Overview

overview

10

Static

static

3

2026-05-22...op.exe

windows10-2004-x64

10

2026-05-22...op.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    158s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    22/05/2026, 15:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-22_2acefe61e82a7d5b9f613898249aefaa_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
  • Size 722KB
  • Sample260522-taaetsay5v
  • SHA256 51866ee7129f6d07887f47f295802a7e575cc4cb9ae52c4aee252e8d413d5082
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwarediscoveryspyware

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Drops file in Windows directory 16 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers network information 2 TTPs 19 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 29 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 20 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-22_2acefe61e82a7d5b9f613898249aefaa_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-22_2acefe61e82a7d5b9f613898249aefaa_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:6064
    • C:\Temp\kicavsnkfdxvpnif.exe
      C:\Temp\kicavsnkfdxvpnif.exe run
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4084
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\upnifaysqi.exe ups_run
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2988
        • C:\Temp\upnifaysqi.exe
          C:\Temp\upnifaysqi.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1960
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:708
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:748
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_upnifaysqi.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:3520
        • C:\Temp\i_upnifaysqi.exe
          C:\Temp\i_upnifaysqi.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2872
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\mkfcxvpnhf.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:1532
        • C:\Temp\mkfcxvpnhf.exe
          C:\Temp\mkfcxvpnhf.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5516
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:4524
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:3424
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_mkfcxvpnhf.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:3816
        • C:\Temp\i_mkfcxvpnhf.exe
          C:\Temp\i_mkfcxvpnhf.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3064
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\hfzxrmkecx.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:1300
        • C:\Temp\hfzxrmkecx.exe
          C:\Temp\hfzxrmkecx.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2820
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:5036
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:3408
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_hfzxrmkecx.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:3524
        • C:\Temp\i_hfzxrmkecx.exe
          C:\Temp\i_hfzxrmkecx.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:756
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\uomgezwrpj.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:1272
        • C:\Temp\uomgezwrpj.exe
          C:\Temp\uomgezwrpj.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3552
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:2040
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:5888
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_uomgezwrpj.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:1660
        • C:\Temp\i_uomgezwrpj.exe
          C:\Temp\i_uomgezwrpj.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:5164
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\ezwrojgbzt.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:1476
        • C:\Temp\ezwrojgbzt.exe
          C:\Temp\ezwrojgbzt.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5568
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:2620
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:3428
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_ezwrojgbzt.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:4604
        • C:\Temp\i_ezwrojgbzt.exe
          C:\Temp\i_ezwrojgbzt.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4880
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\qoigbytrlj.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:776
        • C:\Temp\qoigbytrlj.exe
          C:\Temp\qoigbytrlj.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:492
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:2284
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:560
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_qoigbytrlj.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:5812
        • C:\Temp\i_qoigbytrlj.exe
          C:\Temp\i_qoigbytrlj.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2868
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\igbytrljdb.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:4384
        • C:\Temp\igbytrljdb.exe
          C:\Temp\igbytrljdb.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2336
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:4828
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:2256
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_igbytrljdb.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:2852
        • C:\Temp\i_igbytrljdb.exe
          C:\Temp\i_igbytrljdb.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4756
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\bvtnlfdyvq.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:3180
        • C:\Temp\bvtnlfdyvq.exe
          C:\Temp\bvtnlfdyvq.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3164
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:5404
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:5084
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_bvtnlfdyvq.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:4780
        • C:\Temp\i_bvtnlfdyvq.exe
          C:\Temp\i_bvtnlfdyvq.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4588
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\qkicavsnkf.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:5976
        • C:\Temp\qkicavsnkf.exe
          C:\Temp\qkicavsnkf.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1156
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:2728
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:3168
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_qkicavsnkf.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:4052
        • C:\Temp\i_qkicavsnkf.exe
          C:\Temp\i_qkicavsnkf.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2504
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\causnkfdxv.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:1568
        • C:\Temp\causnkfdxv.exe
          C:\Temp\causnkfdxv.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3044
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:8
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:5020
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_causnkfdxv.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:2696
        • C:\Temp\i_causnkfdxv.exe
          C:\Temp\i_causnkfdxv.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:5724
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\xusmkfcxvp.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:5640
