40906ed34811b75bd56bf8a7bcc831a241185da2123d934c1858a77c3d137add

Analysis

max time kernel
149s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 08:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 722KB
Sample260816-kkfj6atepg
SHA256 40906ed34811b75bd56bf8a7bcc831a241185da2123d934c1858a77c3d137add
MD5 0a124bbac8d11b1af220ebfc25ac5fa3
SHA1 fb832f4ac6af06ecb30bfad243baa12c19d3ab32
SHA512 2e7194ed6c2ac970e531671952f6110aee1be3416d16eadd9acb1188767847d4a8346f55c80f1158184be739952de3c86376bca5835b8c279dff5b6ac2cde26d
SSDEEP 12288:pflfAsiVGjSGecvXAflfAsiVGjSGecvX:hMcfcMcf
TLSH
T103F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4580	bwuomgeywrojhbzt.exe
2524	bwuomgeywrojhbzt.sys
1128	CreateProcess.exe
2660	ecwuomgeyw.exe
4220	CreateProcess.exe
2016	CreateProcess.exe
1996	i_ecwuomgeyw.exe
3864	romgeywqoi.sys
980	CreateProcess.exe
3588	qojgeywqoi.exe
2872	CreateProcess.exe
4664	CreateProcess.exe
2100	i_qojgeywqoi.exe
5632	lgbvtnlgdb.sys
4408	CreateProcess.exe
3136	gdywqoidby.exe
5116	CreateProcess.exe
3152	CreateProcess.exe
1784	i_gdywqoidby.exe
856	lgdbytqlig.sys
3212	CreateProcess.exe
4852	avqnifdxvq.exe
6040	CreateProcess.exe
568	CreateProcess.exe
848	i_avqnifdxvq.exe
5456	caysqnigay.sys
1352	CreateProcess.exe
5888	xvpnifdxvp.exe
5248	CreateProcess.exe
5996	CreateProcess.exe
4412	i_xvpnifdxvp.exe
5268	kicaxspkif.sys
260	CreateProcess.exe
4964	kifaxspnkf.exe
5660	CreateProcess.exe
4588	CreateProcess.exe
5736	i_kifaxspnkf.exe
2612	mkhcausmke.sys
3328	CreateProcess.exe
4872	mhecxupmhe.exe
4108	CreateProcess.exe
3340	CreateProcess.exe
4936	i_mhecxupmhe.exe
3648	wusmkecwus.sys
4520	CreateProcess.exe
2040	mgecwurmhe.exe
5340	CreateProcess.exe
3668	CreateProcess.exe
5060	i_mgecwurmhe.exe
3944	mhecwuomge.sys
1652	CreateProcess.exe
2836	gecwuomjhb.exe
468	CreateProcess.exe
432	CreateProcess.exe
2428	i_gecwuomjhb.exe
1784	bywrojhbyw.sys
888	CreateProcess.exe
1056	ywrojgeywq.exe
6016	CreateProcess.exe
4764	CreateProcess.exe
1596	i_ywrojgeywq.exe
3364	trljgaywqo.sys
3528	CreateProcess.exe
4468	wqoigaywqo.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4952_818799967\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4952_501600267\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4952_501600267\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqoigaywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spnhfzxusp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmkecwupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxupmgecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtqkigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywrojgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgecwurmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmkecwupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oljhbzwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qojgeywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qojgeywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywrojgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqoigaywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytrojgbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bywtodyvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwuomgeywrojhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avqnifdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gecwuomjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gecwuomjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvqnifdyvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtqkigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdywqoidby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnifdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhecxupmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhecxupmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxupmgecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kifaxspnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdywqoidby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avqnifdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnifdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgecwurmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oljhbzwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kifaxspnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvqnifdyvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spnhfzxusp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bytrojgbyt.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4100	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4920	ipconfig.exe
3296	ipconfig.exe
4820	ipconfig.exe
5028	ipconfig.exe
4156	ipconfig.exe
1848	ipconfig.exe
1524	ipconfig.exe
3972	ipconfig.exe
5680	ipconfig.exe
3584	ipconfig.exe
4280	ipconfig.exe
2496	ipconfig.exe
2512	ipconfig.exe
1172	ipconfig.exe
4904	ipconfig.exe
3884	ipconfig.exe
5852	ipconfig.exe
5408	ipconfig.exe
124	ipconfig.exe
5780	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313431720621577"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4046655672-1449839301-2197395821-1000\{18C8ABCE-620C-4705-B4E8-C9937B35C521}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4580	bwuomgeywrojhbzt.exe
4580	bwuomgeywrojhbzt.exe
4580	bwuomgeywrojhbzt.exe
4580	bwuomgeywrojhbzt.exe
4580	bwuomgeywrojhbzt.exe
4580	bwuomgeywrojhbzt.exe
4580	bwuomgeywrojhbzt.exe
4580	bwuomgeywrojhbzt.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1996	i_ecwuomgeyw.exe
Token: SeDebugPrivilege	2100	i_qojgeywqoi.exe
Token: SeDebugPrivilege	1784	i_gdywqoidby.exe
Token: SeDebugPrivilege	848	i_avqnifdxvq.exe
Token: SeDebugPrivilege	4412	i_xvpnifdxvp.exe
Token: SeDebugPrivilege	5736	i_kifaxspnkf.exe
Token: SeDebugPrivilege	4936	i_mhecxupmhe.exe
Token: SeDebugPrivilege	5060	i_mgecwurmhe.exe
Token: SeDebugPrivilege	2428	i_gecwuomjhb.exe
Token: SeDebugPrivilege	1596	i_ywrojgeywq.exe
Token: SeDebugPrivilege	4380	i_wqoigaywqo.exe
Token: SeDebugPrivilege	5928	i_xvqnifdyvt.exe
Token: SeDebugPrivilege	1324	i_vtqkigaysq.exe
Token: SeDebugPrivilege	5088	i_qnifaysqki.exe
Token: SeDebugPrivilege	4256	i_spnhfzxusp.exe
Token: SeDebugPrivilege	4972	i_rmkecwupmh.exe
Token: SeDebugPrivilege	5532	i_zxupmgecwu.exe
Token: SeDebugPrivilege	2216	i_oljhbzwrpj.exe
Token: SeDebugPrivilege	364	i_bytrojgbyt.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4952	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5744 wrote to memory of 4580	5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 5744 wrote to memory of 484	5744	2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 484 wrote to memory of 4952	484	iexplore.exe	91
PID 4952 wrote to memory of 4172	4952	msedge.exe	92
PID 4952 wrote to memory of 1408	4952	msedge.exe	93
PID 4952 wrote to memory of 4100	4952	msedge.exe	95
PID 4952 wrote to memory of 1408	4952	msedge.exe	93
PID 4952 wrote to memory of 1408	4952	msedge.exe	93
PID 4952 wrote to memory of 4672	4952	msedge.exe	96
PID 4952 wrote to memory of 4672	4952	msedge.exe	96
PID 4952 wrote to memory of 2860	4952	msedge.exe	97
PID 4952 wrote to memory of 2860	4952	msedge.exe	97
PID 4952 wrote to memory of 2860	4952	msedge.exe	97
PID 4952 wrote to memory of 5496	4952	msedge.exe	98
PID 4952 wrote to memory of 5496	4952	msedge.exe	98
PID 4952 wrote to memory of 5496	4952	msedge.exe	98
PID 4952 wrote to memory of 1196	4952	msedge.exe	99
PID 4952 wrote to memory of 4412	4952	msedge.exe	100
PID 4952 wrote to memory of 1196	4952	msedge.exe	99
PID 4952 wrote to memory of 1196	4952	msedge.exe	99
PID 4952 wrote to memory of 4412	4952	msedge.exe	100
PID 4952 wrote to memory of 4412	4952	msedge.exe	100
PID 4952 wrote to memory of 1136	4952	msedge.exe	101
PID 4952 wrote to memory of 1136	4952	msedge.exe	101
PID 4952 wrote to memory of 3116	4952	msedge.exe	106
PID 4952 wrote to memory of 1288	4952	msedge.exe	105
PID 4952 wrote to memory of 3116	4952	msedge.exe	106
PID 4952 wrote to memory of 1288	4952	msedge.exe	105
PID 4952 wrote to memory of 5900	4952	msedge.exe	108
PID 4580 wrote to memory of 1128	4580	bwuomgeywrojhbzt.exe	109
PID 2660 wrote to memory of 4220	2660	ecwuomgeyw.exe	114
PID 4952 wrote to memory of 2788	4952	msedge.exe	117
PID 4952 wrote to memory of 2788	4952	msedge.exe	117
PID 4952 wrote to memory of 2820	4952	msedge.exe	118
PID 4952 wrote to memory of 2820	4952	msedge.exe	118
PID 4580 wrote to memory of 2016	4580	bwuomgeywrojhbzt.exe	119
PID 4580 wrote to memory of 980	4580	bwuomgeywrojhbzt.exe	123
PID 3588 wrote to memory of 2872	3588	qojgeywqoi.exe	125
PID 4580 wrote to memory of 4664	4580	bwuomgeywrojhbzt.exe	128
PID 4580 wrote to memory of 4408	4580	bwuomgeywrojhbzt.exe	132
PID 3136 wrote to memory of 5116	3136	gdywqoidby.exe	134
PID 4580 wrote to memory of 3152	4580	bwuomgeywrojhbzt.exe	137
PID 4580 wrote to memory of 3212	4580	bwuomgeywrojhbzt.exe	142
