47546c3734a22761a857dbd7505e8ee12fe381a5ab483475c5eb1b8c181d2e60

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 19:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 722KB
Sample260817-ya2arsgn7x
SHA256 47546c3734a22761a857dbd7505e8ee12fe381a5ab483475c5eb1b8c181d2e60
MD5 3b61055d9cf51c245be4fcb52b15e625
SHA1 e32d61fe40ccbb8d3a0c877f4ddeef1e7cae5cd3
SHA512 259f1c97fb589e42641ea80f77ce3f640d06c350c818b71d771975771a779e5b243e30096273b76cfbd60916632982c9e29120763831ae80df353b1663a766de
SSDEEP 12288:fflfAsiVGjSGecvXAflfAsiVGjSGecvX:HMcfcMcf
TLSH
T124F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1668	rljdbwtolgeywqoj.exe
1376	rljdbwtolgeywqoj.sys
5408	CreateProcess.exe
5412	omgbywqoig.exe
1852	CreateProcess.exe
5800	CreateProcess.exe
4768	i_omgbywqoig.exe
4500	oigaytqoig.sys
3944	CreateProcess.exe
4336	gbytnljdbw.exe
5764	CreateProcess.exe
5872	CreateProcess.exe
4260	i_gbytnljdbw.exe
5160	ljdbvtqliy.sys
4396	CreateProcess.exe
1360	vsnkifdxvp.exe
4940	CreateProcess.exe
4448	CreateProcess.exe
4240	i_vsnkifdxvp.exe
2872	skifaysqki.sys
5676	CreateProcess.exe
4768	nifaqkicau.exe
200	CreateProcess.exe
3752	CreateProcess.exe
5364	i_nifaqkicau.exe
5336	pnkicaxspk.sys
5340	CreateProcess.exe
2612	nhfzxvpnhf.exe
5344	CreateProcess.exe
5328	CreateProcess.exe
4792	i_nhfzxvpnhf.exe
1084	kfcxupmhec.sys
4556	CreateProcess.exe
1104	hfzxrpmkhc.exe
6068	CreateProcess.exe
5020	CreateProcess.exe
1128	i_hfzxrpmkhc.exe
3864	smkeuomkec.sys
3268	CreateProcess.exe
4500	ecwurpjhec.exe
6092	CreateProcess.exe
5636	CreateProcess.exe
3264	i_ecwurpjhec.exe
2144	omgecwuomg.sys
1512	CreateProcess.exe
5156	rmjecwjgey.exe
2984	CreateProcess.exe
1684	CreateProcess.exe
5908	i_rmjecwjgey.exe
480	mjdbwtomge.sys
1204	CreateProcess.exe
5048	ebwtomjebz.exe
5164	CreateProcess.exe
3240	CreateProcess.exe
2356	i_ebwtomjebz.exe
4900	ytrljdbvto.sys
1080	CreateProcess.exe
3784	wqoigbytrl.exe
4228	CreateProcess.exe
5772	CreateProcess.exe
4704	i_wqoigbytrl.exe
1944	vqnlgdynli.sys
1152	CreateProcess.exe
4188	nlfdbvtqki.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1384_1244300286\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1384_1255811726\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1384_951561397\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1384_1244300286\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1384_1255811726\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1384_1255811726\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1384_1255811726\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1384_659755631\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1384_951561397\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgbywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgbywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nifaqkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nifaqkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwtomjebz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljebztomje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwurpjhec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xusmkfcxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wromkeczur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljebztomje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igdbztqolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjecwjgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqoigbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbytnljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnkifdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwurpjhec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjecwjgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igdbztqolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljdbwtolgeywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxrpmkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicausnkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ligaytqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbytnljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnkifdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfzxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqoigbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdbvtqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkidavtnax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicausnkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upmhbzxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwtomjebz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdbvtqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkidavtnax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xusmkfcxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmhbzxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wromkeczur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ligaytqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfzxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxrpmkhc.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5864	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1684	ipconfig.exe
3192	ipconfig.exe
5560	ipconfig.exe
5160	ipconfig.exe
476	ipconfig.exe
4688	ipconfig.exe
720	ipconfig.exe
