feafade84a4db9d795d2b9d64d3c77fe0fec172069dee69a7783072b5b15b286

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 12:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 722KB
Sample260820-p7q2macp81
SHA256 feafade84a4db9d795d2b9d64d3c77fe0fec172069dee69a7783072b5b15b286
MD5 360e46cc0ee6e0c0b32cdd82018df126
SHA1 87c33e4da9e04bd3e99ae49ba17cdccb1a197eb8
SHA512 999728778c82633102a2857ac1f64a42370c1bb5e21d7a27fd651fa0745652329fdc529b01062dbbc16552607a6b52723cdb3ceccd31881bd2da16232da5ebff
SSDEEP 12288:HIflfAsiVGjSGecvXAflfAsiVGjSGecvXU:HUMcfcMcfU
TLSH
T1D2F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4968	qojgbztrljdbztro.exe
1708	qojgbztrljdbztro.sys
6008	CreateProcess.exe
5924	wqojdbywto.exe
2172	CreateProcess.exe
1448	CreateProcess.exe
5908	i_wqojdbywto.exe
676	jdbvtrljdb.sys
4952	CreateProcess.exe
756	oigaytqoig.exe
4596	CreateProcess.exe
5820	CreateProcess.exe
5552	i_oigaytqoig.exe
2616	fdyvqolfdy.sys
3524	CreateProcess.exe
5656	ywqnigaysq.exe
5732	CreateProcess.exe
5860	CreateProcess.exe
3292	i_ywqnigaysq.exe
5768	kidavtnlfd.sys
4512	CreateProcess.exe
2044	kidavsnlfd.exe
5460	CreateProcess.exe
1204	CreateProcess.exe
2996	i_kidavsnlfd.exe
3716	fdxvpnkica.sys
4212	CreateProcess.exe
4816	cxusnkfdxv.exe
4560	CreateProcess.exe
3936	CreateProcess.exe
4168	i_cxusnkfdxv.exe
5988	ausqkhfzxs.sys
3128	CreateProcess.exe
5296	upnhfzxrpk.exe
476	CreateProcess.exe
2120	CreateProcess.exe
4648	i_upnhfzxrpk.exe
3204	urpkhcausm.sys
2884	CreateProcess.exe
4552	urpkhcausm.exe
2664	CreateProcess.exe
2128	CreateProcess.exe
2908	i_urpkhcausm.exe
4884	urmjhbztro.sys
4696	CreateProcess.exe
2244	urpjgeczur.exe
1796	CreateProcess.exe
2020	CreateProcess.exe
3820	i_urpjgeczur.exe
5508	zwrojhbztr.sys
5368	CreateProcess.exe
3884	omgebwurmj.exe
3456	CreateProcess.exe
6108	CreateProcess.exe
3504	i_omgebwurmj.exe
3424	ljdbwtrljg.sys
4284	CreateProcess.exe
948	toigaytqoi.exe
3328	CreateProcess.exe
1944	CreateProcess.exe
1148	i_toigaytqoi.exe
1708	ytqljgbytq.sys
3360	CreateProcess.exe
6020	tqoigaynlf.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4992_2002936684\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4992_798303856\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4992_1977217256\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4992_1334240179\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4992_798303856\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4992_1977217256\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4992_1334240179\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4992_1334240179\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4992_1334240179\office_endpoints_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kidavsnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urpjgeczur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urpjgeczur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	toigaytqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_toigaytqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqojdbywto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqnigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kidavsnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxusnkfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urpkhcausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqoigaynlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxspnkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkfcxusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upnhfzxrpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkfcxusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkhczujh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezurpmhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtrljdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytrljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bytrljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urpkhcausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgebwurmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqoigaynlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnigaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezurpmhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtrljdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqnigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxusnkfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnigaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qojgbztrljdbztro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigaytqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqojdbywto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upnhfzxrpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgebwurmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxspnkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomgezwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigaytqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkhczujh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomgezwto.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3868	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
6036	ipconfig.exe
2024	ipconfig.exe
1660	ipconfig.exe
432	ipconfig.exe
3448	ipconfig.exe
1216	ipconfig.exe
5724	ipconfig.exe
5376	ipconfig.exe
1004	ipconfig.exe
2908	ipconfig.exe
4924	ipconfig.exe
1040	ipconfig.exe
4092	ipconfig.exe
4272	ipconfig.exe
5840	ipconfig.exe
3276	ipconfig.exe
4604	ipconfig.exe
372	ipconfig.exe
5712	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317043231935478"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{E270E2C4-C245-4E24-93F7-F7B836A6DE2D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4968	qojgbztrljdbztro.exe
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4968	qojgbztrljdbztro.exe
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4968	qojgbztrljdbztro.exe
4968	qojgbztrljdbztro.exe
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4968	qojgbztrljdbztro.exe
4968	qojgbztrljdbztro.exe
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4968	qojgbztrljdbztro.exe
4968	qojgbztrljdbztro.exe
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4968	qojgbztrljdbztro.exe
4968	qojgbztrljdbztro.exe
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4968	qojgbztrljdbztro.exe
4968	qojgbztrljdbztro.exe
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4968	qojgbztrljdbztro.exe
4968	qojgbztrljdbztro.exe
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5908	i_wqojdbywto.exe
Token: SeDebugPrivilege	5552	i_oigaytqoig.exe
Token: SeDebugPrivilege	3292	i_ywqnigaysq.exe
Token: SeDebugPrivilege	2996	i_kidavsnlfd.exe
Token: SeDebugPrivilege	4168	i_cxusnkfdxv.exe
Token: SeDebugPrivilege	4648	i_upnhfzxrpk.exe
Token: SeDebugPrivilege	2908	i_urpkhcausm.exe
Token: SeDebugPrivilege	3820	i_urpjgeczur.exe
Token: SeDebugPrivilege	3504	i_omgebwurmj.exe
Token: SeDebugPrivilege	1148	i_toigaytqoi.exe
Token: SeDebugPrivilege	1660	i_tqoigaynlf.exe
Token: SeDebugPrivilege	4656	i_qnigaysqki.exe
Token: SeDebugPrivilege	5840	i_faxspnkica.exe
Token: SeDebugPrivilege	3280	i_spkfcxusmk.exe
Token: SeDebugPrivilege	4504	i_usmkhczujh.exe
Token: SeDebugPrivilege	760	i_ezurpmhezx.exe
Token: SeDebugPrivilege	4584	i_wuomgezwto.exe
Token: SeDebugPrivilege	3052	i_wtrljdbwto.exe
Token: SeDebugPrivilege	4236	i_bytrljdbvt.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4992	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 4968	4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 4960 wrote to memory of 4256	4960	2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 4256 wrote to memory of 4992	4256	iexplore.exe	91
PID 4992 wrote to memory of 4676	4992	msedge.exe	92
PID 4992 wrote to memory of 4672	4992	msedge.exe	94
PID 4992 wrote to memory of 3868	4992	msedge.exe	95
PID 4992 wrote to memory of 4672	4992	msedge.exe	94
PID 4992 wrote to memory of 4672	4992	msedge.exe	94
PID 4992 wrote to memory of 3920	4992	msedge.exe	96
PID 4992 wrote to memory of 3920	4992	msedge.exe	96
PID 4992 wrote to memory of 4512	4992	msedge.exe	97
PID 4992 wrote to memory of 4512	4992	msedge.exe	97
PID 4992 wrote to memory of 4512	4992	msedge.exe	97
PID 4992 wrote to memory of 3036	4992	msedge.exe	98
PID 4992 wrote to memory of 3036	4992	msedge.exe	98
PID 4992 wrote to memory of 3036	4992	msedge.exe	98
PID 4992 wrote to memory of 5512	4992	msedge.exe	100
PID 4992 wrote to memory of 1520	4992	msedge.exe	99
PID 4992 wrote to memory of 5512	4992	msedge.exe	100
PID 4992 wrote to memory of 5512	4992	msedge.exe	100
PID 4992 wrote to memory of 1520	4992	msedge.exe	99
PID 4992 wrote to memory of 1520	4992	msedge.exe	99
PID 4992 wrote to memory of 1204	4992	msedge.exe	102
PID 4992 wrote to memory of 1204	4992	msedge.exe	102
PID 4992 wrote to memory of 2912	4992	msedge.exe	105
PID 4992 wrote to memory of 5756	4992	msedge.exe	106
PID 4992 wrote to memory of 2912	4992	msedge.exe	105
PID 4992 wrote to memory of 5756	4992	msedge.exe	106
PID 4992 wrote to memory of 3780	4992	msedge.exe	108
PID 4968 wrote to memory of 6008	4968	qojgbztrljdbztro.exe	109
PID 5924 wrote to memory of 2172	5924	wqojdbywto.exe	114
PID 4992 wrote to memory of 4772	4992	msedge.exe	117
