a9518c528221e132c5f1cd331c660dd10d3d3b9f5a52c924ce01009b4f08a858

Analysis

max time kernel
143s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 13:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 722KB
Sample260819-qaattawzb1
SHA256 a9518c528221e132c5f1cd331c660dd10d3d3b9f5a52c924ce01009b4f08a858
MD5 92d695b6a4678f16a419526144c16fd3
SHA1 6e820c44a9044b1ea6e30b77417ec304ba6fb124
SHA512 305e809fb7d496773a4b95f61335a7d8a5b8188fa639440bf91efb956a627770c067d52359b003c701d96e3da14f53ba4d93aa68324dc0bb97400d1bc54512c4
SSDEEP 12288:kflfAsiVGjSGecvXAflfAsiVGjSGecvX:AMcfcMcf
TLSH
T1D8F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1884	keczurpkhczurpjh.exe
4640	keczurpkhczurpjh.sys
2944	CreateProcess.exe
4560	smkeczupmh.exe
1628	CreateProcess.exe
1056	CreateProcess.exe
4684	i_smkeczupmh.exe
2756	pkeczxrpjh.sys
1180	CreateProcess.exe
2764	wrojhbztrm.exe
3556	CreateProcess.exe
1460	CreateProcess.exe
5048	i_wrojhbztrm.exe
4696	mjhbztrljh.sys
2096	CreateProcess.exe
5696	jgebztrljh.exe
2500	CreateProcess.exe
4784	CreateProcess.exe
5444	i_jgebztrljh.exe
1104	bztrljebwt.sys
796	CreateProcess.exe
3476	bywqojgbvt.exe
5060	CreateProcess.exe
4780	CreateProcess.exe
2756	i_bywqojgbvt.exe
4656	rljdbvtnlg.sys
1256	CreateProcess.exe
2400	idbvtqlidb.exe
2456	CreateProcess.exe
2928	CreateProcess.exe
4852	i_idbvtqlidb.exe
2972	igayvqolgd.sys
1288	CreateProcess.exe
2168	avtnlfdxvt.exe
5328	CreateProcess.exe
4640	CreateProcess.exe
4716	i_avtnlfdxvt.exe
1720	fdavtnlfdx.sys
1492	CreateProcess.exe
3232	davsnkifax.exe
4864	CreateProcess.exe
2924	CreateProcess.exe
3940	i_davsnkifax.exe
5224	khfdxvsmki.sys
4896	CreateProcess.exe
4316	nkicauspnk.exe
3272	CreateProcess.exe
3336	CreateProcess.exe
1084	i_nkicauspnk.exe
4808	kecxusmkfc.sys
5108	CreateProcess.exe
4980	zxupnhczus.exe
5200	CreateProcess.exe
4528	CreateProcess.exe
1880	i_zxupnhczus.exe
5808	pmhfcxuspk.sys
2044	CreateProcess.exe
2296	ecwurpmhec.exe
3196	CreateProcess.exe
420	CreateProcess.exe
1568	i_ecwurpmhec.exe
1084	pjhezwrpjh.sys
3092	CreateProcess.exe
3144	mhezwrpmhe.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 40 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bywqojgbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avtnlfdxvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avtnlfdxvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davsnkifax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkicauspnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxupnhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xupmhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causmkifzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgebztrljh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bywuomgebz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keczurpkhczurpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkicauspnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwurpmhec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdavtnlfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifdxvpnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xupmhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkeczupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgebztrljh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davsnkifax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifdxvpnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causmkifzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkeczupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idbvtqlidb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwurpmhec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhezwrpmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlgdywrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdxvtnliga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdavtnlfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrojhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bywqojgbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idbvtqlidb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bywuomgebz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlgdywrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdxvtnliga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxupnhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhezwrpmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omkeczurpm.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2160	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4220	ipconfig.exe
1048	ipconfig.exe
420	ipconfig.exe
4512	ipconfig.exe
5512	ipconfig.exe
3552	ipconfig.exe
1048	ipconfig.exe
4472	ipconfig.exe
2472	ipconfig.exe
2524	ipconfig.exe
2912	ipconfig.exe
3212	ipconfig.exe
4660	ipconfig.exe
4832	ipconfig.exe
1604	ipconfig.exe
1816	ipconfig.exe
4396	ipconfig.exe
4232	ipconfig.exe
4720	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316181885920950"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1079202589-886135813-2527035092-1000\{D21321BA-10B6-406B-AD7F-5F228DB9E94A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1884	keczurpkhczurpjh.exe
1884	keczurpkhczurpjh.exe
1884	keczurpkhczurpjh.exe
1884	keczurpkhczurpjh.exe
1884	keczurpkhczurpjh.exe
1884	keczurpkhczurpjh.exe
1884	keczurpkhczurpjh.exe
1884	keczurpkhczurpjh.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	4684	i_smkeczupmh.exe
Token: SeDebugPrivilege	5048	i_wrojhbztrm.exe
Token: SeDebugPrivilege	5444	i_jgebztrljh.exe
Token: SeDebugPrivilege	2756	i_bywqojgbvt.exe
Token: SeDebugPrivilege	4852	i_idbvtqlidb.exe
Token: SeDebugPrivilege	4716	i_avtnlfdxvt.exe
Token: SeDebugPrivilege	3940	i_davsnkifax.exe
Token: SeDebugPrivilege	1084	i_nkicauspnk.exe
Token: SeDebugPrivilege	1880	i_zxupnhczus.exe
Token: SeDebugPrivilege	1568	i_ecwurpmhec.exe
Token: SeDebugPrivilege	4924	i_mhezwrpmhe.exe
Token: SeDebugPrivilege	5808	i_bywuomgebz.exe
Token: SeDebugPrivilege	4792	i_vtnlgdywrl.exe
Token: SeDebugPrivilege	4720	i_gdxvtnliga.exe
Token: SeDebugPrivilege	3644	i_lfdavtnlfa.exe
Token: SeDebugPrivilege	5272	i_ifdxvpnifa.exe
Token: SeDebugPrivilege	704	i_causmkifzx.exe
Token: SeDebugPrivilege	5504	i_xupmhfzxrp.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3264	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 1884	2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 2528 wrote to memory of 1800	2528	2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 1800 wrote to memory of 3264	1800	iexplore.exe	91
PID 3264 wrote to memory of 1128	3264	msedge.exe	92
PID 3264 wrote to memory of 3748	3264	msedge.exe	94
PID 3264 wrote to memory of 2160	3264	msedge.exe	95
PID 3264 wrote to memory of 3748	3264	msedge.exe	94
PID 3264 wrote to memory of 3748	3264	msedge.exe	94
PID 3264 wrote to memory of 1120	3264	msedge.exe	96
PID 3264 wrote to memory of 1120	3264	msedge.exe	96
PID 3264 wrote to memory of 756	3264	msedge.exe	97
PID 3264 wrote to memory of 2092	3264	msedge.exe	98
PID 3264 wrote to memory of 756	3264	msedge.exe	97
PID 3264 wrote to memory of 756	3264	msedge.exe	97
PID 3264 wrote to memory of 2092	3264	msedge.exe	98
PID 3264 wrote to memory of 2092	3264	msedge.exe	98
PID 3264 wrote to memory of 1440	3264	msedge.exe	99
PID 3264 wrote to memory of 996	3264	msedge.exe	100
PID 3264 wrote to memory of 1440	3264	msedge.exe	99
PID 3264 wrote to memory of 1440	3264	msedge.exe	99
PID 3264 wrote to memory of 996	3264	msedge.exe	100
PID 3264 wrote to memory of 996	3264	msedge.exe	100
PID 3264 wrote to memory of 4836	3264	msedge.exe	104
PID 3264 wrote to memory of 4836	3264	msedge.exe	104
PID 3264 wrote to memory of 2156	3264	msedge.exe	105
PID 3264 wrote to memory of 2156	3264	msedge.exe	105
PID 3264 wrote to memory of 2904	3264	msedge.exe	107
PID 1884 wrote to memory of 2944	1884	keczurpkhczurpjh.exe	108
PID 4560 wrote to memory of 1628	4560	smkeczupmh.exe	112
PID 3264 wrote to memory of 5900	3264	msedge.exe	113
PID 3264 wrote to memory of 5900	3264	msedge.exe	113
PID 3264 wrote to memory of 4292	3264	msedge.exe	117
PID 3264 wrote to memory of 4292	3264	msedge.exe	117
PID 3264 wrote to memory of 1640	3264	msedge.exe	118
PID 3264 wrote to memory of 1640	3264	msedge.exe	118
PID 1884 wrote to memory of 1056	1884	keczurpkhczurpjh.exe	119
PID 1884 wrote to memory of 1180	1884	keczurpkhczurpjh.exe	123
PID 2764 wrote to memory of 3556	2764	wrojhbztrm.exe	125
PID 1884 wrote to memory of 1460	1884	keczurpkhczurpjh.exe	128
PID 1884 wrote to memory of 2096	1884	keczurpkhczurpjh.exe	132