240	ipconfig.exe
1984	ipconfig.exe
3824	ipconfig.exe
4372	ipconfig.exe
4380	ipconfig.exe
880	ipconfig.exe
1512	ipconfig.exe
4328	ipconfig.exe
3424	ipconfig.exe
1884	ipconfig.exe
1664	ipconfig.exe
5228	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314689564671017"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{C62474CB-D065-436A-BF4F-594B92F0AD2D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1668	rljdbwtolgeywqoj.exe
1668	rljdbwtolgeywqoj.exe
1668	rljdbwtolgeywqoj.exe
1668	rljdbwtolgeywqoj.exe
1668	rljdbwtolgeywqoj.exe
1668	rljdbwtolgeywqoj.exe
1668	rljdbwtolgeywqoj.exe
1668	rljdbwtolgeywqoj.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	4768	i_omgbywqoig.exe
Token: SeDebugPrivilege	4260	i_gbytnljdbw.exe
Token: SeDebugPrivilege	4240	i_vsnkifdxvp.exe
Token: SeDebugPrivilege	5364	i_nifaqkicau.exe
Token: SeDebugPrivilege	4792	i_nhfzxvpnhf.exe
Token: SeDebugPrivilege	1128	i_hfzxrpmkhc.exe
Token: SeDebugPrivilege	3264	i_ecwurpjhec.exe
Token: SeDebugPrivilege	5908	i_rmjecwjgey.exe
Token: SeDebugPrivilege	2356	i_ebwtomjebz.exe
Token: SeDebugPrivilege	4704	i_wqoigbytrl.exe
Token: SeDebugPrivilege	1716	i_nlfdbvtqki.exe
Token: SeDebugPrivilege	1688	i_nkidavtnax.exe
Token: SeDebugPrivilege	6096	i_kicausnkfd.exe
Token: SeDebugPrivilege	2832	i_xusmkfcxup.exe
Token: SeDebugPrivilege	5032	i_upmhbzxrpj.exe
Token: SeDebugPrivilege	4192	i_wromkeczur.exe
Token: SeDebugPrivilege	4796	i_igdbztqolg.exe
Token: SeDebugPrivilege	5948	i_ligaytqljd.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1384	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3664 wrote to memory of 1668	3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 3664 wrote to memory of 5448	3664	2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 5448 wrote to memory of 1384	5448	iexplore.exe	91
PID 1384 wrote to memory of 1504	1384	msedge.exe	92
PID 1384 wrote to memory of 4528	1384	msedge.exe	93
PID 1384 wrote to memory of 5864	1384	msedge.exe	94
PID 1384 wrote to memory of 4528	1384	msedge.exe	93
PID 1384 wrote to memory of 4528	1384	msedge.exe	93
PID 1384 wrote to memory of 5916	1384	msedge.exe	95
PID 1384 wrote to memory of 5916	1384	msedge.exe	95
PID 1384 wrote to memory of 5044	1384	msedge.exe	96
PID 1384 wrote to memory of 5044	1384	msedge.exe	96
PID 1384 wrote to memory of 4968	1384	msedge.exe	97
PID 1384 wrote to memory of 5044	1384	msedge.exe	96
PID 1384 wrote to memory of 4968	1384	msedge.exe	97
PID 1384 wrote to memory of 4968	1384	msedge.exe	97
PID 1384 wrote to memory of 4596	1384	msedge.exe	99
PID 1384 wrote to memory of 1280	1384	msedge.exe	100
PID 1384 wrote to memory of 4596	1384	msedge.exe	99
PID 1384 wrote to memory of 4596	1384	msedge.exe	99
PID 1384 wrote to memory of 1280	1384	msedge.exe	100
PID 1384 wrote to memory of 1280	1384	msedge.exe	100
PID 1384 wrote to memory of 4512	1384	msedge.exe	101
PID 1384 wrote to memory of 4512	1384	msedge.exe	101
PID 1384 wrote to memory of 4512	1384	msedge.exe	101
PID 1384 wrote to memory of 4060	1384	msedge.exe	103
PID 1384 wrote to memory of 4060	1384	msedge.exe	103
PID 1384 wrote to memory of 704	1384	msedge.exe	106
PID 1384 wrote to memory of 704	1384	msedge.exe	106
PID 1384 wrote to memory of 704	1384	msedge.exe	106
PID 1384 wrote to memory of 2712	1384	msedge.exe	108
PID 1384 wrote to memory of 4276	1384	msedge.exe	107
PID 1384 wrote to memory of 2712	1384	msedge.exe	108
PID 1384 wrote to memory of 4276	1384	msedge.exe	107
PID 1668 wrote to memory of 5408	1668	rljdbwtolgeywqoj.exe	109
PID 5412 wrote to memory of 1852	5412	omgbywqoig.exe	112
PID 1384 wrote to memory of 5852	1384	msedge.exe	116
PID 1384 wrote to memory of 4556	1384	msedge.exe	117
PID 1384 wrote to memory of 4556	1384	msedge.exe	117
PID 1384 wrote to memory of 1580	1384	msedge.exe	120
PID 1384 wrote to memory of 1580	1384	msedge.exe	120
PID 1668 wrote to memory of 5800	1668	rljdbwtolgeywqoj.exe	121
PID 1668 wrote to memory of 3944	1668	rljdbwtolgeywqoj.exe	125
PID 4336 wrote to memory of 5764	4336	gbytnljdbw.exe	127
PID 1668 wrote to memory of 5872	1668	rljdbwtolgeywqoj.exe	130
PID 1668 wrote to memory of 4396	1668	rljdbwtolgeywqoj.exe	134
PID 1360 wrote to memory of 4940	1360	vsnkifdxvp.exe	136
PID 1668 wrote to memory of 4448	1668	rljdbwtolgeywqoj.exe	139
PID 1668 wrote to memory of 5676	1668	rljdbwtolgeywqoj.exe	144
PID 4768 wrote to memory of 200	4768	nifaqkicau.exe	146
PID 1668 wrote to memory of 3752	1668	rljdbwtolgeywqoj.exe	149
PID 1384 wrote to memory of 1464	1384	msedge.exe	151
PID 1384 wrote to memory of 4596	1384	msedge.exe	152
PID 1384 wrote to memory of 1900	1384	msedge.exe	153
PID 1668 wrote to memory of 5340	1668	rljdbwtolgeywqoj.exe	156
PID 2612 wrote to memory of 5344	2612	nhfzxvpnhf.exe	158
PID 1668 wrote to memory of 5328	1668	rljdbwtolgeywqoj.exe	161
PID 1668 wrote to memory of 4556	1668	rljdbwtolgeywqoj.exe	165
PID 1104 wrote to memory of 6068	1104	hfzxrpmkhc.exe	167
PID 1668 wrote to memory of 5020	1668	rljdbwtolgeywqoj.exe	170
PID 1668 wrote to memory of 3268	1668	rljdbwtolgeywqoj.exe	174
PID 4500 wrote to memory of 6092	4500	ecwurpjhec.exe	176
PID 1668 wrote to memory of 5636	1668	rljdbwtolgeywqoj.exe	179
PID 1668 wrote to memory of 1512	1668	rljdbwtolgeywqoj.exe	183

