50c26b57c0ecb29d2d28687ada32fdcd8f1a1790ff89a8b7a66ffcce8221744a

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 722KB
Sample260709-pgmarah12r
SHA256 50c26b57c0ecb29d2d28687ada32fdcd8f1a1790ff89a8b7a66ffcce8221744a
MD5 b2a6b1735b728a0ee28f23a12fc4d834
SHA1 0ae0c4552dc4176c4192339093ad8d1dbef447f9
SHA512 14467e0c1e8cc904fd3070c8fe05634c37547381547b32741cfbe3c8b3022ab2cb35bb83487a20032d15818ce8baa6fe42d72fb83ffb1addba7cd6e25b1a4a46
SSDEEP 12288:+flfAsiVGjSGecvXAflfAsiVGjSGecvX:6McfcMcf
TLSH
T1BBF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1700	mgbywuomgeywtroj.exe
1204	mgbywuomgeywtroj.sys
244	CreateProcess.exe
5872	jgbytqojge.exe
1968	CreateProcess.exe
1680	CreateProcess.exe
2140	i_jgbytqojge.exe
4072	dbvtoljgby.sys
1792	CreateProcess.exe
5836	tqljgbytqi.exe
252	CreateProcess.exe
2932	CreateProcess.exe
3472	i_tqljgbytqi.exe
5336	igayvqoiga.sys
5632	CreateProcess.exe
4712	daytqlidav.exe
4540	CreateProcess.exe
5580	CreateProcess.exe
5664	i_daytqlidav.exe
1116	iaxvtnlida.sys
5216	CreateProcess.exe
2404	vsnlicavsn.exe
900	CreateProcess.exe
2564	CreateProcess.exe
2296	i_vsnlicavsn.exe
4184	snkicauqki.sys
2636	CreateProcess.exe
992	hfcxvpnkfc.exe
5260	CreateProcess.exe
2612	CreateProcess.exe
6024	i_hfcxvpnkfc.exe
3756	xsmkhfzxrp.sys
4016	CreateProcess.exe
5336	rpnhfzxrpk.exe
3004	CreateProcess.exe
5704	CreateProcess.exe
4940	i_rpnhfzxrpk.exe
2056	ecwupmhecw.sys
2132	CreateProcess.exe
4928	uomgezxrpj.exe
5504	CreateProcess.exe
5272	CreateProcess.exe
5552	i_uomgezxrpj.exe
5152	wurmjecwur.sys
3540	CreateProcess.exe
2548	omjezwrpjh.exe
3420	CreateProcess.exe
2124	CreateProcess.exe
3668	i_omjezwrpjh.exe
544	ztrojgbwtr.sys
3632	CreateProcess.exe
2460	tojgbztrlj.exe
3304	CreateProcess.exe
5284	CreateProcess.exe
1836	i_tojgbztrlj.exe
4252	bytnljdbyt.sys
4660	CreateProcess.exe
4292	wqoigbywqo.exe
5656	CreateProcess.exe
5792	CreateProcess.exe
4528	i_wqoigbywqo.exe
5956	olgdyvqoig.sys
4536	CreateProcess.exe
4740	yvqoidbvtn.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_1542607121\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_1819593342\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_1819593342\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_1542607121\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_1777342101\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_1777342101\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_1819593342\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_1819593342\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6128_1761777579\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 40 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tromgebwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqoidbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaysqcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtoljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtoljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfcxvpnkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqoigbywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhbzxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhbzxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tromgebwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tojgbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqoigbywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqoidbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgbytqojge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daytqlidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnlicavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljecwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgbytqojge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpnhfzxrpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tojgbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljecwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omjezwrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omjezwrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cavsnkfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqligayvql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfcxvpnkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomgezxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomgezxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgbywuomgeywtroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqljgbytqi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_daytqlidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnlicavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpnhfzxrpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uspkhcausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqljgbytqi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaysqcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cavsnkfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uspkhcausm.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1780	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2488	ipconfig.exe
5744	ipconfig.exe
4728	ipconfig.exe
3352	ipconfig.exe
5228	ipconfig.exe
5940	ipconfig.exe
6004	ipconfig.exe
2308	ipconfig.exe
5312	ipconfig.exe
572	ipconfig.exe
2740	ipconfig.exe
4004	ipconfig.exe
552	ipconfig.exe