PID 5696 wrote to memory of 2500	5696	jgebztrljh.exe	134
PID 1884 wrote to memory of 4784	1884	keczurpkhczurpjh.exe	137
PID 1884 wrote to memory of 796	1884	keczurpkhczurpjh.exe	142
PID 3476 wrote to memory of 5060	3476	bywqojgbvt.exe	144
PID 1884 wrote to memory of 4780	1884	keczurpkhczurpjh.exe	147
PID 3264 wrote to memory of 2784	3264	msedge.exe	149
PID 3264 wrote to memory of 2596	3264	msedge.exe	150
PID 3264 wrote to memory of 4320	3264	msedge.exe	151
PID 1884 wrote to memory of 1256	1884	keczurpkhczurpjh.exe	154
PID 2400 wrote to memory of 2456	2400	idbvtqlidb.exe	156
PID 1884 wrote to memory of 2928	1884	keczurpkhczurpjh.exe	159
PID 1884 wrote to memory of 1288	1884	keczurpkhczurpjh.exe	163
PID 2168 wrote to memory of 5328	2168	avtnlfdxvt.exe	165
PID 1884 wrote to memory of 4640	1884	keczurpkhczurpjh.exe	168
PID 1884 wrote to memory of 1492	1884	keczurpkhczurpjh.exe	172
PID 3232 wrote to memory of 4864	3232	davsnkifax.exe	174
PID 1884 wrote to memory of 2924	1884	keczurpkhczurpjh.exe	177
PID 1884 wrote to memory of 4896	1884	keczurpkhczurpjh.exe	181
PID 4316 wrote to memory of 3272	4316	nkicauspnk.exe	183
PID 1884 wrote to memory of 3336	1884	keczurpkhczurpjh.exe	186
PID 3264 wrote to memory of 4768	3264	msedge.exe	188
PID 3264 wrote to memory of 4768	3264	msedge.exe	188
PID 1884 wrote to memory of 5108	1884	keczurpkhczurpjh.exe	194
PID 4980 wrote to memory of 5200	4980	zxupnhczus.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_92d695b6a4678f16a419526144c16fd3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Temp\keczurpkhczurpjh.exe
  C:\Temp\keczurpkhczurpjh.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1884
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\smkeczupmh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2944
  - - C:\Temp\smkeczupmh.exe
      C:\Temp\smkeczupmh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4560
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1628
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1048
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_smkeczupmh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1056
  - - C:\Temp\i_smkeczupmh.exe
      C:\Temp\i_smkeczupmh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4684
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wrojhbztrm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1180
  - - C:\Temp\wrojhbztrm.exe
      C:\Temp\wrojhbztrm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2764
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3556
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3212
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wrojhbztrm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1460
  - - C:\Temp\i_wrojhbztrm.exe
      C:\Temp\i_wrojhbztrm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5048
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgebztrljh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2096
  - - C:\Temp\jgebztrljh.exe
      C:\Temp\jgebztrljh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5696
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2500
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1048
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgebztrljh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4784
  - - C:\Temp\i_jgebztrljh.exe
      C:\Temp\i_jgebztrljh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5444
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bywqojgbvt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:796
  - - C:\Temp\bywqojgbvt.exe
      C:\Temp\bywqojgbvt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3476
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5060
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4472
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bywqojgbvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4780
  - - C:\Temp\i_bywqojgbvt.exe
      C:\Temp\i_bywqojgbvt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2756
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\idbvtqlidb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1256
  - - C:\Temp\idbvtqlidb.exe
      C:\Temp\idbvtqlidb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2400
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2456
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4660
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_idbvtqlidb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2928
  - - C:\Temp\i_idbvtqlidb.exe
      C:\Temp\i_idbvtqlidb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4852
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\avtnlfdxvt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1288
  - - C:\Temp\avtnlfdxvt.exe
      C:\Temp\avtnlfdxvt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2168
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5328
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4232
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_avtnlfdxvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4640
  - - C:\Temp\i_avtnlfdxvt.exe
      C:\Temp\i_avtnlfdxvt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\davsnkifax.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1492
  - - C:\Temp\davsnkifax.exe
      C:\Temp\davsnkifax.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3232
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4864
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4832
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_davsnkifax.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2924
  - - C:\Temp\i_davsnkifax.exe
      C:\Temp\i_davsnkifax.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3940
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkicauspnk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4896
  - - C:\Temp\nkicauspnk.exe
      C:\Temp\nkicauspnk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4316
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3272
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:420
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkicauspnk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3336
  - - C:\Temp\i_nkicauspnk.exe
      C:\Temp\i_nkicauspnk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1084
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxupnhczus.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5108
  - - C:\Temp\zxupnhczus.exe
      C:\Temp\zxupnhczus.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4980
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5200
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4720
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxupnhczus.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4528
  - - C:\Temp\i_zxupnhczus.exe
      C:\Temp\i_zxupnhczus.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1880
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwurpmhec.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2044
  - - C:\Temp\ecwurpmhec.exe
      C:\Temp\ecwurpmhec.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2296
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3196
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwurpmhec.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:420
  - - C:\Temp\i_ecwurpmhec.exe
      C:\Temp\i_ecwurpmhec.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1568
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mhezwrpmhe.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3092
  - - C:\Temp\mhezwrpmhe.exe
      C:\Temp\mhezwrpmhe.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3144
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4748
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mhezwrpmhe.exe ups_ins
    3⤵
    PID:1716
  - - C:\Temp\i_mhezwrpmhe.exe
      C:\Temp\i_mhezwrpmhe.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4924
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bywuomgebz.exe ups_run
    3⤵
    PID:1924
  - - C:\Temp\bywuomgebz.exe
      C:\Temp\bywuomgebz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4360
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:916
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2472
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bywuomgebz.exe ups_ins
    3⤵
    PID:2624
  - - C:\Temp\i_bywuomgebz.exe
      C:\Temp\i_bywuomgebz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnlgdywrl.exe ups_run