C:\Users\Admin\AppData\Local\Temp\2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_3b61055d9cf51c245be4fcb52b15e625_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Temp\rljdbwtolgeywqoj.exe
  C:\Temp\rljdbwtolgeywqoj.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omgbywqoig.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5408
  - - C:\Temp\omgbywqoig.exe
      C:\Temp\omgbywqoig.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5412
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1852
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1684
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omgbywqoig.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5800
  - - C:\Temp\i_omgbywqoig.exe
      C:\Temp\i_omgbywqoig.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4768
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gbytnljdbw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3944
  - - C:\Temp\gbytnljdbw.exe
      C:\Temp\gbytnljdbw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4336
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5764
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gbytnljdbw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5872
  - - C:\Temp\i_gbytnljdbw.exe
      C:\Temp\i_gbytnljdbw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vsnkifdxvp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4396
  - - C:\Temp\vsnkifdxvp.exe
      C:\Temp\vsnkifdxvp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1360
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4940
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:476
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vsnkifdxvp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4448
  - - C:\Temp\i_vsnkifdxvp.exe
      C:\Temp\i_vsnkifdxvp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nifaqkicau.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5676
  - - C:\Temp\nifaqkicau.exe
      C:\Temp\nifaqkicau.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4768
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:200
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4328
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nifaqkicau.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3752
  - - C:\Temp\i_nifaqkicau.exe
      C:\Temp\i_nifaqkicau.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5364
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nhfzxvpnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5340
  - - C:\Temp\nhfzxvpnhf.exe
      C:\Temp\nhfzxvpnhf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2612
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5344
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4372
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nhfzxvpnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5328
  - - C:\Temp\i_nhfzxvpnhf.exe
      C:\Temp\i_nhfzxvpnhf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4792
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfzxrpmkhc.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4556
  - - C:\Temp\hfzxrpmkhc.exe
      C:\Temp\hfzxrpmkhc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1104
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6068
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4688
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfzxrpmkhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5020
  - - C:\Temp\i_hfzxrpmkhc.exe
      C:\Temp\i_hfzxrpmkhc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1128
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwurpjhec.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3268
  - - C:\Temp\ecwurpjhec.exe
      C:\Temp\ecwurpjhec.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4500
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6092
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3192
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwurpjhec.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5636
  - - C:\Temp\i_ecwurpjhec.exe
      C:\Temp\i_ecwurpjhec.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3264
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rmjecwjgey.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1512
  - - C:\Temp\rmjecwjgey.exe
      C:\Temp\rmjecwjgey.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5156
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2984
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3424
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rmjecwjgey.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1684
  - - C:\Temp\i_rmjecwjgey.exe
      C:\Temp\i_rmjecwjgey.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ebwtomjebz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1204
  - - C:\Temp\ebwtomjebz.exe
      C:\Temp\ebwtomjebz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5048
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5164
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:720
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ebwtomjebz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3240
  - - C:\Temp\i_ebwtomjebz.exe
      C:\Temp\i_ebwtomjebz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2356
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wqoigbytrl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1080
  - - C:\Temp\wqoigbytrl.exe
      C:\Temp\wqoigbytrl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3784
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4228
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wqoigbytrl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5772
  - - C:\Temp\i_wqoigbytrl.exe
      C:\Temp\i_wqoigbytrl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlfdbvtqki.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1152
  - - C:\Temp\nlfdbvtqki.exe
      C:\Temp\nlfdbvtqki.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4188
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3428
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1884
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlfdbvtqki.exe ups_ins
    3⤵
    PID:2440
  - - C:\Temp\i_nlfdbvtqki.exe
      C:\Temp\i_nlfdbvtqki.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkidavtnax.exe ups_run
    3⤵
    PID:5744
  - - C:\Temp\nkidavtnax.exe
      C:\Temp\nkidavtnax.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2336
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2636
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkidavtnax.exe ups_ins
    3⤵
    PID:2760
  - - C:\Temp\i_nkidavtnax.exe
      C:\Temp\i_nkidavtnax.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1688
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kicausnkfd.exe ups_run
    3⤵
    PID:2884
  - - C:\Temp\kicausnkfd.exe
      C:\Temp\kicausnkfd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2904
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5436
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:880
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kicausnkfd.exe ups_ins
    3⤵
    PID:5616
  - - C:\Temp\i_kicausnkfd.exe
      C:\Temp\i_kicausnkfd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6096
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xusmkfcxup.exe ups_run
    3⤵
    PID:4672
  - - C:\Temp\xusmkfcxup.exe
      C:\Temp\xusmkfcxup.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:728
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1416
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xusmkfcxup.exe ups_ins
    3⤵
    PID:2480
  - - C:\Temp\i_xusmkfcxup.exe
      C:\Temp\i_xusmkfcxup.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2832
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\upmhbzxrpj.exe ups_run
    3⤵
    PID:3388
  - - C:\Temp\upmhbzxrpj.exe
      C:\Temp\upmhbzxrpj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1796
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2052
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5228
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_upmhbzxrpj.exe ups_ins
    3⤵
    PID:4688
  - - C:\Temp\i_upmhbzxrpj.exe
      C:\Temp\i_upmhbzxrpj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5032
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wromkeczur.exe ups_run
    3⤵
    PID:4896
  - - C:\Temp\wromkeczur.exe
      C:\Temp\wromkeczur.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1848
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5652
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wromkeczur.exe ups_ins
    3⤵
    PID:1140
  - - C:\Temp\i_wromkeczur.exe
      C:\Temp\i_wromkeczur.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4192
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljebztomje.exe ups_run
    3⤵
    PID:2924
  - - C:\Temp\ljebztomje.exe
      C:\Temp\ljebztomje.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5704
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3696
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljebztomje.exe ups_ins
    3⤵
    PID:6096
  - - C:\Temp\i_ljebztomje.exe
      C:\Temp\i_ljebztomje.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      PID:3448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igdbztqolg.exe ups_run
    3⤵
    PID:3716
  - - C:\Temp\igdbztqolg.exe
      C:\Temp\igdbztqolg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5336
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2788
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5160
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igdbztqolg.exe ups_ins
    3⤵
    PID:3012
  - - C:\Temp\i_igdbztqolg.exe
      C:\Temp\i_igdbztqolg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ligaytqljd.exe ups_run
    3⤵
    PID:1476
  - - C:\Temp\ligaytqljd.exe
      C:\Temp\ligaytqljd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4996
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4472
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3824
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ligaytqljd.exe ups_ins
    3⤵
    PID:3052
  - - C:\Temp\i_ligaytqljd.exe
      C:\Temp\i_ligaytqljd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5948
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ff8b7a6c188,0x7ff8b7a6c194,0x7ff8b7a6c1a0
      4⤵
      PID:1504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,8044102499610479265,26444806935433510,262144 --field-trial-handle=2536,i,17337939546857731076,4407835671869708717,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:2
      4⤵
      PID:4528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,15599853341865955294,8299675987238403536,524288 --field-trial-handle=2536,i,17337939546857731076,4407835671869708717,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:11
      4⤵
      System Time Discovery
      PID:5864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2352,i,14212759327723090102,5193667543263444440,524288 --field-trial-handle=2536,i,17337939546857731076,4407835671869708717,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:13
      4⤵
      PID:5916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3624,i,5446364152615750427,6880546423966969094,2097152 --field-trial-handle=2536,i,17337939546857731076,4407835671869708717,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
      4⤵
      PID:5044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3628,i,6731479962856520845,6135723643766780797,2097152 --field-trial-handle=2536,i,17337939546857731076,4407835671869708717,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:1
      4⤵
      PID:4968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4340,i,5052108391987993694,801693812257058157,2097152 --field-trial-handle=2536,i,17337939546857731076,4407835671869708717,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:1
      4⤵
      PID:4596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4360,i,7601104411296108288,1839942827284428626,2097152 --field-trial-handle=2536,i,17337939546857731076,4407835671869708717,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:9
      4⤵
      PID:1280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5420,i,16660746422923889015,8958182910318179653,2097152 --field-trial-handle=2536,i,17337939546857731076,4407835671869708717,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:1
      4⤵
      PID:4512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,9605570908577392663,5136746570413268841,524288 --field-trial-handle=2536,i,17337939546857731076,4407835671869708717,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:14
      4⤵
      PID:4060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4568,i,9328803366548220977,11906441395613520257,2097152 --field-trial-handle=2536,i,17337939546857731076,4407835671869708717,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
      4⤵
      PID:704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,18116654875026695136,2624882381169847819,524288 --field-trial-handle=2536,i,17337939546857731076,4407835671869708717,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:14
      4⤵
      PID:4276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,4798665489911912472,17614169737766594422,524288 --field-trial-handle=2536,i,17337939546857731076,4407835671869708717,262144 --variations-seed-version --mojo-platform-channel-handle=1716 /prefetch:14
      4⤵
      PID:2712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,17164434238928683827,15922907982415561674,524288 --field-trial-handle=2536,i,17337939546857731076,4407835671869708717,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
      4⤵
      PID:3452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,17164434238928683827,15922907982415561674,524288 --field-trial-handle=2536,i,17337939546857731076,4407835671869708717,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
      4⤵
      PID:5852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,10293703587498488864,7832647532607165178,524288 --field-trial-handle=2536,i,17337939546857731076,4407835671869708717,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
      4⤵
      PID:4556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,5234426801598262168,4877752151181263367,524288 --field-trial-handle=2536,i,17337939546857731076,4407835671869708717,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:14
      4⤵
      PID:1580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,5392039983592308349,14461706034013875957,524288 --field-trial-handle=2536,i,17337939546857731076,4407835671869708717,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
      4⤵
      PID:1464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,8644810205708868760,410890146090740683,524288 --field-trial-handle=2536,i,17337939546857731076,4407835671869708717,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:14
      4⤵
      PID:4596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,14374939204080198609,14813545981141496092,524288 --field-trial-handle=2536,i,17337939546857731076,4407835671869708717,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
      4⤵
      PID:1900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,7337550823609991807,8072368029775467744,524288 --field-trial-handle=2536,i,17337939546857731076,4407835671869708717,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:14
      4⤵
      PID:4620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,10989557464343696217,11531713879358356583,524288 --field-trial-handle=2536,i,17337939546857731076,4407835671869708717,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
      4⤵
      PID:5000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,14271077544790468298,4597216742701362602,524288 --field-trial-handle=2536,i,17337939546857731076,4407835671869708717,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:14
      4⤵
      PID:1676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,685293818611754073,13418514602870090760,524288 --field-trial-handle=2536,i,17337939546857731076,4407835671869708717,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:14
      4⤵
      PID:1004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6812,i,3828791975499982208,15929385215002461563,262144 --field-trial-handle=2536,i,17337939546857731076,4407835671869708717,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:10
      4⤵
      PID:5404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,17173823440581642079,8744802731196647538,524288 --field-trial-handle=2536,i,17337939546857731076,4407835671869708717,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:14
      4⤵
      PID:3300