240	ipconfig.exe
5540	ipconfig.exe
4860	ipconfig.exe
1092	ipconfig.exe
4816	ipconfig.exe
3040	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280731481904338"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1921861047-1272335887-115070671-1000\{F033BFF0-8C0E-43E5-94D8-574DD513548F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1700	mgbywuomgeywtroj.exe
1700	mgbywuomgeywtroj.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1700	mgbywuomgeywtroj.exe
1700	mgbywuomgeywtroj.exe
1700	mgbywuomgeywtroj.exe
1700	mgbywuomgeywtroj.exe
1700	mgbywuomgeywtroj.exe
1700	mgbywuomgeywtroj.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe
6128	msedge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	2140	i_jgbytqojge.exe
Token: SeDebugPrivilege	3472	i_tqljgbytqi.exe
Token: SeDebugPrivilege	5664	i_daytqlidav.exe
Token: SeDebugPrivilege	2296	i_vsnlicavsn.exe
Token: SeDebugPrivilege	6024	i_hfcxvpnkfc.exe
Token: SeDebugPrivilege	4940	i_rpnhfzxrpk.exe
Token: SeDebugPrivilege	5552	i_uomgezxrpj.exe
Token: SeDebugPrivilege	3668	i_omjezwrpjh.exe
Token: SeDebugPrivilege	1836	i_tojgbztrlj.exe
Token: SeDebugPrivilege	4528	i_wqoigbywqo.exe
Token: SeDebugPrivilege	200	i_yvqoidbvtn.exe
Token: SeDebugPrivilege	4204	i_ifaysqcaus.exe
Token: SeDebugPrivilege	3468	i_cavsnkfdxv.exe
Token: SeDebugPrivilege	936	i_uspkhcausm.exe
Token: SeDebugPrivilege	1896	i_rpjhbzxrpj.exe
Token: SeDebugPrivilege	3608	i_rljecwuomg.exe
Token: SeDebugPrivilege	2640	i_tromgebwto.exe
Token: SeDebugPrivilege	5852	i_bvtoljdbvt.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6128	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5576 wrote to memory of 1700	5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 5576 wrote to memory of 2572	5576	2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 2572 wrote to memory of 6128	2572	iexplore.exe	90
PID 6128 wrote to memory of 1120	6128	msedge.exe	91
PID 6128 wrote to memory of 1780	6128	msedge.exe	92
PID 6128 wrote to memory of 4708	6128	msedge.exe	93
PID 6128 wrote to memory of 4708	6128	msedge.exe	93
PID 6128 wrote to memory of 4708	6128	msedge.exe	93
PID 6128 wrote to memory of 5616	6128	msedge.exe	94
PID 6128 wrote to memory of 5616	6128	msedge.exe	94
PID 6128 wrote to memory of 3948	6128	msedge.exe	96
PID 6128 wrote to memory of 3948	6128	msedge.exe	96
PID 6128 wrote to memory of 3948	6128	msedge.exe	96
PID 6128 wrote to memory of 2404	6128	msedge.exe	97
PID 6128 wrote to memory of 2404	6128	msedge.exe	97
PID 6128 wrote to memory of 2404	6128	msedge.exe	97
PID 6128 wrote to memory of 5916	6128	msedge.exe	98
PID 6128 wrote to memory of 5596	6128	msedge.exe	99
PID 6128 wrote to memory of 5916	6128	msedge.exe	98
PID 6128 wrote to memory of 5916	6128	msedge.exe	98
PID 6128 wrote to memory of 5596	6128	msedge.exe	99
PID 6128 wrote to memory of 5596	6128	msedge.exe	99
PID 6128 wrote to memory of 6136	6128	msedge.exe	100
PID 6128 wrote to memory of 6136	6128	msedge.exe	100
PID 6128 wrote to memory of 2284	6128	msedge.exe	104
PID 6128 wrote to memory of 2284	6128	msedge.exe	104
PID 6128 wrote to memory of 2284	6128	msedge.exe	104
PID 1700 wrote to memory of 244	1700	mgbywuomgeywtroj.exe	105
PID 5872 wrote to memory of 1968	5872	jgbytqojge.exe	108
PID 6128 wrote to memory of 6132	6128	msedge.exe	112
PID 6128 wrote to memory of 5812	6128	msedge.exe	116
PID 6128 wrote to memory of 1492	6128	msedge.exe	115
PID 6128 wrote to memory of 3888	6128	msedge.exe	117
PID 6128 wrote to memory of 2312	6128	msedge.exe	118
PID 6128 wrote to memory of 5812	6128	msedge.exe	116
PID 6128 wrote to memory of 1492	6128	msedge.exe	115
PID 6128 wrote to memory of 3888	6128	msedge.exe	117
PID 6128 wrote to memory of 3888	6128	msedge.exe	117
PID 6128 wrote to memory of 2312	6128	msedge.exe	118
PID 6128 wrote to memory of 4536	6128	msedge.exe	119
PID 6128 wrote to memory of 4536	6128	msedge.exe	119
PID 1700 wrote to memory of 1680	1700	mgbywuomgeywtroj.exe	120
PID 6128 wrote to memory of 3964	6128	msedge.exe	124
PID 6128 wrote to memory of 3964	6128	msedge.exe	124
PID 6128 wrote to memory of 3964	6128	msedge.exe	124
PID 1700 wrote to memory of 1792	1700	mgbywuomgeywtroj.exe	125
PID 5836 wrote to memory of 252	5836	tqljgbytqi.exe	127
PID 1700 wrote to memory of 2932	1700	mgbywuomgeywtroj.exe	130
PID 1700 wrote to memory of 5632	1700	mgbywuomgeywtroj.exe	134
PID 4712 wrote to memory of 4540	4712	daytqlidav.exe	136
PID 1700 wrote to memory of 5580	1700	mgbywuomgeywtroj.exe	139
PID 1700 wrote to memory of 5216	1700	mgbywuomgeywtroj.exe	144
PID 2404 wrote to memory of 900	2404	vsnlicavsn.exe	146
PID 1700 wrote to memory of 2564	1700	mgbywuomgeywtroj.exe	149
PID 6128 wrote to memory of 1224	6128	msedge.exe	151
PID 6128 wrote to memory of 1552	6128	msedge.exe	152
PID 6128 wrote to memory of 924	6128	msedge.exe	153
PID 1700 wrote to memory of 2636	1700	mgbywuomgeywtroj.exe	156
PID 992 wrote to memory of 5260	992	hfcxvpnkfc.exe	158
PID 1700 wrote to memory of 2612	1700	mgbywuomgeywtroj.exe	161
PID 1700 wrote to memory of 4016	1700	mgbywuomgeywtroj.exe	165
PID 5336 wrote to memory of 3004	5336	rpnhfzxrpk.exe	167
PID 1700 wrote to memory of 5704	1700	mgbywuomgeywtroj.exe	170
PID 1700 wrote to memory of 2132	1700	mgbywuomgeywtroj.exe	174