        • C:\Temp\xusmkfcxvp.exe
          C:\Temp\xusmkfcxvp.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5008
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
              PID:3204
              • C:\windows\system32\ipconfig.exe
                C:\windows\system32\ipconfig.exe /release
                6⤵
                • Gathers network information
                PID:4024
        • C:\temp\CreateProcess.exe
          C:\temp\CreateProcess.exe C:\Temp\i_xusmkfcxvp.exe ups_ins
          3⤵
            PID:1500
            • C:\Temp\i_xusmkfcxvp.exe
              C:\Temp\i_xusmkfcxvp.exe ups_ins
              4⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:1976
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\Temp\pjhczurmke.exe ups_run
            3⤵
              PID:1104
              • C:\Temp\pjhczurmke.exe
                C:\Temp\pjhczurmke.exe ups_run
                4⤵
                • System Location Discovery: System Language Discovery
                PID:724
                • C:\temp\CreateProcess.exe
                  C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                  5⤵
                    PID:984
                    • C:\windows\system32\ipconfig.exe
                      C:\windows\system32\ipconfig.exe /release
                      6⤵
                      • Gathers network information
                      PID:1604
              • C:\temp\CreateProcess.exe
                C:\temp\CreateProcess.exe C:\Temp\i_pjhczurmke.exe ups_ins
                3⤵
                  PID:3188
                  • C:\Temp\i_pjhczurmke.exe
                    C:\Temp\i_pjhczurmke.exe ups_ins
                    4⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:6084
                • C:\temp\CreateProcess.exe
                  C:\temp\CreateProcess.exe C:\Temp\bztomgebwu.exe ups_run
                  3⤵
                    PID:2244
                    • C:\Temp\bztomgebwu.exe
                      C:\Temp\bztomgebwu.exe ups_run
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:5328
                      • C:\temp\CreateProcess.exe
                        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                        5⤵
                          PID:4496
                          • C:\windows\system32\ipconfig.exe
                            C:\windows\system32\ipconfig.exe /release
                            6⤵
                            • Gathers network information
                            PID:4724
                    • C:\temp\CreateProcess.exe
                      C:\temp\CreateProcess.exe C:\Temp\i_bztomgebwu.exe ups_ins
                      3⤵
                        PID:1628
                        • C:\Temp\i_bztomgebwu.exe
                          C:\Temp\i_bztomgebwu.exe ups_ins
                          4⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          PID:5564
                      • C:\temp\CreateProcess.exe
                        C:\temp\CreateProcess.exe C:\Temp\wqljdbwtom.exe ups_run
                        3⤵
                          PID:2304
                          • C:\Temp\wqljdbwtom.exe
                            C:\Temp\wqljdbwtom.exe ups_run
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:6100
                            • C:\temp\CreateProcess.exe
                              C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                              5⤵
                                PID:1340
                                • C:\windows\system32\ipconfig.exe
                                  C:\windows\system32\ipconfig.exe /release
                                  6⤵
                                  • Gathers network information
                                  PID:3208
                          • C:\temp\CreateProcess.exe
                            C:\temp\CreateProcess.exe C:\Temp\i_wqljdbwtom.exe ups_ins
                            3⤵
                              PID:5032
                              • C:\Temp\i_wqljdbwtom.exe
                                C:\Temp\i_wqljdbwtom.exe ups_ins
                                4⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of AdjustPrivilegeToken
                                PID:3960
                            • C:\temp\CreateProcess.exe
                              C:\temp\CreateProcess.exe C:\Temp\rljdbvtrlj.exe ups_run
                              3⤵
                                PID:4528
                                • C:\Temp\rljdbvtrlj.exe
                                  C:\Temp\rljdbvtrlj.exe ups_run
                                  4⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:3948
                                  • C:\temp\CreateProcess.exe
                                    C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                    5⤵
                                      PID:3036
                                      • C:\windows\system32\ipconfig.exe
                                        C:\windows\system32\ipconfig.exe /release
                                        6⤵
                                        • Gathers network information
                                        PID:5076
                                • C:\temp\CreateProcess.exe
                                  C:\temp\CreateProcess.exe C:\Temp\i_rljdbvtrlj.exe ups_ins
                                  3⤵
                                    PID:5020
                                    • C:\Temp\i_rljdbvtrlj.exe
                                      C:\Temp\i_rljdbvtrlj.exe ups_ins
                                      4⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4848
                                  • C:\temp\CreateProcess.exe
                                    C:\temp\CreateProcess.exe C:\Temp\fdyvqoigav.exe ups_run
                                    3⤵
                                      PID:1132
                                      • C:\Temp\fdyvqoigav.exe
                                        C:\Temp\fdyvqoigav.exe ups_run
                                        4⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:3040
                                        • C:\temp\CreateProcess.exe
                                          C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                          5⤵
                                            PID:5856
                                            • C:\windows\system32\ipconfig.exe
                                              C:\windows\system32\ipconfig.exe /release
                                              6⤵
                                              • Gathers network information
                                              PID:4880
                                      • C:\temp\CreateProcess.exe
                                        C:\temp\CreateProcess.exe C:\Temp\i_fdyvqoigav.exe ups_ins
                                        3⤵
                                          PID:5876
                                          • C:\Temp\i_fdyvqoigav.exe
                                            C:\Temp\i_fdyvqoigav.exe ups_ins
                                            4⤵
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:2112
                                        • C:\temp\CreateProcess.exe
                                          C:\temp\CreateProcess.exe C:\Temp\vqnigaysqk.exe ups_run