PID 4852 wrote to memory of 6040	4852	avqnifdxvq.exe	144
PID 4580 wrote to memory of 568	4580	bwuomgeywrojhbzt.exe	147
PID 4952 wrote to memory of 1752	4952	msedge.exe	149
PID 4952 wrote to memory of 3528	4952	msedge.exe	150
PID 4952 wrote to memory of 1132	4952	msedge.exe	151
PID 4580 wrote to memory of 1352	4580	bwuomgeywrojhbzt.exe	154
PID 5888 wrote to memory of 5248	5888	xvpnifdxvp.exe	156
PID 4580 wrote to memory of 5996	4580	bwuomgeywrojhbzt.exe	159
PID 4580 wrote to memory of 260	4580	bwuomgeywrojhbzt.exe	163
PID 4964 wrote to memory of 5660	4964	kifaxspnkf.exe	165
PID 4580 wrote to memory of 4588	4580	bwuomgeywrojhbzt.exe	168
PID 4580 wrote to memory of 3328	4580	bwuomgeywrojhbzt.exe	172
PID 4872 wrote to memory of 4108	4872	mhecxupmhe.exe	174
PID 4580 wrote to memory of 3340	4580	bwuomgeywrojhbzt.exe	177
PID 4580 wrote to memory of 4520	4580	bwuomgeywrojhbzt.exe	181
PID 2040 wrote to memory of 5340	2040	mgecwurmhe.exe	183
PID 4580 wrote to memory of 3668	4580	bwuomgeywrojhbzt.exe	186
PID 4952 wrote to memory of 5456	4952	msedge.exe	188
PID 4952 wrote to memory of 5456	4952	msedge.exe	188
PID 4580 wrote to memory of 1652	4580	bwuomgeywrojhbzt.exe	194
PID 2836 wrote to memory of 468	2836	gecwuomjhb.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_0a124bbac8d11b1af220ebfc25ac5fa3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5744
- C:\Temp\bwuomgeywrojhbzt.exe
  C:\Temp\bwuomgeywrojhbzt.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwuomgeyw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1128
  - - C:\Temp\ecwuomgeyw.exe
      C:\Temp\ecwuomgeyw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2660
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4220
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3296
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwuomgeyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2016
  - - C:\Temp\i_ecwuomgeyw.exe
      C:\Temp\i_ecwuomgeyw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1996
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qojgeywqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:980
  - - C:\Temp\qojgeywqoi.exe
      C:\Temp\qojgeywqoi.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3588
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2872
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4280
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qojgeywqoi.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4664
  - - C:\Temp\i_qojgeywqoi.exe
      C:\Temp\i_qojgeywqoi.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2100
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gdywqoidby.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4408
  - - C:\Temp\gdywqoidby.exe
      C:\Temp\gdywqoidby.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3136
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5116
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gdywqoidby.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3152
  - - C:\Temp\i_gdywqoidby.exe
      C:\Temp\i_gdywqoidby.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1784
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\avqnifdxvq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3212
  - - C:\Temp\avqnifdxvq.exe
      C:\Temp\avqnifdxvq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4852
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6040
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2496
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_avqnifdxvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:568
  - - C:\Temp\i_avqnifdxvq.exe
      C:\Temp\i_avqnifdxvq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:848
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvpnifdxvp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1352
  - - C:\Temp\xvpnifdxvp.exe
      C:\Temp\xvpnifdxvp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5888
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5248
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3972
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvpnifdxvp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5996
  - - C:\Temp\i_xvpnifdxvp.exe
      C:\Temp\i_xvpnifdxvp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4412
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kifaxspnkf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:260
  - - C:\Temp\kifaxspnkf.exe
      C:\Temp\kifaxspnkf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4964
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5660
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5680
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kifaxspnkf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4588
  - - C:\Temp\i_kifaxspnkf.exe
      C:\Temp\i_kifaxspnkf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5736
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mhecxupmhe.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3328
  - - C:\Temp\mhecxupmhe.exe
      C:\Temp\mhecxupmhe.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4872
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4108
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4820
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mhecxupmhe.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3340
  - - C:\Temp\i_mhecxupmhe.exe
      C:\Temp\i_mhecxupmhe.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4936
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mgecwurmhe.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4520
  - - C:\Temp\mgecwurmhe.exe
      C:\Temp\mgecwurmhe.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2040
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5340
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3584
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mgecwurmhe.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3668
  - - C:\Temp\i_mgecwurmhe.exe
      C:\Temp\i_mgecwurmhe.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gecwuomjhb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1652
  - - C:\Temp\gecwuomjhb.exe
      C:\Temp\gecwuomjhb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2836
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:468
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5028
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gecwuomjhb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:432
  - - C:\Temp\i_gecwuomjhb.exe
      C:\Temp\i_gecwuomjhb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2428
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywrojgeywq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:888
  - - C:\Temp\ywrojgeywq.exe
      C:\Temp\ywrojgeywq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1056
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6016
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4156
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywrojgeywq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4764
  - - C:\Temp\i_ywrojgeywq.exe
      C:\Temp\i_ywrojgeywq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1596
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wqoigaywqo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3528
  - - C:\Temp\wqoigaywqo.exe
      C:\Temp\wqoigaywqo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4468
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1132
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wqoigaywqo.exe ups_ins
    3⤵
    PID:5060
  - - C:\Temp\i_wqoigaywqo.exe
      C:\Temp\i_wqoigaywqo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvqnifdyvt.exe ups_run
    3⤵
    PID:2032
  - - C:\Temp\xvqnifdyvt.exe
      C:\Temp\xvqnifdyvt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4636
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5028
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1172
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvqnifdyvt.exe ups_ins
    3⤵
    PID:2788
  - - C:\Temp\i_xvqnifdyvt.exe
      C:\Temp\i_xvqnifdyvt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5928
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtqkigaysq.exe ups_run
    3⤵
    PID:4472
  - - C:\Temp\vtqkigaysq.exe
      C:\Temp\vtqkigaysq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4820
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3148
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5408
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtqkigaysq.exe ups_ins
    3⤵
    PID:4140
  - - C:\Temp\i_vtqkigaysq.exe
      C:\Temp\i_vtqkigaysq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1324
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnifaysqki.exe ups_run
    3⤵
    PID:2512