C:\Users\Admin\AppData\Local\Temp\2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_b2a6b1735b728a0ee28f23a12fc4d834_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5576
- C:\Temp\mgbywuomgeywtroj.exe
  C:\Temp\mgbywuomgeywtroj.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1700
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgbytqojge.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:244
  - - C:\Temp\jgbytqojge.exe
      C:\Temp\jgbytqojge.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5872
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1968
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6004
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgbytqojge.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1680
  - - C:\Temp\i_jgbytqojge.exe
      C:\Temp\i_jgbytqojge.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2140
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqljgbytqi.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1792
  - - C:\Temp\tqljgbytqi.exe
      C:\Temp\tqljgbytqi.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5836
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:252
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4004
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqljgbytqi.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2932
  - - C:\Temp\i_tqljgbytqi.exe
      C:\Temp\i_tqljgbytqi.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3472
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\daytqlidav.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5632
  - - C:\Temp\daytqlidav.exe
      C:\Temp\daytqlidav.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4712
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4540
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4728
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_daytqlidav.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5580
  - - C:\Temp\i_daytqlidav.exe
      C:\Temp\i_daytqlidav.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vsnlicavsn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5216
  - - C:\Temp\vsnlicavsn.exe
      C:\Temp\vsnlicavsn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2404
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:900
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:552
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vsnlicavsn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2564
  - - C:\Temp\i_vsnlicavsn.exe
      C:\Temp\i_vsnlicavsn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2296
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfcxvpnkfc.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2636
  - - C:\Temp\hfcxvpnkfc.exe
      C:\Temp\hfcxvpnkfc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:992
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5260
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfcxvpnkfc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2612
  - - C:\Temp\i_hfcxvpnkfc.exe
      C:\Temp\i_hfcxvpnkfc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6024
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpnhfzxrpk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4016
  - - C:\Temp\rpnhfzxrpk.exe
      C:\Temp\rpnhfzxrpk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5336
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3004
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpnhfzxrpk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5704
  - - C:\Temp\i_rpnhfzxrpk.exe
      C:\Temp\i_rpnhfzxrpk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4940
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uomgezxrpj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2132
  - - C:\Temp\uomgezxrpj.exe
      C:\Temp\uomgezxrpj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4928
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5504
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4860
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uomgezxrpj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5272
  - - C:\Temp\i_uomgezxrpj.exe
      C:\Temp\i_uomgezxrpj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5552
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omjezwrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3540
  - - C:\Temp\omjezwrpjh.exe
      C:\Temp\omjezwrpjh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2548
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3420
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2488
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omjezwrpjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2124
  - - C:\Temp\i_omjezwrpjh.exe
      C:\Temp\i_omjezwrpjh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tojgbztrlj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3632
  - - C:\Temp\tojgbztrlj.exe
      C:\Temp\tojgbztrlj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2460
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3304
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5744
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tojgbztrlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5284
  - - C:\Temp\i_tojgbztrlj.exe
      C:\Temp\i_tojgbztrlj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wqoigbywqo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4660
  - - C:\Temp\wqoigbywqo.exe
      C:\Temp\wqoigbywqo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4292
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5656
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2308
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wqoigbywqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5792
  - - C:\Temp\i_wqoigbywqo.exe
      C:\Temp\i_wqoigbywqo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4528
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvqoidbvtn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4536
  - - C:\Temp\yvqoidbvtn.exe
      C:\Temp\yvqoidbvtn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4740
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4484
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5312
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvqoidbvtn.exe ups_ins
    3⤵
    PID:4168
  - - C:\Temp\i_yvqoidbvtn.exe
      C:\Temp\i_yvqoidbvtn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ifaysqcaus.exe ups_run
    3⤵
    PID:3712
  - - C:\Temp\ifaysqcaus.exe
      C:\Temp\ifaysqcaus.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4084
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2648
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ifaysqcaus.exe ups_ins
    3⤵
    PID:5380
  - - C:\Temp\i_ifaysqcaus.exe
      C:\Temp\i_ifaysqcaus.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4204
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cavsnkfdxv.exe ups_run
    3⤵
    PID:1748
  - - C:\Temp\cavsnkfdxv.exe
      C:\Temp\cavsnkfdxv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5288
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5980
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cavsnkfdxv.exe ups_ins
    3⤵
    PID:5608
  - - C:\Temp\i_cavsnkfdxv.exe
      C:\Temp\i_cavsnkfdxv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3468
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uspkhcausm.exe ups_run
    3⤵
    PID:5876
  - - C:\Temp\uspkhcausm.exe
      C:\Temp\uspkhcausm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1432
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5152
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uspkhcausm.exe ups_ins
    3⤵
    PID:2360
  - - C:\Temp\i_uspkhcausm.exe
      C:\Temp\i_uspkhcausm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:936
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpjhbzxrpj.exe ups_run
    3⤵
    PID:5900
  - - C:\Temp\rpjhbzxrpj.exe
      C:\Temp\rpjhbzxrpj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4968
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3988
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5228
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpjhbzxrpj.exe ups_ins
    3⤵
    PID:2696
  - - C:\Temp\i_rpjhbzxrpj.exe
      C:\Temp\i_rpjhbzxrpj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rljecwuomg.exe ups_run
    3⤵
    PID:2860
  - - C:\Temp\rljecwuomg.exe
      C:\Temp\rljecwuomg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4864
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5016
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5940
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rljecwuomg.exe ups_ins
    3⤵
    PID:3240
  - - C:\Temp\i_rljecwuomg.exe
      C:\Temp\i_rljecwuomg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3608
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tromgebwto.exe ups_run
    3⤵
    PID:2872
  - - C:\Temp\tromgebwto.exe
      C:\Temp\tromgebwto.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5748
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5968
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tromgebwto.exe ups_ins
    3⤵
    PID:4728
  - - C:\Temp\i_tromgebwto.exe
      C:\Temp\i_tromgebwto.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2640
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bvtoljdbvt.exe ups_run
    3⤵
    PID:5728
  - - C:\Temp\bvtoljdbvt.exe
      C:\Temp\bvtoljdbvt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3352
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1304
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3040
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bvtoljdbvt.exe ups_ins
    3⤵
    PID:6136
  - - C:\Temp\i_bvtoljdbvt.exe
      C:\Temp\i_bvtoljdbvt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5852
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqligayvql.exe ups_run
    3⤵
    PID:2128
  - - C:\Temp\sqligayvql.exe
      C:\Temp\sqligayvql.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1932
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1220
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2740
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:6128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x2c8,0x7ffa1934c188,0x7ffa1934c194,0x7ffa1934c1a0
      4⤵
      PID:1120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,16634708702440168408,13061515078436702641,524288 --field-trial-handle=2316,i,5960016238237659132,1572484096400708562,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:11
      4⤵
      System Time Discovery
      PID:1780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,5286225255869404418,10954554996469835624,262144 --field-trial-handle=2316,i,5960016238237659132,1572484096400708562,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
      4⤵
      PID:4708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2332,i,3300702395113072021,235001270083279374,524288 --field-trial-handle=2316,i,5960016238237659132,1572484096400708562,262144 --variations-seed-version --mojo-platform-channel-handle=2776 /prefetch:13
      4⤵
      PID:5616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,17663603413254770654,10800385146982758734,2097152 --field-trial-handle=2316,i,5960016238237659132,1572484096400708562,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
      4⤵
      PID:3948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,549093224483477941,389559995948799091,2097152 --field-trial-handle=2316,i,5960016238237659132,1572484096400708562,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
      4⤵
      PID:2404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4304,i,4380533466843334494,6306464484824008301,2097152 --field-trial-handle=2316,i,5960016238237659132,1572484096400708562,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:1
      4⤵
      PID:5916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4328,i,13045446338369233321,10479512705866921218,2097152 --field-trial-handle=2316,i,5960016238237659132,1572484096400708562,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:9
      4⤵
      PID:5596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,481421760176547237,11905548899933077130,524288 --field-trial-handle=2316,i,5960016238237659132,1572484096400708562,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:14
      4⤵
      PID:6136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5408,i,7122978261380226735,12574595666122099634,2097152 --field-trial-handle=2316,i,5960016238237659132,1572484096400708562,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:1
      4⤵
      PID:2284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,1051951045429847535,5131045051175026276,524288 --field-trial-handle=2316,i,5960016238237659132,1572484096400708562,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:14
      4⤵
      PID:1776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,1051951045429847535,5131045051175026276,524288 --field-trial-handle=2316,i,5960016238237659132,1572484096400708562,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:14
      4⤵
      PID:6132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4372,i,7668194346102120006,2331264606210467770,524288 --field-trial-handle=2316,i,5960016238237659132,1572484096400708562,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
      4⤵
      PID:1492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4060,i,11314219496951084480,16603517138811850810,524288 --field-trial-handle=2316,i,5960016238237659132,1572484096400708562,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
      4⤵
      PID:5812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6068,i,13575831236700887620,6955796603830763717,2097152 --field-trial-handle=2316,i,5960016238237659132,1572484096400708562,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:1
      4⤵
      PID:3888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,7985116228612721942,1813503539626153790,524288 --field-trial-handle=2316,i,5960016238237659132,1572484096400708562,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:14
      4⤵
      PID:2312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,16098385013967668162,6799396995703838202,524288 --field-trial-handle=2316,i,5960016238237659132,1572484096400708562,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:14
      4⤵
      PID:4536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5284,i,6734137307286991276,4365851537248945416,2097152 --field-trial-handle=2316,i,5960016238237659132,1572484096400708562,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:1
      4⤵
      PID:3964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,13373397819570019714,621393987592394983,524288 --field-trial-handle=2316,i,5960016238237659132,1572484096400708562,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
      4⤵
      PID:1224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,18090012152079792140,13833354337650018164,524288 --field-trial-handle=2316,i,5960016238237659132,1572484096400708562,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:14
      4⤵
      PID:1552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,12922249346383813868,17780606997612561409,524288 --field-trial-handle=2316,i,5960016238237659132,1572484096400708562,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:14
      4⤵
      PID:924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,11676429298616334008,4924465911063131973,524288 --field-trial-handle=2316,i,5960016238237659132,1572484096400708562,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
      4⤵
      PID:1180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,4519698191948616435,527787595715368357,524288 --field-trial-handle=2316,i,5960016238237659132,1572484096400708562,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:14
      4⤵
      PID:5864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=916,i,4910274969704304717,17405915246747512042,524288 --field-trial-handle=2316,i,5960016238237659132,1572484096400708562,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
      4⤵
      PID:5904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,8577871153517823050,13879347021748061099,524288 --field-trial-handle=2316,i,5960016238237659132,1572484096400708562,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
      4⤵
      PID:1356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5972,i,1165855210684630930,145210472907764792,262144 --field-trial-handle=2316,i,5960016238237659132,1572484096400708562,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:10
      4⤵
      PID:5164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,12396822320521196071,14234625544003016543,524288 --field-trial-handle=2316,i,5960016238237659132,1572484096400708562,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:14
      4⤵
      PID:4560