PID 4992 wrote to memory of 4772	4992	msedge.exe	117
PID 4992 wrote to memory of 3288	4992	msedge.exe	118
PID 4992 wrote to memory of 3288	4992	msedge.exe	118
PID 4968 wrote to memory of 1448	4968	qojgbztrljdbztro.exe	119
PID 4968 wrote to memory of 4952	4968	qojgbztrljdbztro.exe	123
PID 756 wrote to memory of 4596	756	oigaytqoig.exe	125
PID 4968 wrote to memory of 5820	4968	qojgbztrljdbztro.exe	128
PID 4968 wrote to memory of 3524	4968	qojgbztrljdbztro.exe	132
PID 5656 wrote to memory of 5732	5656	ywqnigaysq.exe	134
PID 4968 wrote to memory of 5860	4968	qojgbztrljdbztro.exe	137
PID 4968 wrote to memory of 4512	4968	qojgbztrljdbztro.exe	142
PID 2044 wrote to memory of 5460	2044	kidavsnlfd.exe	144
PID 4968 wrote to memory of 1204	4968	qojgbztrljdbztro.exe	147
PID 4992 wrote to memory of 4172	4992	msedge.exe	149
PID 4992 wrote to memory of 1244	4992	msedge.exe	150
PID 4992 wrote to memory of 2608	4992	msedge.exe	151
PID 4968 wrote to memory of 4212	4968	qojgbztrljdbztro.exe	154
PID 4816 wrote to memory of 4560	4816	cxusnkfdxv.exe	156
PID 4968 wrote to memory of 3936	4968	qojgbztrljdbztro.exe	159
PID 4968 wrote to memory of 3128	4968	qojgbztrljdbztro.exe	163
PID 5296 wrote to memory of 476	5296	upnhfzxrpk.exe	165
PID 4968 wrote to memory of 2120	4968	qojgbztrljdbztro.exe	168
PID 4968 wrote to memory of 2884	4968	qojgbztrljdbztro.exe	172
PID 4552 wrote to memory of 2664	4552	urpkhcausm.exe	174
PID 4968 wrote to memory of 2128	4968	qojgbztrljdbztro.exe	177
PID 4968 wrote to memory of 4696	4968	qojgbztrljdbztro.exe	181
PID 2244 wrote to memory of 1796	2244	urpjgeczur.exe	183
PID 4968 wrote to memory of 2020	4968	qojgbztrljdbztro.exe	186
PID 4992 wrote to memory of 5804	4992	msedge.exe	188
PID 4992 wrote to memory of 5804	4992	msedge.exe	188
PID 4968 wrote to memory of 5368	4968	qojgbztrljdbztro.exe	194
PID 3884 wrote to memory of 3456	3884	omgebwurmj.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_360e46cc0ee6e0c0b32cdd82018df126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Temp\qojgbztrljdbztro.exe
  C:\Temp\qojgbztrljdbztro.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4968
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wqojdbywto.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6008
  - - C:\Temp\wqojdbywto.exe
      C:\Temp\wqojdbywto.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5924
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2172
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1660
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wqojdbywto.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1448
  - - C:\Temp\i_wqojdbywto.exe
      C:\Temp\i_wqojdbywto.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oigaytqoig.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4952
  - - C:\Temp\oigaytqoig.exe
      C:\Temp\oigaytqoig.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:756
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4596
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5724
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oigaytqoig.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5820
  - - C:\Temp\i_oigaytqoig.exe
      C:\Temp\i_oigaytqoig.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5552
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywqnigaysq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3524
  - - C:\Temp\ywqnigaysq.exe
      C:\Temp\ywqnigaysq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5656
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5732
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:432
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywqnigaysq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5860
  - - C:\Temp\i_ywqnigaysq.exe
      C:\Temp\i_ywqnigaysq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3292
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kidavsnlfd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4512
  - - C:\Temp\kidavsnlfd.exe
      C:\Temp\kidavsnlfd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2044
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5460
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kidavsnlfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1204
  - - C:\Temp\i_kidavsnlfd.exe
      C:\Temp\i_kidavsnlfd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2996
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cxusnkfdxv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4212
  - - C:\Temp\cxusnkfdxv.exe
      C:\Temp\cxusnkfdxv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4816
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4560
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1216
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cxusnkfdxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3936
  - - C:\Temp\i_cxusnkfdxv.exe
      C:\Temp\i_cxusnkfdxv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4168
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\upnhfzxrpk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3128
  - - C:\Temp\upnhfzxrpk.exe
      C:\Temp\upnhfzxrpk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5296
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:476
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5376
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_upnhfzxrpk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2120
  - - C:\Temp\i_upnhfzxrpk.exe
      C:\Temp\i_upnhfzxrpk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4648
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urpkhcausm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2884
  - - C:\Temp\urpkhcausm.exe
      C:\Temp\urpkhcausm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4552
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2664
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urpkhcausm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2128
  - - C:\Temp\i_urpkhcausm.exe
      C:\Temp\i_urpkhcausm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urpjgeczur.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4696
  - - C:\Temp\urpjgeczur.exe
      C:\Temp\urpjgeczur.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2244
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1796
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urpjgeczur.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2020
  - - C:\Temp\i_urpjgeczur.exe
      C:\Temp\i_urpjgeczur.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3820
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omgebwurmj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5368
  - - C:\Temp\omgebwurmj.exe
      C:\Temp\omgebwurmj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3884
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3456
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3276
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omgebwurmj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6108
  - - C:\Temp\i_omgebwurmj.exe
      C:\Temp\i_omgebwurmj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3504
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\toigaytqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4284
  - - C:\Temp\toigaytqoi.exe
      C:\Temp\toigaytqoi.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:948
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3328
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_toigaytqoi.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1944
  - - C:\Temp\i_toigaytqoi.exe
      C:\Temp\i_toigaytqoi.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqoigaynlf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3360
  - - C:\Temp\tqoigaynlf.exe
      C:\Temp\tqoigaynlf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6020
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4700
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4924
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqoigaynlf.exe ups_ins
    3⤵
    PID:4352
  - - C:\Temp\i_tqoigaynlf.exe
      C:\Temp\i_tqoigaynlf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1660
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnigaysqki.exe ups_run
    3⤵
    PID:4828
  - - C:\Temp\qnigaysqki.exe
      C:\Temp\qnigaysqki.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5276
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2240
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4604
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnigaysqki.exe ups_ins
    3⤵
    PID:5044
  - - C:\Temp\i_qnigaysqki.exe
      C:\Temp\i_qnigaysqki.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4656
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\faxspnkica.exe ups_run
    3⤵
    PID:4564
  - - C:\Temp\faxspnkica.exe
      C:\Temp\faxspnkica.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5800
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2592
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1040
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_faxspnkica.exe ups_ins
    3⤵
    PID:704
  - - C:\Temp\i_faxspnkica.exe
