ab83ca61af371e822098f67875ae3c6cc672f2b1bd15a8569ee3cc5d87224bc3

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 722KB
Sample260709-tycj4adv7j
SHA256 ab83ca61af371e822098f67875ae3c6cc672f2b1bd15a8569ee3cc5d87224bc3
MD5 ccfcf6c525d37faa576bb9a7ba1d1037
SHA1 3bbfed2781d4025c7e62dbfabc3c9b80f60c9016
SHA512 2bf8dbdec1b8f232e97624384ae8506aafc70bd7bdfa7a9e7ed782250c1fc9c7afe48856244bd90f7290089e07cfc446b21ab68e5e15b6505739e7f80a5db860
SSDEEP 12288:jflfAsiVGjSGecvXAflfAsiVGjSGecvX:rMcfcMcf
TLSH
T19BF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
5532	kecwuomhezxrpjhb.exe
4836	kecwuomhezxrpjhb.sys
2884	CreateProcess.exe
6048	mhezxrpmhe.exe
5176	CreateProcess.exe
2008	CreateProcess.exe
3364	i_mhezxrpmhe.exe
6088	ojgezwrpje.sys
5868	CreateProcess.exe
1844	ebwuomgewt.exe
2636	CreateProcess.exe
4908	CreateProcess.exe
2796	i_ebwuomgewt.exe
2956	bywtojgebw.sys
1412	CreateProcess.exe
3424	qomjdbvtqo.exe
948	CreateProcess.exe
704	CreateProcess.exe
3292	i_qomjdbvtqo.exe
1108	gaytqoigay.sys
1396	CreateProcess.exe
5172	dbvtnlfdyv.exe
3056	CreateProcess.exe
2964	CreateProcess.exe
4696	i_dbvtnlfdyv.exe
4584	avtnlyvqni.sys
5884	CreateProcess.exe
4580	lfdxvpnifa.exe
4780	CreateProcess.exe
2516	CreateProcess.exe
4568	i_lfdxvpnifa.exe
1380	avsnlfdxvp.sys
2532	CreateProcess.exe
1552	nkfdxvpnhf.exe
1120	CreateProcess.exe
3944	CreateProcess.exe
356	i_nkfdxvpnhf.exe
916	pnhfzxvpnk.sys
5844	CreateProcess.exe
2900	vpnhfzxspk.exe
5992	CreateProcess.exe
708	CreateProcess.exe
1752	i_vpnhfzxspk.exe
3284	rpmhfzxrpm.sys
1308	CreateProcess.exe
3708	spkhcausmk.exe
5700	CreateProcess.exe
3456	CreateProcess.exe
876	i_spkhcausmk.exe
4692	wupmherpjh.sys
4304	CreateProcess.exe
4200	mhezwuomhe.exe
124	CreateProcess.exe
5484	CreateProcess.exe
1440	i_mhezwuomhe.exe
3608	jhezxrpjec.sys
1464	CreateProcess.exe
612	ezwjhbztrl.exe
2496	CreateProcess.exe
2388	CreateProcess.exe
3120	i_ezwjhbztrl.exe
4912	trojhbzwqo.sys
5392	CreateProcess.exe
432	qomgebywqo.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping480_2001596449\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping480_1750215887\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping480_1750215887\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping480_1542807823\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping480_1542807823\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping480_1542807823\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping480_305569949\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping480_2001596449\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping480_1542807823\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwuomgewt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdxvpnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfdxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnhfzxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzuspkhcxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhezxrpmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhezxrpmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwuomgewt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qomjdbvtqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdxvpnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifdxvqnifd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urpjhecwur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecwuomhezxrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qomjdbvtqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkhcausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhezwuomhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifdxvqnifd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axvpnifaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urpjhecwur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwjhbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qomgebywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfdxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnhfzxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkhcausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhezwuomhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axvpnifaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qomgebywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigaytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jwuomgeywr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigaytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ayvqoigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtomjhbzw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwjhbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ayvqoigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzuspkhcxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jwuomgeywr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtomjhbzw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
408	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3360	ipconfig.exe
4512	ipconfig.exe
5588	ipconfig.exe
2492	ipconfig.exe
2776	ipconfig.exe
3736	ipconfig.exe
4852	ipconfig.exe
1056	ipconfig.exe
2176	ipconfig.exe
1440	ipconfig.exe
5184	ipconfig.exe
5452	ipconfig.exe
1288	ipconfig.exe
904	ipconfig.exe
684	ipconfig.exe
3332	ipconfig.exe
1880	ipconfig.exe
3284	ipconfig.exe