                                          3⤵
                                            PID:400
                                            • C:\Temp\vqnigaysqk.exe
                                              C:\Temp\vqnigaysqk.exe ups_run
                                              4⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:3836
                                              • C:\temp\CreateProcess.exe
                                                C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                5⤵
                                                  PID:3808
                                                  • C:\windows\system32\ipconfig.exe
                                                    C:\windows\system32\ipconfig.exe /release
                                                    6⤵
                                                    • Gathers network information
                                                    PID:4920
                                            • C:\temp\CreateProcess.exe
                                              C:\temp\CreateProcess.exe C:\Temp\i_vqnigaysqk.exe ups_ins
                                              3⤵
                                                PID:4580
                                                • C:\Temp\i_vqnigaysqk.exe
                                                  C:\Temp\i_vqnigaysqk.exe ups_ins
                                                  4⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:2724
                                              • C:\temp\CreateProcess.exe
                                                C:\temp\CreateProcess.exe C:\Temp\fdxvpnhfax.exe ups_run
                                                3⤵
                                                  PID:3772
                                                  • C:\Temp\fdxvpnhfax.exe
                                                    C:\Temp\fdxvpnhfax.exe ups_run
                                                    4⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:3448
                                                    • C:\temp\CreateProcess.exe
                                                      C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                      5⤵
                                                        PID:912
                                                        • C:\windows\system32\ipconfig.exe
                                                          C:\windows\system32\ipconfig.exe /release
                                                          6⤵
                                                          • Gathers network information
                                                          PID:4184
                                                  • C:\temp\CreateProcess.exe
                                                    C:\temp\CreateProcess.exe C:\Temp\i_fdxvpnhfax.exe ups_ins
                                                    3⤵
                                                      PID:4888
                                                      • C:\Temp\i_fdxvpnhfax.exe
                                                        C:\Temp\i_fdxvpnhfax.exe ups_ins
                                                        4⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:3620
                                                    • C:\temp\CreateProcess.exe
                                                      C:\temp\CreateProcess.exe C:\Temp\cxvpnhfzxs.exe ups_run
                                                      3⤵
                                                        PID:2968
                                                        • C:\Temp\cxvpnhfzxs.exe
                                                          C:\Temp\cxvpnhfzxs.exe ups_run
                                                          4⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:5160
                                                          • C:\temp\CreateProcess.exe
                                                            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                            5⤵
                                                              PID:2480
                                                              • C:\windows\system32\ipconfig.exe
                                                                C:\windows\system32\ipconfig.exe /release
                                                                6⤵
                                                                • Gathers network information
                                                                PID:4708
                                                        • C:\temp\CreateProcess.exe
                                                          C:\temp\CreateProcess.exe C:\Temp\i_cxvpnhfzxs.exe ups_ins
                                                          3⤵
                                                            PID:1624
                                                            • C:\Temp\i_cxvpnhfzxs.exe
                                                              C:\Temp\i_cxvpnhfzxs.exe ups_ins
                                                              4⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:3932
                                                        • C:\Program Files\Internet Explorer\iexplore.exe
                                                          "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
                                                          2⤵
                                                          • Modifies Internet Explorer settings
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:3324
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
                                                            3⤵
                                                            • Drops file in Windows directory
                                                            • Enumerates system info in registry
                                                            • Modifies data under HKEY_USERS
                                                            • Modifies registry class
                                                            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                            • Suspicious use of FindShellTrayWindow
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:5500
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffeee5fc188,0x7ffeee5fc194,0x7ffeee5fc1a0
                                                              4⤵
                                                                PID:4280
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1740,i,1806862871017248317,9462207116318476384,524288 --field-trial-handle=2304,i,8306410287444825557,16515329796837671010,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:11
                                                                4⤵
                                                                • System Time Discovery
                                                                PID:344
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,16793351937574861280,15312444064873316312,262144 --field-trial-handle=2304,i,8306410287444825557,16515329796837671010,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
                                                                4⤵