      C:\Temp\i_faxspnkica.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spkfcxusmk.exe ups_run
    3⤵
    PID:2736
  - - C:\Temp\spkfcxusmk.exe
      C:\Temp\spkfcxusmk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3672
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6060
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:372
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spkfcxusmk.exe ups_ins
    3⤵
    PID:4364
  - - C:\Temp\i_spkfcxusmk.exe
      C:\Temp\i_spkfcxusmk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3280
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usmkhczujh.exe ups_run
    3⤵
    PID:6016
  - - C:\Temp\usmkhczujh.exe
      C:\Temp\usmkhczujh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3908
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1768
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5712
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usmkhczujh.exe ups_ins
    3⤵
    PID:5600
  - - C:\Temp\i_usmkhczujh.exe
      C:\Temp\i_usmkhczujh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4504
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ezurpmhezx.exe ups_run
    3⤵
    PID:2344
  - - C:\Temp\ezurpmhezx.exe
      C:\Temp\ezurpmhezx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4380
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1392
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6036
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ezurpmhezx.exe ups_ins
    3⤵
    PID:5136
  - - C:\Temp\i_ezurpmhezx.exe
      C:\Temp\i_ezurpmhezx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:760
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wuomgezwto.exe ups_run
    3⤵
    PID:5332
  - - C:\Temp\wuomgezwto.exe
      C:\Temp\wuomgezwto.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4172
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4652
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wuomgezwto.exe ups_ins
    3⤵
    PID:4276
  - - C:\Temp\i_wuomgezwto.exe
      C:\Temp\i_wuomgezwto.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4584
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtrljdbwto.exe ups_run
    3⤵
    PID:4304
  - - C:\Temp\wtrljdbwto.exe
      C:\Temp\wtrljdbwto.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4840
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4772
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1004
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtrljdbwto.exe ups_ins
    3⤵
    PID:2772
  - - C:\Temp\i_wtrljdbwto.exe
      C:\Temp\i_wtrljdbwto.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3052
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bytrljdbvt.exe ups_run
    3⤵
    PID:4112
  - - C:\Temp\bytrljdbvt.exe
      C:\Temp\bytrljdbvt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1732
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4360
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2024
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bytrljdbvt.exe ups_ins
    3⤵
    PID:2156
  - - C:\Temp\i_bytrljdbvt.exe
      C:\Temp\i_bytrljdbvt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4236
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x300,0x7ff83d36c188,0x7ff83d36c194,0x7ff83d36c1a0
      4⤵
      PID:4676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2004,i,9841179004891364493,10742284345043092715,262144 --field-trial-handle=3016,i,6383107664823987850,4464482439025442525,262144 --variations-seed-version --mojo-platform-channel-handle=3012 /prefetch:2
      4⤵
      PID:4672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2192,i,5446002343553627083,10982304106895259450,524288 --field-trial-handle=3016,i,6383107664823987850,4464482439025442525,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:11
      4⤵
      System Time Discovery
      PID:3868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,15642786256340195333,7165449903247447554,524288 --field-trial-handle=3016,i,6383107664823987850,4464482439025442525,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:13
      4⤵
      PID:3920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3528,i,1479541214187114922,9165096937491557981,2097152 --field-trial-handle=3016,i,6383107664823987850,4464482439025442525,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
      4⤵
      PID:4512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3536,i,10799611050128596229,5389537495301230941,2097152 --field-trial-handle=3016,i,6383107664823987850,4464482439025442525,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
      4⤵
      PID:3036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,9708002568415313573,12595591143600279871,2097152 --field-trial-handle=3016,i,6383107664823987850,4464482439025442525,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:1
      4⤵
      PID:1520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,14005254469401740662,3369965129500584826,2097152 --field-trial-handle=3016,i,6383107664823987850,4464482439025442525,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:9
      4⤵
      PID:5512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,15350826492219625356,5871662170744097740,524288 --field-trial-handle=3016,i,6383107664823987850,4464482439025442525,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:14
      4⤵
      PID:1204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,2922498241797874387,12228729691638548453,524288 --field-trial-handle=3016,i,6383107664823987850,4464482439025442525,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
      4⤵
      PID:2912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,2407946216625028928,1488979145793058267,524288 --field-trial-handle=3016,i,6383107664823987850,4464482439025442525,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
      4⤵
      PID:5756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,2862586562247826565,9064488852307468834,524288 --field-trial-handle=3016,i,6383107664823987850,4464482439025442525,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
      4⤵
      PID:756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,2862586562247826565,9064488852307468834,524288 --field-trial-handle=3016,i,6383107664823987850,4464482439025442525,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
      4⤵
      PID:3780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,13862130001664231825,18126820112907726806,524288 --field-trial-handle=3016,i,6383107664823987850,4464482439025442525,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
      4⤵
      PID:4772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,14995066798402091683,13603290285964669126,524288 --field-trial-handle=3016,i,6383107664823987850,4464482439025442525,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:14
      4⤵
      PID:3288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1312,i,9167149793530745392,16929991639626031183,524288 --field-trial-handle=3016,i,6383107664823987850,4464482439025442525,262144 --variations-seed-version --mojo-platform-channel-handle=1292 /prefetch:14
      4⤵
      PID:4172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1308,i,10045791411043844106,7461582300521213963,524288 --field-trial-handle=3016,i,6383107664823987850,4464482439025442525,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:14
      4⤵
      PID:1244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1316,i,12145202847673969720,8610001258847555398,524288 --field-trial-handle=3016,i,6383107664823987850,4464482439025442525,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:14
      4⤵
      PID:2608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,18366668526603320242,8291314355952377006,524288 --field-trial-handle=3016,i,6383107664823987850,4464482439025442525,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
      4⤵
      PID:5804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,14397688181347173882,13741519778125629334,524288 --field-trial-handle=3016,i,6383107664823987850,4464482439025442525,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
      4⤵
      PID:2344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,9021743364408330110,17000879278958838710,524288 --field-trial-handle=3016,i,6383107664823987850,4464482439025442525,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:14
      4⤵
      PID:5808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,12800475447431725224,17532115898675016811,524288 --field-trial-handle=3016,i,6383107664823987850,4464482439025442525,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:14
      4⤵
      PID:2812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6016,i,17038109700269824632,1916921486794137785,262144 --field-trial-handle=3016,i,6383107664823987850,4464482439025442525,262144 --variations-seed-version --mojo-platform-channel-handle=940 /prefetch:10
      4⤵
      PID:4656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,2735129598860385638,8316284725427595635,524288 --field-trial-handle=3016,i,6383107664823987850,4464482439025442525,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:14
      4⤵
      PID:5920