    3⤵
    PID:5476
  - - C:\Temp\vtnlgdywrl.exe
      C:\Temp\vtnlgdywrl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1704
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4512
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3552
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnlgdywrl.exe ups_ins
    3⤵
    PID:2816
  - - C:\Temp\i_vtnlgdywrl.exe
      C:\Temp\i_vtnlgdywrl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4792
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gdxvtnliga.exe ups_run
    3⤵
    PID:3492
  - - C:\Temp\gdxvtnliga.exe
      C:\Temp\gdxvtnliga.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4324
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4516
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4220
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gdxvtnliga.exe ups_ins
    3⤵
    PID:3324
  - - C:\Temp\i_gdxvtnliga.exe
      C:\Temp\i_gdxvtnliga.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4720
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lfdavtnlfa.exe ups_run
    3⤵
    PID:2472
  - - C:\Temp\lfdavtnlfa.exe
      C:\Temp\lfdavtnlfa.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2420
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1100
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lfdavtnlfa.exe ups_ins
    3⤵
    PID:612
  - - C:\Temp\i_lfdavtnlfa.exe
      C:\Temp\i_lfdavtnlfa.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3644
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ifdxvpnifa.exe ups_run
    3⤵
    PID:2676
  - - C:\Temp\ifdxvpnifa.exe
      C:\Temp\ifdxvpnifa.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3464
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4816
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1604
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ifdxvpnifa.exe ups_ins
    3⤵
    PID:5208
  - - C:\Temp\i_ifdxvpnifa.exe
      C:\Temp\i_ifdxvpnifa.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\causmkifzx.exe ups_run
    3⤵
    PID:4284
  - - C:\Temp\causmkifzx.exe
      C:\Temp\causmkifzx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4220
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3496
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_causmkifzx.exe ups_ins
    3⤵
    PID:5620
  - - C:\Temp\i_causmkifzx.exe
      C:\Temp\i_causmkifzx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xupmhfzxrp.exe ups_run
    3⤵
    PID:3020
  - - C:\Temp\xupmhfzxrp.exe
      C:\Temp\xupmhfzxrp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2172
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4152
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4396
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xupmhfzxrp.exe ups_ins
    3⤵
    PID:2428
  - - C:\Temp\i_xupmhfzxrp.exe
      C:\Temp\i_xupmhfzxrp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5504
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omkeczurpm.exe ups_run
    3⤵
    PID:5752
  - - C:\Temp\omkeczurpm.exe
      C:\Temp\omkeczurpm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5652
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5980
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2912
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omkeczurpm.exe ups_ins
    3⤵
    PID:1880
  - - C:\Temp\i_omkeczurpm.exe
      C:\Temp\i_omkeczurpm.exe ups_ins
      4⤵
      PID:4612
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x220,0x300,0x7ff8106dc188,0x7ff8106dc194,0x7ff8106dc1a0
      4⤵
      PID:1128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1940,i,18048904437636980700,13234081631553166007,262144 --field-trial-handle=2776,i,3641190202441711277,9049638810901816302,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:2
      4⤵
      PID:3748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2092,i,8273425041428217081,4029355148465144564,524288 --field-trial-handle=2776,i,3641190202441711277,9049638810901816302,262144 --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:11
      4⤵
      System Time Discovery
      PID:2160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2416,i,15969783841058989241,5503642290420549744,524288 --field-trial-handle=2776,i,3641190202441711277,9049638810901816302,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:13
      4⤵
      PID:1120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,12579656524810996640,12707055074133988852,2097152 --field-trial-handle=2776,i,3641190202441711277,9049638810901816302,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
      4⤵
      PID:756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,16081498854532946298,9390405300599682364,2097152 --field-trial-handle=2776,i,3641190202441711277,9049638810901816302,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
      4⤵
      PID:2092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,10635767515714167630,13342984758641240098,2097152 --field-trial-handle=2776,i,3641190202441711277,9049638810901816302,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:1
      4⤵
      PID:1440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,11760014774889461377,14362261347948957722,2097152 --field-trial-handle=2776,i,3641190202441711277,9049638810901816302,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:9
      4⤵
      PID:996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,14853391217239138479,57707644025434255,524288 --field-trial-handle=2776,i,3641190202441711277,9049638810901816302,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
      4⤵
      PID:4836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,2873359355617435486,8908248326338505831,524288 --field-trial-handle=2776,i,3641190202441711277,9049638810901816302,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
      4⤵
      PID:2156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,6517580007115144500,5826845235043194927,524288 --field-trial-handle=2776,i,3641190202441711277,9049638810901816302,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14
      4⤵
      PID:3284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,6517580007115144500,5826845235043194927,524288 --field-trial-handle=2776,i,3641190202441711277,9049638810901816302,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14
      4⤵
      PID:2904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,11879339471818818860,6941723253280215218,524288 --field-trial-handle=2776,i,3641190202441711277,9049638810901816302,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:14
      4⤵
      PID:5900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6660,i,778232656237523862,12978029293702878216,524288 --field-trial-handle=2776,i,3641190202441711277,9049638810901816302,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
      4⤵
      PID:4292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,9731187895617702077,5970435264801055190,524288 --field-trial-handle=2776,i,3641190202441711277,9049638810901816302,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:14
      4⤵
      PID:1640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1424,i,6369179944482253176,7651759493645419093,524288 --field-trial-handle=2776,i,3641190202441711277,9049638810901816302,262144 --variations-seed-version --mojo-platform-channel-handle=1388 /prefetch:14
      4⤵
      PID:2784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1432,i,8337166818028430382,11401534746114338331,524288 --field-trial-handle=2776,i,3641190202441711277,9049638810901816302,262144 --variations-seed-version --mojo-platform-channel-handle=1200 /prefetch:14
      4⤵
      PID:2596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1440,i,4588983230972388925,11894801185722999410,524288 --field-trial-handle=2776,i,3641190202441711277,9049638810901816302,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
      4⤵
      PID:4320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,17495736844261439563,8232629387215933067,524288 --field-trial-handle=2776,i,3641190202441711277,9049638810901816302,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:14
      4⤵
      PID:4768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6280,i,15614998613897785967,3465090564042483242,262144 --field-trial-handle=2776,i,3641190202441711277,9049638810901816302,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:10
      4⤵
      PID:4824