3748	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280880638430471"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2626306573-1585762579-411806764-1000\{129A14DA-5EB1-49A4-B692-8077B3962F95}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5532	kecwuomhezxrpjhb.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5532	kecwuomhezxrpjhb.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5532	kecwuomhezxrpjhb.exe
3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5532	kecwuomhezxrpjhb.exe
5532	kecwuomhezxrpjhb.exe
5532	kecwuomhezxrpjhb.exe
5532	kecwuomhezxrpjhb.exe
5532	kecwuomhezxrpjhb.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
480	msedge.exe
480	msedge.exe
480	msedge.exe
480	msedge.exe
480	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3364	i_mhezxrpmhe.exe
Token: SeDebugPrivilege	2796	i_ebwuomgewt.exe
Token: SeDebugPrivilege	3292	i_qomjdbvtqo.exe
Token: SeDebugPrivilege	4696	i_dbvtnlfdyv.exe
Token: SeDebugPrivilege	4568	i_lfdxvpnifa.exe
Token: SeDebugPrivilege	356	i_nkfdxvpnhf.exe
Token: SeDebugPrivilege	1752	i_vpnhfzxspk.exe
Token: SeDebugPrivilege	876	i_spkhcausmk.exe
Token: SeDebugPrivilege	1440	i_mhezwuomhe.exe
Token: SeDebugPrivilege	3120	i_ezwjhbztrl.exe
Token: SeDebugPrivilege	4544	i_qomgebywqo.exe
Token: SeDebugPrivilege	4176	i_qoigaytqlj.exe
Token: SeDebugPrivilege	1108	i_ayvqoigays.exe
Token: SeDebugPrivilege	5964	i_ifdxvqnifd.exe
Token: SeDebugPrivilege	1908	i_axvpnifaxs.exe
Token: SeDebugPrivilege	6124	i_fzuspkhcxu.exe
Token: SeDebugPrivilege	3376	i_urpjhecwur.exe
Token: SeDebugPrivilege	3092	i_jwuomgeywr.exe
Token: SeDebugPrivilege	2592	i_bwtomjhbzw.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
480	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3436 wrote to memory of 5532	3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 3436 wrote to memory of 3108	3436	2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 3108 wrote to memory of 480	3108	iexplore.exe	90
PID 480 wrote to memory of 3088	480	msedge.exe	91
PID 480 wrote to memory of 2544	480	msedge.exe	93
PID 480 wrote to memory of 408	480	msedge.exe	94
PID 480 wrote to memory of 2544	480	msedge.exe	93
PID 480 wrote to memory of 2544	480	msedge.exe	93
PID 480 wrote to memory of 5996	480	msedge.exe	95
PID 480 wrote to memory of 5996	480	msedge.exe	95
PID 480 wrote to memory of 3712	480	msedge.exe	97
PID 480 wrote to memory of 2012	480	msedge.exe	96
PID 480 wrote to memory of 3712	480	msedge.exe	97
PID 480 wrote to memory of 3712	480	msedge.exe	97
PID 480 wrote to memory of 2012	480	msedge.exe	96
PID 480 wrote to memory of 2012	480	msedge.exe	96
PID 480 wrote to memory of 1172	480	msedge.exe	98
PID 480 wrote to memory of 2788	480	msedge.exe	99
PID 480 wrote to memory of 1172	480	msedge.exe	98
PID 480 wrote to memory of 1172	480	msedge.exe	98
PID 480 wrote to memory of 2788	480	msedge.exe	99
PID 480 wrote to memory of 2788	480	msedge.exe	99
PID 480 wrote to memory of 1908	480	msedge.exe	100
PID 480 wrote to memory of 1908	480	msedge.exe	100
PID 5532 wrote to memory of 2884	5532	kecwuomhezxrpjhb.exe	104
PID 480 wrote to memory of 1636	480	msedge.exe	107
PID 480 wrote to memory of 1028	480	msedge.exe	106
PID 480 wrote to memory of 1636	480	msedge.exe	107
PID 480 wrote to memory of 1028	480	msedge.exe	106
PID 6048 wrote to memory of 5176	6048	mhezxrpmhe.exe	109
PID 480 wrote to memory of 2148	480	msedge.exe	113
PID 480 wrote to memory of 5460	480	msedge.exe	114
PID 480 wrote to memory of 5460	480	msedge.exe	114
PID 480 wrote to memory of 1516	480	msedge.exe	117
PID 480 wrote to memory of 1516	480	msedge.exe	117
PID 5532 wrote to memory of 2008	5532	kecwuomhezxrpjhb.exe	118
PID 5532 wrote to memory of 5868	5532	kecwuomhezxrpjhb.exe	122
PID 1844 wrote to memory of 2636	1844	ebwuomgewt.exe	124
PID 5532 wrote to memory of 4908	5532	kecwuomhezxrpjhb.exe	127
PID 5532 wrote to memory of 1412	5532	kecwuomhezxrpjhb.exe	131
PID 3424 wrote to memory of 948	3424	qomjdbvtqo.exe	133
PID 5532 wrote to memory of 704	5532	kecwuomhezxrpjhb.exe	136
PID 5532 wrote to memory of 1396	5532	kecwuomhezxrpjhb.exe	141
PID 5172 wrote to memory of 3056	5172	dbvtnlfdyv.exe	143
PID 5532 wrote to memory of 2964	5532	kecwuomhezxrpjhb.exe	146
PID 480 wrote to memory of 2620	480	msedge.exe	148
PID 480 wrote to memory of 4508	480	msedge.exe	149
PID 480 wrote to memory of 2288	480	msedge.exe	150
PID 5532 wrote to memory of 5884	5532	kecwuomhezxrpjhb.exe	153
PID 4580 wrote to memory of 4780	4580	lfdxvpnifa.exe	155
PID 5532 wrote to memory of 2516	5532	kecwuomhezxrpjhb.exe	158
PID 5532 wrote to memory of 2532	5532	kecwuomhezxrpjhb.exe	162
PID 1552 wrote to memory of 1120	1552	nkfdxvpnhf.exe	164
PID 5532 wrote to memory of 3944	5532	kecwuomhezxrpjhb.exe	167
PID 5532 wrote to memory of 5844	5532	kecwuomhezxrpjhb.exe	171
PID 2900 wrote to memory of 5992	2900	vpnhfzxspk.exe	173
PID 5532 wrote to memory of 708	5532	kecwuomhezxrpjhb.exe	176
PID 5532 wrote to memory of 1308	5532	kecwuomhezxrpjhb.exe	180
PID 3708 wrote to memory of 5700	3708	spkhcausmk.exe	182
PID 5532 wrote to memory of 3456	5532	kecwuomhezxrpjhb.exe	185
PID 480 wrote to memory of 2872	480	msedge.exe	187
PID 480 wrote to memory of 2872	480	msedge.exe	187
PID 5532 wrote to memory of 4304	5532	kecwuomhezxrpjhb.exe	193
PID 4200 wrote to memory of 124	4200	mhezwuomhe.exe	195

