3023a4e49160601bc78af085928493a12b967b2f06a67f10abdb0f967b49c70a

Analysis

max time kernel
124s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 02:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 722KB
Sample260910-c9d4maw1as
SHA256 3023a4e49160601bc78af085928493a12b967b2f06a67f10abdb0f967b49c70a
MD5 c9a6c49b9c914d5d22c0157574ad700f
SHA1 bdabfd25a826aea64f6847d11665760b44d522d5
SHA512 274928abb1ba60c3e94bddf0107a05c10ebfc926938c60afde38046905656e0dfea3e7ae96466736721ddfb13bf0b2965e69b1e1530e6fcf8a6dae94c71ee36c
SSDEEP 12288:hflfAsiVGjSGecvXAflfAsiVGjSGecvX:JMcfcMcf
TLSH
T152F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
6540	gbvtnlgdbytrljdb.exe
3396	gbvtnlgdbytrljdb.sys
5824	CreateProcess.exe
2360	lgdbvtnlga.exe
4348	CreateProcess.exe
5880	CreateProcess.exe
5448	i_lgdbvtnlga.exe
1236	nigaytqlid.sys
2284	CreateProcess.exe
6568	qoifaysqki.exe
756	CreateProcess.exe
1080	CreateProcess.exe
5152	i_qoifaysqki.exe
2012	aysqkicayv.sys
5184	CreateProcess.exe
6160	yspkifaysq.exe
4076	CreateProcess.exe
4460	CreateProcess.exe
4884	i_yspkifaysq.exe
4248	kicausmkfc.sys
4308	CreateProcess.exe
4556	fzxspkicax.exe
4852	CreateProcess.exe
4908	CreateProcess.exe
5936	i_fzxspkicax.exe
2260	zurpkecwus.sys
5188	CreateProcess.exe
2556	ausmhczusm.exe
2372	CreateProcess.exe
1252	CreateProcess.exe
2428	i_ausmhczusm.exe
3444	xupmhfcxup.sys
3368	CreateProcess.exe
3128	mjebzurmke.exe
976	CreateProcess.exe
5200	CreateProcess.exe
1488	i_mjebzurmke.exe
7040	pjhezwrpjh.sys
5492	CreateProcess.exe
6224	pjebwuomge.exe
5180	CreateProcess.exe
5112	CreateProcess.exe
5844	i_pjebwuomge.exe
6736	ljgbywuolj.sys
1100	CreateProcess.exe
6380	omjdbzwrom.exe
1052	CreateProcess.exe
6964	CreateProcess.exe
6460	i_omjdbzwrom.exe
3540	ytqoigbytq.sys
5376	CreateProcess.exe
7048	qljgbytqlj.exe
4144	CreateProcess.exe
3356	CreateProcess.exe
6668	i_qljgbytqlj.exe
4288	olgdbvtolg.sys
5832	CreateProcess.exe
3184	dyvqoigays.exe
6620	CreateProcess.exe
6204	CreateProcess.exe
4180	i_dyvqoigays.exe
7032	fdyvtnlfdx.sys
1092	CreateProcess.exe
4712	fdxvqnigay.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_2028392311\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_2028392311\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1488014117\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_597791201\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_597791201\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_597791201\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1488014117\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1488014117\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_1488014117\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3908_597791201\deny_etld1_domains.list	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6592	6540	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 35 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausmhczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdbvtnlga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjebwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xsqnifaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jecwuomgez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvqnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxspkicax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxspkicax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjebwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omjdbzwrom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvqnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khfzxspkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yspkifaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yspkifaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omjdbzwrom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xsqnifaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khfzxspkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwurpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdbvtnlga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qljgbytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dyvqoigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwurpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvqoigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjebzurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbvtnlgdbytrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausmhczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qljgbytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jecwuomgez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjebzurmke.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6616	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1216	ipconfig.exe
4208	ipconfig.exe
5720	ipconfig.exe
2004	ipconfig.exe
6492	ipconfig.exe
2352	ipconfig.exe
3284	ipconfig.exe
3104	ipconfig.exe
2472	ipconfig.exe
4952	ipconfig.exe
5740	ipconfig.exe
6636	ipconfig.exe
2716	ipconfig.exe
2900	ipconfig.exe
6332	ipconfig.exe
1280	ipconfig.exe
6256	ipconfig.exe
4444	ipconfig.exe
2936	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134334819903925524"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{7CD603F6-1A4A-4818-8C90-3477524DCE3F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6540	gbvtnlgdbytrljdb.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6540	gbvtnlgdbytrljdb.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6540	gbvtnlgdbytrljdb.exe
6540	gbvtnlgdbytrljdb.exe
6540	gbvtnlgdbytrljdb.exe
6540	gbvtnlgdbytrljdb.exe
6540	gbvtnlgdbytrljdb.exe
6540	gbvtnlgdbytrljdb.exe