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1416

C:\Temp\mgbywuomgeywtroj.sys
C:\Temp\mgbywuomgeywtroj.sys
1⤵
- Executes dropped EXE
PID:1204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4220

C:\Temp\dbvtoljgby.sys
C:\Temp\dbvtoljgby.sys
1⤵
- Executes dropped EXE
PID:4072

C:\Temp\igayvqoiga.sys
C:\Temp\igayvqoiga.sys
1⤵
- Executes dropped EXE
PID:5336

C:\Temp\iaxvtnlida.sys
C:\Temp\iaxvtnlida.sys
1⤵
- Executes dropped EXE
PID:1116

C:\Temp\snkicauqki.sys
C:\Temp\snkicauqki.sys
1⤵
- Executes dropped EXE
PID:4184

C:\Temp\xsmkhfzxrp.sys
C:\Temp\xsmkhfzxrp.sys
1⤵
- Executes dropped EXE
PID:3756

C:\Temp\ecwupmhecw.sys
C:\Temp\ecwupmhecw.sys
1⤵
- Executes dropped EXE
PID:2056

C:\Temp\wurmjecwur.sys
C:\Temp\wurmjecwur.sys
1⤵
- Executes dropped EXE
PID:5152

C:\Temp\ztrojgbwtr.sys
C:\Temp\ztrojgbwtr.sys
1⤵
- Executes dropped EXE
PID:544

C:\Temp\bytnljdbyt.sys
C:\Temp\bytnljdbyt.sys
1⤵
- Executes dropped EXE
PID:4252

C:\Temp\olgdyvqoig.sys
C:\Temp\olgdyvqoig.sys
1⤵
- Executes dropped EXE
PID:5956

C:\Temp\nlidavtnli.sys
C:\Temp\nlidavtnli.sys
1⤵
PID:4280

C:\Temp\kicavsnlfd.sys
C:\Temp\kicavsnlfd.sys
1⤵
PID:5748

C:\Temp\fcxupnhfzx.sys
C:\Temp\fcxupnhfzx.sys
1⤵
PID:3752

C:\Temp\czusmkecwu.sys
C:\Temp\czusmkecwu.sys
1⤵
PID:1200

C:\Temp\hbztrpjhbz.sys
C:\Temp\hbztrpjhbz.sys
1⤵
PID:3980

C:\Temp\cwtomgeywr.sys
C:\Temp\cwtomgeywr.sys
1⤵
PID:4204

C:\Temp\jgeywqoigb.sys
C:\Temp\jgeywqoigb.sys
1⤵
PID:3752

C:\Temp\igaytnlgdb.sys
C:\Temp\igaytnlgdb.sys
1⤵
PID:2216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