C:\Users\Admin\AppData\Local\Temp\2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_ccfcf6c525d37faa576bb9a7ba1d1037_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Temp\kecwuomhezxrpjhb.exe
  C:\Temp\kecwuomhezxrpjhb.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5532
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mhezxrpmhe.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2884
  - - C:\Temp\mhezxrpmhe.exe
      C:\Temp\mhezxrpmhe.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6048
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5176
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2176
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mhezxrpmhe.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2008
  - - C:\Temp\i_mhezxrpmhe.exe
      C:\Temp\i_mhezxrpmhe.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3364
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ebwuomgewt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5868
  - - C:\Temp\ebwuomgewt.exe
      C:\Temp\ebwuomgewt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1844
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2636
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1880
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ebwuomgewt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4908
  - - C:\Temp\i_ebwuomgewt.exe
      C:\Temp\i_ebwuomgewt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qomjdbvtqo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1412
  - - C:\Temp\qomjdbvtqo.exe
      C:\Temp\qomjdbvtqo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3424
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:948
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1440
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qomjdbvtqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:704
  - - C:\Temp\i_qomjdbvtqo.exe
      C:\Temp\i_qomjdbvtqo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3292
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbvtnlfdyv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1396
  - - C:\Temp\dbvtnlfdyv.exe
      C:\Temp\dbvtnlfdyv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5172
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3056
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3284
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbvtnlfdyv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2964
  - - C:\Temp\i_dbvtnlfdyv.exe
      C:\Temp\i_dbvtnlfdyv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lfdxvpnifa.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5884
  - - C:\Temp\lfdxvpnifa.exe
      C:\Temp\lfdxvpnifa.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4580
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4780
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:684
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lfdxvpnifa.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2516
  - - C:\Temp\i_lfdxvpnifa.exe
      C:\Temp\i_lfdxvpnifa.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4568
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkfdxvpnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2532
  - - C:\Temp\nkfdxvpnhf.exe
      C:\Temp\nkfdxvpnhf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1552
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1120
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3748
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkfdxvpnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3944
  - - C:\Temp\i_nkfdxvpnhf.exe
      C:\Temp\i_nkfdxvpnhf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:356
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vpnhfzxspk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5844
  - - C:\Temp\vpnhfzxspk.exe
      C:\Temp\vpnhfzxspk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2900
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5992
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5184
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vpnhfzxspk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:708
  - - C:\Temp\i_vpnhfzxspk.exe
      C:\Temp\i_vpnhfzxspk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1752
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spkhcausmk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1308
  - - C:\Temp\spkhcausmk.exe
      C:\Temp\spkhcausmk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3708
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5700
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3360
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spkhcausmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3456
  - - C:\Temp\i_spkhcausmk.exe
      C:\Temp\i_spkhcausmk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:876
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mhezwuomhe.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4304
  - - C:\Temp\mhezwuomhe.exe
      C:\Temp\mhezwuomhe.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4200
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:124
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mhezwuomhe.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5484
  - - C:\Temp\i_mhezwuomhe.exe
      C:\Temp\i_mhezwuomhe.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1440
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ezwjhbztrl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1464
  - - C:\Temp\ezwjhbztrl.exe
      C:\Temp\ezwjhbztrl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:612
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2496
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5452
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ezwjhbztrl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2388
  - - C:\Temp\i_ezwjhbztrl.exe
      C:\Temp\i_ezwjhbztrl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qomgebywqo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5392
  - - C:\Temp\qomgebywqo.exe
      C:\Temp\qomgebywqo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:432
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3064
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qomgebywqo.exe ups_ins
    3⤵
    PID:5592
  - - C:\Temp\i_qomgebywqo.exe
      C:\Temp\i_qomgebywqo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoigaytqlj.exe ups_run
    3⤵
    PID:5136
  - - C:\Temp\qoigaytqlj.exe
      C:\Temp\qoigaytqlj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5972
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1856
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5588
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoigaytqlj.exe ups_ins
    3⤵
    PID:2108
  - - C:\Temp\i_qoigaytqlj.exe
      C:\Temp\i_qoigaytqlj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4176
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ayvqoigays.exe ups_run
    3⤵
    PID:4216
  - - C:\Temp\ayvqoigays.exe
      C:\Temp\ayvqoigays.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5184
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2000
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1288
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ayvqoigays.exe ups_ins
    3⤵
    PID:4804
  - - C:\Temp\i_ayvqoigays.exe
      C:\Temp\i_ayvqoigays.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1108
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ifdxvqnifd.exe ups_run
    3⤵
    PID:3796
  - - C:\Temp\ifdxvqnifd.exe
      C:\Temp\ifdxvqnifd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3264
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3332
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2492
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ifdxvqnifd.exe ups_ins
    3⤵
    PID:2652
  - - C:\Temp\i_ifdxvqnifd.exe
      C:\Temp\i_ifdxvqnifd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5964
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\axvpnifaxs.exe ups_run
    3⤵
    PID:2116
  - - C:\Temp\axvpnifaxs.exe
      C:\Temp\axvpnifaxs.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5588
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:400
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2776
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_axvpnifaxs.exe ups_ins
    3⤵
    PID:6140
  - - C:\Temp\i_axvpnifaxs.exe
      C:\Temp\i_axvpnifaxs.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fzuspkhcxu.exe ups_run
    3⤵
    PID:3856
  - - C:\Temp\fzuspkhcxu.exe
      C:\Temp\fzuspkhcxu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:916
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3428
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3736
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fzuspkhcxu.exe ups_ins
    3⤵
    PID:2352
  - - C:\Temp\i_fzuspkhcxu.exe
      C:\Temp\i_fzuspkhcxu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urpjhecwur.exe ups_run
    3⤵
    PID:1164
  - - C:\Temp\urpjhecwur.exe
      C:\Temp\urpjhecwur.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5332
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1060
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4852
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urpjhecwur.exe ups_ins
    3⤵
    PID:3460
  - - C:\Temp\i_urpjhecwur.exe
      C:\Temp\i_urpjhecwur.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3376
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jwuomgeywr.exe ups_run
    3⤵
    PID:2456
  - - C:\Temp\jwuomgeywr.exe
      C:\Temp\jwuomgeywr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4528
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3048
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1056
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jwuomgeywr.exe ups_ins
    3⤵
    PID:3984
  - - C:\Temp\i_jwuomgeywr.exe
      C:\Temp\i_jwuomgeywr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bwtomjhbzw.exe ups_run
    3⤵
    PID:4516
  - - C:\Temp\bwtomjhbzw.exe
      C:\Temp\bwtomjhbzw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2404
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1940
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:904
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bwtomjhbzw.exe ups_ins
    3⤵
    PID:5456
  - - C:\Temp\i_bwtomjhbzw.exe
      C:\Temp\i_bwtomjhbzw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2592
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x2cc,0x7ff80ddcc188,0x7ff80ddcc194,0x7ff80ddcc1a0
      4⤵
      PID:3088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,5284718005446260960,6847312421834141287,262144 --field-trial-handle=2208,i,13170612171044899937,4831141171402240634,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:2
      4⤵
      PID:2544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,7729823692175349070,4222615673133717389,524288 --field-trial-handle=2208,i,13170612171044899937,4831141171402240634,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:11
      4⤵
      System Time Discovery
      PID:408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,9180599912066878134,5870302983620964841,524288 --field-trial-handle=2208,i,13170612171044899937,4831141171402240634,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:13
      4⤵
      PID:5996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,18070268095445042795,1249041839170306181,2097152 --field-trial-handle=2208,i,13170612171044899937,4831141171402240634,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
      4⤵
      PID:2012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,12993786262817557184,8537983152874744264,2097152 --field-trial-handle=2208,i,13170612171044899937,4831141171402240634,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
      4⤵
      PID:3712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,2865418762612663808,12991229794025298186,2097152 --field-trial-handle=2208,i,13170612171044899937,4831141171402240634,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:1
      4⤵
      PID:1172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,5449604867612062035,4954069413646685577,2097152 --field-trial-handle=2208,i,13170612171044899937,4831141171402240634,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:9
      4⤵
      PID:2788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3808,i,3620870113879962914,15958107771644133372,524288 --field-trial-handle=2208,i,13170612171044899937,4831141171402240634,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:14
      4⤵
      PID:1908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,976607403455395549,17528878704531367808,524288 --field-trial-handle=2208,i,13170612171044899937,4831141171402240634,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
      4⤵
      PID:1028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,12443625270088368810,13733369662625652530,524288 --field-trial-handle=2208,i,13170612171044899937,4831141171402240634,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:14
      4⤵
      PID:1636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,17087322926470514522,14860125387036367278,524288 --field-trial-handle=2208,i,13170612171044899937,4831141171402240634,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
      4⤵
      PID:568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,17087322926470514522,14860125387036367278,524288 --field-trial-handle=2208,i,13170612171044899937,4831141171402240634,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
      4⤵
      PID:2148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,15111492601808487504,10851716637779736053,524288 --field-trial-handle=2208,i,13170612171044899937,4831141171402240634,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
      4⤵
      PID:5460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,900744700480164939,11679596821889935404,524288 --field-trial-handle=2208,i,13170612171044899937,4831141171402240634,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:14
      4⤵
      PID:1516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,12881064343977797226,17905966244627203781,524288 --field-trial-handle=2208,i,13170612171044899937,4831141171402240634,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:14
      4⤵
      PID:2620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,7478206556619722984,2831695801701952275,524288 --field-trial-handle=2208,i,13170612171044899937,4831141171402240634,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:14
      4⤵
      PID:4508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,4733062408196318632,3659409996886552775,524288 --field-trial-handle=2208,i,13170612171044899937,4831141171402240634,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:14
      4⤵
      PID:2288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2772,i,9174646059987844348,15027380233495104118,524288 --field-trial-handle=2208,i,13170612171044899937,4831141171402240634,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
      4⤵
      PID:2872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,15090011809331892863,13795842537969524980,524288 --field-trial-handle=2208,i,13170612171044899937,4831141171402240634,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
      4⤵
      PID:1584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=908,i,5290170458156643726,17557739668829363671,524288 --field-trial-handle=2208,i,13170612171044899937,4831141171402240634,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:14
      4⤵
      PID:1940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,17508870612051697949,3986683884617874003,524288 --field-trial-handle=2208,i,13170612171044899937,4831141171402240634,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
      4⤵
      PID:904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5580,i,2517833890106137100,8742245459448546908,262144 --field-trial-handle=2208,i,13170612171044899937,4831141171402240634,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:10
      4⤵
      PID:1528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,4654210665928489450,15997885719723710735,524288 --field-trial-handle=2208,i,13170612171044899937,4831141171402240634,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
      4⤵
      PID:3420