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2440

C:\Temp\rljdbwtolgeywqoj.sys
C:\Temp\rljdbwtolgeywqoj.sys
1⤵
- Executes dropped EXE
PID:1376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3472

C:\Temp\oigaytqoig.sys
C:\Temp\oigaytqoig.sys
1⤵
- Executes dropped EXE
PID:4500

C:\Temp\ljdbvtqliy.sys
C:\Temp\ljdbvtqliy.sys
1⤵
- Executes dropped EXE
PID:5160

C:\Temp\skifaysqki.sys
C:\Temp\skifaysqki.sys
1⤵
- Executes dropped EXE
PID:2872

C:\Temp\pnkicaxspk.sys
C:\Temp\pnkicaxspk.sys
1⤵
- Executes dropped EXE
PID:5336

C:\Temp\kfcxupmhec.sys
C:\Temp\kfcxupmhec.sys
1⤵
- Executes dropped EXE
PID:1084

C:\Temp\smkeuomkec.sys
C:\Temp\smkeuomkec.sys
1⤵
- Executes dropped EXE
PID:3864

C:\Temp\omgecwuomg.sys
C:\Temp\omgecwuomg.sys
1⤵
- Executes dropped EXE
PID:2144

C:\Temp\mjdbwtomge.sys
C:\Temp\mjdbwtomge.sys
1⤵
- Executes dropped EXE
PID:480

C:\Temp\ytrljdbvto.sys
C:\Temp\ytrljdbvto.sys
1⤵
- Executes dropped EXE
PID:4900

C:\Temp\vqnlgdynli.sys
C:\Temp\vqnlgdynli.sys
1⤵
- Executes dropped EXE
PID:1944

C:\Temp\vqnlfdxvqn.sys
C:\Temp\vqnlfdxvqn.sys
1⤵
PID:5980

C:\Temp\pnhfdxvpnk.sys
C:\Temp\pnhfdxvpnk.sys
1⤵
PID:708

C:\Temp\uspkhfzxrp.sys
C:\Temp\uspkhfzxrp.sys
1⤵
PID:5116

C:\Temp\fzxrpjhczu.sys
C:\Temp\fzxrpjhczu.sys
1⤵
PID:3180

C:\Temp\xromkhbzxu.sys
C:\Temp\xromkhbzxu.sys
1⤵
PID:2672

C:\Temp\wrojgbztrl.sys
C:\Temp\wrojgbztrl.sys
1⤵
PID:4496

C:\Temp\tqoigaytql.sys
C:\Temp\tqoigaytql.sys
1⤵
PID:6084

C:\Temp\ifdbvtnlid.sys
C:\Temp\ifdbvtnlid.sys
1⤵
PID:4588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gbytnljdbw.exe