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4248

C:\Temp\keczurpkhczurpjh.sys
C:\Temp\keczurpkhczurpjh.sys
1⤵
- Executes dropped EXE
PID:4640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3288

C:\Temp\pkeczxrpjh.sys
C:\Temp\pkeczxrpjh.sys
1⤵
- Executes dropped EXE
PID:2756

C:\Temp\mjhbztrljh.sys
C:\Temp\mjhbztrljh.sys
1⤵
- Executes dropped EXE
PID:4696

C:\Temp\bztrljebwt.sys
C:\Temp\bztrljebwt.sys
1⤵
- Executes dropped EXE
PID:1104

C:\Temp\rljdbvtnlg.sys
C:\Temp\rljdbvtnlg.sys
1⤵
- Executes dropped EXE
PID:4656

C:\Temp\igayvqolgd.sys
C:\Temp\igayvqolgd.sys
1⤵
- Executes dropped EXE
PID:2972

C:\Temp\fdavtnlfdx.sys
C:\Temp\fdavtnlfdx.sys
1⤵
- Executes dropped EXE
PID:1720

C:\Temp\khfdxvsmki.sys
C:\Temp\khfdxvsmki.sys
1⤵
- Executes dropped EXE
PID:5224

C:\Temp\kecxusmkfc.sys
C:\Temp\kecxusmkfc.sys
1⤵
- Executes dropped EXE
PID:4808

C:\Temp\pmhfcxuspk.sys
C:\Temp\pmhfcxuspk.sys
1⤵
- Executes dropped EXE
PID:5808

C:\Temp\pjhezwrpjh.sys
C:\Temp\pjhezwrpjh.sys
1⤵
- Executes dropped EXE
PID:1084

C:\Temp\gbywrojhbz.sys
C:\Temp\gbywrojhbz.sys
1⤵
PID:4720

C:\Temp\ywtnlgdbyt.sys
C:\Temp\ywtnlgdbyt.sys
1⤵
PID:2396

C:\Temp\vtolgeywqo.sys
C:\Temp\vtolgeywqo.sys
1⤵
PID:4860

C:\Temp\kigayvqoif.sys
C:\Temp\kigayvqoif.sys
1⤵
PID:1156

C:\Temp\ifaysqkica.sys
C:\Temp\ifaysqkica.sys
1⤵
PID:4460

C:\Temp\cxuspkifax.sys
C:\Temp\cxuspkifax.sys
1⤵
PID:5964

C:\Temp\ecaupmkecx.sys
C:\Temp\ecaupmkecx.sys
1⤵
PID:2664

C:\Temp\urpjhczurm.sys
C:\Temp\urpjhczurm.sys
1⤵
PID:4952

C:\Temp\zwurljhbzt.sys
C:\Temp\zwurljhbzt.sys
1⤵
PID:3212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

avtnlfdxvt.exe

Path C:\Temp\avtnlfdxvt.exe
Size 722KB
SHA256 a517ff76db6751b8ec1431583916dea9c7958afd6a183b578212cc9bf27b9055
MD5 a44eeea604db74e13f4c05093281f8e9
SHA1 efa81d5bd9e6f70295e1acb59e4488645b6744a2
SHA512 f2abd0c7e24f9352b7edcfe7906d004973698e69d02d0df8509f962494db95fe42581335ff55ea04fd38f3ec87e26288b5e0d21bd222d2f7b29aa5c33adfe84f
SSDEEP 12288:LflfAsiVGjSGecvXAflfAsiVGjSGecvX:DMcfcMcf
TLSH
T1C7F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bywqojgbvt.exe