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1196

C:\Temp\kecwuomhezxrpjhb.sys
C:\Temp\kecwuomhezxrpjhb.sys
1⤵
- Executes dropped EXE
PID:4836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3104

C:\Temp\ojgezwrpje.sys
C:\Temp\ojgezwrpje.sys
1⤵
- Executes dropped EXE
PID:6088

C:\Temp\bywtojgebw.sys
C:\Temp\bywtojgebw.sys
1⤵
- Executes dropped EXE
PID:2956

C:\Temp\gaytqoigay.sys
C:\Temp\gaytqoigay.sys
1⤵
- Executes dropped EXE
PID:1108

C:\Temp\avtnlyvqni.sys
C:\Temp\avtnlyvqni.sys
1⤵
- Executes dropped EXE
PID:4584

C:\Temp\avsnlfdxvp.sys
C:\Temp\avsnlfdxvp.sys
1⤵
- Executes dropped EXE
PID:1380

C:\Temp\pnhfzxvpnk.sys
C:\Temp\pnhfzxvpnk.sys
1⤵
- Executes dropped EXE
PID:916

C:\Temp\rpmhfzxrpm.sys
C:\Temp\rpmhfzxrpm.sys
1⤵
- Executes dropped EXE
PID:3284

C:\Temp\wupmherpjh.sys
C:\Temp\wupmherpjh.sys
1⤵
- Executes dropped EXE
PID:4692

C:\Temp\jhezxrpjec.sys
C:\Temp\jhezxrpjec.sys
1⤵
- Executes dropped EXE
PID:3608

C:\Temp\trojhbzwqo.sys
C:\Temp\trojhbzwqo.sys
1⤵
- Executes dropped EXE
PID:4912

C:\Temp\tolgdbvtol.sys
C:\Temp\tolgdbvtol.sys
1⤵
PID:5364

C:\Temp\dysqoigays.sys
C:\Temp\dysqoigays.sys
1⤵
PID:1636

C:\Temp\nkidavtnki.sys
C:\Temp\nkidavtnki.sys
1⤵
PID:3252

C:\Temp\axspnkfcay.sys
C:\Temp\axspnkfcay.sys
1⤵
PID:2788

C:\Temp\caxsmkecau.sys
C:\Temp\caxsmkecau.sys
1⤵
PID:2724

C:\Temp\cwuomhezxu.sys
C:\Temp\cwuomhezxu.sys
1⤵
PID:5404

C:\Temp\kecwurmkec.sys
C:\Temp\kecwurmkec.sys
1⤵
PID:5624

C:\Temp\ebwtomgeyw.sys
C:\Temp\ebwtomgeyw.sys
1⤵
PID:5384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