Path C:\Temp\gbytnljdbw.exe
Size 722KB
SHA256 2f8abdf2be554a50db6f03c3c94b4d80c15eca094c8866569b0e1776ba360fd1
MD5 5a6df8829333db896474dba5be8e368d
SHA1 09095b15afd58367dda703bda6f78a78cd970f21
SHA512 218ec59c9c0f3089d38ed12f8559c9fb31af188f428f3d94ea4a69f772aa9c945ac17bb5a0b425ce1f8a68a28f760c640e702870a10e64ccb6c71d35c15093d1
SSDEEP 12288:nflfAsiVGjSGecvXAflfAsiVGjSGecvX:fMcfcMcf
TLSH
T126F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfzxrpmkhc.exe

Path C:\Temp\hfzxrpmkhc.exe
Size 722KB
SHA256 0cfb8cec35080bea5f1b327c8da70e77c6e886ed70174f9042441ba8eb060e5a
MD5 e668d4513823a44b3ce5b33cd81519b9
SHA1 2991853afee63594f788bf3e8534720f6a774102
SHA512 d555bde0b1fcd038ae6437febd4b1f4c5f5158eecff490678fee684f184df5ce180b8c210a6f901862d580a2226f95ca733e87afe85e88a38aed9f12d9ae75c2
SSDEEP 12288:EflfAsiVGjSGecvXAflfAsiVGjSGecvX:gMcfcMcf
TLSH
T12AF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gbytnljdbw.exe

Path C:\Temp\i_gbytnljdbw.exe
Size 722KB
SHA256 c9ed48c8958998ffdc4847981bb8c6f761de25c06e59224d90a585d0fb45ef43
MD5 9797323663c9d152ac23e34c4aca65d8
SHA1 106f7c05afe65b5d928cfca8b5e3ddcb20119c27
SHA512 c74dd6668bd71ffd79f6f09639f85b6fcc4007694e79c3f61f8d5547c14e4922058db8a5d15b5e49257e730e11abc45271d621d39bde36aeadcd9d23164860e8
SSDEEP 12288:IflfAsiVGjSGecvXAflfAsiVGjSGecvX:UMcfcMcf
TLSH
T1D2F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nhfzxvpnhf.exe

Path C:\Temp\i_nhfzxvpnhf.exe
Size 722KB
SHA256 6457eeff2b2b3ad2dbd1f8ddd7669b5fc9170b644bb6059052e03f5f134a3189
MD5 915fbe7e571cf3ad80287939d3d4eb82
SHA1 9fbec3a0acc2f21044209b5f3805d804eb889167
SHA512 d1631af23710f962531046c3a982f8a8db4ff1d2e2f3d1196210db4e208da81131708429f70eee0af649ba33a420b253ee88f62fc313b1d5e4bca01895311ca9
SSDEEP 12288:OflfAsiVGjSGecvXAflfAsiVGjSGecvX:qMcfcMcf
TLSH
T1A6F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nifaqkicau.exe

Path C:\Temp\i_nifaqkicau.exe
Size 722KB
SHA256 023695d04f75801b5de43beacccaaa2741fe0fb7859e730f54da29d3dff470bf
MD5 848db36649eafab548c6015014e4db9a
SHA1 73368a82c7aad4e61438fcb4bcda79ef4a03fed5
SHA512 c350788982891f33119fcbbe41b854962ceadbc168225a0e71024edf4b716ec1938a4ecf2408fbad6a0ce7941702db5a58dec16878b9d92eb48da3499e0c756a
SSDEEP 12288:uflfAsiVGjSGecvXAflfAsiVGjSGecvX:KMcfcMcf
TLSH
T1ACF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_omgbywqoig.exe

Path C:\Temp\i_omgbywqoig.exe
Size 722KB
SHA256 051c10162c251274dec7cf9edf177c867864b73639c186b6c19bd603843f4bd9
MD5 7fc777efccba9a03f18b9ee3637a9482
SHA1 3a93db3dec75b6601476209fec87f1a2568362e2
SHA512 b463a8f07ac7fb54ed0f9349839b7a3d11e64e2a8ec455010610b15b45fd951e0e033a7ba63db44f63669c0c02c361770a847044c492759084cb876f73551f39
SSDEEP 12288:oflfAsiVGjSGecvXAflfAsiVGjSGecvX:0McfcMcf
TLSH
T18BF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vsnkifdxvp.exe

Path C:\Temp\i_vsnkifdxvp.exe
Size 722KB
SHA256 cc447f1c898ca351ba071870ff2f5db75a4963f1c13db6a187b7c28f159ec7dc
MD5 89cbbef59719f5181a950523ae5aefc4
SHA1 edfc6588891664be1eeb8a8eeeda858bc39ae84d
SHA512 e23d356c9bcbb84cc5a6201400351ac7822a47b048793e4ec2c163f309f8b47e0321ab8131e85e13aeddaf06f250932729b21ce104c36d5d07153734cea68d5f
SSDEEP 12288:GflfAsiVGjSGecvXAflfAsiVGjSGecvX:SMcfcMcf
TLSH
T1BCF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfcxupmhec.sys

Path C:\Temp\kfcxupmhec.sys
Size 293KB
SHA256 69a0880ec9db90bba2390d66d22c145d86999e26de7f1b782a6ac8218e285668
MD5 af6f6c3ad76a0b9ba2d10c1eab86dfe2
SHA1 186b63dfaac165c0d228e3b6391878369abf0b91
SHA512 dfd290def24de97d91555da03c508d492eab57025fdf82e5a74ad5ff63e0f561b5523051756827eccf8fdd2ade2506ee579900ecfe7dc341140623d576707689
SSDEEP 3072:ntKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:nIJjiJcbI03GBc3ucY5DCSj
TLSH
T19F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbvtqliy.sys