Suspicious behavior: LoadsDriver 17 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	5448	i_lgdbvtnlga.exe
Token: SeDebugPrivilege	5152	i_qoifaysqki.exe
Token: SeDebugPrivilege	4884	i_yspkifaysq.exe
Token: SeDebugPrivilege	5936	i_fzxspkicax.exe
Token: SeDebugPrivilege	2428	i_ausmhczusm.exe
Token: SeDebugPrivilege	1488	i_mjebzurmke.exe
Token: SeDebugPrivilege	5844	i_pjebwuomge.exe
Token: SeDebugPrivilege	6460	i_omjdbzwrom.exe
Token: SeDebugPrivilege	6668	i_qljgbytqlj.exe
Token: SeDebugPrivilege	4180	i_dyvqoigays.exe
Token: SeDebugPrivilege	5728	i_fdxvqnigay.exe
Token: SeDebugPrivilege	712	i_xsqnifaxsq.exe
Token: SeDebugPrivilege	6080	i_khfzxspkic.exe
Token: SeDebugPrivilege	5516	i_zxrpkecwup.exe
Token: SeDebugPrivilege	1228	i_ecwurpjhbz.exe
Token: SeDebugPrivilege	5328	i_jecwuomgez.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3908	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 6540	4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 4652 wrote to memory of 3460	4652	2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	91
PID 3460 wrote to memory of 3908	3460	iexplore.exe	92
PID 3908 wrote to memory of 4260	3908	msedge.exe	93
PID 3908 wrote to memory of 4500	3908	msedge.exe	94
PID 3908 wrote to memory of 6616	3908	msedge.exe	96
PID 3908 wrote to memory of 4500	3908	msedge.exe	94
PID 3908 wrote to memory of 4500	3908	msedge.exe	94
PID 3908 wrote to memory of 2868	3908	msedge.exe	97
PID 3908 wrote to memory of 2868	3908	msedge.exe	97
PID 3908 wrote to memory of 3240	3908	msedge.exe	98
PID 3908 wrote to memory of 3240	3908	msedge.exe	98
PID 3908 wrote to memory of 3240	3908	msedge.exe	98
PID 3908 wrote to memory of 4112	3908	msedge.exe	99
PID 3908 wrote to memory of 4112	3908	msedge.exe	99
PID 3908 wrote to memory of 4112	3908	msedge.exe	99
PID 6540 wrote to memory of 5824	6540	gbvtnlgdbytrljdb.exe	102
PID 2360 wrote to memory of 4348	2360	lgdbvtnlga.exe	105
PID 6540 wrote to memory of 5880	6540	gbvtnlgdbytrljdb.exe	108
PID 3908 wrote to memory of 5228	3908	msedge.exe	109
PID 3908 wrote to memory of 5228	3908	msedge.exe	109
PID 3908 wrote to memory of 5444	3908	msedge.exe	110
PID 3908 wrote to memory of 5444	3908	msedge.exe	110
PID 3908 wrote to memory of 6304	3908	msedge.exe	113
PID 6540 wrote to memory of 2284	6540	gbvtnlgdbytrljdb.exe	118
PID 6568 wrote to memory of 756	6568	qoifaysqki.exe	120
PID 6540 wrote to memory of 1080	6540	gbvtnlgdbytrljdb.exe	123
PID 6540 wrote to memory of 5184	6540	gbvtnlgdbytrljdb.exe	127
PID 6160 wrote to memory of 4076	6160	yspkifaysq.exe	129
PID 6540 wrote to memory of 4460	6540	gbvtnlgdbytrljdb.exe	132
PID 6540 wrote to memory of 4308	6540	gbvtnlgdbytrljdb.exe	137
PID 4556 wrote to memory of 4852	4556	fzxspkicax.exe	139
PID 6540 wrote to memory of 4908	6540	gbvtnlgdbytrljdb.exe	142
PID 3908 wrote to memory of 6296	3908	msedge.exe	144
PID 3908 wrote to memory of 2324	3908	msedge.exe	145
PID 3908 wrote to memory of 6972	3908	msedge.exe	146
PID 6540 wrote to memory of 5188	6540	gbvtnlgdbytrljdb.exe	149
PID 2556 wrote to memory of 2372	2556	ausmhczusm.exe	151
PID 6540 wrote to memory of 1252	6540	gbvtnlgdbytrljdb.exe	154
PID 6540 wrote to memory of 3368	6540	gbvtnlgdbytrljdb.exe	158
PID 3128 wrote to memory of 976	3128	mjebzurmke.exe	160
PID 6540 wrote to memory of 5200	6540	gbvtnlgdbytrljdb.exe	163
PID 6540 wrote to memory of 5492	6540	gbvtnlgdbytrljdb.exe	167
PID 6224 wrote to memory of 5180	6224	pjebwuomge.exe	169
PID 6540 wrote to memory of 5112	6540	gbvtnlgdbytrljdb.exe	172
PID 6540 wrote to memory of 1100	6540	gbvtnlgdbytrljdb.exe	176
PID 6380 wrote to memory of 1052	6380	omjdbzwrom.exe	178
PID 6540 wrote to memory of 6964	6540	gbvtnlgdbytrljdb.exe	181
PID 3908 wrote to memory of 6276	3908	msedge.exe	183
PID 3908 wrote to memory of 6276	3908	msedge.exe	183
PID 6540 wrote to memory of 5376	6540	gbvtnlgdbytrljdb.exe	188
PID 7048 wrote to memory of 4144	7048	qljgbytqlj.exe	190
PID 6540 wrote to memory of 3356	6540	gbvtnlgdbytrljdb.exe	193
PID 6540 wrote to memory of 5832	6540	gbvtnlgdbytrljdb.exe	197
PID 3184 wrote to memory of 6620	3184	dyvqoigays.exe	199
PID 3908 wrote to memory of 4596	3908	msedge.exe	202
PID 3908 wrote to memory of 4596	3908	msedge.exe	202
PID 6540 wrote to memory of 6204	6540	gbvtnlgdbytrljdb.exe	203
PID 6540 wrote to memory of 1092	6540	gbvtnlgdbytrljdb.exe	207
PID 4712 wrote to memory of 3732	4712	fdxvqnigay.exe	209
PID 6540 wrote to memory of 3728	6540	gbvtnlgdbytrljdb.exe	212
PID 6540 wrote to memory of 1472	6540	gbvtnlgdbytrljdb.exe	216
PID 2500 wrote to memory of 2956	2500	xsqnifaxsq.exe	218
PID 6540 wrote to memory of 1304	6540	gbvtnlgdbytrljdb.exe	221