avsnlfdxvp.sys

Path C:\Temp\avsnlfdxvp.sys
Size 293KB
SHA256 f507ea8cfe012b03ae9f2eac95e927f55944615c45ee97ec5c74dc1f7cb7bd4d
MD5 9b4e346a9945fd7952aaea4f6906ee21
SHA1 0f1d24d968ef02c0d5885366ce3a23c41a8a3c12
SHA512 90ec22d2ce31d857b3643483e4b9f390f240d48ebfe9e14ad9495d2adc8a5d2875e4bffdd5d431031617810ad3ff6c9a9c49c9135b12cc0f339e50e9d4180a72
SSDEEP 3072:vtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:vIJjiJcbI03GBc3ucY5DCSj
TLSH
T11F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avtnlyvqni.sys

Path C:\Temp\avtnlyvqni.sys
Size 293KB
SHA256 601558c9aac3f880bfe3cc96f10fb24cafa09d0e6cf6a34e94e122235022aa8f
MD5 5f92cec8dfadc31f97d98a00d737dad6
SHA1 b6391198eb2dbd8f9810b57c77acc6f3ef29e990
SHA512 53cbdf9b493dcaa68c34b80a10e250a2eca6a044878e33fca65391cdea0824a698ad102fb9c1efa033b2109a4e6388fe25fc6bfe92826d59f12cd83a85774d9a
SSDEEP 3072:1tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:1IJjiJcbI03GBc3ucY5DCSj
TLSH
T17E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bywtojgebw.sys

Path C:\Temp\bywtojgebw.sys
Size 293KB
SHA256 94d1e69fbe128b5d21767be902f1cdeb8fd3f07a1e040ef3dbe608b9b68a1983
MD5 56be800cc73ca271813f4d69c97f2bd6
SHA1 63ea9c687de8d13d5707140e53564411d4f8d934
SHA512 61931bb180c298c6fb51c7c0610fba8c943c998a8e2d7a2ad76b0df8a37bde08b47528317f83fc0887d0689996872f30044e561f5d8574967e508c2414e43e24
SSDEEP 3072:mtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:mIJjiJcbI03GBc3ucY5DCSj
TLSH
T172545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbvtnlfdyv.exe

Path C:\Temp\dbvtnlfdyv.exe
Size 722KB
SHA256 917990315eeee65e5a25e731a5be684c59bec5251bfd00cbf8a74271b683f6b5
MD5 816e1c87f58db1b7017df819ecad1e50
SHA1 5803ea2def01f8934a2d3fbcaab2bb7ddd6170e4
SHA512 fb85d3f733e289ed6e9ea4fd97b986232a79ee1ecd03dca0a38fb4ff0ad753df08ded33478c909ca53f3e7a1d6ca70759bb3d59605141c865800d7198c9a8c35
SSDEEP 12288:nflfAsiVGjSGecvXAflfAsiVGjSGecvX:fMcfcMcf
TLSH
T15FF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebwuomgewt.exe

Path C:\Temp\ebwuomgewt.exe
Size 722KB
SHA256 6f9e36e1ff8444bc07e0d3c0b7bdf31d4dee9e5c1c158ad02dd353a91d543b6e
MD5 77bd2e2e22fdbfede2e302810ce59f3e
SHA1 9e94ddfa93914e057bb21636e68f6f7da4ca8ca4
SHA512 3552ac371f39cfa0851bda10828fb75454b3f22d2cdb697abd343aa95b895d361f49c048baadfbbc8e7da38362f2bf5fe12af888d78e2f95e7a043f84c23a4f0
SSDEEP 12288:7flfAsiVGjSGecvXAflfAsiVGjSGecvX:TMcfcMcf
TLSH
T133F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaytqoigay.sys

Path C:\Temp\gaytqoigay.sys
Size 293KB
SHA256 dab785ef11ffa1e0d6addd7e6f2aca0bbe747d980d354f93ef9c267135429036
MD5 54a91bdbf0d10c149a210b65c4dfb9d6
SHA1 edfd0b8ff1848a957450e68453b57d08c329bbb0
SHA512 23ac9d331f20b51891a7dce0b88ae2c6e732a227a92760f128131ff4d9f74d6d0cd16fd7884ba68d61912b10525caca1163c3ffe23433a29010cb4a6e18f747d
SSDEEP 3072:RtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:RIJjiJcbI03GBc3ucY5DCSj
TLSH
T113545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbvtnlfdyv.exe

Path C:\Temp\i_dbvtnlfdyv.exe
Size 722KB
SHA256 f5f96a48c2156c858bc3720720d3a0a5d52130deb1a264a95bd3f73f4748f090
MD5 4dc2e26bc40b61b619d48eb494864844
SHA1 d6bf1713cec6654c4892d40f979722d7ef6bb081
SHA512 ae0da7a48f5c1f29a257856503ff994ea1411409545cdf56ac0a599b75ef42f18e511e9ac903d64b371765923ad532a434f42f40e79c0982360c5634c5976bb8
SSDEEP 12288:jflfAsiVGjSGecvXAflfAsiVGjSGecvX:rMcfcMcf
TLSH
T16AF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ebwuomgewt.exe