  - - C:\Temp\qnifaysqki.exe
      C:\Temp\qnifaysqki.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2456
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3652
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4920
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnifaysqki.exe ups_ins
    3⤵
    PID:4552
  - - C:\Temp\i_qnifaysqki.exe
      C:\Temp\i_qnifaysqki.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5088
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spnhfzxusp.exe ups_run
    3⤵
    PID:2600
  - - C:\Temp\spnhfzxusp.exe
      C:\Temp\spnhfzxusp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5676
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:872
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4904
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spnhfzxusp.exe ups_ins
    3⤵
    PID:4564
  - - C:\Temp\i_spnhfzxusp.exe
      C:\Temp\i_spnhfzxusp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rmkecwupmh.exe ups_run
    3⤵
    PID:2776
  - - C:\Temp\rmkecwupmh.exe
      C:\Temp\rmkecwupmh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2428
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5176
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rmkecwupmh.exe ups_ins
    3⤵
    PID:824
  - - C:\Temp\i_rmkecwupmh.exe
      C:\Temp\i_rmkecwupmh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4972
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxupmgecwu.exe ups_run
    3⤵
    PID:2284
  - - C:\Temp\zxupmgecwu.exe
      C:\Temp\zxupmgecwu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1472
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4156
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5780
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxupmgecwu.exe ups_ins
    3⤵
    PID:1596
  - - C:\Temp\i_zxupmgecwu.exe
      C:\Temp\i_zxupmgecwu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5532
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oljhbzwrpj.exe ups_run
    3⤵
    PID:956
  - - C:\Temp\oljhbzwrpj.exe
      C:\Temp\oljhbzwrpj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:800
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5684
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3884
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oljhbzwrpj.exe ups_ins
    3⤵
    PID:848
  - - C:\Temp\i_oljhbzwrpj.exe
      C:\Temp\i_oljhbzwrpj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2216
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bytrojgbyt.exe ups_run
    3⤵
    PID:1256
  - - C:\Temp\bytrojgbyt.exe
      C:\Temp\bytrojgbyt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6100
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3296
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5852
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bytrojgbyt.exe ups_ins
    3⤵
    PID:5476
  - - C:\Temp\i_bytrojgbyt.exe
      C:\Temp\i_bytrojgbyt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:364
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bywtodyvtn.exe ups_run
    3⤵
    PID:2444
  - - C:\Temp\bywtodyvtn.exe
      C:\Temp\bywtodyvtn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5044
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3052
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1848
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffbab9cc188,0x7ffbab9cc194,0x7ffbab9cc1a0
      4⤵
      PID:4172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1572,i,14310878152503303681,12877324870974864362,262144 --field-trial-handle=2236,i,18118333339855921128,1257475574773766306,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
      4⤵
      PID:1408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,13042835540555991245,18316477472570817624,524288 --field-trial-handle=2236,i,18118333339855921128,1257475574773766306,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:11
      4⤵
      System Time Discovery
      PID:4100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2436,i,9838322160248603448,6201452271109195924,524288 --field-trial-handle=2236,i,18118333339855921128,1257475574773766306,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:13
      4⤵
      PID:4672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3616,i,17497275317428820952,4828225843362938408,2097152 --field-trial-handle=2236,i,18118333339855921128,1257475574773766306,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
      4⤵
      PID:2860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3636,i,4334464969918318901,1008388656600604200,2097152 --field-trial-handle=2236,i,18118333339855921128,1257475574773766306,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
      4⤵
      PID:5496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4328,i,7215958204814862501,8006422271016898334,2097152 --field-trial-handle=2236,i,18118333339855921128,1257475574773766306,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:1
      4⤵
      PID:1196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4344,i,2490564699156851971,3182089477884352487,2097152 --field-trial-handle=2236,i,18118333339855921128,1257475574773766306,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:9
      4⤵
      PID:4412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,15966942462170718704,16123918588954056977,524288 --field-trial-handle=2236,i,18118333339855921128,1257475574773766306,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
      4⤵
      PID:1136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,11164370648544821693,16629209592869186681,524288 --field-trial-handle=2236,i,18118333339855921128,1257475574773766306,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
      4⤵
      PID:1288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,12540527460187050658,16444773044384531295,524288 --field-trial-handle=2236,i,18118333339855921128,1257475574773766306,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
      4⤵
      PID:3116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,8406743919748938165,11732728550244974601,524288 --field-trial-handle=2236,i,18118333339855921128,1257475574773766306,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
      4⤵
      PID:5560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,8406743919748938165,11732728550244974601,524288 --field-trial-handle=2236,i,18118333339855921128,1257475574773766306,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
      4⤵
      PID:5900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,11252023390119082518,2823045363940701694,524288 --field-trial-handle=2236,i,18118333339855921128,1257475574773766306,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
      4⤵
      PID:2788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,15690612204574414351,720622756608773443,524288 --field-trial-handle=2236,i,18118333339855921128,1257475574773766306,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:14
      4⤵
      PID:2820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,596739747003029113,8799198454235655935,524288 --field-trial-handle=2236,i,18118333339855921128,1257475574773766306,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:14
      4⤵
      PID:1752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,6244568188794952802,10123001897934053465,524288 --field-trial-handle=2236,i,18118333339855921128,1257475574773766306,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:14
      4⤵
      PID:3528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3828,i,10443450085373681947,3515193460770602236,524288 --field-trial-handle=2236,i,18118333339855921128,1257475574773766306,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14
      4⤵
      PID:1132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,6992292431831153043,15374181185419585556,524288 --field-trial-handle=2236,i,18118333339855921128,1257475574773766306,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
      4⤵
      PID:5456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,15393459563201930244,14367050586185733578,524288 --field-trial-handle=2236,i,18118333339855921128,1257475574773766306,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:14
      4⤵
      PID:3612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6568,i,5695906551681533163,6059296785819610525,262144 --field-trial-handle=2236,i,18118333339855921128,1257475574773766306,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:10
      4⤵
      PID:2516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,13554413769211904327,7387492498404186203,524288 --field-trial-handle=2236,i,18118333339855921128,1257475574773766306,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
      4⤵
      PID:2924