daytqlidav.exe

Path C:\Temp\daytqlidav.exe
Size 722KB
SHA256 ed49d05eea9ca1a950386dabfd6efb25f2e35120850d3712025b6a7f3ab034bc
MD5 c47c694ad0efb5995cb78aaed7f36b5f
SHA1 e845d224112ea9d1741df4bc9d0be026abb79da0
SHA512 b5c87a9b520e1898a17bcbef069aa5450d1cd586106b72e9f2ee39b2d585707a08d86ba7f5f262115bd1e4c67d1d28daf8ef0ae39e640f32c4a97ae7a8b5fb09
SSDEEP 12288:MflfAsiVGjSGecvXAflfAsiVGjSGecvX:YMcfcMcf
TLSH
T1FDF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbvtoljgby.sys

Path C:\Temp\dbvtoljgby.sys
Size 293KB
SHA256 6e0aa033ac34e03cc44ee8f4326bf30f00c2ea98b27eeb4473266e6c1999ae7e
MD5 d567d797b15bc4b4365ec21348922dc8
SHA1 879c476cd72621b736fefcfbd2cac07214c41854
SHA512 6edeec07d00d34efabf1244066b20551d5007fa47a3ecf6e5d2f81f56eb712051c6e7e7d56f65915761e6270a1fe1eddb9095c7c26228bc18441bcfcd06c7789
SSDEEP 3072:KtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:KIJjiJcbI03GBc3ucY5DCSj
TLSH
T1FF545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfcxvpnkfc.exe

Path C:\Temp\hfcxvpnkfc.exe
Size 722KB
SHA256 bb1299fb13d99bbc9720f93f91d95404ae78933111d929076d18e62b46d8f3f8
MD5 0e81185767b55ef9c89b0e11d5497077
SHA1 4ab6ce9ff1d319e1f3324a6de7766ec11fed3d09
SHA512 78a3c8aed71df55a7c415fec413b3a8822df71eb449f1727581a761d6d53dabb70f3e512438f55f15a62746cf439e2c434700905cb5d069bc8e5e54988515398
SSDEEP 12288:vflfAsiVGjSGecvXAflfAsiVGjSGecvX:3McfcMcf
TLSH
T144F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_daytqlidav.exe

Path C:\Temp\i_daytqlidav.exe
Size 722KB
SHA256 3963763ece2ce1f44cfa5b19328acc1756f7f6a39c4e2bc9c3e5dcc0dd1a84d6
MD5 f0e0067b1c01f1d19d10731891b21bac
SHA1 e7eb64fef941065bd1201e71c0586111265a2d0a
SHA512 3a1139101abf25eaa29cebc10c9744dd17261ce7585e022afbb1a52913b2534b4a28f4f07f3af402eb1e44e032a6b39fe6e7d55a19e2af51b8be7d1ab67a1e1e
SSDEEP 12288:AflfAsiVGjSGecvXAflfAsiVGjSGecvX:cMcfcMcf
TLSH
T1B7F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hfcxvpnkfc.exe

Path C:\Temp\i_hfcxvpnkfc.exe
Size 722KB
SHA256 c97f6988f6a78d83c26f9d2712aec1890e7ee09a8bcaa16fe4d5ede1da99b604
MD5 6e9e4f281d2b6e11703cbd719620dc33
SHA1 4b57e9f032a35a6587564592ab7952c5096da3f6
SHA512 475ac2665df138b058e27b7b2e7f0b3bb8af113d7142ace1746e5979444279e9ed5cceee55d37a4b35645f03aa5eb0b4ed7b10eff46727033ab061d1f4e6a8be
SSDEEP 12288:XflfAsiVGjSGecvXAflfAsiVGjSGecvX:vMcfcMcf
TLSH
T1ADF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jgbytqojge.exe

Path C:\Temp\i_jgbytqojge.exe
Size 722KB
SHA256 5f9b9041b4489ee7caed290237a206246aefc77f285ddf646f367a2492e46dec
MD5 165e321caa01934f8a401764f140700f
SHA1 579016b6e20cd63d3869f85f0a05fe4f3044110c
SHA512 df3f9f4d3c38f106e2f3e66cf9db0e3b5f0bb4285e9813383ed60217490786a1eb7335218febcf008bb0d748e4a5cc50c79d6ab4eb804a487ed8756b18343df3
SSDEEP 12288:4flfAsiVGjSGecvXAflfAsiVGjSGecvX:kMcfcMcf
TLSH
T185F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tqljgbytqi.exe

Path C:\Temp\i_tqljgbytqi.exe
Size 722KB
SHA256 8978fc1e0fb726cba85ebb76046954e4aa8d586e0153f842d6db933d896f2b74
MD5 a22bca167dd36a91e42ae461d7e39369
SHA1 43032511e6e2efeaa162d8498214c842b44f64ae
SHA512 9d16cf5393700bb3ba2e9f3fe70f56ccabe10c69abc285698a19b78e1bce13fbb0d65d9aeefea39ef8c61c485c753071876bc96e1ff3eb95ce2da2248aa98950
SSDEEP 12288:cflfAsiVGjSGecvXAflfAsiVGjSGecvX:IMcfcMcf
TLSH
T11AF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vsnlicavsn.exe

Path C:\Temp\i_vsnlicavsn.exe
Size 722KB
SHA256 02b79c86435417a4769990137f4e5eb3cf1e88fef5e527d62fc2a778ad51e7a0
MD5 0fda2ed7917bdc59ebfdf9f445f4b061
SHA1 3b9fff007bfd888a3b5c5dff67ea7ae6b25de9d1
SHA512 614c204349222754b698e8bd5e14de3b590f2c15eaf126e53b746309ec8c7e7f295b50763b5fced4288567550134aa31f5c0ac2ae77b45950ef39899b2eb1c0a
SSDEEP 12288:hflfAsiVGjSGecvXAflfAsiVGjSGecvX:JMcfcMcf
TLSH
T1F7F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iaxvtnlida.sys