Path C:\Temp\i_ebwuomgewt.exe
Size 722KB
SHA256 435ecc43f7d64c9d7aeb73d68ddaf29dc6d303e97b2f59b86b934f0b5362bc88
MD5 e4ee2fee20ed11960f97c0ea97a32257
SHA1 ed0231487196a3a465fe97e58a40d3eeb96ae215
SHA512 f90faec0d8c2be12060ca6fd32a7cfe18907b94bf064b8123bc846c41346428f9c3ff06454e127480978a0979b039a6f1d95074f974e8a69cad2c9a2808452c8
SSDEEP 12288:vflfAsiVGjSGecvXAflfAsiVGjSGecvX:3McfcMcf
TLSH
T1A5F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lfdxvpnifa.exe

Path C:\Temp\i_lfdxvpnifa.exe
Size 722KB
SHA256 9077983adf7a6cb057440a569ff07c09336d99716702055b82c826adeadb6d20
MD5 69f1dc2b8b4d5590564438488fb11a55
SHA1 573cb90ef7551eca33429ab38f5a7918c7579e8a
SHA512 e88495d3083149252a789f905a3a507405af360c7c7ce29b217f163dd2e90f4f293776a75eb95919836c8dc144497a0746c2de3fb6223669b5e41a27429457e0
SSDEEP 12288:6flfAsiVGjSGecvXAflfAsiVGjSGecvX:WMcfcMcf
TLSH
T192F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mhezxrpmhe.exe

Path C:\Temp\i_mhezxrpmhe.exe
Size 722KB
SHA256 8cf527f4026b9b9da0402b35fd8c75e5948e2332e6330d33ca92b0338e25344e
MD5 bd7ee2ef8cb041ca5800119fd24cbe5c
SHA1 235d889164f185398a3325cffee567b5dd66ea29
SHA512 015bd123b50e5e3b1e0f11974ea1a5d66a80bc2def55a8fa34d69ae13b046b346ccc9c574c09735bb958b8c8e4c8c00db11131d65357909e5419cad0e656ccda
SSDEEP 12288:zflfAsiVGjSGecvXAflfAsiVGjSGecvX:bMcfcMcf
TLSH
T19AF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qomjdbvtqo.exe

Path C:\Temp\i_qomjdbvtqo.exe
Size 722KB
SHA256 67ec0bee902751273b02c21c25ab437fb5786ea4def41fd09ffddf32e20ddf81
MD5 6e2dd2204b6eff9293aba9a59c99ad79
SHA1 1f997d04b3ecf0d95925f16d9f6ab8633b0f2948
SHA512 aec92a5737bf5f954ff5542639c721c5f73f61ddfef2a8f492dc24e8cf05f4b97faac7f6088363258bbb4d366c8920997f82cbbe5d2d1702b23490e530f25dbb
SSDEEP 12288:FflfAsiVGjSGecvXAflfAsiVGjSGecvX:NMcfcMcf
TLSH
T113F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kecwuomhezxrpjhb.exe

Path C:\Temp\kecwuomhezxrpjhb.exe
Size 722KB
SHA256 e3439ccb7f573dc76971d0585504d9072bfcfe47140ab2b8ae6f9461ac606d7f
MD5 abe8fc1a3bc6d60ed676ccc7d12fa4f5
SHA1 a7c47c429fa450abc98646824a03599acb0dcf8f
SHA512 1622d7bdf44708515710acff763b37886876be4e0f1955bfc971544d64dabf164097a8dda5c9cf6e6399c75858ec296e63dfbae2fa2c5348558d824e4eb08de6
SSDEEP 12288:qflfAsiVGjSGecvXAflfAsiVGjSGecvX:mMcfcMcf
TLSH
T1B5F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kecwuomhezxrpjhb.sys

Path C:\Temp\kecwuomhezxrpjhb.sys
Size 293KB
SHA256 40e81aab0291679499bc5e060dc0557cc8173355187b8e8205b7920c79ae8615
MD5 9124350da3ca31bfb267f849af6f89fe
SHA1 9e873a1e85a4438dcb0e0e7072ffc2002374e067
SHA512 fab16b712868a4d9bb9cc45f4724179dcfca512672a99bf44242348c2cca9b1d2ec5cea8c221a6c8f77c6a09be4af2fe87946ab0a7934ba9c48535828ea14866
SSDEEP 3072:ItKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:IIJjiJcbI03GBc3ucY5DCSj
TLSH
T1EB545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdxvpnifa.exe

Path C:\Temp\lfdxvpnifa.exe
Size 722KB
SHA256 1386a5e710dcc5d9bb36c5bd37f3593e06b3220a5de660a03bcc11da26016737
MD5 fbed4e61d4bfcf80b9ae98ec8d7d1d32
SHA1 470da19573e2c9880e2961155dd9d64a3113a335
SHA512 73b57e20492dd498acd24b68cb5913299ddf8164ebaedecfea26b1e0b0711aac4f9be7bd6e57264f4d743188cdc3b388785a7ee5c1ce5c53eea4c68bb95221a0
SSDEEP 12288:MflfAsiVGjSGecvXAflfAsiVGjSGecvX:YMcfcMcf
TLSH
T1B9F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhezxrpmhe.exe

Path C:\Temp\mhezxrpmhe.exe
Size 722KB
SHA256 38ddccc699c8ee43c7c55548e6c39e16faccdd83a48129d9bcc96c93f3a8dea8
MD5 e5009580eb32130a3b318d79ab9d531a
SHA1 3af2ffe01b9f9ca0ec57f4dffaf3910fc9e34642
SHA512 53dd7639ef1b92efa8e194f3257bbabf150626804d68582c693d86211cc56c1869bc111f1f0ff9022f0de869cb03b5b301acb7e5b47268b718a9025f36526110
SSDEEP 12288:rflfAsiVGjSGecvXAflfAsiVGjSGecvX:jMcfcMcf
TLSH
T1F2F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkfdxvpnhf.exe