                                                                  PID:1616
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2328,i,9271796414362413576,7051479025754608613,524288 --field-trial-handle=2304,i,8306410287444825557,16515329796837671010,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:13
                                                                  4⤵
                                                                    PID:1216
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,16640706060057145166,13296960997385871901,2097152 --field-trial-handle=2304,i,8306410287444825557,16515329796837671010,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
                                                                    4⤵
                                                                      PID:2316
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,16747667859376231130,8399605811800519274,2097152 --field-trial-handle=2304,i,8306410287444825557,16515329796837671010,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
                                                                      4⤵
                                                                        PID:4904
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4748,i,14359700113428262037,15619172184752087218,524288 --field-trial-handle=2304,i,8306410287444825557,16515329796837671010,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:14
                                                                        4⤵
                                                                          PID:4124
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,13364252024599150903,2702721083827859771,524288 --field-trial-handle=2304,i,8306410287444825557,16515329796837671010,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:14
                                                                          4⤵
                                                                            PID:5828
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,15459485537978014137,7163533068171134029,524288 --field-trial-handle=2304,i,8306410287444825557,16515329796837671010,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:14
                                                                            4⤵
                                                                              PID:5448
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,15459485537978014137,7163533068171134029,524288 --field-trial-handle=2304,i,8306410287444825557,16515329796837671010,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:14
                                                                              4⤵
                                                                                PID:4072
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,2332092817794428251,9661141903836018295,524288 --field-trial-handle=2304,i,8306410287444825557,16515329796837671010,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:14
                                                                                4⤵
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:4984
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                                                                                  cookie_exporter.exe --cookie-json=1136
                                                                                  5⤵
                                                                                    PID:1584
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,13071347472918051482,8716800104077181014,524288 --field-trial-handle=2304,i,8306410287444825557,16515329796837671010,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:14
                                                                                  4⤵
                                                                                    PID:5504
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,1715921410244193302,844276204071980320,524288 --field-trial-handle=2304,i,8306410287444825557,16515329796837671010,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
                                                                                    4⤵
                                                                                      PID:2808
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,10753017304674152035,9376286891165768142,524288 --field-trial-handle=2304,i,8306410287444825557,16515329796837671010,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
                                                                                      4⤵
                                                                                        PID:5160
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2112,i,8166254291477081227,17472218890199891254,524288 --field-trial-handle=2304,i,8306410287444825557,16515329796837671010,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:14
                                                                                        4⤵
                                                                                          PID:5028
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,6366467431372988842,5280766127812042867,524288 --field-trial-handle=2304,i,8306410287444825557,16515329796837671010,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
                                                                                          4⤵
                                                                                            PID:3332
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,5679054748676322985,3879693274901454283,524288 --field-trial-handle=2304,i,8306410287444825557,16515329796837671010,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
                                                                                            4⤵
                                                                                              PID:3136
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4916,i,8008558831681746913,8736061330151618850,262144 --field-trial-handle=2304,i,8306410287444825557,16515329796837671010,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:10
                                                                                              4⤵
                                                                                                PID:1704
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,826584583118030197,9961909092980533923,524288 --field-trial-handle=2304,i,8306410287444825557,16515329796837671010,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
                                                                                                4⤵
                                                                                                  PID:2104
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                            1⤵
                                                                                              PID:2732
                                                                                            • C:\Temp\kicavsnkfdxvpnif.sys
                                                                                              C:\Temp\kicavsnkfdxvpnif.sys
                                                                                              1⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:3960