Path C:\Temp\iaxvtnlida.sys
Size 293KB
SHA256 ee902ea678304cb6afb9b410f0e29301fc56ac2516454f2ce7ef67ebb1c7d501
MD5 6e95731ba8974da1e384576c15e3fa60
SHA1 26dbb5c66400ae3eeb9aff799fcc65a26cbb43d0
SHA512 53683176a050391d641ba1ae092afca4065af6cb54ff7ff18df9d01e935ebecf6b95da677667d2492c23aba67646eb66813d8e268e49a08387d5755826d15b49
SSDEEP 3072:atKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:aIJjiJcbI03GBc3ucY5DCSj
TLSH
T170545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igayvqoiga.sys

Path C:\Temp\igayvqoiga.sys
Size 293KB
SHA256 eb72ed89459e87b992e61c2fc5483ff5ad1ddcbdddb1834e58318c1942e5adde
MD5 358b1f08e3d09349ba8435f90f0028fc
SHA1 b3e021b4a847f2fff6c957f421d20cd088074bc7
SHA512 dcb021e854f44e736da8da1dbbcf99145bdcce1dd55d7d8e189011eb2cf060f6cc9a547ccc2078093067a30776cbd114f38d158227a44cd23ea6ef88c26ecde8
SSDEEP 3072:ttKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:tIJjiJcbI03GBc3ucY5DCSj
TLSH
T17E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgbytqojge.exe

Path C:\Temp\jgbytqojge.exe
Size 722KB
SHA256 4d7d7054557a69b173bf573319ac14b85d395b56e20c886dd0666ba134ad99d5
MD5 137c4c8303a945e06f2704068816a06b
SHA1 cc82d6830c81ea64d7cca12e457314f9a40b2045
SHA512 25b145d5ddaf0ba7e83ba837b34484f6bb02e1b69ad4ca3a25841c6a30b27cc1583f1b28d57f6c10daff31638a026beb651d62c6ece0214cd48bb58e125a66ad
SSDEEP 12288:dflfAsiVGjSGecvXAflfAsiVGjSGecvX:VMcfcMcf
TLSH
T1D5F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgbywuomgeywtroj.exe

Path C:\Temp\mgbywuomgeywtroj.exe
Size 722KB
SHA256 519a00d0ed38b432d92e99fa8f089ba3aa6e180fb08f8572d196e87abcfb49cc
MD5 89324d9f57834a2472b5b15383b864b7
SHA1 e0d6f20971b3f85c4f2e159f70b56395451d9df7
SHA512 34ddfa2a8a063f8e4fe6ccfd19bb22cb79454bf813c96daf3a84e44503fe11f1784d49b519e22b8e03192b4c35395740bca52dbd5022995d92020cb86364af97
SSDEEP 12288:4flfAsiVGjSGecvXAflfAsiVGjSGecvX:kMcfcMcf
TLSH
T16EF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgbywuomgeywtroj.sys

Path C:\Temp\mgbywuomgeywtroj.sys
Size 293KB
SHA256 2ea3b70dc9813aced9a019a9c014e82816119866b1935f6a5c5d1280256aac1b
MD5 c062e2687c432013d17f7ca42ee21c7f
SHA1 5cd3495d99bbf097b27ddaa65fd897880e4aeed3
SHA512 8b9e952d8bc7899e8a6f4055560777329999267949e579f195a2dbaf67017f926cd0828264d1309026096807d2238a87826e88d31825f4bbda82b81ddb164e67
SSDEEP 3072:xtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:xIJjiJcbI03GBc3ucY5DCSj
TLSH
T136545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snkicauqki.sys

Path C:\Temp\snkicauqki.sys
Size 293KB
SHA256 899c92461a8e677b475dca91faf6d26c74b0578ed6a703317c5e7215c665b649
MD5 7844c0fa9051afff6b04dca4d46f8523
SHA1 658dbc36f25f878f18f505d562e8c4e575cc9a5c
SHA512 ef1cf78cb5f3cc1533e05f7aa33e310642ee5d6cfed43169c2f8d93fc717d198abd1147950504017f866519647069602b5bceccd8233a452aac20bc15c948a75
SSDEEP 3072:ctKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:cIJjiJcbI03GBc3ucY5DCSj
TLSH
T13E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqljgbytqi.exe

Path C:\Temp\tqljgbytqi.exe
Size 722KB
SHA256 36ed2ea69cc7a1308fb37b3ddee3e2ab5299e4a21e07962ce84f6a9a41a32217
MD5 ee28e55ba7295550c18267d55a14574f
SHA1 33f714cc0c44af3d785956c2e4bc288f08a2a484
SHA512 d74e25ac835709d1b74241512f5b1164648c7195b1c7e813baaa30c919e340273b1512bb10b2efc755a442480c5d41ef7eaee97bcd3dfc97664452cbb167026e
SSDEEP 12288:4flfAsiVGjSGecvXAflfAsiVGjSGecvX:kMcfcMcf
TLSH
T198F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsnlicavsn.exe

Path C:\Temp\vsnlicavsn.exe
Size 722KB
SHA256 8afadaca599863e5eecaf4b5a0b599e9dd673173b435b7ab8201b6b2d871713c
MD5 47ae21e740c866c5118bbc109c6b4ce5
SHA1 9989a8e98d6cb27a22e43e8ae8c185efdecb0d25
SHA512 012bd9fff7dd3282dae869b82fb9117724bc15d3b2335e6194afd2a4482d3158dbc30103f77317ba02046415eeaf365ecf21526753e2715128fc70f70b060f16
SSDEEP 12288:2flfAsiVGjSGecvXAflfAsiVGjSGecvX:iMcfcMcf
TLSH
T193F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xsmkhfzxrp.sys