Path C:\Temp\nkfdxvpnhf.exe
Size 722KB
SHA256 3b37faae229d29b419fe8d7b38d7fcd0494af2d14f261b35e9bbf80014d7b430
MD5 a3599f452c6c3e9148bcf51110599523
SHA1 4da350303c85addbf32ae4ca6e06503e71f5113e
SHA512 593e15f0e656146d9a53fdde3f34ae505ab8f7456174994085b71c31f84baeefd8b045c736e2de4469c8966b447aeefd54079f7e740ba9adb70870320f167467
SSDEEP 12288:0flfAsiVGjSGecvXAflfAsiVGjSGecvX:wMcfcMcf
TLSH
T179F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ojgezwrpje.sys

Path C:\Temp\ojgezwrpje.sys
Size 293KB
SHA256 b3f1bbbb225e5f1fe03992ce34527b8c58e550685808a77b8964b2eb2700bb12
MD5 1a980eaedb1ae732c49acf037734200a
SHA1 1ab6fd55500618a57f00342f8063b3d10e81d617
SHA512 13c15b2b483b7b2b82ea1fcb91b3e2f6279d88667746f7383e3fa55df350a5aaf857567e3747cbedd0d00bb1d066f7a604d89bb928e60c5b0d9b6634f849d870
SSDEEP 3072:YtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:YIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A0545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qomjdbvtqo.exe