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                              1⤵
                                                                                                PID:5720
                                                                                              • C:\Temp\icavsnkfdx.sys
                                                                                                C:\Temp\icavsnkfdx.sys
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:4364
                                                                                              • C:\Temp\rpkhcausmk.sys
                                                                                                C:\Temp\rpkhcausmk.sys
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:4580
                                                                                              • C:\Temp\ezwrpjhczu.sys
                                                                                                C:\Temp\ezwrpjhczu.sys
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:4660
                                                                                              • C:\Temp\omgezwrpjh.sys
                                                                                                C:\Temp\omgezwrpjh.sys
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:5188
                                                                                              • C:\Temp\mhbztomgey.sys
                                                                                                C:\Temp\mhbztomgey.sys
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:4692
                                                                                              • C:\Temp\tolgdywqoi.sys
                                                                                                C:\Temp\tolgdywqoi.sys
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:5416
                                                                                              • C:\Temp\igaysqlida.sys
                                                                                                C:\Temp\igaysqlida.sys
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:2116
                                                                                              • C:\Temp\aysqkidavt.sys
                                                                                                C:\Temp\aysqkidavt.sys
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:2084
                                                                                              • C:\Temp\sqkicavsnl.sys
                                                                                                C:\Temp\sqkicavsnl.sys
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:4752
                                                                                              • C:\Temp\hcausmkecx.sys
                                                                                                C:\Temp\hcausmkecx.sys
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:3856
                                                                                              • C:\Temp\zusmkecxup.sys
                                                                                                C:\Temp\zusmkecxup.sys
                                                                                                1⤵
                                                                                                  PID:2136
                                                                                                • C:\Temp\jhbztrmjec.sys
                                                                                                  C:\Temp\jhbztrmjec.sys
                                                                                                  1⤵
                                                                                                    PID:2116
                                                                                                  • C:\Temp\ljebztrlje.sys
                                                                                                    C:\Temp\ljebztrlje.sys
                                                                                                    1⤵
                                                                                                      PID:4924
                                                                                                    • C:\Temp\eywqojgbzt.sys
                                                                                                      C:\Temp\eywqojgbzt.sys
                                                                                                      1⤵
                                                                                                        PID:4752
                                                                                                      • C:\Temp\nlfdyvqoig.sys
                                                                                                        C:\Temp\nlfdyvqoig.sys
                                                                                                        1⤵
                                                                                                          PID:5724
                                                                                                        • C:\Temp\davtnlfdxv.sys
                                                                                                          C:\Temp\davtnlfdxv.sys
                                                                                                          1⤵
                                                                                                            PID:3944
                                                                                                          • C:\Temp\xvqnigaysq.sys
                                                                                                            C:\Temp\xvqnigaysq.sys
                                                                                                            1⤵
                                                                                                              PID:2028
                                                                                                            • C:\Temp\kfcxvpnhfz.sys
                                                                                                              C:\Temp\kfcxvpnhfz.sys
                                                                                                              1⤵
                                                                                                                PID:2544
                                                                                                              • C:\Temp\fzxrpkhcau.sys
                                                                                                                C:\Temp\fzxrpkhcau.sys
                                                                                                                1⤵
                                                                                                                  PID:692