C:\Users\Admin\AppData\Local\Temp\2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_c9a6c49b9c914d5d22c0157574ad700f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Temp\gbvtnlgdbytrljdb.exe
  C:\Temp\gbvtnlgdbytrljdb.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:6540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lgdbvtnlga.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5824
  - - C:\Temp\lgdbvtnlga.exe
      C:\Temp\lgdbvtnlga.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2360
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4348
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lgdbvtnlga.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5880
  - - C:\Temp\i_lgdbvtnlga.exe
      C:\Temp\i_lgdbvtnlga.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoifaysqki.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2284
  - - C:\Temp\qoifaysqki.exe
      C:\Temp\qoifaysqki.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6568
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:756
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4444
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoifaysqki.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1080
  - - C:\Temp\i_qoifaysqki.exe
      C:\Temp\i_qoifaysqki.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5152
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yspkifaysq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5184
  - - C:\Temp\yspkifaysq.exe
      C:\Temp\yspkifaysq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6160
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4076
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2936
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yspkifaysq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4460
  - - C:\Temp\i_yspkifaysq.exe
      C:\Temp\i_yspkifaysq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4884
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fzxspkicax.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4308
  - - C:\Temp\fzxspkicax.exe
      C:\Temp\fzxspkicax.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4556
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4852
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2472
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fzxspkicax.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4908
  - - C:\Temp\i_fzxspkicax.exe
      C:\Temp\i_fzxspkicax.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5936
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ausmhczusm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5188
  - - C:\Temp\ausmhczusm.exe
      C:\Temp\ausmhczusm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2556
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2372
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1216
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ausmhczusm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1252
  - - C:\Temp\i_ausmhczusm.exe
      C:\Temp\i_ausmhczusm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2428
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mjebzurmke.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3368
  - - C:\Temp\mjebzurmke.exe
      C:\Temp\mjebzurmke.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3128
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:976
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6492
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mjebzurmke.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5200
  - - C:\Temp\i_mjebzurmke.exe
      C:\Temp\i_mjebzurmke.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1488
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjebwuomge.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5492
  - - C:\Temp\pjebwuomge.exe
      C:\Temp\pjebwuomge.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6224
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5180
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4952
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjebwuomge.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5112
  - - C:\Temp\i_pjebwuomge.exe
      C:\Temp\i_pjebwuomge.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5844
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omjdbzwrom.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1100
  - - C:\Temp\omjdbzwrom.exe
      C:\Temp\omjdbzwrom.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6380
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1052
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omjdbzwrom.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6964
  - - C:\Temp\i_omjdbzwrom.exe
      C:\Temp\i_omjdbzwrom.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qljgbytqlj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5376
  - - C:\Temp\qljgbytqlj.exe
      C:\Temp\qljgbytqlj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:7048
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4144
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5740
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qljgbytqlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3356
  - - C:\Temp\i_qljgbytqlj.exe
      C:\Temp\i_qljgbytqlj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dyvqoigays.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5832
  - - C:\Temp\dyvqoigays.exe
      C:\Temp\dyvqoigays.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3184
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6620
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6636
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dyvqoigays.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6204
  - - C:\Temp\i_dyvqoigays.exe
      C:\Temp\i_dyvqoigays.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4180
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdxvqnigay.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1092
  - - C:\Temp\fdxvqnigay.exe
      C:\Temp\fdxvqnigay.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4712
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3732
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4208
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdxvqnigay.exe ups_ins
    3⤵
    PID:3728
  - - C:\Temp\i_fdxvqnigay.exe
      C:\Temp\i_fdxvqnigay.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5728
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xsqnifaxsq.exe ups_run
    3⤵
    PID:1472
  - - C:\Temp\xsqnifaxsq.exe
      C:\Temp\xsqnifaxsq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2500
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2956
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xsqnifaxsq.exe ups_ins
    3⤵
    PID:1304
  - - C:\Temp\i_xsqnifaxsq.exe
      C:\Temp\i_xsqnifaxsq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:712
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\khfzxspkic.exe ups_run
    3⤵
    PID:6836
  - - C:\Temp\khfzxspkic.exe
      C:\Temp\khfzxspkic.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4584
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:7152
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2900
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_khfzxspkic.exe ups_ins
    3⤵
    PID:2296
  - - C:\Temp\i_khfzxspkic.exe
      C:\Temp\i_khfzxspkic.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6080
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxrpkecwup.exe ups_run
    3⤵
    PID:6428
  - - C:\Temp\zxrpkecwup.exe
      C:\Temp\zxrpkecwup.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4984
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2196
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3284
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxrpkecwup.exe ups_ins
    3⤵
    PID:2668
  - - C:\Temp\i_zxrpkecwup.exe
      C:\Temp\i_zxrpkecwup.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5516
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwurpjhbz.exe ups_run
    3⤵
    PID:6512
  - - C:\Temp\ecwurpjhbz.exe
      C:\Temp\ecwurpjhbz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2872
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6824
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3104
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwurpjhbz.exe ups_ins
    3⤵
    PID:5740
  - - C:\Temp\i_ecwurpjhbz.exe
      C:\Temp\i_ecwurpjhbz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1228
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jecwuomgez.exe ups_run
    3⤵
    PID:4820
  - - C:\Temp\jecwuomgez.exe
      C:\Temp\jecwuomgez.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1232
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5220
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5720
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jecwuomgez.exe ups_ins
    3⤵
    PID:2472
  - - C:\Temp\i_jecwuomgez.exe
      C:\Temp\i_jecwuomgez.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5328
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\geywqojgby.exe ups_run
    3⤵
    PID:5320
  - - C:\Temp\geywqojgby.exe
      C:\Temp\geywqojgby.exe ups_run
      4⤵
      PID:5488
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1968
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2004
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_geywqojgby.exe ups_ins
    3⤵
    PID:4728
  - - C:\Temp\i_geywqojgby.exe
      C:\Temp\i_geywqojgby.exe ups_ins
      4⤵
      PID:4520
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoigbywqdb.exe ups_run
    3⤵
    PID:5444
  - - C:\Temp\qoigbywqdb.exe
      C:\Temp\qoigbywqdb.exe ups_run
      4⤵
      PID:4892
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6844
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoigbywqdb.exe ups_ins
    3⤵
    PID:4280
  - - C:\Temp\i_qoigbywqdb.exe
      C:\Temp\i_qoigbywqdb.exe ups_ins
      4⤵
      PID:6904
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoifdyvqnl.exe ups_run
    3⤵
    PID:2308
  - - C:\Temp\qoifdyvqnl.exe
      C:\Temp\qoifdyvqnl.exe ups_run
      4⤵
      PID:4212
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6776
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1280
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6540 -s 516
    3⤵
    - Program crash
    PID:6592
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff8eafec188,0x7ff8eafec194,0x7ff8eafec1a0
      4⤵
      PID:4260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,4119601968649544171,13387118616923524987,262144 --field-trial-handle=2364,i,9935961306943165700,9790363903250032060,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:2
      4⤵
      PID:4500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1744,i,7411232547906959022,12181128447321230349,524288 --field-trial-handle=2364,i,9935961306943165700,9790363903250032060,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:11
      4⤵
      System Time Discovery
      PID:6616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,8954863552855736626,18184621459480557805,524288 --field-trial-handle=2364,i,9935961306943165700,9790363903250032060,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:13
      4⤵
      PID:2868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3536,i,16478993168285918520,3307974250617846185,2097152 --field-trial-handle=2364,i,9935961306943165700,9790363903250032060,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
      4⤵
      PID:3240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,10953647370673064534,540949552690279989,2097152 --field-trial-handle=2364,i,9935961306943165700,9790363903250032060,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
      4⤵
      PID:4112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,13788302267707266631,3212742309193847282,524288 --field-trial-handle=2364,i,9935961306943165700,9790363903250032060,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
      4⤵
      PID:5228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,14634493426086839045,12038912914746218997,524288 --field-trial-handle=2364,i,9935961306943165700,9790363903250032060,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:14
      4⤵
      PID:5444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,4067806250848390518,7317645156093423247,524288 --field-trial-handle=2364,i,9935961306943165700,9790363903250032060,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
      4⤵
      PID:5000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,4067806250848390518,7317645156093423247,524288 --field-trial-handle=2364,i,9935961306943165700,9790363903250032060,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
      4⤵
      PID:6304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,2473600557875913245,1375444957198819064,524288 --field-trial-handle=2364,i,9935961306943165700,9790363903250032060,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
      4⤵
      PID:6296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,9043170647257993902,10959375711080228867,524288 --field-trial-handle=2364,i,9935961306943165700,9790363903250032060,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:14
      4⤵
      PID:2324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,3945542525339763404,10441746697004106661,524288 --field-trial-handle=2364,i,9935961306943165700,9790363903250032060,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:14
      4⤵
      PID:6972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,5461073128355224399,11031033313237087175,524288 --field-trial-handle=2364,i,9935961306943165700,9790363903250032060,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:14
      4⤵
      PID:6276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,3672254953586329986,15994574606247491843,524288 --field-trial-handle=2364,i,9935961306943165700,9790363903250032060,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:14
      4⤵
      PID:4596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,17015999823587205355,16161533239863658596,524288 --field-trial-handle=2364,i,9935961306943165700,9790363903250032060,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
      4⤵
      PID:6348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,15141926742425131857,18287383615379635592,524288 --field-trial-handle=2364,i,9935961306943165700,9790363903250032060,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:14
      4⤵
      PID:6756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6728,i,882228616157019133,14936374028031603137,262144 --field-trial-handle=2364,i,9935961306943165700,9790363903250032060,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:10
      4⤵
      PID:4304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,8179193838100300135,17610064107216587467,524288 --field-trial-handle=2364,i,9935961306943165700,9790363903250032060,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:14
      4⤵
      PID:5244