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5972

C:\Temp\bwuomgeywrojhbzt.sys
C:\Temp\bwuomgeywrojhbzt.sys
1⤵
- Executes dropped EXE
PID:2524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3008

C:\Temp\romgeywqoi.sys
C:\Temp\romgeywqoi.sys
1⤵
- Executes dropped EXE
PID:3864

C:\Temp\lgbvtnlgdb.sys
C:\Temp\lgbvtnlgdb.sys
1⤵
- Executes dropped EXE
PID:5632

C:\Temp\lgdbytqlig.sys
C:\Temp\lgdbytqlig.sys
1⤵
- Executes dropped EXE
PID:856

C:\Temp\caysqnigay.sys
C:\Temp\caysqnigay.sys
1⤵
- Executes dropped EXE
PID:5456

C:\Temp\kicaxspkif.sys
C:\Temp\kicaxspkif.sys
1⤵
- Executes dropped EXE
PID:5268

C:\Temp\mkhcausmke.sys
C:\Temp\mkhcausmke.sys
1⤵
- Executes dropped EXE
PID:2612

C:\Temp\wusmkecwus.sys
C:\Temp\wusmkecwus.sys
1⤵
- Executes dropped EXE
PID:3648

C:\Temp\mhecwuomge.sys
C:\Temp\mhecwuomge.sys
1⤵
- Executes dropped EXE
PID:3944

C:\Temp\bywrojhbyw.sys
C:\Temp\bywrojhbyw.sys
1⤵
- Executes dropped EXE
PID:1784

C:\Temp\trljgaywqo.sys
C:\Temp\trljgaywqo.sys
1⤵
- Executes dropped EXE
PID:3364

C:\Temp\igeywqoigb.sys
C:\Temp\igeywqoigb.sys
1⤵
PID:3004

C:\Temp\xvtnlfdays.sys
C:\Temp\xvtnlfdays.sys
1⤵
PID:5956

C:\Temp\vsnkfdxvpn.sys
C:\Temp\vsnkfdxvpn.sys
1⤵
PID:3544

C:\Temp\pnhfcaxrpn.sys
C:\Temp\pnhfcaxrpn.sys
1⤵
PID:4808

C:\Temp\xusmkhczxs.sys
C:\Temp\xusmkhczxs.sys
1⤵
PID:5476

C:\Temp\wurmkeczur.sys
C:\Temp\wurmkeczur.sys
1⤵
PID:6084

C:\Temp\rojhezwrom.sys
C:\Temp\rojhezwrom.sys
1⤵
PID:4936

C:\Temp\jdbolgeywq.sys
C:\Temp\jdbolgeywq.sys
1⤵
PID:1452

C:\Temp\geywqolgdy.sys
C:\Temp\geywqolgdy.sys
1⤵
PID:2516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

avqnifdxvq.exe

Path C:\Temp\avqnifdxvq.exe
Size 722KB
SHA256 85f62575e3bb140fe6a9b68c436fd8dd5b776dc259831757e777b26d9b485abe
MD5 6946067704079c65e605950bcf235c23
SHA1 1e8d83279eaed7e9f4304dc5bf31f9717ec54e56
SHA512 aa4e2c639701a402b6ac4ae564c71dc3a184db87037e4d676541d0dcc4a1fd447955144ada43afde97b339af8753d6d0c939ffd0774c41c80942d73a2c9c14ed
SSDEEP 12288:6flfAsiVGjSGecvXAflfAsiVGjSGecvX:WMcfcMcf
TLSH
T14DF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bwuomgeywrojhbzt.exe