                                                                                                                Network

                                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                                      Replay Monitor

                                                                                                                      Loading Replay Monitor...

                                                                                                                      Downloads

                                                                                                                      ezwrojgbzt.exe
                                                                                                                      • Path C:\Temp\ezwrojgbzt.exe
                                                                                                                      • Size 722KB
                                                                                                                      • SHA256 9294f1da920598dd24faa9987497261b547a3c605ea1f75e9a80981ba560ed9d
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      ezwrpjhczu.sys
                                                                                                                      • Path C:\Temp\ezwrpjhczu.sys
                                                                                                                      • Size 293KB
                                                                                                                      • SHA256 742cd18fd2905a432cb1156283c5431ccb92e713091c06c7d719d2a41337a31f
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      hfzxrmkecx.exe
                                                                                                                      • Path C:\Temp\hfzxrmkecx.exe
                                                                                                                      • Size 722KB
                                                                                                                      • SHA256 4ad42dea44cb3a6c0a18e518aa7b8ebdbb6ad669896192e03afde96c8a3b5205
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      i_ezwrojgbzt.exe
                                                                                                                      • Path C:\Temp\i_ezwrojgbzt.exe
                                                                                                                      • Size 722KB
                                                                                                                      • SHA256 3b94023e75f05227847ae655008db8e4016ec10185509b0504576cf7b5255303
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      i_hfzxrmkecx.exe
                                                                                                                      • Path C:\Temp\i_hfzxrmkecx.exe
                                                                                                                      • Size 722KB
                                                                                                                      • SHA256 0c807068c624837856e926993af7b508215da3eaac3f97def258968e97e075d6
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      i_mkfcxvpnhf.exe
                                                                                                                      • Path C:\Temp\i_mkfcxvpnhf.exe
                                                                                                                      • Size 722KB
                                                                                                                      • SHA256 0eae3df786df69f92ef6b75eed73ed07326628adb11e0631788bd8c686f9ffd7
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      i_qoigbytrlj.exe
                                                                                                                      • Path C:\Temp\i_qoigbytrlj.exe
                                                                                                                      • Size 722KB
                                                                                                                      • SHA256 ed69c1782a4ec0e2079035e242bb1d02f56802c0df9f9ff9cd04c8288e15b5bc
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      i_uomgezwrpj.exe
                                                                                                                      • Path C:\Temp\i_uomgezwrpj.exe
                                                                                                                      • Size 722KB
                                                                                                                      • SHA256 ec15197a27536eab8559ce1b97f5f56d36a081595e9a03b88c8546111c00c680
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      i_upnifaysqi.exe
                                                                                                                      • Path C:\Temp\i_upnifaysqi.exe
                                                                                                                      • Size 722KB
                                                                                                                      • SHA256 6ee683f19c2288ec1f5b3bace27f9a40048beb207203109192568c7f5ab830d3
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      icavsnkfdx.sys
                                                                                                                      • Path C:\Temp\icavsnkfdx.sys
                                                                                                                      • Size 293KB