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5472

C:\Temp\gbvtnlgdbytrljdb.sys
C:\Temp\gbvtnlgdbytrljdb.sys
1⤵
- Executes dropped EXE
PID:3396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4952

C:\Temp\nigaytqlid.sys
C:\Temp\nigaytqlid.sys
1⤵
- Executes dropped EXE
PID:1236

C:\Temp\aysqkicayv.sys
C:\Temp\aysqkicayv.sys
1⤵
- Executes dropped EXE
PID:2012

C:\Temp\kicausmkfc.sys
C:\Temp\kicausmkfc.sys
1⤵
- Executes dropped EXE
PID:4248

C:\Temp\zurpkecwus.sys
C:\Temp\zurpkecwus.sys
1⤵
- Executes dropped EXE
PID:2260

C:\Temp\xupmhfcxup.sys
C:\Temp\xupmhfcxup.sys
1⤵
- Executes dropped EXE
PID:3444

C:\Temp\pjhezwrpjh.sys
C:\Temp\pjhezwrpjh.sys
1⤵
- Executes dropped EXE
PID:7040

C:\Temp\ljgbywuolj.sys
C:\Temp\ljgbywuolj.sys
1⤵
- Executes dropped EXE
PID:6736

C:\Temp\ytqoigbytq.sys
C:\Temp\ytqoigbytq.sys
1⤵
- Executes dropped EXE
PID:3540

C:\Temp\olgdbvtolg.sys
C:\Temp\olgdbvtolg.sys
1⤵
- Executes dropped EXE
PID:4288

C:\Temp\fdyvtnlfdx.sys
C:\Temp\fdyvtnlfdx.sys
1⤵
- Executes dropped EXE
PID:7032

C:\Temp\ausnkfdxvs.sys
C:\Temp\ausnkfdxvs.sys
1⤵
PID:2840

C:\Temp\mkhfzxusmk.sys
C:\Temp\mkhfzxusmk.sys
1⤵
PID:7064

C:\Temp\pkhcausmke.sys
C:\Temp\pkhcausmke.sys
1⤵
PID:4972

C:\Temp\hbzxuomkec.sys
C:\Temp\hbzxuomkec.sys
1⤵
PID:2596

C:\Temp\jebwtrljeb.sys
C:\Temp\jebwtrljeb.sys
1⤵
PID:6604

C:\Temp\rljebzojgb.sys
C:\Temp\rljebzojgb.sys
1⤵
PID:6296

C:\Temp\toljdbywqo.sys
C:\Temp\toljdbywqo.sys
1⤵
PID:6780

C:\Temp\vqoigaysql.sys
C:\Temp\vqoigaysql.sys
1⤵
PID:4900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 6540 -ip 6540
1⤵
PID:5484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ausmhczusm.exe

Path C:\Temp\ausmhczusm.exe
Size 722KB
SHA256 3db1afd06f63218ea4bb97b03ac096765eaff08e13c269e49ad81b687011455e
MD5 4eaa27ed0617c236f00c550e43d69fb4
SHA1 355b20bcdbfb10243f76880a901ab0d90f10f0c1
SHA512 9cc71d4fcfb74214d05c3aba75648274828c0955b434f170b66dd74df8d4f316ec94fb47d0dd29d03a07093f13e3e6ae7f59f5b8a5a09d0cc0fc487b60028dea
SSDEEP 12288:RflfAsiVGjSGecvXAflfAsiVGjSGecvX:ZMcfcMcf
TLSH
T1FFF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aysqkicayv.sys

Path C:\Temp\aysqkicayv.sys
Size 293KB
SHA256 009bea7fcaa9a01fd1e8a6c1518d7f9e6c87a69e0f97bb0c55e59d4ea8e50026
MD5 17facdce5818126ea52e876a80f3e3c6
SHA1 48489a1d85546b3c3d08cf49d4547e5ebabff108
SHA512 c0d1ba9fb7a1fa48967c0431bf5b4ed282b1b653cc1aa7ea0a65cca8656b3b91c99ddaee2ef04168557d86f23348f16a31b423db4703633cc7b490a709f0de68
SSDEEP 3072:StKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:SIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A4545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxspkicax.exe

Path C:\Temp\fzxspkicax.exe
Size 722KB
SHA256 f50bc4fe8876d3b8bf789633c936840206645fddd36e8f18abadeb4bc16a213a
MD5 369a2847656531135d20f4834f2ad361
SHA1 71eebbd2d3682d0429244b35de570e43744fd2cd
SHA512 2af21d99b60c4996b8cdb7ad254131d3b3576ee314b6515c2244b6fe5716d2e27ffad9459e6d45a770feb5b1f1e799e6dac8322ee3a3985f83f031be5d170d0f
SSDEEP 12288:0flfAsiVGjSGecvXAflfAsiVGjSGecvX:wMcfcMcf
TLSH
T15BF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbvtnlgdbytrljdb.exe

Path C:\Temp\gbvtnlgdbytrljdb.exe
Size 722KB
SHA256 9d10351ff260715ff093b2d164e838b3103993f0822d1a206155e5e6766755a2
MD5 9746db6ad41e688f584991713cb58b47
SHA1 78f991ec51fd72deb3bf19759ace099f6252c925
SHA512 2483bb4548787d7c985630fc075c36c075618001c34bbf1152fcb01110571a49396c62abd135cdd4f75dee10d05c06be1975a8fe240b6b7e607f52c3996e4389
SSDEEP 12288:dflfAsiVGjSGecvXAflfAsiVGjSGecvX:VMcfcMcf
TLSH
T153F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbvtnlgdbytrljdb.sys

Path C:\Temp\gbvtnlgdbytrljdb.sys
Size 293KB
SHA256 4ebcedf79dac1d081073c0533442a7c6d31c70681383bbd1a602ec475fc3a9bb
MD5 75efd55a13adf0150ce4ce4d2178be4d
SHA1 ce566f99df4a16126c173162bcf1366c5f3ea753
SHA512 33023ae7e3a822e04f7e6c81d625fd080ea10d207babbbcdedcbc24a12cdd75b13245850592adc0af176fac1259f0d2d790ce86e1f5cacaa2ff644e239aeea7b
SSDEEP 3072:ytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:yIJjiJcbI03GBc3ucY5DCSj
TLSH
T19B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ausmhczusm.exe

Path C:\Temp\i_ausmhczusm.exe
Size 722KB
SHA256 1f6fd0d01cda074616e96a3ed5570884f7a076315b3c2669e419dc54dc76c0a5
MD5 84db913a549b3098805ad1b4dca111da
SHA1 e91266c13a7798d537fc313f9afb99b46a25462f
SHA512 0f818cdd6329a69c5a82a81e1ad6fa8faba740ec0c66544b6152dca6426babac65c162be341630dea101f48a7f7169c202f92954100c99fd4e7e2706bbdc2f40
SSDEEP 12288:NflfAsiVGjSGecvXAflfAsiVGjSGecvX:lMcfcMcf
TLSH
T10DF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fzxspkicax.exe

Path C:\Temp\i_fzxspkicax.exe
Size 722KB
SHA256 f96c2c5c254f1f77355538fb20ddd0e5c9889e524dde59b141d1f04594edb567
MD5 5c89cc23b186d0bf046ac81bc5cd93a1
SHA1 93b01a02222ea47193501c560e2b70896d150033
SHA512 e64e9a2d9b1bc1c53104d2cfb91c424e4c4ecbd194e90e6e5cde773d98072fb1a6edc4b27c462580a1ec5f269bd5fc4329954d8a74045765f637c3570d2d0fc9
SSDEEP 12288:5flfAsiVGjSGecvXAflfAsiVGjSGecvX:RMcfcMcf
TLSH
T122F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lgdbvtnlga.exe

Path C:\Temp\i_lgdbvtnlga.exe
Size 722KB
SHA256 49a00cea897b08136fda82ed7722e9e4d5302a6e0d56003b1e7f7ada1182b5cb
MD5 ecc7ebbcc6fe7c8cf80cad726850d35c
SHA1 16e04dd365e6b6109abbbf3a39fbf73b29ae9500
SHA512 4ceea444e6dad5717f988ecc399707fd23429ea7b98ec5fa10b82155417d6e88113dce3c0391e9ce5fc0a038a23c4bba472359dbd6c44e7bdf9bcf9b97e863df
SSDEEP 12288:lflfAsiVGjSGecvXAflfAsiVGjSGecvX:tMcfcMcf
TLSH
T13AF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mjebzurmke.exe

Path C:\Temp\i_mjebzurmke.exe
Size 722KB
SHA256 020c8639effa3de94948688406864aba57be1b9c02724db3b7965a087be9614b
MD5 cc80b9405324cb17872c3929b33db93c
SHA1 0e6d827dd7fe08d35bb9dc3242499ed486bcecd9
SHA512 11398e617db86424906e210f145d11242d2b6ded6bfe1c757b1b24338322b4b96dc7667a47619295fbfc40e4906fede1b9dbe908a9ab10c29fd434feb758b006
SSDEEP 12288:OflfAsiVGjSGecvXAflfAsiVGjSGecvX:qMcfcMcf
TLSH
T11EF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qoifaysqki.exe

Path C:\Temp\i_qoifaysqki.exe
Size 722KB
SHA256 8fc5eda868a8ff12709bb7863f72ad6800ea99e844b577f311b83635fde4222d
MD5 6caea03b929b4a8c128e642a1fe9e7e6
SHA1 f1035309427256e753fa3b4e331dc2163b4bea28
SHA512 3a553025bbae98c184869f9f90f9a47934269114b35e67390d77b209db78f165507ecae5e9698d302a3b0e1a018273303fc0adbd5e6f8c68ff10d2780a93bb75
SSDEEP 12288:LflfAsiVGjSGecvXAflfAsiVGjSGecvX:DMcfcMcf
TLSH
T124F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_yspkifaysq.exe

Path C:\Temp\i_yspkifaysq.exe
Size 722KB
SHA256 4a7b0dcc1f1e1b806e12312b14f124217b8a1a6344350b1df3412471b6858402
MD5 5779eb29c19f30c1f0d2feb92471c98c
SHA1 732f90820f3fca1218f8ff54d25e32e9f5956a29
SHA512 1766b1fff16c5b413c0b5ab502494fca48238438e28647081651282d3d3139549d4ed2b4d0969fa8fe30b2fcf6555aa31942624b659b82de631ff3558ebf451b
SSDEEP 12288:dflfAsiVGjSGecvXAflfAsiVGjSGecvX:VMcfcMcf
TLSH
T15FF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicausmkfc.sys

Path C:\Temp\kicausmkfc.sys
Size 293KB
SHA256 12fca23c6ea7daa6e563db74cf7c6addf3543c5fd1bb39476b8d486f8dca4e21
MD5 128d797c313b032be00763955c0ddbd6
SHA1 f9b8a2da0317fc975326ecfec364fa014a42fb43
SHA512 248d05c895a842d6f9160be86a5c7c952d163a959d90bfb7b52a92914f1ff0052f6caf411246a894e8c49b5d18b42bb1343e629df96397172b4c07d33f82b58f
SSDEEP 3072:OtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:OIJjiJcbI03GBc3ucY5DCSj
TLSH
T124545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgdbvtnlga.exe