Path C:\Temp\ljdbvtqliy.sys
Size 293KB
SHA256 43d76b6b634bf96a5d076e389f407b0d52ae36de3eb37f727e0aeb43ab3a5509
MD5 4fa44d569d2e2493fc7c855cc89483e3
SHA1 72cfb03cc18eaae97b4253bf4de5daa6f94bccc1
SHA512 50cb5dcc93674a6e4cc0fae1fcdbe748bc688bc3b013b798fcbd026754ca547011cf66c7c1bcb903b8a26e3c32c83a7019d3850fd9238d8e68effaaf8482dca9
SSDEEP 3072:itKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:iIJjiJcbI03GBc3ucY5DCSj
TLSH
T15A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfzxvpnhf.exe

Path C:\Temp\nhfzxvpnhf.exe
Size 722KB
SHA256 7939a7a92a0a75adcc8b97a1cb254a9a711e219f5f0a8984c0f4b666828d82ad
MD5 81d4b8982d7430d416167e063b30a4f5
SHA1 2fcf125d5fc358349806b507b8430c7d49d97a64
SHA512 baefa1da5313af258b1b31231631c9d946bbabadbeff2c4021e36df5327065a816d6bed293529c3295c56ff8c5045d974383642b6052bc92ef277f4c7c19c7a7
SSDEEP 12288:rflfAsiVGjSGecvXAflfAsiVGjSGecvX:jMcfcMcf
TLSH
T12CF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nifaqkicau.exe

Path C:\Temp\nifaqkicau.exe
Size 722KB
SHA256 6b8aaf123d8fb74b84c6671d20cdba61863cec7fda2f963c7003ad9da73fcd03
MD5 1f7fb08bb62c96dd5057ea97034f66fb
SHA1 03ff77740048832ee123fac50e9d890d4fa3cc82
SHA512 7fc09f25212b2ea2158e6f4791122776dc26ca33aa010c6d0d4b0bb89344f207141cf479883fc05da022f7afd131e9751e31c77691b5016f29d327fd14c339ed
SSDEEP 12288:CflfAsiVGjSGecvXAflfAsiVGjSGecvX:uMcfcMcf
TLSH
T198F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigaytqoig.sys

Path C:\Temp\oigaytqoig.sys
Size 293KB
SHA256 9ef7287612fbf2381cbe3c0d6a176abded752c45ae5e02dd1a1e4e8eb374940c
MD5 652c684d74be2a3f7eeb9b7228a4a001
SHA1 3f43ab1f418dcf67b132f5af68c6e9cfea725036
SHA512 ba6fd98232d44dc91b063ca40347a8fb1538534d9883e5402b7406383e90f3b1f025a56858e21087108cf517655064c0c1cea6688a19a8afc3864ebce04b07df
SSDEEP 3072:wtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:wIJjiJcbI03GBc3ucY5DCSj
TLSH
T106545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgbywqoig.exe

Path C:\Temp\omgbywqoig.exe
Size 722KB
SHA256 c3721849d4c1cce9d167be3831da34714a1d86509c740c09ca5c169c07d9446c
MD5 cff8211082d8b19ff425d5a5d7c84143
SHA1 a0aac78d3470daa63ca906660c70481058c7de89
SHA512 fd4d19ebd8e383ff14142ee78a68d75f05a01ffe8a36b26f458cb433c52ef950976e559c634aaf295d12914c55b2268a9f14fc768ed197230114676cdc2513a5
SSDEEP 12288:bflfAsiVGjSGecvXAflfAsiVGjSGecvX:zMcfcMcf
TLSH
T1CCF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnkicaxspk.sys

Path C:\Temp\pnkicaxspk.sys
Size 293KB
SHA256 2c43663f97b9d189ebc899f5d2c406437bf195c2d8317ef5939fc86b39d05223
MD5 e1ce5ec0a1fce29bf6d6c7442acf7757
SHA1 2990bc095d47142f64eaaba8711c824c09a3edc4
SHA512 3e6df2b6dda401fda31a10cb4c8160c91195af432bf602d23a1f35cf073edc3169b5d0beb714e88b5f6b30f3eca10bd910ca5a101f0e1bad521f847237935ef6
SSDEEP 3072:otKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:oIJjiJcbI03GBc3ucY5DCSj
TLSH
T12E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljdbwtolgeywqoj.exe

Path C:\Temp\rljdbwtolgeywqoj.exe
Size 722KB
SHA256 e66e62c34d730a48cdecee959d61ff4f44cb5749c890d540dad24fa62ee72a78
MD5 5c76c11984d17c8c74f030b0bfdb66f7
SHA1 0e52b6f27124aee1800c99c809132d3f7bb2887a
SHA512 c92469ccdfb9d422e4a984663fd785a55e2c01eb6afadacc5ef913edf7be2851d2e8bbe28589d880a92d6b8c463bbc30cdfb287c391ea0acf659a3c92607ab31
SSDEEP 12288:pflfAsiVGjSGecvXAflfAsiVGjSGecvX:hMcfcMcf
TLSH
T1C8F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljdbwtolgeywqoj.sys

Path C:\Temp\rljdbwtolgeywqoj.sys
Size 293KB
SHA256 673bf96b77bc2ad96f58aa1b0a9147ee571ffb4474e5367f0eab04f068e4924f
MD5 43893c65372e87bc84f3ef312ae37814
SHA1 6788c0c9f0e87aaa46c7e791a051b60daabf45fc
SHA512 4beffeca4eddfd19a9e64d6dbfd5d56f67e7c60c615f77af9de28fff74f7022ee885e14d649d40ac6e6d5c5a57f0ca031fec19017392830ca3a60350a219c6d2
SSDEEP 3072:EtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:EIJjiJcbI03GBc3ucY5DCSj
TLSH
T1CE545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

skifaysqki.sys

Path C:\Temp\skifaysqki.sys
Size 293KB
SHA256 3fdc0d92e5f067c980d7b9f3412d5c5daf93a57847b8e5ee3e9a4073a15f0082
MD5 d175cd91fc94b34191db565a15b62be2
SHA1 bd9596f9bea1500620bdabecab092392eefdf941
SHA512 2e9cdaa2b60117192e136a5af9e585429c9ff8ad7a4a3d652174663f4f81412bdbdff8a2d1182a2b2d9ac1033c65f03fc0c072080dde2fb4e2ef03fcaac8888a
SSDEEP 3072:xtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:xIJjiJcbI03GBc3ucY5DCSj
TLSH
T193545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsnkifdxvp.exe