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4368

C:\Temp\qojgbztrljdbztro.sys
C:\Temp\qojgbztrljdbztro.sys
1⤵
- Executes dropped EXE
PID:1708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5428

C:\Temp\jdbvtrljdb.sys
C:\Temp\jdbvtrljdb.sys
1⤵
- Executes dropped EXE
PID:676

C:\Temp\fdyvqolfdy.sys
C:\Temp\fdyvqolfdy.sys
1⤵
- Executes dropped EXE
PID:2616

C:\Temp\kidavtnlfd.sys
C:\Temp\kidavtnlfd.sys
1⤵
- Executes dropped EXE
PID:5768

C:\Temp\fdxvpnkica.sys
C:\Temp\fdxvpnkica.sys
1⤵
- Executes dropped EXE
PID:3716

C:\Temp\ausqkhfzxs.sys
C:\Temp\ausqkhfzxs.sys
1⤵
- Executes dropped EXE
PID:5988

C:\Temp\urpkhcausm.sys
C:\Temp\urpkhcausm.sys
1⤵
- Executes dropped EXE
PID:3204

C:\Temp\urmjhbztro.sys
C:\Temp\urmjhbztro.sys
1⤵
- Executes dropped EXE
PID:4884

C:\Temp\zwrojhbztr.sys
C:\Temp\zwrojhbztr.sys
1⤵
- Executes dropped EXE
PID:5508

C:\Temp\ljdbwtrljg.sys
C:\Temp\ljdbwtrljg.sys
1⤵
- Executes dropped EXE
PID:3424

C:\Temp\ytqljgbytq.sys
C:\Temp\ytqljgbytq.sys
1⤵
- Executes dropped EXE
PID:1708

C:\Temp\vtnlidavtn.sys
C:\Temp\vtnlidavtn.sys
1⤵
PID:4768

C:\Temp\hfdxvpnifa.sys
C:\Temp\hfdxvpnifa.sys
1⤵
PID:4884

C:\Temp\xspnkfvpnk.sys
C:\Temp\xspnkfvpnk.sys
1⤵
PID:4092

C:\Temp\pnhfcxusmk.sys
C:\Temp\pnhfcxusmk.sys
1⤵
PID:4892

C:\Temp\bzurpmhecw.sys
C:\Temp\bzurpmhecw.sys
1⤵
PID:852

C:\Temp\bztrljebwu.sys
C:\Temp\bztrljebwu.sys
1⤵
PID:4612

C:\Temp\ztroljdbyo.sys
C:\Temp\ztroljdbyo.sys
1⤵
PID:1144

C:\Temp\ebytrljdbw.sys
C:\Temp\ebytrljdbw.sys
1⤵
PID:4644

C:\Temp\vtnljdaysq.sys
C:\Temp\vtnljdaysq.sys
1⤵
PID:5696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ausqkhfzxs.sys