Path C:\Temp\lgdbvtnlga.exe
Size 722KB
SHA256 0c7fd79c5055e139663090c5af66dd3b042bd69be8b00cb8786fd78104534644
MD5 0d635b0a93a17f31f9d488f2a23c2a32
SHA1 a7e99328d92ac24e2d2052d33522c0d983d032cb
SHA512 705012c25ceb2c2f0f61196c2ded7a21bcb245ee8224fbf6a7a478ada1a1d22b25d9e32e8062f2af5888257d177c9bb5c7077ce25ffd23c20893c162b431dd82
SSDEEP 12288:DflfAsiVGjSGecvXAflfAsiVGjSGecvX:LMcfcMcf
TLSH
T1CBF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjebzurmke.exe

Path C:\Temp\mjebzurmke.exe
Size 722KB
SHA256 aa530e90740d70b10e56f541ba6ddf2d81b0f97b6667bb92d8020937892952ae
MD5 a81d7791013be25b0e73e8fafd8ca504
SHA1 c31a40ccefbe31c5f1c7d9d869efdb7942df486b
SHA512 28ced1edca345978664c43597a7d8d022d902eb9b5b8fcc75bb35a1e348b1f92ce66e6ecfd8582cc15a2a4d0e1153b1361767c9dedc8f8f982430e45a850c57f
SSDEEP 12288:CflfAsiVGjSGecvXAflfAsiVGjSGecvX:uMcfcMcf
TLSH
T1E2F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nigaytqlid.sys

Path C:\Temp\nigaytqlid.sys
Size 293KB
SHA256 9dbb782631bfb01371b4f30fc3f3fb68af836e94e90c161656dc93257733da0a
MD5 852fc119e2c3dbec43bb70086e7190a1
SHA1 b53ee7c2289d0face751632161411f62691b9ba5
SHA512 4215212f2b139aed903130d6a510cd6b94ff7de21107cdea132b4d46eddb1b125bec4af73f67fa946a96a036f435ece79c8dc242d8b0515c5d911dbe73e639cd
SSDEEP 3072:gtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:gIJjiJcbI03GBc3ucY5DCSj
TLSH
T1CE545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjebwuomge.exe

Path C:\Temp\pjebwuomge.exe
Size 722KB
SHA256 cc503c866c5a0fc9294a62bf9328ce634251633abf540fcd3d006534a19e31ac
MD5 57cf0636dea9baabf9f14c01c54a4931
SHA1 1fe3878ea2662a19e9febd07fd7b34ab2ad56d76
SHA512 892ae81643322d55bf1f6f8faf69e784032e80131af905cb2358c86b6d0ae7587e94af44710da6dfb2ebf3f170b1fb1e20cd2c58ca689b16aef375b7819f8e00
SSDEEP 12288:IflfAsiVGjSGecvXAflfAsiVGjSGecvX:UMcfcMcf
TLSH
T198F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhezwrpjh.sys

Path C:\Temp\pjhezwrpjh.sys
Size 293KB
SHA256 b5809665738ef3f1a5fafc6a98b41df87396c01a3f24f81291d91e186dc06962
MD5 1314bb7fc418deeff8aa394ab6dffb00
SHA1 a2e2a2ea9d22ba9c2b7638e298079cdc06b0a5ce
SHA512 b80e3959f6b4e6381140c593dad75b4c3aba01f6e755ea0cb77e0e9b48f61b02fbe91dda6f1cd06e1746feaf80898cb52a4853a1fb7cf6f18db34a1f11d1da48
SSDEEP 3072:YtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:YIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D4545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoifaysqki.exe

Path C:\Temp\qoifaysqki.exe
Size 722KB
SHA256 ae0775295ef9a90fd8e89757700587b2c2142f9cc6ead3199003c6921553c74f
MD5 cf2ec74e06598a2fa3507a2a948561cb
SHA1 3760c91428e91eec4b29cbbea57dd9ba07641237
SHA512 2d719383827e6ff35e2784c498509c88fb535cd41e745b8132ca75ecd63a2499ca0252755d2d7dc40fdec5b8b873e2c81626036ee46fff5d5152a7dae41d95a3
SSDEEP 12288:CflfAsiVGjSGecvXAflfAsiVGjSGecvX:uMcfcMcf
TLSH
T165F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xupmhfcxup.sys

Path C:\Temp\xupmhfcxup.sys
Size 293KB
SHA256 3e8e728299b6c61d00ba40509d2ea14c1de5c10052204f10deedbf5aa37ef7ec
MD5 5817fd34295dc647edd107090bbbe0d9
SHA1 da3a2dd03899c1b8cdd85c65252421886fb75430
SHA512 dc445551d08d70de8883c17d5ca73d0893a01589d1c4ae3174f290905c464f21a7611bad7592db251221a2f763168397f30dac3bb8f797e5f442384879f4ab97
SSDEEP 3072:ZtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:ZIJjiJcbI03GBc3ucY5DCSj
TLSH
T107545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yspkifaysq.exe

Path C:\Temp\yspkifaysq.exe
Size 722KB
SHA256 2dd1a02c77d6b0ce205ae34333dae3096adc03822b73b030c173cc55e6e1c85b
MD5 b49d4ff4376a867b987e70aaa27121f6
SHA1 e211546928cfc384abb5640482ef6e9f38a6afee
SHA512 e8ecad4657c1e28e1088fdc63673755a6307b0c172de15bcab1c235d817bc5514ec8f20d8bd38d5006d87c04b115b785bcd5b102dc0edd821012e0c8de57b19f
SSDEEP 12288:yflfAsiVGjSGecvXAflfAsiVGjSGecvX:+McfcMcf
TLSH
T13EF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zurpkecwus.sys