Path C:\Temp\xsmkhfzxrp.sys
Size 293KB
SHA256 d01ee03b40b0b1be30c97793f9618318c8eed8d868c2d578a601c7f9080285ae
MD5 f0220f13340d0962c6d116236e33081d
SHA1 24e42c56378b5998eddc8e8630139012fb2f405b
SHA512 aa9033718a84f0fb50de1b9e154bc1d6d88875d3dd2cb96f0d11049acee1f5a06fbefc6c28902f5f7fe14ed657c54da5fc6c308923f84adb01ae1556d0918fc7
SSDEEP 3072:stKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:sIJjiJcbI03GBc3ucY5DCSj
TLSH
T1EF545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b1496502321f517b09534c582617bf030c4ff8de0da869f66429de1f101cdb1f
MD5 f8c7c49718fb6139261b35e0de8a16f5
SHA1 932be60f167543f9dbb0f9b873e479d309cb10b0
SHA512 e9fcba656bc8d7c02793b76cbc257eb03a5172f334bfa8f59061b7de2fab23110edfa4591bcecfadd614473caa4406378af299bcdc22d3753e10d61c633fb387
TLSH
T1FFD09B652A91884DCDC024365DF1520597104920440D538D5193F5F59C753C147564FE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7cadb07cec87a9d6e886e0897040864e85c8a9cb8ea1734421c7e3c95ff5567f
MD5 59d9a1eb4ea3242d4f75e485ef2482ed
SHA1 8733adf96390d513d87aa17999ca7bfae8196968
SHA512 d73da85f02cb3f1c5052a1fea5d7597e6dddcd0846834fbc7342bde26490b72952c8f1f8a3d773edb5b45b738c7f7a08782c58474e98bb4303cf93e7072c2681
TLSH
T190D09B652A91894DCDC024365DF1520597104920540D538D5093F5F59C753C147574FE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 96fea634b65bccdc29cbedd237cc7f49fbc9928bde59a80905ee1ec0f5243e35
MD5 e0190e172bfef6927866fdd45696c307
SHA1 fe83fc2738ad5bfe1bc8992fef99c9063dff7b65
SHA512 c7d730385ddff2746a3a7de4f9e1265c3845659cf052b520f1768ba9a02a39516bac6b8ed6cc39a850ae0e085b1a12e8174d160c2dc0e46a08f772bd352e68a4
TLSH
T156512B44172627F9C7B5F9B552D2C8DA76B0C55AC7EBEF006F98A0B7283F38080114B0
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9b265f62-a002-42f3-8e81-8c14045c7fa3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9b265f62-a002-42f3-8e81-8c14045c7fa3.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 02c85d5de53569033ec3328a5a7d2dcd57ea8696d1deff12a81320633221071b
MD5 88b6a5dc8da3590b47a8f04e59fd79d1
SHA1 818508ae4ac7c85f2879f49a852df44773e2fb63
SHA512 6b13da3e5e55dd9d5afc13c2281c367c55408869c7f909f79dbc40a68d33a7c51a5f5a90a107d1c6999a89e95137e905acc7006137345b7082de4f4fbbcdee47
TLSH
T1CD419EF3C3E8856EC90156F0AA187E1BCE1D0915436C3D5AC9E4EE5B93E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 66de64ba153ee3d127465464b48563c89660de8fff675eba2f8c0f03c46a4526
MD5 7dad28dea8f4fffa8293d6f8b704d158
SHA1 5c874b11b8d1ae8a0e91d581e4d689044c5e52bd
SHA512 0038691a61084131921a92ebc4ac43e2fbfbc4f585faee99137802d158cc286245b8c14ca6ae5cf2c648457edfbf56ca92dd7e9f8469f8fe1f5cb11ee496d28c
SSDEEP 192:sxRbR8yM/jK1Ml8wCZ/fSsX0ZjZqTzbzoA8p9z/g6+WNIYBHufGsIgDvJ:sxRbW8Z/fSsX+NvR/5I5ZF
TLSH
T1F552DA15AA24993BDCDBD20DFA557F53D6F81473A2941E44AAFCCA0C04E76ED121382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 979d7216f2fe9cffa6b9ace256b6e0031b26f9dffc12ea2328e2fd4934cb32c3
MD5 b239289b6f8ae9336786f2431291a0d5
SHA1 752367c1becaf16f75585a30b1f2ce002869bce2
SHA512 fecce12b91c2eb0c38d6e0c54e193863ca2a8adefcf4bf6cf5959ab4648ca3a5594decd181b4195ac730cdee5b94279c88d0fa671117ef926a38b351ddaab015
SSDEEP 192:sxRbR8yM/jK1Ml8UQPCZ/fSsX05jZqTzbzoA8prz/g6+WNIYB1ufGsIgDVJ:sxRbWqaZ/fSsX2NvX/5IlZD
TLSH
T12262DA16A924997BDCDBD209FA557F53D6F81473A2941E44AAFCCA0C00E76DD121382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ea5cc85e30e473eebaeeeb265de407840b34ed5ebe0a97d75ab7ac7c2cd2b490
MD5 45a3db7e4d27878af9a30b47c961be9a
SHA1 45b3522cba7a0239ae251edd03728c78b0506211
SHA512 543c5d526dfe2019725dc6ce88d339c2fc4f66d31cecd00f303126d3ea1cea0f8e29ba14d9ab7b0321c8aca8d7b20decf1e1a23ad3bbc43d6ac02731c16e2f04
SSDEEP 192:sxRAR8yM/jK1Ml8wCZ/fSsE0ZjZqTzbzoA8p9z/g6+WNIYBHufGsIgtJ:sxRAW8Z/fSsE+NvR/5I5Z3
TLSH
T1AA52DA156A28993BDCDBD20DFA557F53D6F81473A2941E44AAFCCA0C04E76ED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 ed860d1d3842f35c533e09890f502ca446e682bbd86228093c3f84ed97dc8b1c
MD5 5cecdfbeef87be03b8d961b74b39c9f7
SHA1 1827401e31d94bf2a93c9a6bc12935e6c77e146a
SHA512 3383a8ad630777857ee4afb1ae7597f292d7c587ecdc7d803fe1b8a03f04f214a26ea6cac7c2b5ddaf40928b7959e01f894463ab2fe0cd4fa4f6f048ad7b7b82
SSDEEP 768:IKC5Nm7pLuL7ryWguUffI8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOf6moK4JroDQ4y:IKC5NGE7ryWguUffIu1jalf6dK4iDQ+u
TLSH
T152E2FC7B680CCB7F4F80499DED29BA8EADA801CF56D8C95447F9880C03C66FB51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a29f4eed1caee539b2399dcfce9630d038c8b4bdd20789a60ffb019ccab0b3e2
MD5 8afbefac9b4c67c3ee0e165e4a095a3d
SHA1 e741e92e68d24fc052ed108425e64f4f92001a79
SHA512 16a53da6a1818980dd56f80f0b5e4f99c1a83770f9ee37af47032e70c641bcb760a05d9c7e88ff8f349442a2102fb0ee0b9b79deffa336e0ac5df7076131af2a