Path C:\Temp\bwuomgeywrojhbzt.exe
Size 722KB
SHA256 8a4ec34401b4fa47384ae54f2fe0014522b816577f6bcf5bb0e901599e0d7046
MD5 413d44a3383edd7409003e6bf606683a
SHA1 7c73fb64931d2b9eb0f0d4d14422ae82774b88e1
SHA512 69fb841f3e4c7af04f5e56a52add7c4de654a9c44a6a608c2914509b8cddfdc65cfca41a76a35e8b727decab35c2a6397fbb39c4d2d67c9fc88535f9e911a7d8
SSDEEP 12288:XflfAsiVGjSGecvXAflfAsiVGjSGecvX:vMcfcMcf
TLSH
T1A7F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bwuomgeywrojhbzt.sys

Path C:\Temp\bwuomgeywrojhbzt.sys
Size 293KB
SHA256 e0fae3554562c72698ad093f520545e3b4d3e5203c9326b351c86370485bd72d
MD5 3d9062e1867698ee912ef63fd5e7dd50
SHA1 10dca93497b8c0f4b807257cc17e7fab6ba9a57c
SHA512 51256e332a37f36e1b632f7cc77e7d127f1c820355faff7d46b8af20f803d7ef1e4952dc59401508facc2c701762877d4fee3d75a7aa31911ab65c3dbc2209a0
SSDEEP 3072:4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:4IJjiJcbI03GBc3ucY5DCSj
TLSH
T13C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

caysqnigay.sys

Path C:\Temp\caysqnigay.sys
Size 293KB
SHA256 47d78218b3c2941061d39bcf4fc7ba49ccc61d0e49b78585fd30db8fa4b19729
MD5 141c7e28f01b05807d08b0434909d267
SHA1 eeb83bdde23c4b572f5439984d88966f17a6d601
SHA512 7af81faf96be577312341bd6343f1c685bd766a8fe4fc6e156844d6acb6cd7ebe4af2b2305b2a96e2ef6003f5a4f3096bea7ddd288005edc632bd58f664a0aca
SSDEEP 3072:mtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:mIJjiJcbI03GBc3ucY5DCSj
TLSH
T105545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwuomgeyw.exe

Path C:\Temp\ecwuomgeyw.exe
Size 722KB
SHA256 2f4eef7e41f9968aac27729b5af624113a355df8c33b4e259ad7b5d54f8b309a
MD5 8cb70deea8f5e760c26d132eff438cb0
SHA1 6c8e4d8e8b2406565e6a9eb9ddfebae9be787611
SHA512 674fdd6ab481abc4ec262d8a01b9951123b361e11d3c83a9586e99091223848a7e730a56fbce4a440cbe553de748527c5e2092446f985720b1bf69fc3930c0fa
SSDEEP 12288:0flfAsiVGjSGecvXAflfAsiVGjSGecvX:wMcfcMcf
TLSH
T112F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdywqoidby.exe

Path C:\Temp\gdywqoidby.exe
Size 722KB
SHA256 c89a4f1d3652ba56436334923027c27628eb39fa37db76eb6f0727d1aa38e378
MD5 c0b08ce3a03a8964db679ecdae27ecea
SHA1 2854250257f951ba1fe24cce90b604c7c4df9837
SHA512 d32870ba41681ff2bda405c5a493237ec6d2c8bbcd89b16b61641ee98daa54af628c97cc1e585ea2b8fc5c14e53acf9921e9d1b18302f76e894330c9a8b08a1b
SSDEEP 12288:/flfAsiVGjSGecvXAflfAsiVGjSGecvX:nMcfcMcf
TLSH
T1AFF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_avqnifdxvq.exe

Path C:\Temp\i_avqnifdxvq.exe
Size 722KB
SHA256 a9ec36b4c087aad3b7eb0607bdc9725b9a4897916ad3673da8325180a6b01c02
MD5 8b2c56ac2fce3ec53076942f90e52355
SHA1 d379ca091887e734e500ea75b57bf49b1b3b160d
SHA512 9581aaf7b104a42abb9fe20b461fa1f82e3dc1d589247f6eb14788c6f25ab974e5012fd739b7d669d988c6dbf67bce38a6eaadcb8c13413f0ab248217cc3fe6c
SSDEEP 12288:SflfAsiVGjSGecvXAflfAsiVGjSGecvX:eMcfcMcf
TLSH
T1CFF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ecwuomgeyw.exe

Path C:\Temp\i_ecwuomgeyw.exe
Size 722KB
SHA256 6088ae6019461c30d3fa5fe5c9c7bbf76b0c0b245df10d4d2816706d3b33da10
MD5 8cbc20d920955c43ce798d3d99f7d5b8
SHA1 32b577a171e018343b0539aa5f52455c67787a0a
SHA512 ffafca573d92e251c6434281cfcbf4355dac02ffa6c83efe1268efba1eba51d35a94b12db9288c5293c82f51504725edce24a6b2f02564db74f75a4426c3505e
SSDEEP 12288:oflfAsiVGjSGecvXAflfAsiVGjSGecvX:0McfcMcf
TLSH
T16CF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gdywqoidby.exe

Path C:\Temp\i_gdywqoidby.exe
Size 722KB
SHA256 c3dcc3cf60d142aa384bb70fce4b6cf2ee32495133d7a41cf09552087ccb66de
MD5 7d1d4367bf0fe36963e22ca884d62d81
SHA1 8fe447b1f22413f28fb487d815f10c0b5b068d52
SHA512 fc59c43d120425d3c3a2a859e99ef15f55e1fecc8b53ea75b2cd86d554b89fd68ccf633229b4cb25f998c8869523fdd4413231cbee37bdecc55b65fada2a5705
SSDEEP 12288:gflfAsiVGjSGecvXAflfAsiVGjSGecvX:8McfcMcf
TLSH
T1D6F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qojgeywqoi.exe