Path C:\Temp\bywqojgbvt.exe
Size 722KB
SHA256 e99acd5cc18e73a18295026af0447d9f6dd3e05f47c5d8d7415f40e4fa246e37
MD5 43957850c237992e9c9199948a15110e
SHA1 90e7b475299305a3c21bb12c16d3fefabd82b71e
SHA512 b6b567e0f3bd32f74b1871db28e6621e3e4af175bbef00b93b0b176f9649d8a7203720dac558ee0dee8c2de915d19c35577828fd8e26e72fe309916faadb614c
SSDEEP 12288:0flfAsiVGjSGecvXAflfAsiVGjSGecvX:wMcfcMcf
TLSH
T1CDF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztrljebwt.sys

Path C:\Temp\bztrljebwt.sys
Size 293KB
SHA256 c3c71dccb64e8f0f0d796486e01bfcb823d6701e175ceea1af108ab350bf585c
MD5 8341c750201606078a29de5bd0487d6b
SHA1 6362b5522fd3d76fd7bf274e202e206648aba1ca
SHA512 c80b0c984e024380dd4128563889f8b029e723d12e842c9074647d98a5393496af52699c6a814a67b5524cf74ff842f18a4f2a893db16e3914ad6f30bc3ebffd
SSDEEP 3072:FtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:FIJjiJcbI03GBc3ucY5DCSj
TLSH
T1DA545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bywqojgbvt.exe

Path C:\Temp\i_bywqojgbvt.exe
Size 722KB
SHA256 60f2466d3931e3b9b50e508108bd643f87cc37d1e85fc3b34b2614c0dfc53b25
MD5 12679f0d13b320122c2e3fd03f8576e6
SHA1 326de901c81e750752961c8ff4861492bb778b8a
SHA512 bcf3b8a4b39d944af6786e053376232612a78c9a0fcbde42f89b30b773f3d8149430a449063a948f027f5088e98f4eac4c5e6e2bb014f59be64f72095f0c5fbf
SSDEEP 12288:8flfAsiVGjSGecvXAflfAsiVGjSGecvX:oMcfcMcf
TLSH
T1F0F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_idbvtqlidb.exe

Path C:\Temp\i_idbvtqlidb.exe
Size 722KB
SHA256 2a9a4e4d057cc1896d14c62bc53cb3483ae10b9728f1e4d2155a401f90ac8e27
MD5 ae393a18b1faaeeb965bc2c45a39c947
SHA1 1f54889226afd4e5548999fa692f54beb577fdc1
SHA512 2213eb9059bf545cfe4f0bce5e7844583eb729c2949926512f14bcd91413be617242cfd896e7abeac0ac775c22fce809ecd468ab54fd41e5cfe46cc9fa6b2751
SSDEEP 12288:fflfAsiVGjSGecvXAflfAsiVGjSGecvX:HMcfcMcf
TLSH
T171F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jgebztrljh.exe

Path C:\Temp\i_jgebztrljh.exe
Size 722KB
SHA256 21989282dc50dcd00c7b503033b0ac0984185628a493b1a21d5a5c195773dffc
MD5 37286524af0a2544f7b35d28051f62f3
SHA1 7d3c721356f60ac386848b05ccf63624ce187431
SHA512 d69bf298352fd5014ab219de08e2c92c7e733c4a3e7055e83b8a863b7c988dbb77317fbb4274885e640b6656ad97b619227bcba2e7cf646fe9a3c3631de91cc3
SSDEEP 12288:OflfAsiVGjSGecvXAflfAsiVGjSGecvX:qMcfcMcf
TLSH
T157F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_smkeczupmh.exe

Path C:\Temp\i_smkeczupmh.exe
Size 722KB
SHA256 be2207dbea4b1e7f3f1a57d8c95480b16cacb787997401b3b8a82b54625b12fb
MD5 51980dca0c80cfbea778dcd17639cc7c
SHA1 e22ab506a9ce95ee504c3984a3b05e2bd7f35ee9
SHA512 765dda6a500736e61260852a756208c45e0682e3f2508592663ed15d0a383cdd9c240011afc853fc772fede3e6d3c8d397314aa289280b086b6749dde66215cb
SSDEEP 12288:LflfAsiVGjSGecvXAflfAsiVGjSGecvX:DMcfcMcf
TLSH
T115F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wrojhbztrm.exe

Path C:\Temp\i_wrojhbztrm.exe
Size 722KB
SHA256 cb2a957affbbc4b8fedf1a1fca55c6aba67ce778d74b2b0c6a641de53a5753e0
MD5 2e36d234766415b9a982ed2fade36ca3
SHA1 64fd79d70052fdb2ffe51a558d2ee106102df52a
SHA512 5dbc733b452ddef406fa686e8b9c5d112e769e6f913a9d447d179d8f6e0c00a0238331f90a81752648fa49f27b63ea38a2a97c4bd4f7d8ea64cc3d85b06c94e8
SSDEEP 12288:OflfAsiVGjSGecvXAflfAsiVGjSGecvX:qMcfcMcf
TLSH
T1B4F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idbvtqlidb.exe

Path C:\Temp\idbvtqlidb.exe
Size 722KB
SHA256 667740d116b625536bb7c674a512a850bdcd7f4a9f1c2db673fd473b56198323
MD5 c98140854c387c670dc50bf5b227ffb5
SHA1 dd0dbbdf07dc7386c4970702077a832c04cbc264
SHA512 f080805bf746db0730bf3df637d572c43d43003671e0f9b5a8836935bced20e63c589f00fb0e8c897678140d744fce2f839faabb28060cdb98af2bf1daa8a88a
SSDEEP 12288:2flfAsiVGjSGecvXAflfAsiVGjSGecvX:iMcfcMcf
TLSH
T1FAF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igayvqolgd.sys

Path C:\Temp\igayvqolgd.sys
Size 293KB
SHA256 a87be69c8d31fef5bb0157cb4cadc266c069dc06331c694c6ab3b1be26738640
MD5 60e82fba6814f6ef720071f3d71628ea
SHA1 e7e933e3a73cc3646687273f4988fd9cd05ba1a9
SHA512 cf0b63b997c17c3d6fcfa7bbb50e6f81de119168272ea6b2ee0e354ece74b34f750282cd48e69933c0c4cfd1100f20f4f3954eb77c9457ac9b329e0c4c73a701
SSDEEP 3072:2tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:2IJjiJcbI03GBc3ucY5DCSj
TLSH
T100545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgebztrljh.exe

