHA1 cc0a41190982a5dec61a3c3aa7c3080417d9834e
SHA512 f80e9759b4da5880d5ddd87f24a95522ace64af715dffb16e258b72201d09457e53855db7b1c0d2821a096ae8c0fba925c9651675d782e76ccd148d3d00ef71c
SSDEEP 768:DR3TmqlYyJaCP7Hucys6BRvi82oP4/z6himo6SPi9PHT:DR3TlX+3imOz6ImohP4
TLSH
T1AEF2B070E854DE62ECEBE2C5B54537936EF51233A4C81E54E9DE9B0D06C7A5E031B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

d6a2c72b-80a1-4d9f-809c-f227d23bed14.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d6a2c72b-80a1-4d9f-809c-f227d23bed14.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5400_1800808679\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 ce0245666356deffdcd39fdd94985486cbdae027929739dac31a3a77cd08a6cb
MD5 00a749f01418b16b2a14d111de8d6bc6
SHA1 6b963efd4ed13dfc7516ec839eb50c91b6edf236
SHA512 22faa12cf20f759ac9bc2664dd7c2b8c0e254561751c8fbe70f74b780746769ba2311625c775fc851c81b411b6d230a9936011c07e5ce8406737c248e62b05be
TLSH
T12F71238357B9C5B3C1DE9FF102835604F6FF22384B2370244BA15586EB30A7A28B8F44
MD5 SHA1 SHA512 TLSH

Submit Download

memory/796-314-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/916-350-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/932-383-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1128-375-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1708-295-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1716-232-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2676-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2832-451-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2972-185-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3048-325-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3420-414-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3568-362-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3668-471-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3884-435-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3884-441-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3972-260-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4352-310-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4508-403-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4944-318-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5080-274-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5080-307-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5556-439-0x0000000000010000-0x00000000000AB000-memory.dmp

Download