Path C:\Temp\i_qojgeywqoi.exe
Size 722KB
SHA256 766e396fcba9fdf644cc780ed6a9b3783073938b3241b0cfd54a379043842c2e
MD5 11aa5e6d06cbf129632315ee4d93f98a
SHA1 d68d27e1fac399c32df51bd45523ad061c5daf91
SHA512 2ce389531f91ea4392ec8b412e62bb5f2a07de137ea546b90274bc42a263a6ce616a9cff356be90c93e3518f96131fed78bfd3a533f6ad87f11c1dfdafcd7a66
SSDEEP 12288:zflfAsiVGjSGecvXAflfAsiVGjSGecvX:bMcfcMcf
TLSH
T188F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xvpnifdxvp.exe

Path C:\Temp\i_xvpnifdxvp.exe
Size 722KB
SHA256 7dee04e362cddb3836bb5fe963ce5e09ec76544aa9c5af1a67d399a8f716b908
MD5 81943942475a6daa57064b615159481c
SHA1 fbde419c4c00a080943a5b1c2eaafec5343455de
SHA512 fbbee01cd17f906cfba3bcfa33714cf6ff967e51fb6af370b689ebe90dc772caadfca14656846d01e3bbbbf1ed04b24abe157aaf595efb857ef6167c9a5c0814
SSDEEP 12288:oflfAsiVGjSGecvXAflfAsiVGjSGecvX:0McfcMcf
TLSH
T1BDF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicaxspkif.sys

Path C:\Temp\kicaxspkif.sys
Size 293KB
SHA256 002709dff0d5e3c761cc7f1e892b775403d265a61a01b4fe8d23a57daf974fb0
MD5 c77c4a9c72d397c39f99dd5240c1d743
SHA1 3190631cf5a893120164045819da3dde5142490c
SHA512 56238b483a280f571f6c845876dc06f37e9149960477faf1c9857aff00642fabf25c961a9c44862946ffb47cf8b30d6f06adba55ba6bc8bfefb05f4e37db3807
SSDEEP 3072:6tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:6IJjiJcbI03GBc3ucY5DCSj
TLSH
T1E4545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kifaxspnkf.exe

Path C:\Temp\kifaxspnkf.exe
Size 722KB
SHA256 c20e1c9045543485c16494f236d2937be0646f345788a3a6ff2fde0418a39a63
MD5 d3403f31427c6195b2d4a363d9471743
SHA1 8e1ea24a664e6d735db14dc70bc10b12d9342f26
SHA512 302c199f6631d59906965aca585d830a8d1cb98c62afc05d81ca32c25d4f5c67b6a3e28436b853239db05cfeec1621cf9308049a4366a1909776489d35075ef1
SSDEEP 12288:5flfAsiVGjSGecvXAflfAsiVGjSGecvX:RMcfcMcf
TLSH
T150F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgbvtnlgdb.sys

Path C:\Temp\lgbvtnlgdb.sys
Size 293KB
SHA256 6d62aa405f2a187dd1f82db7ff6dfff87962c4e67a7b91a21a004974496b4b01
MD5 987537ac374fb2c6685bd0e47b949165
SHA1 166d804b67c16b9a37a05957113791c75dd4c444
SHA512 6b79d1282de2113974efc7cf8360cb2f70d4a5a2083936315e08c498145c453d804d2cc8cd2ebc1e6f0b506366b797576d956b6faab626db751d41d52d7da5bf
SSDEEP 3072:PtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:PIJjiJcbI03GBc3ucY5DCSj
TLSH
T1CC545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgdbytqlig.sys

Path C:\Temp\lgdbytqlig.sys
Size 293KB
SHA256 745474886944504b6545776440a33bbaf87c54aa3c3af0e2435b7e46e2407e16
MD5 254903b4af92a841aa99c60af1a65896
SHA1 f709f42bb9527b5e6becdf1c156dd80ffbaec164
SHA512 486e26e51f5847bbdab5ce6575fe187d50c33e0e6364b9387590e4cd7edaa5c926117dcf483679f2e5c0e685f0582f3e6d46de80701b097c100abe456b36f5af
SSDEEP 3072:xtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:xIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F4545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qojgeywqoi.exe

Path C:\Temp\qojgeywqoi.exe
Size 722KB
SHA256 beffa74eeaf35687defb3e22ffd96b6e0c37230eeec9dfa55bfdc1610a537192
MD5 d8a12bca392138ac3f275a0d097d4b69
SHA1 4c0cb3dff89110b442ae4637a6b730793892f4cf
SHA512 0cf8d939beb9367033f98f4d6c9c5ef4ed845a5b2ca9cc7528e558618be33e722083e2284f2797103e9ae17f9be3a674948e960e0d239d031245f56cabae20a8
SSDEEP 12288:GflfAsiVGjSGecvXAflfAsiVGjSGecvX:SMcfcMcf
TLSH
T112F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

romgeywqoi.sys

Path C:\Temp\romgeywqoi.sys
Size 293KB
SHA256 3538d06170dcea771eb7f40aca7554c4bb61e46acafc211033a8366454fe0b0c
MD5 27f9231d9ff2abd2e2dccaa0213a31c3
SHA1 6b7d89aaa05ceb5c8792f0c18ecf9d91b071d8d2
SHA512 7428e1f57c90c56be98da39de2ed7a4b9cd17979d733283ad93cd03f4766810cce1517eef7e1bd68ecbce0a07829f57dfcd360f34017ce5c5076a55a3bdc9efb
SSDEEP 3072:NtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:NIJjiJcbI03GBc3ucY5DCSj
TLSH
T1ED545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvpnifdxvp.exe