Path C:\Temp\jgebztrljh.exe
Size 722KB
SHA256 4565a860cb42c3593ed3ef1033146255ace3afe4128f8f59d7c3f95672346f4b
MD5 87aafabe97bf064cf00e210ec69263bc
SHA1 27bb643560445fd32066a21e530a961ffe669e8a
SHA512 bf46fccf44e045601fb519efb8224dc69c05628a5422de774c2d8eade3b19b2ec61f9f6bfb6be91c580dd18f2c5e6caa8b604a69e11dcb345f946e237e34bd76
SSDEEP 12288:8flfAsiVGjSGecvXAflfAsiVGjSGecvX:oMcfcMcf
TLSH
T191F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keczurpkhczurpjh.exe

Path C:\Temp\keczurpkhczurpjh.exe
Size 722KB
SHA256 1c121b870cb13bf59228175e9fceaaa1a0043fe0407b5263f56672bef9b83414
MD5 1f6637f048bf1114c8819498280ca14f
SHA1 3b0fb99b71b63b8485e29adab95d9bdd2bb41271
SHA512 fe9a9a06d6a623ffc68d19f1493753b124d19ea56961ca1abbf3cbb14bb953ec756ab866774f73928d8aed38206e3c4a8a7b05bdb609f57f4668cb96557ed2ed
SSDEEP 12288:lflfAsiVGjSGecvXAflfAsiVGjSGecvX:tMcfcMcf
TLSH
T118F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keczurpkhczurpjh.sys

Path C:\Temp\keczurpkhczurpjh.sys
Size 293KB
SHA256 b733374dbccf92d4e8bd369f8956cc9b2409668ea218d9e0b1ce38944191b7bc
MD5 b930a7fc17586b52f10e6e8bd9e02d53
SHA1 e0db36325fb2060e75fb612fba804f36de5bf49d
SHA512 872a134e64c770915d889ff0f933034010e37f24cb2192f3cd906da6aab25e802376b1e2630ffc982b7ffac40290dad4eb65b5b392cbb3948a350020b7470f6a
SSDEEP 3072:ztKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:zIJjiJcbI03GBc3ucY5DCSj
TLSH
T1FC545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjhbztrljh.sys

Path C:\Temp\mjhbztrljh.sys
Size 293KB
SHA256 f493ae769e6f3af69099d351e62c1217d1653463d83fef513c55e12310412cd8
MD5 e36d56682a76a58cf8f298e80610c2bb
SHA1 77cf097475b642fd0dbe00a2cb9bf148910aa914
SHA512 c2378f605ac3214d71c333b4a098b0229eee57f7a716fb1e489d0916a67c47a08975f4bf3dac6e25e369b0a02c5704dfc046bed279e2f2411876e19bf8239efe
SSDEEP 3072:AtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:AIJjiJcbI03GBc3ucY5DCSj
TLSH
T140545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkeczxrpjh.sys

Path C:\Temp\pkeczxrpjh.sys
Size 293KB
SHA256 98a3d4e1f7290b81312fe54862c906c37274c22498a39de149c2040b69309b45
MD5 eb307ba23ec9c30b4c9f8c1a0c5267a7
SHA1 1825dfe1fb4b9b85fbb6276ece8816a37f23f679
SHA512 d82aed28b47af1785222194c722a9a1c90d48847a85de34e6cb62e1344ec59aabe9086d82d481d4d9150375da3d26a5632e1d4bd7b463d54fa28bd83e7323b07
SSDEEP 3072:ItKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:IIJjiJcbI03GBc3ucY5DCSj
TLSH
T11E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljdbvtnlg.sys

Path C:\Temp\rljdbvtnlg.sys
Size 293KB
SHA256 49d20a6915403b64bfe74d38997a66b8a6972ca13385af9b707aa225ab2ded62
MD5 26271c4bdbc85420a2a7adc51a8d8097
SHA1 201265369be7e69385a99d3d786252a11172a70a
SHA512 0fc57125eb637a7172d457e59139761524b3b4ce609d8b15ee427626773af2c8a49f812dd3e4542e020f28538553349caf3b627b6186bd29370f0411301a8441
SSDEEP 3072:1tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:1IJjiJcbI03GBc3ucY5DCSj
TLSH
T126545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smkeczupmh.exe

Path C:\Temp\smkeczupmh.exe
Size 722KB
SHA256 6bdbd9a8acb4597ca034ebe785ecbc57dfb6accae1a36864671a5408fa90e0c0
MD5 3c22c6d7ce290ecff24a81b5af0efe4e
SHA1 513edde3312eee70b72abea0f6691c737014d4b8
SHA512 6087a9a5057f50a1c548b1c34d2d73aeb68e953d6c42a0ddf789cf835252da83eaa64efaf9e0626258e449f72da8938c2840c696dcccef9b5ca7a64ae34b9727
SSDEEP 12288:PflfAsiVGjSGecvXAflfAsiVGjSGecvX:XMcfcMcf
TLSH
T136F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrojhbztrm.exe