Path C:\Temp\ausqkhfzxs.sys
Size 293KB
SHA256 d514424135a87578d9e9dcd56e9d90f6a046aaf5fd30424ea03df9e7adfec499
MD5 e65feb69969dc05a04149b7524e8e9f3
SHA1 22868a8ac189ebd837ded985bb7ed8ded7547ad4
SHA512 e995fc595b3dd27def63fbc9a0c944bcf6602049f0d10963ee3a753cf4b01405150b1640dfc252cc2a58cfdbb9abe5e42074f9a584adc835cc54ab08a2d3d8c8
SSDEEP 3072:8tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:8IJjiJcbI03GBc3ucY5DCSj
TLSH
T152545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxusnkfdxv.exe

Path C:\Temp\cxusnkfdxv.exe
Size 722KB
SHA256 2911e7a6c925444ffd20ce141cfca20ac4769fee941a8e5383d9999a1b8b716b
MD5 4a54f578e9a8db5ed763f8bfa83d8e55
SHA1 de4aba7167a9bc8af271e7bd377f745962474044
SHA512 33956fbb92717bdf36642c2ca7c86fa02f0b448da190cdbae4bd668aa17a0d7cf0f30c778d6113e8ada2c20b2b5ebfedfed808d8a9cbf977b8c9158784def491
SSDEEP 12288:2flfAsiVGjSGecvXAflfAsiVGjSGecvX:iMcfcMcf
TLSH
T173F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvpnkica.sys

Path C:\Temp\fdxvpnkica.sys
Size 293KB
SHA256 465f3a2705f7b924d02131049e66501b72e5775379a3f89d8e3bdc5d500637eb
MD5 47fa2fc23cc26aefc2ea25cd528c836a
SHA1 95191aed13dab99b80862db4e7218a8e0a61be64
SHA512 7ecdea96f8568743516fda8c41c8c8e8b7484a859a02886c1c563150ae58d1c7fb8aaacbefb90bd5e38bc02ae46977d428c266b5d7d5e90229a140f0f1e2e99d
SSDEEP 3072:YtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:YIJjiJcbI03GBc3ucY5DCSj
TLSH
T172545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdyvqolfdy.sys

Path C:\Temp\fdyvqolfdy.sys
Size 293KB
SHA256 fa3510135054781cb68eb6a50d985eb4b4fbdb7d3da9b6b0df038c977aded5ab
MD5 8340c0357dfc1c4732b36507466fae73
SHA1 d709f8b2895e8f5978390d1bd0b92be9e5a5e2bd
SHA512 a4f8a0d82b1ce899e07182672d595db7d987d041baf7c6e8b07fd5b9d05c14f9d08d2ab89d18581489a006ba4cee9ae6b0f417db93e83fc6045d6e301ee94b61
SSDEEP 3072:ItKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:IIJjiJcbI03GBc3ucY5DCSj
TLSH
T1FA545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cxusnkfdxv.exe

Path C:\Temp\i_cxusnkfdxv.exe
Size 722KB
SHA256 23707c4e76aafd3bdad27aacf55250d57f2e7ad81dc408a9e7bc8c53d65682c6
MD5 87daec4f212d7e54331da04f194e1c8c
SHA1 ba2053ec4f10f6f2528641f776b5406ed06af5e6
SHA512 2649c755f39aace617d7f55983fdc7af5798892ced30e32f1ca6fe32f347d9d268325b3c5be031cb2076f2d4e889532eaf54c142188ed5148ab0c7ef96c9d468
SSDEEP 12288:6flfAsiVGjSGecvXAflfAsiVGjSGecvX:WMcfcMcf
TLSH
T1D9F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kidavsnlfd.exe

Path C:\Temp\i_kidavsnlfd.exe
Size 722KB
SHA256 a7e27cace84a6b83112c340eeb7260c1073bb7b141e6dddbfd4710203030a8cd
MD5 11ab1e07d1c8f6c864d667708cda0726
SHA1 de441eb8f77cff3a97eac9cbf515708ec02d308a
SHA512 0ed1e293e06fc9337544e2f52dfc585118af6f294b38b36feed2314a94bf24d073d0142b1bb62df9c65fe3927b31a5d7f3702b374ba01cfb26075ec5c7baedda
SSDEEP 12288:7flfAsiVGjSGecvXAflfAsiVGjSGecvX:TMcfcMcf
TLSH
T1E0F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_oigaytqoig.exe

Path C:\Temp\i_oigaytqoig.exe
Size 722KB
SHA256 7bb921366c975edb67c86611c6f75336dadb276f6d756f013c4a861fb901dc8d
MD5 f0d8cd9cf2a04cab7983998249ab0a27
SHA1 77409f23ebce259899505375cbe49582fda74b0a
SHA512 4eb9a8e410002725800268c1768cff555e5520711da29f6d063698744288374c74b8083a0a386b5c8ed2a6166af9be3503bb816a222c8cec175365b1bc59fc3c
SSDEEP 12288:BflfAsiVGjSGecvXAflfAsiVGjSGecvX:pMcfcMcf
TLSH
T1F8F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wqojdbywto.exe