Path C:\Temp\xvpnifdxvp.exe
Size 722KB
SHA256 3816cfbf0b0f7162fb50e240775a9c9f40d9b1c303fdd074b95e07d761403768
MD5 0ddcbeee14ba4c8e845c020b98c25575
SHA1 24d4b1f05d79f574780b0010a25e091495923475
SHA512 ae675838f54d825766ef8ea696074e64ec80897becce2211221bfd76b4ceb5352ec05e8eba17774a5e4c01a0844e52eb3c8ba0824d11705a3d10435e59f30b98
SSDEEP 12288:6flfAsiVGjSGecvXAflfAsiVGjSGecvX:WMcfcMcf
TLSH
T116F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e75f270f1371188bd7f350113eee1f4d141652add7af8e5f7af0ab47dac6d1f2
MD5 e0e7da4c84e8882b494037c575bd294c
SHA1 04d43c383ac5d232ee362aad151519414dc6db2b
SHA512 70d9ca23de3befb782d3d04a586490c626e7c63ad00fac39b0fd9adeae2c1d8413a5d2474e847fabb4f48bbf1384f1fcd10e67765d21ed94ac67795b274b3c2e
TLSH
T122D09294BB60A90CCC81B0322AE66355BA1598A1182D868900A5F07A9CA8AC246179AF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e35119268ad2455b6ec4314361db946ee09b095b28e62d25bbd7542d6be959b9
MD5 5c633da04aeb5bea485c08ea28f57d24
SHA1 1c5287022e764ef0bb6d895cd993be007ab68eba
SHA512 341697613439896bbdc5bae2e067bf2b52fd4ee959460166157f5fcf5f0647d000c9824a7394abad2ea244ee761164649972236a37dd919e413ac011474bb4b7
TLSH
T12DD09B947B50A50CCC41703229E5535579155461581D45450055F0799C646C246175BF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 f37d9b2114880a0b86ab487f0c1385c76bc1d26c0067fe7346e7c09a43fc528a
MD5 3c960a8f88c5a95223602a9a406dd7e3
SHA1 cd9970140f18e9a0865c39e19f5305c84f18302c
SHA512 9e2843caa56c37b40624aaa275b2446eeff6c31488c0dcaadd6c91a54fe5ce21ea6fa62237ca13d398d7b5045fe152368a428f4a6feae2437bafe9b6dd2442f9
TLSH
T14C5198566FB8D6E1D338E37163F0574433F9A8A94A079E122052FD32198EF87B0E0253
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599a90.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599a90.TMP
Size 2KB
SHA256 d2dc551b66bff16c90765d7cd0e2cd029537503441b94c1542fa7e3a126931c1
MD5 3f204eb5278012a43493301c6157df52
SHA1 fa1c6704f30ce063217020557ba85b553361da45
SHA512 594854ad0ad50bd849708ee0634f63d21c57fcc0d0d49bc67946b29e3f611a014c8a4ea77cf7c083e0ff796ab1dc2ecf3144d4c4d1b345735fc60d6ab2f9ceb8
TLSH
T11F5198566FB8D6E1D338E67163F0574833F9A8A94A079F122052ED32198EF87F4E0253
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