Path C:\Temp\vsnkifdxvp.exe
Size 722KB
SHA256 6bbb0e1b3b8c309a51dcf56496da372a7a60f5e4fe45431d88e14e090e04e734
MD5 4ea149fb72f91b739fc69c37d0246bcd
SHA1 9c4d5dc2539f44df654d1677f437d4870ecacc35
SHA512 9e34a488f05dd29e0209f229ae185eae3a6c0676bc5bac5134348530a310c38fa7ebe15b9ba65d7d1309d4c4732ff2e99d76f585110682d02039f47ad4a93161
SSDEEP 12288:0flfAsiVGjSGecvXAflfAsiVGjSGecvX:wMcfcMcf
TLSH
T1A4F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

16795ecc-556c-4765-b081-b7d3c0d0cd4b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\16795ecc-556c-4765-b081-b7d3c0d0cd4b.tmp
Size 12KB
SHA256 9803d18cba6fe6702897c4f211bf864f879ad0c4e926e6953ce83125b121a993
MD5 8eaf9266975a1b6abfb731cc9992e13e
SHA1 06d80c4aec3090db0609a1253c136a5c3c089c52
SHA512 809336eac45c410684735f673174ead1d4de3bec53a17fdc2bd153d04001a3c438848030b8c91d048c649f4da3558154587286b4c2f68db1b52d3f3ebbf179b4
SSDEEP 192:sxRrRwCi/f8+smMwQVZymMrzoA8p9E/g6+WNC43I/YoYdbCYzGiIgDd8J:sxRr5i/fHsmMBbDMKW/5m/YIIS
TLSH
T1AE42C8156928693B9CC7E21DBB65BF53E3F91132A4D51E48ABFC861C00E76CD620781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 2ab5bfdd8012616ee3e61b725d77e72b82de8149697cd8316239e763e84c3667
MD5 38d868e3ae17412416b34ae6767a4314
SHA1 c515958503c373b641e953ccd67dcffb7f052369
SHA512 1d4cdd49ab0f42475a7a3a2663555de8422f301a5bf08f66aafeff3f1a7840ecd16094633cc764921cd16bdbdc91985d9ae21c2823ca09ef33a7eac4faec4ecb
TLSH
T1655151612B2D29E3D7B6417370E5195936FFC40942AF1E20A0D45D745D22F0F9CE3867
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b8a8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b8a8.TMP
Size 2KB
SHA256 d194dcd3c5520b1010cdd211f38ce107c9e89efdab55715e303e1c77bc853d07
MD5 a404f2d0887b90f19e0b656d015c8759
SHA1 dff10774068f2486e9ed7f0647ab6f7447b6b805
SHA512 b85b0461b719f8f47b551eedd1415eb507099fd3ab5acfb2313ac5dfeb198076676537df41301e033f28447c4210e283aa5f6c07f8417a0624b9d6458f6cbd0a
TLSH
T1145162612B2D29E3D7B64073B0E5195936FFC44942AF1E20A0D45D745E22F0FACE3867
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 607c90d3518ddc1b40f1f6b80f1d7848df6a388af2fec7a161b469d115a2f58a
MD5 bab6c807dcd1c893f39298e2c92fbab6
SHA1 55b81c328f4bfd363f485c012274d5a9fee7dc25
SHA512 3a0885044cd2d2660bc821251a4215de5606fcba89c23a189f765c87ebab536fcc2014197492132b602a89dd84e74a234ec261015520d35cf6e27aec6e98152a
TLSH
T17841BEF383F4856E8A0196F0AA14AE1FCE2C0511432C7D5AC9E0AF2B93E34B1E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d3dabc57f3ac4fbe8337077d3fe44cf789314706c582e43c535a08e6d610f354
MD5 27106ec591f8ad0c2ab5a5399d0d275e
SHA1 6f5ea3e4f440bcf31dcf4257bf4faa911af2690c
SHA512 1140ea8423c85d27d6e76c483999dbca9389d91e069bf8cae6b0c28f1b2624f3e3155d5d9b9ec8af315d6e908fe54a7881ecca6c94f0596f4010b51bcd28bbd2
SSDEEP 192:sxRkRwCi/f8+sIMwFVZymMrzoA8p9E/g6+WNC43I/YoYsDCYzGiIgV8J:sxRk5i/fHsIMUbDMKW/5m/Y1IO
TLSH
T18F42C8156D28A93B9CC7E21DBA65BF53E3F91132A5D41E48ABFC861C00E76DD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b5729dec1e7a50d3f31a2807d03c36f5b98085e6801cd14d46e757a96de461d8
MD5 1f067cc1f43a24d8bea542c4ca70f21e
SHA1 34117245bb3a0366694c108f6058a1bcd52cd655
SHA512 b841d17fb61f17004242d1824588270d0c158363989ec47ebb09ac149758356766712d11f58754e6638c6279abe52eb01ccaa60d29a04185233dd26e789357de
SSDEEP 192:sxRrRwCi/f8+smMwFVZymMrzoA8p9E/g6+WNC43I/YoYsDCYzGiIgDP8J:sxRr5i/fHsmMUbDMKW/5m/Y1IU
TLSH
T15442C8156928AA3B9CC7D21DBB65BF53E3F91132A5D51E48ABFC861C00E76CD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 df781593cb32a638374a6bcd9dfe86c313d56dea3f82207b08a1f200fca3191f
MD5 a00c2710e84718925e29c7329564c0c0
SHA1 9e320e4f030df7862fe4b57775a645929a806888
SHA512 9c54025e741c771312008e09768fd77fcea9d7559eb29188bf82179b48a1ca4d60555e8b29ab6ec7dddf029767be561a110326f2e5210aa745b5e4f18213a5bb
SSDEEP 768:j26Hwo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OV+y3BVuw2ro9Ue+:j26HwUE7MRWgs2f02u1ja1y3B4wN/A
TLSH
T158D2DA7B740DCBBE4F800ADDEC197E9F6D6802CB9698CD8447FA941C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2491d1b9-e262-45a6-8a77-0516367715e9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2491d1b9-e262-45a6-8a77-0516367715e9.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 8c6426235ca17a81a051fe286dedab90f66c3c6006adade0be53ff1bff0565b2
MD5 171619c95f6c91d6af77dbef39b50394
SHA1 9b1ad5cab966915c1f341d45bafbd849585886a9
SHA512 72495fd2307bfcacc96d732050632bb9c96048f6ebaca0162e8439891f852f5d6a1658538e3b6be3fb38e7819b51c03e3215b723ad6e92245146dcd6957804c1