Path C:\Temp\zurpkecwus.sys
Size 293KB
SHA256 fb3ce5746a15933aea111af42a394077994b6b8497d6d0a0ce408fbe3ffc88e7
MD5 9a0672872e106ca36512ece7860879eb
SHA1 50fdbb1f04541a2a09b0341cebbaffac84e1d18e
SHA512 f939850e4deefc210602f571de8829a0627e3f2b5ec882f75ac6c9b6bfbd5051282e8c936eccda96b2a0bce6a77298b0c232e82f7023f4f0958af639692e9d63
SSDEEP 3072:/tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:/IJjiJcbI03GBc3ucY5DCSj
TLSH
T1C0545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 01ccf2a8d78d11388a9b4b5271922785558ae72c278de3c6655d8148998f9ace
MD5 6046f09df6b2f3c44118c0771aeeb1b1
SHA1 49b9466f5e1023858948c5f4ad3fd293e55c0a13
SHA512 8f80cc29f14f532c2b66d08dccf68348b10fbf03e2c70cc7645c22c0e509c56cd0c0ee7ee4baef038b0b007b3e98d35f7a6b0a8b16716d45100e3765e0ad25bb
TLSH
T113E0E599C960AC2719F81B1861545687E740131B3A41984B3B3C816D4FB063B4286C5C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 71693947e8f0423e3dcec9478ae9cedb892d3ee8d720de50eb3e73a9ce928e99
MD5 3ae66eba6dfd03594c16c698169fb9df
SHA1 0568cecd85abbea77a9cbbcc955ddda919a444d4
SHA512 b7605b769e6576725846d34a604cf032f12485d22ea05b7a55b4663e8ea9085565144c96616f11d65cca1f7e803bcc37959270b97fedc13388d3ebe9d330d9de
TLSH
T13D41B0F783F4866ECA1196F0AA18BE1FCE1D0511432C7D9AC5E0AE2793E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 81e1841a0a68fba34af036957719b9cd7bfc01d3ad2d8be440609669a68bd38e
MD5 8e8345997a5a784465a27e389a49c439
SHA1 ffd4285436093ecf850f56e633537b833e80f30f
SHA512 ea589002349d3c0bf52a55480592bc8b1edbb55e3d5c6a8240e1d89c5b5fb9171944ccfefd7ec5bc6c90f302e60bfffc4ff3510b8348d986865bbdaddba56e48
SSDEEP 384:sxRR98l/fQslSN/RI2Fu/5C/W4sJsGQyVjb:stSl/fRQW9/54W4sJsGQyF
TLSH
T15E72F915AA249D3B8CDBD309FA957F93D6F81133A1905E44AAFCDA0C04E66ED2113C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 3db75271ad1ba17048d1e362bc8525e3c07c44115ee09da8ca28ef35dd4dabf2
MD5 b5ad42af65cfec94d738c41465f00d42
SHA1 73b1bbb5a697a9136872b960fcb6a264d883eb97
SHA512 f2235e65dd4575a1e1792044179d828237ca8a08b5ea4a6d4ee1ba26fd14f0b1773c249a8f6b8dbfaf70092fa15d41fbe8d9f15ded2978aa1463a8e806425464
SSDEEP 384:sxRR9q1l/fQsldN/RI2Fu/5C/W4nTsGQyV5h1:stM1l/fJ/W9/54W4nTsGQyD
TLSH
T15372E815A9249D7B8CDBD319FA957F93D2F81173A1905E44AAFC8A1C00E66ED2113C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 3f72ef00d891cf57eea8758cedf5b5949a8cd2c16dea13ea9f22375f012f061b
MD5 38c373e4caa4b9c2537111d80b8bd578
SHA1 fde826190649831536d0f9bfb3e58dde65ab1f3d
SHA512 6eb9bb11301f2bb3a46079158270f7b72e6a21af10531a30d496c965038cabeeecb4ded317c87236b23f9df25f7f914bce216f1b0da97c2f66670360975ca3c4
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVoobbDwzro/4i:Ob4YZnE7yTWg1NfwBu1jaPobHwAwi
TLSH
T164E2FC3B280CCB7E4F804ADDEC29BD9A6DA801CF56D88D5447FA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 7e8d24f216f544de42eeefc431904b9d83c22e1291b7db17e50a940a7d24b156
MD5 529a22cd00c0ce3bc8571725fe008384
SHA1 acd488658b4c301ba6e904a101680d873b3fb07e
SHA512 f02d1059053216d02f5ca401c87dcbb15e4bbb37eefa76c46b0f070d87b8ba3b9a52164a0fea090c2593e5a7135e71d8cb434653d2b5de6e2f7feb4d99421e94
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9fF9:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRu
TLSH
T12DB25C11713F4680383EA90C91B8D81E96C2B4A37519E53F7BA801A65F67E039DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 f909b1db8474bc50d483b0982659ee196cf409d7385c6e7cfdf21a6b5fc73faa
MD5 3ef076678ae9b1e1c4c89af061f21dd6
SHA1 0374cd4bacf0d7ff10de27f40e2b229c74ec87b4
SHA512 888145afab83921cd7140d82d86a9816b9cf86f42c1092cb7849ada60b86627e4b6b353c1acc124207c494f4342373531d257694f0f9d6d274ebe4f2270926c1
SSDEEP 384:nziFPZcIL8NLn8TUNTUlIRpPvuTFSTEqfbzG3+3YEi3rcr5Dsa+VYg8LEEIzEom:eFHLQnwgPucZG3yYEMMZhgMB
TLSH
T129E2B2F198D789B3D89E4B87673E6E4299FCD153B4884994B7C45D0DCC861BFC30A81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 a793a33ac3e535d41b3250f203b2a335f91a1acca0222e1a1e0cacca4c3e5dba
MD5 df6ae4b242cc62c0e0d549b6418819aa
SHA1 5c0d64c0b73d426220ae96d14987aa6ef54670a6
SHA512 c67c7785cf0f4a8ed5360f018b579e4df2243ec0d6843622120c640974908cb706dd0753d0e5d5606c59673659f5aedcdea1ae533bcb9839511e9a746e4e5634
SSDEEP 384:nmiF1tNn/s3n9Sn8Ngs8TUNTUlIRiPvuTu2REqfbzG3+3YEeLQOObjI9G6w7ZV8p:NF1j+9SXswgUuxXG3yYE8Q29MW
TLSH
T189C25B36E855CEB7EDE64FD9B70E7A46DEE0516384985AD8DAC85E0C00C71ED4307C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 bc5e43939e879591bed211a42ad64ffc0e1a86eae7867e20c5a98bfbc313e524
MD5 052eda5eb3462e8510a7f1c501a7055f
SHA1 c9a5b83ec11eb1179f775a5536cde3c3d633d37f
SHA512 0680866368b5d7c4cb516b2ed797cafea9e46a5468c3ebf7381f6fbf623ede38d6f98a8685987adf842f67045d2b960f4e193b6df05a2389570b98a3de6ea92d
SSDEEP 384:nviF1tNn/s3n9SW8NLn8TUNTUlIRbPvuTITTEqfbzG3+3YEi3ryI5DEf8LEEIzpF:6F1j+9rQnwgluIZG3yYEMNZEl
TLSH
T100B23B36D895CEB7ECD64FD8A70A7646DEE0516388CC5AD8EAD85D4D00C71EE070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 8e7fdd40fac11479bd28d8a8cf87b0211a7ce24f6fb3c3b5e88370726768f854