91914f15-9708-4fda-be62-acf7d8e8c12b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\91914f15-9708-4fda-be62-acf7d8e8c12b.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 69319d0f0b779794b1b91d0fb3d9baceb7e34f007dbc50ae957402f12351eb4d
MD5 cf0c66209b76f4e087b3489aad95b9c9
SHA1 c4ef8a651e29cd106f5362ad2d9033429689c0ea
SHA512 840cfbb679ce4021edc1aa9226865cd4c3af4ebc8383c5e9ad50c6479754c09ac5d28c94be9332d04ee14e0dbd09b05bb84995afea6185b111249d674cf407a3
TLSH
T1F741BFF387F4856E8A0196F0AA186E1FDE1D0515436C7C5A89E09E2B93F3471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c4a382d62d2263ec60c7ee8a27ac1144d69706ba88d31ed50125eb8b66ca165c
MD5 8b7f31936beac02d5f06397134ae2f6c
SHA1 1f3fa4ddb99ae5f4adf86678330453961e60c921
SHA512 92f68a2b35ed91d5e334839a908ed77eb0e22e800aa8ba56f2ce937e1e60b8b842be8d08a54a3be5355dd6baf28e7bd96154df4773ef6a86a2daa49b4fda016a
SSDEEP 192:sxR7RbyM/jK1Ml8wCP/f2sB52MZINzoA8p9c/g6+WNCty/YECKiK6GpIgVGJ:sxR7x8P/f2sB52yIAq/5z/o4w
TLSH
T19862EA15AA34697B8CDBE20DFA557F53D3F81573A2941E04AEFC8A1C00E6ADD221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a0741a639ea8ee450ab86e263d8e88c4aaf7d13f15586cf55e0cc2a97bf413d3
MD5 c4babad1aba241d4ffdd095de41c569e
SHA1 404d3480e8a860972906b0184406e6dbfa5f16c4
SHA512 e2e0d18597f20d3d482e88988f2bbd0523849cd2bf187949ce50c38784613c0d5f546e287fad9db048ee0116cd3f57f7eac71f84cbb96ca19dba8c798b819a4a
SSDEEP 192:sxRwRbyM/jK1Ml8wCP/f2sA52MZINzoA8p9c/g6+WNCty/YECKiK6GpIgDFwGJ:sxRwx8P/f2sA52yIAq/5z/o4d
TLSH
T10D62FB15AA34697B8CDBE20DFA557F53D3F8157392941E04AEFC8A1C00EAADD221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e6c2b5bf260b10f787f306cebfcfc03316557d747e8a2de46055e8cbc01257f8
MD5 6c4137285771e3517b6f4f1be098cb82
SHA1 5decd19d382309476745b62315c74cd6aff131dd
SHA512 a8a8107c545d794de53cb60457b3578099c8682ec7c8a9d3a833ea5afab5800c674d39332f004b4239c5ba910c718deee55ea272927f7b0d9bfce71bd65dd8e7
SSDEEP 192:sxRwRbyM/jK1Ml8UQgCP/f2sA5lMZINzoA8prc/g6+WNCty/YEosiK6GpIgDFCGJ:sxRwxq3P/f2sA5lyIAQ/5z/C4j
TLSH
T1B4620A15AA2469779CDBE20DFA51BF53D3F8147392941E04AEFCCA1C00E6ADD221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 bae6c4ec7c31931fac4d762f710df3b1a5792558f7285754ce373981f81db6b1
MD5 90049db4f221afecc0651f6a33b0976d
SHA1 6837e32c3877c68b1a1d9cda20bf386e0ab57aa4
SHA512 97522333c4d3624cad25cda64948d5c2f98e37f428fb0257b2e4e3b1e982bf07f38af701df8d4a138707892242f769fb4a22b4586e28c9b4fabb73bde217e4b5
SSDEEP 768:0hiieW7pLuL7jaWgH7f3Q8F1+UoAYDCx9Tuqh0VfUC9xbog/OV5AeOV8Froz6o:0hiie2E7jaWgH7f3Qu1jaKAeI8+1
TLSH
T123E2FB3B680CCB7F4F404ADCEC29BD9A6DE801CB96D88D9447EA884C03C67EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a46bb1ae4a93fc90e9ff92d0e2d6d216072a3e69166f9f3a4aa37459d9152f94
MD5 1df543715567ee6eeb40317e1ff9d5b0
SHA1 0b7e19b8f50d8c1b61e9bc709c46c91253b321d9
SHA512 f4af9175bd9dc114a5becef85890b8434eb135070a83e24e12fbab2baba45cec80e793702a95d9d06c42f135830148d15a1a125ce648e8585369ef32f3433eb1
SSDEEP 96:KReTieYgQGWAltgeGK4DgcGcW+9M+XH7kh1DZpVW9yogdVK4kgzVcbDa9puHYp8V:CeTieYgQxAl+eODgc1W+9M+XH7kh1DZM
TLSH
T16491E951717B52843C3D6A1D82B88C3E92C17872301CB96B776965E64F66E038CFF8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a34fc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a34fc.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 063bb5890dcb8a23b6945eb99561764075918b9031fefda4793d23c8a5a8e587
MD5 48e3e6c0f10347c38338cfc1e41d7036
SHA1 76731cedad68fb3fd592c9cbb6c6327955fac547
SHA512 35b0877c43e21747f05ba207e44d05ba4d5ee0bd2a9e767bf2cbb4056a3fe4ee357fd034eb02f8a17d76ebc734290c5ce5b4ed7b5fec061ab09cc2847af56a8f
SSDEEP 768:2rv+4UNbdP3iUqGt8CD0zK48dHeByERRFzjK3Y/eVH1SCX:2bsbh32GX0W48dHSyw/pEH11
TLSH
T13913CE7068A8AE734CEBE28975477697BFF4016384C80F64D9D9AF4E458A0CC170BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d9e0dd75fa00be236a4ad7af29cc5666ff77a2fb289fe74df8a86d5978d5ed9f
MD5 29f548624552e59001edabe707792353
SHA1 c3575ab58783773b3f3f4f54c42b60e14e197700
SHA512 754563d945287f9282036a724c12852ba45b6fbc02068d88755105cd672271718f577d4569057ba56776b1f888168423f983a5c9d9602ca3afaff76667c80b77
SSDEEP 768:Qrv+4UNbdf3/qG9RD9K48dHeByERRFzjK3YkeVH1SCj:QbsbJ3yG/U48dHSyw/WEH1Z
TLSH
T15703CE71A8A85E734CE792897643B657BFF4412382C81BA4C5CD6F4E828B0DC130BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 c4ef7ceac2fe7c2a045a7693db901d6043a0d85f0ef503a88a6336947edf8e1a
MD5 1800a272bf3e41dc429b2787389e3483
SHA1 8461962dbc31ee23fad526c676d7568e6d51adb1
SHA512 a6404a359ed00e5d5fad6069c7fa31d086ecd0dc672455675cac47a106fdbab35c7b53192885f92e45ce10027a75961b83e3d7f96aee056ff8ec59be4d343225
SSDEEP 768:+rv+4UNbdf3VqGNgUD0hK48dHeByERRFzjK3J/eVH1SCj:+bsbJ3QGl0o48dHSyw/mEH1Z
TLSH
T1A303BE70A8A8AD734CEBA2897583B797BFF4016385C40B64D9D9AF4E45860CD170FD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 fe1dbfccc953a39b3e8876d5ce9de0d62263c5464d71f4a5cadb70fe2eb56f16
MD5 e4ea1509b90d3f9c4c30b19906bd4e8d
SHA1 121b1e5851c7e2ee313274f898400f84c8771a46
SHA512 0aa04c1d343ef93f480cda446a2bf440c799f34ecbaf15be1879f86664a28c84ac5663d90939ff17ac6964b12276d91a987380f8c9dba452c3b849ec679a3efc
SSDEEP 768:P03MUqGtWCD0vK48dHeByERRFzjK3Y/Pi9PR:P03gG50C48dHSyw/pPu
TLSH
T176F2BEB068A86D634CFBE2C976573797AFF00123D4C85E28D6DDEA0E448619D070BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 1fbab31ad21945624197f859791c94a53e9fa67bcc21b7698b9b7af9a848a2ce
MD5 a0439f472e9528b9551a5b9346283b93
SHA1 ad080a7b1523a43bc1f81c99b1791ffa051e0b9a
SHA512 f45c7bbca7a67ea29683535ee6a2e5e979562274ab93a84530d480920aae3268cc76c6a01952b8c3e338383bf0a700865db38b2f6f3eb231cb155b359932fca5
SSDEEP 768:yFQe3LwgYUqGt2m2XK48dHeByERRFzjK3Y/Pi9PR:Je3+Gg648dHSyw/pPu
TLSH
T15B1328F098D79977D8AE9787673D6E469AFCC053B4885994B7C89D0DCC820BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

1d6a98f0-6a44-4bf7-b980-316b0f8d2074.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1d6a98f0-6a44-4bf7-b980-316b0f8d2074.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4952_1545882633\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 d429f572d67cc572e848af46a7b477171fa5a6b6310c783411e342d1d10cbbce
MD5 5b175c2fad6ef26b69452255c8ae72cd
SHA1 3d2dd3d90efcbf50ca82180938f9a411ba24a827
SHA512 fd27b70ef0eb8cc0a0a2689ffcf3cf0c5fd947b70c03a94d9f1f9461910792121c876b0b9df8cc7871fab36d656358e2d24e4b69f1f4f4664a0e484420ddbe5f
TLSH
T13171238357B8C5B3C1DE5FF502835648F6FB22380B2330350B916546AB30A7A24B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/856-262-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1452-450-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1784-339-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2516-470-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2524-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2612-316-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3004-376-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3364-364-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3544-397-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3648-320-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3864-185-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3944-335-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4808-417-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4936-431-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5268-299-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5456-278-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5476-427-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5632-232-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5956-389-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6084-425-0x0000000000010000-0x00000000000AB000-memory.dmp

Download