Path C:\Temp\i_wqojdbywto.exe
Size 722KB
SHA256 7e8c106021a7d9a3cc970b2cc6841c0cd399cc483bf9b6721b6b79a4e92a314c
MD5 090eba5700fb3e0122ee02ec6be93329
SHA1 c9b52e5525de5a157391d98dcbc131d3236917c6
SHA512 1c909c56b1b80d136b15191b4e0d1d6ae5b7814806211d081a65d0d8866766cb5020031837ca34d33a3adf90aa2f6a82f9c89153c5d67e8a767d46214ab54dfb
SSDEEP 12288:aflfAsiVGjSGecvXAflfAsiVGjSGecvX:2McfcMcf
TLSH
T112F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ywqnigaysq.exe

Path C:\Temp\i_ywqnigaysq.exe
Size 722KB
SHA256 f1807c8d97787f88f135ece94cbcc5178b2e9c6c6f04991f3617c3bb98fc56ac
MD5 3810eb38f435c2c3fa31b31ed0b7c050
SHA1 caa890dccec97bdf71df86b59cbec465402d845a
SHA512 c7633a9a52f7d4e1cb68dfb47c4e7958d23c72395408c705049d5f00dd126d392c682ae297c00a65e8e45df9fcdb0390d840d2a172275287e3e3202f9a6a57ac
SSDEEP 12288:VflfAsiVGjSGecvXAflfAsiVGjSGecvX:9McfcMcf
TLSH
T186F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbvtrljdb.sys

Path C:\Temp\jdbvtrljdb.sys
Size 293KB
SHA256 a1167978de879b84ffa7770669abbe710e26efa06474da60276e0abd75597d62
MD5 7a1400e7c9d1291f3675e74dd6172641
SHA1 718f902c6a8a395c9df3c4eada65250e31b7a1e9
SHA512 166aaa5ec98bcbcdeccd571e45216af3f3a5e7fa3a38d058bef144471cf9c93b2b29c9dc27b6f2a31498bab6bc08762ba40adf6daf86330d9db3a58ab7730750
SSDEEP 3072:htKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:hIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C2545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kidavsnlfd.exe

Path C:\Temp\kidavsnlfd.exe
Size 722KB
SHA256 7d45cc40cc845770aa5719867b790dd48665bc984fb4a085da8c438266cb78ab
MD5 36986454f58c38f2f1006cc8e307962f
SHA1 7cd2d0a253405666ab53d236644b3eb4cbea10fb
SHA512 75eeba39da1588909d93625f15a4aec6ff6c002040a9ded2f766b718790102e0f89234f57b5a978bcd9a327467f6fd39b602c22dfb7ff88ee6aea0acaa43d40b
SSDEEP 12288:DflfAsiVGjSGecvXAflfAsiVGjSGecvX:LMcfcMcf
TLSH
T1D1F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kidavtnlfd.sys

Path C:\Temp\kidavtnlfd.sys
Size 293KB
SHA256 6986445e9406781d6d5db6fd75e12abc9ca58daf6fcf670d55da60fa9deb9126
MD5 58351dd87ade3613f2789357e564450b
SHA1 f68aecb79e1254fac52909c2906e8ae820a071b0
SHA512 42d6627071e81eb22e7ba495e99a77c4f2277318709444663491e5fc55749f8d5c4fae173220a16ac5a2b5d8a0a56a8b1a8a0ca20560a76ed00418f47e91d3a2
SSDEEP 3072:ktKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:kIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A8545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigaytqoig.exe

Path C:\Temp\oigaytqoig.exe
Size 722KB
SHA256 d6ef2eed785d13ec007e2bf7230b06e87386f4ee6e91273e19aa39abbec392a4
MD5 87a59d5cf9e1d0134e8343f4b75486a2
SHA1 20325a159a460b2089c8896f9c28d7fd74988634
SHA512 7f06e0bb40a6f4fb2d4876867512d13a0f8a197c3428ca9cb139e5c7a3813bb7e552d739f187a1e9663af3a956dec4f2ec8654ea14d04a7472ba5bef238a4181
SSDEEP 12288:8flfAsiVGjSGecvXAflfAsiVGjSGecvX:oMcfcMcf
TLSH
T146F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qojgbztrljdbztro.exe

Path C:\Temp\qojgbztrljdbztro.exe
Size 722KB
SHA256 c76a18dc7139a4de987313553fe9b2d073229d87e39cb0fc13d6387c51db5287
MD5 20b8c43540a42e4b1ab0984b4ef3b994
SHA1 be2e3de065fd888e3bd23a5be35c7d0fd0d7f99d
SHA512 c3ecb5f0bb17dc0655d063065169395d65eaa563e741d7aa1ba35bf016d314d8f1716203d3785594499e0423b4a6e6827d0375a2868e44761881c1ddc90fd932
SSDEEP 12288:jIflfAsiVGjSGecvXAflfAsiVGjSGecvX0:jUMcfcMcf0
TLSH
T1CBF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qojgbztrljdbztro.sys

Path C:\Temp\qojgbztrljdbztro.sys
Size 293KB
SHA256 3aaa45291edd537b937bfe9b2942e0ece9df15c456116d051ad6525487a51d64
MD5 79ea3ad2422b6c6d7d442d8114305f4e
SHA1 6e426da81bf396cda429f6dcd69cc362b668d37b
SHA512 3d5d83ff063b8e6bf0b68950991348045ef6617342a5f3168fc6db23268af73f9abbdfbcbc0d7cad485a80bf1135b31b5778b29207cbce10b2c96c6569145d09
SSDEEP 3072:vtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:vIJjiJcbI03GBc3ucY5DCSj
TLSH
T158545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

upnhfzxrpk.exe

Path C:\Temp\upnhfzxrpk.exe
Size 722KB
SHA256 82fc2577c39f57a19f4db1f9941d04336df7926d747b558865308bb103c39e6d
MD5 8f5d4fe69d1bdc6b6f1cb935d0083846
SHA1 6b0f7ea32c8e266503bbd80d49eb64044551629d
SHA512 048dcf49db1adfd920220d20bf7f6cd47e5f1c9a8b524aae2896f74ddb5659e66192710fa68336901a39c17f6a7dedb946bb64b140c83c35efb8dfdd714cb00e
SSDEEP 12288:QflfAsiVGjSGecvXAflfAsiVGjSGecvX:MMcfcMcf
TLSH
T193F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqojdbywto.exe