Path C:\Temp\wrojhbztrm.exe
Size 722KB
SHA256 ddc30d0fd8f50ef2c6c19a8b191515343beef536e3f7648d15e30042f592e4f9
MD5 501378a47f224ca0fbf894987683ded5
SHA1 053693f159122673d4d816d1c4867bdb9510d4eb
SHA512 aca7e7ffe00c6d518bfde8a50d1c87674f514d70e25e35bb0b3a097a08a1e397cbec9bbcd65f3a1fb37910849880e11f3cea544a9ebf72e01f018254a84d6cbc
SSDEEP 12288:+flfAsiVGjSGecvXAflfAsiVGjSGecvX:6McfcMcf
TLSH
T16BF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0c59160a51f6f3c09faaf3593a45b43a14b1da3961c2cccaed8346e6543c20e0
MD5 a2b289a93fce671046a365170f24567f
SHA1 d545bd953aab467815db42a92fd1d54047d5e6af
SHA512 ce7bb8aa1a40366ad652feb8233f60cd807014cb9e8ca999c2c1931eeb40a4afa1dc2c94c60d58639e2cece8c73d3a46da7a30c651ca6da0834f57b890bd2572
TLSH
T1CFD092653BA04E08C5C4207628E1A6A6A2504A31642E024841A2F23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2d6015222f1312f2737e561f5cb789cba16ddda90131d3af679ca4d112ce8de9
MD5 c1a7f665f2c508cc6aaf2ab720e9bbac
SHA1 f10047340073ccfd0dfa0a1ac50f19824703c6c6
SHA512 3b4b2c7997cc3a8e382662b8ab84779147222db6dcf3b614fe3750efba14aade687800978cd24780f580eacb766daa34fe0e560c30dde1f463983613dda767cb
TLSH
T188D092693B904E08C5C4207228E0A6A6A2604A31B82E024840A2B23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2e53a063ee58bc9f626c25bf190b33b0338c5bc6025a0b2d5d59ada413d294ae
MD5 ba790720fe728522058b8c9275afa844
SHA1 9bb264ea769ca28518508275d166d8a169b31eee
SHA512 f1ec9ba3b8c41e16308ee8f51c39d4420a388ffd38bdf8f38b9f76536b873e20e605079c5c00d0b3906dffa1d9e53a9b77839cb70874548bba407b4a706f092b
TLSH
T19A616D1337DA1BEDDB2240F214F1D0FB35F5C849060B2A18478C6EB4877AE24ABE0223
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595a5b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595a5b.TMP
Size 3KB
SHA256 b6ecd7b5a4c962f24b69d82bd18124d8181acf82204cad67300a333b0586fdb8
MD5 4893a3ecde12564ce060f9026caaf7ec
SHA1 6de2ddc76410c1990996c8243ff6e880d4e23ad3
SHA512 85f69077841d838008fad4db1461310bb052f99da8517859ebe735e12fa953a55ada2caf90f7ba25f32e15e3f37f4942057a1227442ef1193b4c875b3e6dc548
TLSH
T1ED615E5737DA1BEDDB2240F214F1D0FB35F5C849060B6A58478C6DB48776E24ABE1263
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 61550b2c82801424c1e761c4af3bf1e62763e4e60aab1ee4ddf9fae7510b4bf5
MD5 559686d83d92d0c641147406ac9ed86e
SHA1 f149ca81f73519432433c4ef8c2b19571c3f6f39
SHA512 e9ecdee79762b27e501305b308259ab503e376714098254b9ae11db4d115baa2a371096c4ddb3fef96350a73e695cb20d7d732198265d4880e0a753cd1d06f91
TLSH
T176419EF7C3F8856E8A0196F0AA186E1BCF2D0515432C7D5AC9E4AF2B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 15cd72aec85b0f94550c8dead72a314d51b69cf8fd33527259bbed3329e6fe26
MD5 e27feb551c3c98b72024a2b8e33dde36
SHA1 781fd71b74bc8abbaa4f7c1f4b6ffa3aa54bdc6a
SHA512 9e21ee0117b7ae14a2ed21bdb56e496116daf7de6a654c7020a335ea81bc947521ae923fd4d27ecc7da0929cb8388674b70e4087cc1bb763b57bab58e6aea3ac
SSDEEP 192:sxRCREyM/jK1Ml8wC96/fDsjg7ZOkzoA8p95/g6+WNCNC/Yb1AZ6VGEIgVtJ:sxRCa8g/fDsjg14z/59/h6Dl
TLSH
T13462FB156A245977CCDBD209FA567F53D2F91573E2901E48AEFCCA1C04E6AED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 05bf78dd69289a444a6324a9e8f2cd71c3ff2edc38270d468c9a60302e315e4a
MD5 a9548c9c652e40ca5b0f7351eaca9894
SHA1 f0a5123b8e86f199d24663109b91b5f7e76f3988
SHA512 42a8159da6f185b36cc78faa19423c4868a994aea0fb6ca04f334af8607dbc324178077d1fefec0e743870a2ad03418014b662a18b4e47eecfa8497b9f6f43ea
SSDEEP 192:sxRFREyM/jK1Ml8wC96/fDsMg7ZOkzoA8p95/g6+WNCNC/Yb1AZ6VGEIgDmtJ:sxRFa8g/fDsMg14z/59/h6DA
TLSH
T16A62FB05AA245A778CDBD209FA527F53D2F91573A2900E48AEFCCA1C04E6ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 1e6dd70435a1e94029810131bea58eae17f82018837af681a40ed1a115200d8f
MD5 cf3f0a7b7a4c27aef024fe7b9ffd9c7f
SHA1 fcf2ed059d3a831c0540a80ee2dd6b929070b266
SHA512 680d8a26b66961fcd839cee84b437f5b9e07fa70a50718a9c86cad60e6144ae82bf5132f2760918eacb1877c2b9ac6e2519f35e31ab85eccbc5ef5e75f358276
SSDEEP 192:sxRFREyM/jK1Ml8UQ4C96/fDsM87ZOkzoA8pr5/g6+WNCNC/YbOiZ6VGEIgDctJ:sxRFaq/g/fDsM8149/59/G6DG
TLSH
T14662EA15AA245E778CDBD209FA527F53D3F91573A2940E48AAFCCA1C00E7ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 aeb99289151d6f89a4e9d8b4003e22921d97f293db05e9190a5e4e4c32fa0d9a
MD5 80f9f4a51d72266f81414c65166131fe
SHA1 4d924f3125a492441fe5541eae40bcc10764bc6f
SHA512 1b1d93bcfea0341a0ec3a06b1556f1b8f0a00f06d962e016d01ea934b1e065f85b1d77a7dfae839c29374ab5eb886cd5940d53141b8ed0d6931d12dedad15bb3
SSDEEP 768:FW7pXD7pLuL70tWgikfn48F1+UoAYDCx9Tuqh0VfUC9xbog/OVEoBJ8WwrogZhNH:FW7pX1E70tWgikfn4u1jaPoByWb6vvf
TLSH
T1ABE2DB3B680CCB7E4F804EDDEC2ABD9A6DA801CF56D88D9447EA480C03C67EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 680fc2c052b11466f3835130ad0a7836917aa7edd6331a937ecee9581a7410c9
MD5 e929a3447028cd08f62fb75f860ff011
SHA1 f991d8415ec4d8ecc1226da798084cf10a5709d1
SHA512 a7a5d78f9df32a62c6a7b5891f9e5f4406bcc6411b6a1e9c4c70d27ab9647a0ba958a6892d8d9b1551126018412a5e0bef719bf77a50e381bdcb7b9ad3b582d7
SSDEEP 96:KRqP2qc8cKWkB5gaKK4/ggKcKiJ46jHLURlTp5FWtC4gNFK40gjFcrzKtoDuKIcz:CqP2qc8c1kBKay/ggRKiJ46jHLURlTpq
TLSH
T1B791B41136BA42983C7E650C81BCD93BDA867872701D653F7FE851654FAAE024DFC8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59fda0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59fda0.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 7006d577e9df55cfc410bb0557656bd04f86a5ffbd2963e08c9697ab45bace92