SSDEEP 96:KRinOiU0kiWs5RgSiK4HgIicy6hAiLHKvWK8c8qWEhZg6qK4fgAqcqCpYa+zC+4F:CinOiU0kds5ySaHgIpy6hAiLHKvWK8cm
TLSH
T1D2915105703B1650787D684D80B98C6BC6C179A67219E92B7FAC41E25F27E028EFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a4ac6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a4ac6.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 339b09f9684a4a8c4bbfbdf5b8e8017caf74c93e15895b09089e0eb10d3f5839
MD5 ad66bca207b5d5ce8f91357be903f2be
SHA1 a67b05525b2dc6d3404fc42090a39678c8e351b7
SHA512 c17d6e1d5fb8f3f821c204c91baa2d11110ff3e7c542bfe4ad95ce4c69fd9eddbc468929368655717f61a47e6f92a07c96a640fcf9fd26951e075f1f7bc7763e
SSDEEP 768:krv+4UNbdt3rfSNDOw0AQkgo5RRtMaW10xsUiZ+:kbsbj3bsQk55LtMaA0aUv
TLSH
T1B003BE72A8A88933DCE3D385B24B66837FFC5113C6811B90C9ED6B8D469B45E2707C5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 5d2b9f498a072e734fa343c283ac69ad4d319cec647d8ca558a98aadfd78e87d
MD5 a14d2b61cace1f910ccff7b0236bb9b0
SHA1 df6a6233c6a1914c5e44efe1e9860e9ba11dd5d0
SHA512 3d1d8ad71f1b1a8c8bb800d323a634dfb07fc77366ce76f34ed3ae36901b55f594d08e41b8188776d8f014c1e5a5003c80b3dcf88639b23c6caa68ef3ec90a16
SSDEEP 768:+j+9J3CrIwhSNDOw0/uQkgo5RRtMaW10Nvb9Mzw:99J3edCQk55LtMaA01b+zw
TLSH
T101F2CF72AC668E63DCC7D784B24B27D7AFE90267C5802E84C9DD9F0D09835AE170780E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f85191425742ebcd8fb324268ccf9d1d825c1bbbe65056e7d6ac281ee084a3ba
MD5 3f92e05da2e6b5dabd72c52b7a16c2a7
SHA1 188424155bf8575f2792d0b292f2a5bdcdcb78a1
SHA512 fccb048e5dcebef7a5e50c2f619a8242d22226c10f91b092ddeb6808fec53a687e237715923951e4d090ddb0fc6a06bb444e86688e76e6468c120805ccfa02f3
SSDEEP 768:wF1j+9y3DwgWrIwaDDOw0/mQkgo5RRtMaW10Nvb9Mzw:d9y34eQk55LtMaA01b+zw
TLSH
T17A038C72DC66CA67EDD38BC5B74A6B87AEE50167C6886DD4DAC95F4C00C35AE0307C0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 393550b3c48a6326314a13a6adce6263fdcee05b3521193f44c776a5fb5adf13
MD5 aacd75fec125573c2a8bd4ea1bb59e96
SHA1 cb59de02e3bd298f40a941770b757215c282c410
SHA512 5751487d3e07a560605d73c59eb131a7de71b6b42f3b48765d0144bc1cffe6ef9eeb33afca21b45243052ca4c896aad4eb0bd36e7273ce4d2ab5767ca19a7233
SSDEEP 768:Erv+4UNbdb3zrIhhSNDOw0/uQkgo5RRtMaW10NvSe:Ebsbl3fyCQk55LtMaA01Se
TLSH
T18303BEB2A8A9CA339CE7D784B24B66837FFC1163C5812E94C8D95F4C458749F270BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2921865608a44e8f35b2dced6b89327cdb71b81d29111c6409a75f11986fa486
MD5 dc42ba408bd4fe9adb0253771d0423c4
SHA1 a3df30eb6f9f80df59d0acde717130397de9fe20
SHA512 80e2fa9e2e33d1fd12b95af6958cd27b8033be7c859474703cd56aff7525ca34fbcb274b8d73a3a3f0b8520bad57fe42e3390ee3f6e3d90329c1cac72bc85a75
SSDEEP 768:Fj+9J3zrIwhSNDOw0/uQkgo5RRtMaW10Nvb9Mzw:w9J3fdCQk55LtMaA01b+zw
TLSH
T162F2CF72AC668D638CC7D784B24B27C7AFE90267C5802E84C9DD9F0D09835AE1707C0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

ab759a2e-c05a-4c87-8124-17a610350e18.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ab759a2e-c05a-4c87-8124-17a610350e18.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6128_782112235\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 5b411e36f2196f4e03d854092aa42fe561a160363d7c9ab4e6b7b56f58202a80
MD5 732e6c81891c652851a7703954e8e01d
SHA1 738b7ddbb34b13ee103d8bbcdb9ba91a12239eb7
SHA512 0db652baa6402b8521217e69fdc0930de46d2322a06c508dbabd16c22c58e2b8a53b5cf4d92ca889d1e5fa5faa76c4f1ed52d0efff9f8a88eec2289861eeaae0
TLSH
T11D71E78357A9D5F3C1DA5BF502835644F5FF12384763701017555556A730A7D6478F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/544-335-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1116-268-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1200-432-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1204-62-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2056-316-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2216-494-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3752-468-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3752-428-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3756-311-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3980-443-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4072-195-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4184-282-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4204-464-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4204-478-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4252-360-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4280-408-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5152-320-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5336-243-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5748-407-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5956-368-0x0000000000010000-0x00000000000AB000-memory.dmp

Download