MD5 79bba3f412ea6dd97562f60864fc3470
SHA1 a0ba0a570db74cd566632ec349ea9d2adf6bbbd3
SHA512 efb6ad8bef809ca9a6c838bc12985bcc8cdeffe0a64feff5e9ad737a47ac278a3eb65af729a0df88174b083a51759cbf5a16c11c10dd69e167949e575aa61d37
SSDEEP 384:nQiFPZcIs8NLn8TUNTUlIRpPvuTFTTEqfbzG3+3YEi3ry/5Dsa+VYg8LEEIzEom:rFHsQnwgPutZG3yYEMGZhgMB
TLSH
T154C23C329894CEB7ECEB4FD5A64A7646DEF0516388CC9AD4D6D85E4D00C71EE070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 e90b1a44bfe7456472b9b4ef3fc9da3e526ca3402c6e2b73c7c934b0584fd57c
MD5 a9bd3b8d68896e00b39c1fc396012b3d
SHA1 59c55164cef4f164353c5aaeeeb91655a761158f
SHA512 dd066621451d5d13a5152bdcf7ec00336f01cc90bfcdcbd4d6a20c97135924ac04910c5be6ec01feae111935171ea7e5b1dfe44ca3b91f1272d08dcf2509a2b7
SSDEEP 384:nxiF1tNn/s3n9Sn8Ngn8TUNTUlIRiPvuT1OTEqfbzG3+3YEi3ryk5DOObjI9G6wa:YF1j+9SXnwgUusZG3yYEMbZ29MW
TLSH
T12AD25C36E855CEB7ECD64FD8B74A3A46EEE05263888C5AD8E6D85E4D00C71ED0707C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ae0e3cbd96e98792e9027adc4b2eccbc937bfac425b12dad427b36d39b9b50a8
MD5 0fc0c97dffed99638b43bf65d2995769
SHA1 0e81c195932ca0160a9e1547bd77b72fc6df7083
SHA512 0602449e5b718c20e44797866e98f68f7ceb4e73aaf394bb7a186a56eff98365afb6fecd1c4648f19ca861b87b526fe6ae584cab5344f2d0dc07b2984f508a22
SSDEEP 384:nviFsZcIs8NLn8TUNTUlIRpPvuTITTEqfbzG3+3YEi3ryI5Dsa+VYg8LEEIzEom:6F6sQnwgPuIZG3yYEMNZhgMB
TLSH
T15CC23C329894CEB7ECEB4FD5A64A7646DEF0516388CC9AD4D6D85E4D00C71EE070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 5b13b6fcdf04fb96e793406611cf7bea4f0b25a21e6210ff6fcfb1601d456cec
MD5 12233c6bdb79fb5af7e57b25da973536
SHA1 34747b1c27534b8b74cbfee6a2a11d96508d27a4
SHA512 dbd9a12f0c15dfb739a20974af92acf153e278d3895c5b3771f558fd6665e280e51d7fd4931709d73557d9ed82792f579b34710e934cb9cfe292599545ab1b56
TLSH
T153512DE04C381AC1D4BD0E7FB45B78FC85E8C726F490343D6858EA985A7A65D309483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 c51ba821bf356132d1b7cd4b592cf9c755f7357bf634240dc4df69ef0f699ce5
MD5 eb56e0946f920f37434482d6a27e02e3
SHA1 bdfb4b4a63e6eecd30115d237593cbf05ee86135
SHA512 889497252ba5b465a6c32f6c8f6d7bcc10eb7382294b0233b5940781cb135ac1726187f4142fd174612a5dd98d10e7e360fac7b98ed1c922bceb4caece06d6cc
TLSH
T1215150E04C3C16D5D5FD0E3EB05739FC85EC8726B8A034386858EA985A3A61D309083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 227be09e96c4832820afaacf9d6ad4e465a70ffb9ad647e7506b01eaabc2ba29
MD5 6b31e16abed878ec8f83c2d26611117b
SHA1 708191624e1213c3f87e073e478169f0b74f0514
SHA512 beea38815a8328c54cdd63c2e77537c64fdf3a5fa3ef4fce943c978f9b4ffac236a333b5ece11ffc02821ac21421ffec15a7eff5e2b5771e1ac768c33789b00d
TLSH
T159514FE04C3C1AD5D5FD0E7EB05739FC85EC9726B89034386858EA985A3A61D309083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 fc8158bcac0e1a43c912e8899e7f1c5e1d622db63f0096f7ece6833f081442b6
MD5 35a224c2ab78a8e4de46ffe2bbfff98c
SHA1 5bf2c935d683009baad6b104386ca6a2df08bfcd
SHA512 a0cef6559aa65787fb88ba8f2a20f8d8f87fa2a86afadf9c255bd6df6083efb477762c29e4417fd191353f39724da6b875183e140872a4617e941adfbaeb280e
TLSH
T1A8512DE04C3C1AD1D4FD0E7EB44B78FC85EC9726F89434386858EA985A7A61D309483F
MD5 SHA1 SHA512 TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 8995ca91fe756bf9089e1afee9cbf631aa6ff48ba163b59c7eee5130edba7c04
MD5 73f4178d7b97178c3499af1b496b6e32
SHA1 46cab7cdd141c20add7a379419a3a0ec1fea207f
SHA512 e8045f04fcda848021a29214c0f6196ccacb6e540012af6201a7c64737af9f731d4ce01d991acdc270a376f2650336aa01324ad99cac0dc0a274314d8260d073
TLSH
T19F71008356A9D9F2C2DA5FF002835244F1FB223C076320240B515546AA70A3A64B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1236-141-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2012-168-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2260-209-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2596-364-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2840-321-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3396-48-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3444-222-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3540-268-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4248-196-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4288-272-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4900-428-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4972-352-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6296-402-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6604-381-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6736-264-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6780-409-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/7032-323-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/7032-304-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/7040-258-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/7064-340-0x0000000000010000-0x00000000000AB000-memory.dmp

Download