MD5 84347b8de3ddcca340bc827cd64ac9ae
SHA1 e1b78f282d086bce693002aa1e938b3f3f9e8e30
SHA512 03c0789fcfde27333dbe05cbae5e4b6ae1d836584d07ffbd31cca0c06e367d7ab8d66ec26d3e6f9f90f9246cf242c2b2bbf7c1c8c804d6357b27766fa8f8aabe
SSDEEP 768:8rv+4UNbdC3HcqBqobGUQtuOtZu4aWADIidy8LbleVH1S1C:8bsbw32tZzaNsuVLhEH1d
TLSH
T1D903C076A859CE735CF7A284B1877A4B7EF861B385880AD4C8CD1B4E058B4ED130BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 807b0440772decaa1e206adb47f95589cef5dec0dee9b8101ff53a3fe35a0fc2
MD5 6393d2cecb478ce560ca33b00e2d2c14
SHA1 a2d3d557538ba59f4c350ecc6f05759f61fdd6bd
SHA512 c46440390bd29c5e3e620ed46246caf24bb4adaf623678f6b47405212dfe6e9604517b58073971fb6785d37500311074415c44d15284ea089c67f2004bf64107
SSDEEP 768:9rv+4UNbdC3Qq0BqobGUQtppZu4aWADIidy8LqdeVH1S1C:9bsbw3JpZzaNsuVLCEH1d
TLSH
T11D03C037AC59CA739CF79284B1877A0B7EF89163C6880AD088DD1B4E45DB8AD1307E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 3b6fb48035714d7e7c439d8ee1f8e9a6f0bb6154c62ce84c1855543ececc96d6
MD5 5788e1d9adc3b4cdff28fa15d6ce61d0
SHA1 19bfad14e9cf3b2bd73feb5a5874c061b2ce3208
SHA512 adb6b0d5b0a04837cefdd6993a5137a66e0ff1fbad9e4008d91f99857123092e33a16d28378aae1e9283464ef163f99a2b4546eed46c14eb912114d54bb2cb4f
SSDEEP 768:frv+4UNbd/3sFUgBqobGUQtudtZu4aWADIidy8LuleVH1S1C:fbsbZ3kntZzaNsuVL2EH1h
TLSH
T19613C076AC69CE735CFB6284B1877A4BBEF8617385880AD4C8D91B4E05874ED130BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 ba7ec4ae8c2637f61cbf617e4223276f72ce0c9be414c8756aa950fe7db944ac
MD5 a1df5c6854c8b0f9889049b8d6c60076
SHA1 486a7913ccf341ecd53797ee5133208e861d6f4a
SHA512 c287a7eed3f3844a97480796335222787688b5f4732cb7a579647de95e2a585edea15cbb9be1c98138e79b5d00718c427e0e8bab485931523f66288707384589
SSDEEP 768:irv+4UNbd/3GMUgBqobGUQtu6tZu4aWADIidy8LuleVH1S1C:ibsbZ3RMtZzaNsuVL2EH1h
TLSH
T1AF13C076AC69CE735CFB6284B1877A4BBEF8617385880AD4C8D91B4E05874ED130BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 161baa4bffef7f63e5cd9382a787dd5b82f3328c6b7b51d4a338df73c6883da5
MD5 373ecb4db246d42db5e240aa0d9f9206
SHA1 4eb359a4247141413169228ee1b04ef554c44145
SHA512 d519bd93f9273b95c3c7990222ac59a92272f3e18c8fb38976e97d09a5bd0dff8e77f077d83c5b49844287a8ec7408e2a1c732f79c579a7024d047c7928032b5
SSDEEP 768:GY3hMUgBqobGUQtu6tZu4aWADIidy8Lul/vmdTr1Fd:GY3+MtZzaNsuVL2/o7d
TLSH
T133F2BF76EC568D7398BAA384B1873A47EEF461B3D5C84ED888DD5B4E00835AD1317C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 05e1aa4f17481072cd4698bafd9210705f2385cfe751a9b5b4b1f1cc1ea36fbc
MD5 fe8859cf94d9998413a11eea108a3d1e
SHA1 cac136378286b09cccc5e8242284f7e69b6b5d30
SHA512 cec91882e6811e9356b2716b9103d16e0c6765195c3d543f27477ae5bb844a1be3f9f4255c8de1034e61b946e1cc6a08c65138442b93ad5d80bc53c21cc3bc1f
SSDEEP 768:0FQ+3/wgBuUj4vUQtuctZu4aWADIidy8Lul/vmdTr1Fd:X+3q9tZzaNsuVL2/o7d
TLSH
T1DB1307F698D38977D8AE5383A37D2D4699FCD063B5884994BBC91E4DCC820BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

797a4919-507b-4e6c-a3ee-deaf2ad45698.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\797a4919-507b-4e6c-a3ee-deaf2ad45698.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3264_2007312654\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 97e61f9075d069f628bf2837a0b2b73a7ce7896ed2f9e9889be7685464193b78
MD5 58773758b9e9d65cbb518d669bb4dc65
SHA1 95c8d074f3a283b99bfaa0000146bf19d00be1a2
SHA512 657310a256eafcd3bb69d035c119d606e9130fbf0c3ea36000da23e0619ce1e5d9ce04bb855e0da3c7d241d4a9f306ab7b9344d41806755178868cdb417ab754
TLSH
T15F71008356ADC9B3C1DA5BF002835648F1BB22380723202087525A86AA34A3A54B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1084-382-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1104-263-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1156-415-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1156-421-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1720-325-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1720-339-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2396-407-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2664-429-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2664-442-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2756-187-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2972-295-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3212-446-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4460-419-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4640-61-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4640-220-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4656-283-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4656-317-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4696-235-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4720-394-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4808-344-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4860-411-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4952-441-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5224-337-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5808-357-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5964-425-0x0000000000010000-0x00000000000AB000-memory.dmp

Download