Path C:\Temp\wqojdbywto.exe
Size 722KB
SHA256 207ccc5bd1684cd61a656e1f1b8955f0d7ece20e4aadd36c0b40c0303db55de6
MD5 76ee92851daf5fd3a72fbe7f7f0892b5
SHA1 f87a637c8de1788108dccbc368a608487c622bbe
SHA512 108b6ca1a010d060306bd6559b9f6b4f58d0304f28a4bfb8b98e66a6497b2bcab7b8a6e804ca22c9bb9202f8d40cf7d779a766ec391fb9adbb70b6ade65ebdb3
SSDEEP 12288:AflfAsiVGjSGecvXAflfAsiVGjSGecvX:cMcfcMcf
TLSH
T13DF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqnigaysq.exe

Path C:\Temp\ywqnigaysq.exe
Size 722KB
SHA256 e2e5789bf83d7ccf6f75a855b830df09b7c9a740f8d246cf44f73fbd1c9709ce
MD5 cb939ff347e00ba178cf9ad90e0b1564
SHA1 9c4493af0a247cb57b8c685c64a5c95d6add1321
SHA512 5a59ce6b843a8e4e0e5601d14a53d73902c693df3db2a8fa5d39619ca8965175a3589d70346faebf04262ba064ff840d3bd904dcaf47dda99a0fa91e54197c2a
SSDEEP 12288:ZflfAsiVGjSGecvXAflfAsiVGjSGecvX:xMcfcMcf
TLSH
T104F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 71d7070760252693d1c20d9feee040cb5ba6836247ffbd694c0e29c3b87a9f6c
MD5 cb37553cea790465fa99a0f637c8d37b
SHA1 a9d2d329f34688a97420402898e6b35f2e8b2063
SHA512 69aad15521ba314bd55d91482875453a15a41cf77497ad1566d36ce4e7cd16a61a39e3c7b92c4c519a797b0220f81597c3dae15215bc68d321d6d5c86dbd4fcb
TLSH
T1B061E7A3936725D1E76BA472E3F1980937F8A44B81AB2E0343D25D38180AF4CD5DF667
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ac63.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59ac63.TMP
Size 3KB
SHA256 348ec5d22023b378d0cb6b7ce6833b1bd098d6d73b850a08212735038ffb31b9
MD5 8b6d041f3476b181ef0ae8cd2f5d80d7
SHA1 e284afc42892f2fd91f3690cb1f2f86049c2af3a
SHA512 529a3ca845689ad04cc2c80bc7749ffab09174aeb68d29fcbdaddf3150847888911f2619c830555de9c99a7ec2495fd193ebea8daa73eb7e73acf7ba510510d8
TLSH
T1DB61E8A3836325D1E76B6472E3F0580937F8A44B81A72E0303D25D745806F4CD5DF267
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 853c87b3c047ffc4abb395a8d9c2fb7566b634cb1b2a3c3a817412d3cd7524a2
MD5 806ce36062a7f80da47fc961ccd7e3ba
SHA1 03ae6c63c443f746ddbe3f8125e203b4ef40c3ab
SHA512 ceed4a12d9e7073ae7e1fe07e6e4a1caf6ffe200ed26c3e076275bf10e011c92e41c60cf9ae5609997ca8e35822a8142502a6e734f0d867014f59757de5c69d8
TLSH
T10541B0F783F4857D8A1195F0AB146E1FCE1D0515432C7C5AC9E4AE2BA3E3471D14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e5be9c79a9f94d0d4e139a346b68759b162b9a45cdc82792b0da5f17aeb01bfd
MD5 5d58352a8b59611742bbfab5ef93575a
SHA1 582fa1a10edf9644f4e8faaaa17afb299a1f9549
SHA512 35a1dc49f9a5ce510a7537bc1455549c801e85e882ae6ddb7f55bfc246012acb5611d8a698d3f7abb813c1035c947a7017d2a24d782a408fcc2e2e63e9d82743
SSDEEP 192:sxRORCCF/fo+sHxeMdCZvVzoD8p9o/g6+WNCHn/YCEXwuO4GFIgVOJ:sxROrF/fDsHxeMEvB6/52/Fds
TLSH
T14A42D8156D28A93B9CC7E20DFB25BF53E3F9503261D55E48AAFC9A1C04EB6DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c7c26a45ee441011fb1a3bc6641e83ed15c3ab8bb72c22c235decb3125a2a803
MD5 e54921d743918ee12430dadd424453b5
SHA1 02e14c3cdc780f49202409862d86c4ff8720d315
SHA512 d88c6c95c9ed5411481ba785e43cfc50d6309525fb0cbe046757a15a4188d5cb980497f73efc5b26142c62fae711dd7f105277a15559eac6f897e7209405acd0
SSDEEP 192:sxRpRCCF/fo+sPxeMdCZvVzoD8p9o/g6+WNCHn/YCEXwuO4GFIgDGtOJ:sxRprF/fDsPxeMEvB6/52/Fd3
TLSH
T18742C7156A28A93B8CC7E20DBB15BF53E3F9503261D55F48AAFC9A1C04EB6DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 da5d36f81335dae822930de6f23ec41a8c26559c91ae60611330ef5bf8e70795
MD5 05dc30269271c29bf853f65ca83ca971
SHA1 c3c19c5647c417e1df580b6c60f226c38ee9ebde
SHA512 d1189b62dcd6dc0294dc8ab82be576c502c9aeb39f061286c3b293ebfd97f6be94b94e6d3e8740171853de16c7e2bb730317d1c8dbe3151897f3fbdd09f79db4
SSDEEP 192:sxRpRCCF/fo+sPxJMdCZvVzoD8p9o/g6+WNCHn/YCEXIuO4GFIgDGXOJ:sxRprF/fDsPxJMEvB6/52/bdF
TLSH
T1CE42C7156928693B9CC7E24DBB15BF53E3F9503261D56F48AAFC9B1C10EB6CD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 c77ca0e20f3a838b8c518232097bf6d4d5e5483b53d1ffdda71692c975ddd1ae
MD5 4c76439da64951f9836f995511d8802a
SHA1 d2c428d9e88d77aa6bd3c0857798cf12b7412b77
SHA512 7beed81aa6b7ff46dc764289c06c7340e5ec798c004147b009c9e4da782ccc3a132c19c68990fc5d074a12451ee75eaf881c68ee857b9f0b703ae81d25ab54bc
SSDEEP 768:jC+vBN7pLuL7JQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDZ0QqcZroZ+e1:jC+vB7E7JQWgQ+f4+u1jaAZ0VcS4i
TLSH
T1F9D2EA7B640DCB7F4F804ADDED197A9F6DA802CB9698CD4047FE841C02C6BEB52164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1f1a696f-d843-4839-85c7-9a02fbd8933f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1f1a696f-d843-4839-85c7-9a02fbd8933f.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 48KB