SSDEEP 768:QFQd3zwgyvpsOWT1a5/ONXyer1IRCzni9J0uTHhBuX:Dd3MC6/SIqna0cHhBK
TLSH
T1421328F594D38A37D89E5387A73E6E469EBCD063B5884590BBD51E0DCC821BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 52b04c0a1a3b6dafcc85ddf1aaba835b93cef1eeb3985987beaa38574b437aaa
MD5 2b0e6c4dc8574f42be700dc0a9756a9c
SHA1 57a2c44c42892f4e01bae6084f546656a6a9e586
SHA512 f5f8b715cf6317b90849d3c1c213e5b04c3044c3bcb5c4ed1aa0b44aa90db68f78930677c6973cb8a377ae8951c54f700d16b53b1edac7c37f501dac29e4c718
SSDEEP 768:arv+4UNbds388/TBOWT1a5fONXyer1IRCzni9JG:absb+3Lj6fSIqnaG
TLSH
T1BF03AF30E5A9DE338CE6A3D6B0476783BFB8206789C10694E9DA1F4E059759E230F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d3ab28cbb4cb69c4e33e9576aeeb7531d1220cf35e04eb239736a3b6043b1382
MD5 5e613c25464007e859ea0fd8038fcf21
SHA1 5dd07f3bd858ad424244e683b50a28e916ca9d7b
SHA512 d3a20e13cf575547ce0ceeeced950129439bb8839df80b335273babc429e1dbca68d194a31ef77f9c05eeddc2952710063be7e249cb09ba3aa00a2a0b34014e0
SSDEEP 768:KH3e8/TBOWT1a5MONXyer1IRCzni9J0uTHhBuX:KH3Rj6MSIqna0cHhBK
TLSH
T185F2BE30A851DE738CAAB3D6B5476783AFF82077C9884A94EAE91F0E019755D130F81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f0bd4a62dba9444003929183738aab0816e954dc1188610bf94df4ed9e3a19a6
MD5 4e4362e5947fc39523d2f60ff6fb9e07
SHA1 54fb8d47c8f866c907c025d8d1520a81bba42cbd
SHA512 47901ef95aafb275ca0dd76a8b03ae10ea5da2fd7bbae1769a07ed40edfc19163410a534ad291e86e0b4d09d6080ef98fd341cf098163f711f9be1c5977ba705
SSDEEP 768:hrv+4UNbdz3Tt/TBOWT1jONXyer1IRCzniBYeVH1SK7:hbsbV3BjjSIqnzEH1l
TLSH
T1C303BF36A5A8DE338CE2A3C5B04776437FB86057C6840790EDDE2F4E069B59D230B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 9d137471ca2fb971b9bf3b35572e9053d2fd728444cb7e16c3dc8b93450ab2b9
MD5 7d18d2addf514b84e39b042e7cf62e18
SHA1 b9fa980329db3f7c46b22cc9f3aeb87067a6449f
SHA512 0559c301a555181fb723abbdbb34fe6340745481a6d6888215e1bf4a951373580498d31b2e0f92e06bb7cedcc96e9e72f99b7ea460bb6ef82de8a0a4d21cf284
SSDEEP 768:eH398/TBOWT1a5MONXyer1IRCzni9J0uTHhBuX:eH3ej6MSIqna0cHhBK
TLSH
T12EF2BE30A851DE738CAAB3D6B5476783AFF82077C9C84A94EAE91F0E019755D131F81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 eddfbc6404762b225b74389d44b33b35b6e53024b39a81b331f23be26ee9f913
MD5 84a021002c6201b7e2febf37aa0e7d89
SHA1 5d4bb9240bdf29919c288563f9ded763057d437f
SHA512 9d5862698ce48c0e12e575e2f5fc2d43e610aee46560ee89d72095c334b570ca306d1f0fcfbb2768c96bbc8a146d445f5fa4899ae563b5a53c393feab64a54a4
SSDEEP 768:wrv+4UNbdz31u/TBOWT1a54ONXyer1IRCzniwJeVH1SK7:wbsbV3gj64SIqnlEH1l
TLSH
T18203BF31E1A9DE334DE6A3D6B047A2877FB82067C9800B90E9DA1F4E059759D230F91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

4329eb86-cd37-47c1-8595-bb17de208822.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4329eb86-cd37-47c1-8595-bb17de208822.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1384_1132440320\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 b1554b7e653ccf49155341480830c4a755df37633129735a4615640ffdbe3e8a
MD5 a565005574ef545ac081d8760c0c0108
SHA1 e5df8c9cd6cc6ab80f9720a00a47c0fe33404053
SHA512 b6a32a7c45ae9ab4343cb19c22a17aebbb33f98f7d2a0a4b7a9ccd251c6a336b64d25db649d5adc9b565c87fa2358282a8860cd14c7c9d83f04493a05318c00e
TLSH
T1D571238357B8D5B3C2DE5FF002835204F6FB223C0B2370240B915946EB30A7A68B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/480-325-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/708-390-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1084-300-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1376-63-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1944-358-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2144-310-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2672-425-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2872-260-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3180-414-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3864-306-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4496-430-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4500-185-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4588-469-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4900-329-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5116-402-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5160-232-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5336-272-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5980-378-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6084-452-0x0000000000010000-0x00000000000AB000-memory.dmp

Download