                                                                                                                      • SHA256 89c5ec2f27b65b3bcdf85e0cd78e037b2b7fabcbef1650674bb69c617d2a5e1f
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      kicavsnkfdxvpnif.exe
                                                                                                                      • Path C:\Temp\kicavsnkfdxvpnif.exe
                                                                                                                      • Size 722KB
                                                                                                                      • SHA256 3de23a96c75f049fb176a1b94aee5502e373d7f80532493307e7cd74e6f15566
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      kicavsnkfdxvpnif.sys
                                                                                                                      • Path C:\Temp\kicavsnkfdxvpnif.sys
                                                                                                                      • Size 293KB
                                                                                                                      • SHA256 35396c095ff0dd6e7a1131e40f037ebbfd8350f5420e999ac1a6240b5c3ccd31
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      mhbztomgey.sys
                                                                                                                      • Path C:\Temp\mhbztomgey.sys
                                                                                                                      • Size 293KB
                                                                                                                      • SHA256 ed24ba5df8bd6a3bc55a1ea48023ff67a62eb581ffb199095dfe8ea519b17d29
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      mkfcxvpnhf.exe
                                                                                                                      • Path C:\Temp\mkfcxvpnhf.exe
                                                                                                                      • Size 722KB
                                                                                                                      • SHA256 3222a152c10bf395226292d88d2249553ec75c83b1434f9aeff05d7ec90cd66a
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      omgezwrpjh.sys
                                                                                                                      • Path C:\Temp\omgezwrpjh.sys
                                                                                                                      • Size 293KB
                                                                                                                      • SHA256 c21651126509665a998b3b8e4c05dfacbf6c0d6cbd5faccfcaf065c570643edc
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      qoigbytrlj.exe
                                                                                                                      • Path C:\Temp\qoigbytrlj.exe
                                                                                                                      • Size 722KB
                                                                                                                      • SHA256 cef0411990f50a4f92e66d645fb8b05901714418cf460f07a0afd129bb00422a
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      rpkhcausmk.sys
                                                                                                                      • Path C:\Temp\rpkhcausmk.sys
                                                                                                                      • Size 293KB
                                                                                                                      • SHA256 efd716b70d43284019b4a3c47d09eecb2883eba818c89de320590d8cfa08e795
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      tolgdywqoi.sys
                                                                                                                      • Path C:\Temp\tolgdywqoi.sys
                                                                                                                      • Size 293KB
                                                                                                                      • SHA256 b2739c17366f369e1ee4a6c7c2e489501329fa5362c6b02ee043e6a496326c68
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      uomgezwrpj.exe
                                                                                                                      • Path C:\Temp\uomgezwrpj.exe
                                                                                                                      • Size 722KB
                                                                                                                      • SHA256 d514649bd28ef1e95e07377b01c4207e41890b05704992a9920fd3720dd81358
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      upnifaysqi.exe
                                                                                                                      • Path C:\Temp\upnifaysqi.exe
                                                                                                                      • Size 722KB
                                                                                                                      • SHA256 54566a9cb0f697afaaab814c08c5f6a7ad5db509b131702c4d172bf402595911
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      settings.dat
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                      • Size 280B
                                                                                                                      • SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                      Submit Download