SHA256 adc241bfe96dd78b7c326e012700a0bb61a6a37111358e8fa16c54ae34df48e2
MD5 d6dee268476f97b79b3ab2c279a6ac94
SHA1 11c724ac011c7ea4e7a8a7d8f45d1c9d40bbe07b
SHA512 49c09a5fb61be9c505066ae00e5c29306873ecc1bf21f0a17e7b6fb31df8e72008a7bb0f7e3b1d0de8fa773b614f4b0a892e540856c8932e8b1528e397da8b52
SSDEEP 768:uF0rv+4UNbd73+wgjz13w6p8+p3bd66j+4BRv86aLIWMHfB:vbsb13Gzmk8+p3Z6n4yWHfB
TLSH
T1952328F298DB8936D8AD8787A37D2E47AEBCD05375844994B7C85E4CCC461BFD30A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a986115695a6fc6873b43c9f01cc2877b9b815ce6039f5cfeefa056c6872aad3
MD5 84d2e23cd8a019a45a22d87e7d7c7014
SHA1 35e5c239e45fa623c559057ccdef4b3995e105de
SHA512 9f80949e4179ff1585d9ba1381fa1f352a34b66916b81fad47c1bab033b37219b06886d46143099cfbab33b9f5068d5d5d878721d6b4a36834fba527aaf5e85c
SSDEEP 768:Irv+4UNbdD3AcZZNp8+p3bd66j+4BRv86aLIih2bwCl1:Ibsbp3RZL8+p3Z6n4y/0ww
TLSH
T14403BE73F9A899339CF6C644B2467B437FF851A396C10AC4D4DD2B4E419A19E630BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 74a9648776bd0d99f08e33e73b5823cfcb54ecd20689b9ed43d4cdaa4b73e34f
MD5 c2e03c30f643b7dcd9ead7fc918e65ad
SHA1 c99f15910bc2dc97c6e80fafe2928aaec984c160
SHA512 284a71a7cdb82ae0b762980de891560f428fc794b3652a81b850a86cd57f7123793b4fe464b55fc067b8f180121d034fd09b0958a5d43efa1820c289f7bc3440
SSDEEP 768:qrv+4UNbdh3Xz9FZPep8+p3bd66j+4BRv86aLIWMH7:qbsbH3XzNPY8+p3Z6n4yWH7
TLSH
T13703AE72F869D9339CF6D644B1873B837FF810A395C01E94D8CA6B4D54971AE270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 95a7fcae73c274a7f89464eb5f1595ccf0e0c195545ea8b888714a2065e5bfb0
MD5 91e5a093386e7558e48ee6897a9981cd
SHA1 f3cb4dffb6c5b9c88e7e0d9bc79b79890b79345f
SHA512 6eb6d6bbeef828253eaba7caa962500e724f2cca22aaa2dc456b69e096547017b963c090b511b2b3cc309ad73c0801302cb1d2a98d3109287aa8b3e1802e4d5e
SSDEEP 768:grv+4UNbdh3gztFZPtp8+p3bd66j+4BRv86aLIWMHfB:gbsbH3gzdPr8+p3Z6n4yWHfB
TLSH
T15503BEB1F8699D338CF5C644B2873B477FF820A395C00E98D8C9AB5D059A19E270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 a513d10bb5ff337c3c88aa218ae77ab2c8e70343b807481a146382dcfb2886c0
MD5 3874a1e1c56aa26fb2e25f47714b3930
SHA1 3efe09b18d06fbe22bf1821f4c679c1fcfe1cf1d
SHA512 bf6bb2ff06298b35fdbd7d98ef467155d410ddeea60d2c5e6873b104ee87fe6a7a3bdaf0060bc2e755d5b54a1e162fcb62f5f290c251c6a9b1e03a9775036be3
SSDEEP 768:qrv+4UNbdD3+PZPNp8+p3bd66j+4BRv86aLITMH2bwCl1:qbsbp3OPL8+p3Z6n4ytH0ww
TLSH
T1F803BEB2E96899339CF6C644B1867B877FF851A399C10AC4D8C96B4E405629E370F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

851c35c4-8dcc-4aea-9a81-6b932ad817ac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\851c35c4-8dcc-4aea-9a81-6b932ad817ac.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4992_476038501\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 93828467e88ce1e3b8706b321e7c594dfe1aa53f7cb50658a1e5ea12325070ef
MD5 9ff6e216d28763b967294e2f7a129a76
SHA1 d1ef2373b4805eda0dff45b478e5f999f87a5af5
SHA512 45f8d5f311b50bd57f438252bbf31f601f95369358113ffab6406699570c2bb2503ac2091749fe893b634525fcc5df942bea5a8e762ad53fa589dfca37035d96
TLSH
T18371008357B9C5B2C1DE5FF102835244F6FB22384B2330200BA1558AAB30A7A18B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/676-187-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/852-446-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1144-469-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1708-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1708-363-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2616-234-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3204-317-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3204-311-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3424-337-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3716-274-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4092-415-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4612-464-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4644-489-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4768-390-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4884-403-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4884-315-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4892-426-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5508-354-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5508-331-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5696-493-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5768-262-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5988-286-0x0000000000010000-0x00000000000AB000-memory.dmp

Download