                                                                                                                      settings.dat
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                      • Size 280B
                                                                                                                      • SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                      Submit Download

                                                                                                                      BookmarkMergedSurfaceOrdering
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                      • Size 6B
                                                                                                                      • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                      Submit Download

                                                                                                                      BrowsingTopicsState
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
                                                                                                                      • Size 649B
                                                                                                                      • SHA256 05714e14f64ffea7bd0c99df29f799ffef06e5a15d113ee170f0cf1b358c34f5
                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                      Submit Download

                                                                                                                      SiteList-Enterprise.json
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                      • Size 2B
                                                                                                                      • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                      Submit Download

                                                                                                                      HubApps
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                                                                                                      • Size 106KB
                                                                                                                      • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      Network Persistent State
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                      • Size 1KB
                                                                                                                      • SHA256 253326117d6c2aef4af053362736a1146658fe1b7820df999a25facddc1fe936
                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                      Submit Download

                                                                                                                      SCT Auditing Pending Reports
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                      • Size 2B
                                                                                                                      • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                      Submit Download

                                                                                                                      Sdch Dictionaries
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                      • Size 40B
                                                                                                                      • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                      Submit Download

                                                                                                                      Preferences
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                      • Size 15KB
                                                                                                                      • SHA256 f22de198fa150805eefc2ddc3f605c2273037f17146e5205c107e42a439ac438
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      Preferences
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                      • Size 15KB
                                                                                                                      • SHA256 d1f296b5cd333584fc197520e56817b96479571e64d5df2b43548d939ea0bfc4
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      Secure Preferences
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                      • Size 36KB
                                                                                                                      • SHA256 8020f2e0d3beebc6243f38c5fe0796d1aa0ab51032161a5d07127ddef946c847
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      sync_diagnostic.log
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                      • Size 22KB
                                                                                                                      • SHA256 c4d99939f579be2dcc45b6a6c981f31bafcfca074c24ed76edadf9001e28dd0f
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      Local State
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                      • Size 25KB
                                                                                                                      • SHA256 6c1c3490212c8d27a3e18ebd35575e98a86200d7f1079ee99077a0289c3d0ad0
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      Local State
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                      • Size 25KB
                                                                                                                      • SHA256 6df7b480c3f67aa30d0e1ac81a952235ab1a5c8e6906714a48cfb8097d225796
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      Local State
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                      • Size 28KB
                                                                                                                      • SHA256 c7a63c0db330a409f1e8891c87027e8dccec0f92c532588940bc53a81b750f1e
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      Local State
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                      • Size 28KB
                                                                                                                      • SHA256 878bd5dba08a5d1da574ab67d223c40ce16c47640e4d30a0d54f3f4787c14688
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      Local State
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                      • Size 33KB
                                                                                                                      • SHA256 504c803354c22c5d2ce7ff1aea33578aa453538157158de2ac8dcf77ffab1e7d
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      typosquatting_list.pb
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.21.1\typosquatting_list.pb
                                                                                                                      • Size 426KB
                                                                                                                      • SHA256 dd09485bbf5cc88d4b16947759497eaa159173798917953ed192e4f70f7b5d4f
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      metadata.json
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                      • Size 2KB
                                                                                                                      • SHA256 3daa74121f6a923b93354bc391df3300dd8f23f63aeffba74ef82a2c34fac363
                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                      Submit Download

                                                                                                                      metadata.json
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                      • Size 2KB
                                                                                                                      • SHA256 b16251a32202e9ae23c0ae913940eb448ce680501bf96177856745bd1a117b40
                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                      Submit Download

                                                                                                                      metadata.json
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                      • Size 2KB
                                                                                                                      • SHA256 c2797c3dc57b5720539db522ecc60d7e1bc89b6b6754cc5533a05b3b18da55cc
                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                      Submit Download

                                                                                                                      edge_checkout_page_validator.js
                                                                                                                      • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5500_116254685\edge_checkout_page_validator.js
                                                                                                                      • Size 1009KB
                                                                                                                      • SHA256 9960614ae3d67b2a2b2b1bb1fdd6a427f4d103835e50e45f2e2cf3b1c540fa44
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      manifest.json
                                                                                                                      • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5500_116254685\manifest.json
                                                                                                                      • Size 146B
                                                                                                                      • SHA256 1d4f529025d274699f815657573b828ae880ae0d44ee0b0ce66a6a273f2bddff
                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                      Submit Download

                                                                                                                      manifest.json
                                                                                                                      • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5500_154329388\manifest.json
                                                                                                                      • Size 118B
                                                                                                                      • SHA256 3c286bc18a9899fc2b55d3c55cd8331e6c64b853519149d854d42958b8209b87
                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                      Submit Download

                                                                                                                      data.txt
                                                                                                                      • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5500_1938781557\data.txt
                                                                                                                      • Size 145KB
                                                                                                                      • SHA256 5f9da8ac4889421d2020e6246daa63b3d5d4fb5a19019b1c20fc803481f01484
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                      Submit Download

                                                                                                                      manifest.json
                                                                                                                      • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5500_1938781557\manifest.json
                                                                                                                      • Size 52B
                                                                                                                      • SHA256 90f59dd0f7cd3fb4906d133943819da7aaf33f7ae5b5a0241e03ddea2611885d
                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                      Submit Download

                                                                                                                      CreateProcess.exe
                                                                                                                      • Path C:\temp\CreateProcess.exe
                                                                                                                      • Size 3KB
                                                                                                                      • SHA256 52f02a970c5803fb5cdc7341926a7230558a8686cfce0677e46a2b6bb82274c7
                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                      Submit Download

                                                                                                                      memory/692-532-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/2028-500-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/2084-310-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/2116-388-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/2116-298-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/2136-362-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/2544-528-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3856-347-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3944-455-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3960-56-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4364-166-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4580-201-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4660-221-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4692-258-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4752-422-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4752-322-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4924-402-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/5188-234-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/5416-286-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/5724-434-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                      Download