Path C:\Temp\qomjdbvtqo.exe
Size 722KB
SHA256 8f0c25f95536881e87cad7b75e242a1b4cd7ec3338444c5f4b78a2679785f14e
MD5 26dd316573835cb2e884f7162643d083
SHA1 ecaf23b306d5fab5a65fbee81c7dff481d30e23f
SHA512 a6a0668d47034494cac9fc75a4683ca6ddf1c0e3d02b18041a55d2d7df1dabf3d5e4ec5f079b5b507f5e0dc4129dab303087a141ad0c590b8b1055eceebf808b
SSDEEP 12288:MflfAsiVGjSGecvXAflfAsiVGjSGecvX:YMcfcMcf
TLSH
T135F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3f51b0e24e52d8511f72e348c132f84b6b8edb54027a5c8c4fbe2a976322a690
MD5 e32f775acc5ed08adf9d5f6678c2bc4d
SHA1 bd5f4d60c6c8f97a1fed276a8c02ca345e30bb2a
SHA512 2b2fef021516ee5e90b192840780767fff5c147cfb2dfe5b900a8b298d542111707f16c28e265447d090c61e8e091b3529eb29ff376abe03cd34315206805eba
TLSH
T1DAD09B996686AD54DD80343534A1E34B9A18F522102C46488117B064CCA464246561FF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a54d1be6da491be16ecc22dac3ad8cfbe4eabb017451e32c26f2904977fde58e
MD5 9daa45ac0383b3b978ad8da2d5000b62
SHA1 f52083ce5d095366a6fa9406b8b49000fcb53bc0
SHA512 ac55ccfd63460f712cd2ffb1ff656349475683b1ec07abd198254ac469a634f7129cf280de184340d8314fe2b8f7e955f7a112deb1511d52de882ae801a7c1af
TLSH
T17DD09B9D6686AE54DD80343134A1E34B9A18F522642C464880177054CCA464246571FF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ed081d802b5d61314581c77d79be07c897b5ec6a2dff1ec0f3cba16beb54a2a7
MD5 21d97445daf22122c3a94fcb729a2edd
SHA1 fbb711fef789ec13bc6e2b9dd47be45ae8f5519f
SHA512 9ca0e8f5b41351e5fbbe430e26d6f375147a55c3f1fcbf7225267b1980085ae4040583146cef51a606623977f50edcf79c6fa3d51a170d70dc65a805185beccd
TLSH
T15E6199520B3A6BD5DB245DBB2AE214A43F387CCF823FAE07514596B54A42F00DF5E532
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597b02.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe597b02.TMP
Size 3KB
SHA256 5b55fff1eee2b7e3339deb150d95fc7c08edf460a129a626c06e7fbcc6141f36
MD5 a7817ff44ee7458663324b07ad5a1860
SHA1 efb6bd1725dcda8f142ba55c117b5efc32129c93
SHA512 e79c927dcd2a961bad8128e76a568d584f5add8e755981bda9ea34e660ccc1319546f757791f2dc4a1db12c2d7f2bc12d26a3f821a3de4bf88606c6b8ed65e08
TLSH
T1D861B9520B3A6BD5DB245DBB2AE214A43F387CCF823FAE07414986B54A42F00DF5E432
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c0b741fbad057a42e54f6a92ceac65d4ab8108e8bb0efc1439accaec93135ee0
MD5 70641f97fab42f3c41bd7fa7642a9b54
SHA1 5198907a84739671ff1534b5749290e9a879c153
SHA512 43fe06ed0643474ebb3034b9eb4fe1699506c48aa1776a727f98b7db259d4df743d05f18e3b2f0116b2bcf147b64072050eb746ec128694be6289ec6e3a6d036
TLSH
T1B841AFF3C3E4856ECA1196F0AA187E2BCE2D0915432C3D5AC9E4AE5BA3E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 605c81615d04c9a6638c107c392329d2b095580826bf6f7c0e56289e4b03cbc8
MD5 6c4e66a586f62f7b2988ed2563bc43aa
SHA1 b2b886063486093c474ffd7bea75ad38122440d3
SHA512 da8413a8652989acf07f55061608a4afce5a68d98432a70bb3f2d36385a5712f301cbd2b2c90e96870b6d76eb28bdaa8e322846c712ddd915e7538fefa9f74db
SSDEEP 192:sxR7RsyM/jK1Ml8wCP/fysTrdpZHEg8xQzoA8pi/g6+WNIYDLkGzIgtJ:sxR7G8P/fysTZnB8xJi/5IA3
TLSH
T1A052C8056A24593BCCDBD219FA557F53D6F81563A2901E44AAFCCA0C00E7AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2047674a9e43ac7b56a8904af2d3d472bed3692024b83b14a22e008dfdbb016c
MD5 167c034c36e429335bc005d64db56de8
SHA1 0ba086b259c0755b161a9d64ac5b7563ebbcc05e
SHA512 d4b5d412fde5d9fa6dbbc3b510535c2a57da7f93ac769d3a9b1cb21fa0294838f8d47c694a3a51cf74b4795f55c947ad18152f47f516f6817f58e7e0e1c079fc
SSDEEP 192:sxRERsyM/jK1Ml8UQLCP/fysErspZHEM8xQzoA8prd/g6+WNC0C/YDAkGzIgDCJ:sxREeq+P/fysEonp8xJB/5Y/fy
TLSH
T1C362B816AA289D37DCDBD219FA517F53D6F81562A2941E44AAFCCB0C00E76DD2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 fceff640e3d764562153dc52068a57a22c0f828f433678c59ffe4a301a703f80
MD5 564ec770fdf10e557ab07adcb4cb6a77
SHA1 b565d1aab90b2578386a3fd0c3e96ae30195c79d
SHA512 0e062820264687b1defb177628784789af421a25a7cc80a0714116ff3066945577a8024133418c12cbe4df5a6b68db1486d9a3ec3d089763510455cc08ee2be4
SSDEEP 192:sxRERsyM/jK1Ml8wCP/fysErdpZHEM8xQzoA8p9d/g6+WNC0C/YD5kGzIgDMJ:sxREe8P/fysEZnp8xJD/5Y/KU
TLSH
T11662B8166A285D37CCDBD219FA557F53D6F81562A2941E44AAFC8B0C00E76DD2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 de2730f5bd805ac18bbe8212d9a01b264e4be89ed5ebf0b1a95accf3c33f726c
MD5 9cd94070d8c286a634159215cbf7c3b2
SHA1 1644811222a528cb01597cc9eff4250043b4a28d
SHA512 011c17106ca4ffdf25a50c3d73e9fa93a994a3efcb477a9a92569270ad530e50b13be99c5bc0c8c17fcf747e1780a4938fc0a124a3948360fef2f8bfc743acda
SSDEEP 768:f+4+zH7pLuL7eDWgb/fPI8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJxkIn25ro7h2:f+4+zBE7eDWgb/fPIu1jauxkw2y7h2
TLSH
T179E2FB7B680CCB7E4F404A9DEC29BD9A6DE801CF96D8C95447FA880C03C6AEB55174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a1704.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a1704.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 15563d4b860a13d890a1ed18a2dce2f7979b28446cfe941f8f67c7eb6c610e16
MD5 3db8ed07025212a7859cc4d84c5ffa59
SHA1 102fc0f8e0d70891e7bf8b1c5a22b2700fe85612
SHA512 e18774238f5de26ea26e9cb958ff737dc863a1c6192c7374f3feb8e6962794da41aba96b31a1ebc13c8a405930914dfd9d816932795ea58a97af1a7e36f79440
SSDEEP 768:0rv+4UNbdC3KhTwif7caHuVboPzkZLNx9OZ1Uik4K:0bsbs3KO+HOawZLNqHUVr
TLSH
T18703B036A8749937DDE79289B24B79477FF81113C5800B88C9EC3B4D459B4AD1B0BE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 502b5654848dad4ae0cf6b292f2294e398616379b92fb6cd1d9a14ac7e2a381f
MD5 7e4c51064e4b6251e75cdcf2f76b8f96
SHA1 fa65897167985b489f97a7fcdb45efbb95bb62c8
SHA512 ae98844ed431ce17ba337ebe039e4eed48ba2b1da502f54601a3cace26195e6c71bf4d92d329371b09901c1c3f02852623702c6dc02eaba45b653ee17f21bbe1
SSDEEP 768:8j+9/3J1gmwif7XE9aHuVboPzkZLNx9OFNb9MK:b9/37ST4HOawZLNqDb+K
TLSH
T1C2F2BF71B8268D278CDB87D8B24A3AD7AFF4116789841F88C9D86F0D04975AD1F0BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 daf7bd898b903dd7c671c47c5b1b7e1ecfeb7b6a1fd1d467c69ece8c48a8f2d4
MD5 a8fc944a73b62c4e6a7107e05cd471a4
SHA1 db8f622100e1a92464e752e4df625ca6fbfbd724
SHA512 edb267489e0002983728e0070feaaaafeffd84b450cd1d6b26c8c60d9f11cece74babb54a0ab2ab87910553756e8fce9a739348ab4d3cec435af529313fc4c21
SSDEEP 768:grv+4UNbd93V1Jmwif7XEyaHuVboPzkZLNx9OFNb9Mm:gbsbL3nfTTHOawZLNqDb+m
TLSH
T17613C031B435DD37DDA79698B18B3987BFF8206789C40B88C9D86B4C055B4AD2B0BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 1b909c34593c811873dbbf9486470c8bc864a7d3943f59b6aee01df33d17aa81
MD5 f66f4cbd7e22ff7dc5b0080954ebd11a
SHA1 ce67f5020e30ec755ef4d3c7a7c08a47b3653e32
SHA512 54b22b05de64ebfe198bf4980a8c327354f2501d48a1a9d6b4a7fb0e990540a29a83fb75a1117d635cec1f9059ac1b51cb6df2201bb38ef6cc87c107557add2c
SSDEEP 768:mj+9/3g1gmwif7XE9aHuVboPzkZLNx9OFNb9MK:19/3OST4HOawZLNqDb+K
TLSH
T1BAF2BF71B8269D278CDB87D8B24A3AC7AFF4116789C41F88C9D86F0D04975AD1F0BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 00f2576472e46bdbf1bbd2f4bc1fc235b25f4a02ccaa3c8a5a2b2b7e1ec2b7e8
MD5 3a0265939457a74124d2843cd1c26e0e
SHA1 dc9e3f47c733205c2b680ee024fb78302ac2503f
SHA512 19c25b2345f0b5b4662d161b6f93354ce1d214f6fbe5e2657e1cc13ec85c12a588266cb97b9c97a92c13433f24afc6718913680e4d221cb8b37c589a8143feee
SSDEEP 768:KFKj+9O3iwgY1bfAXEHaHuVboPzkZLNx9OFNb9MK:i9O3d56HOawZLNqDb+K
TLSH
T13B1306F6A8D38937D89E4787A37D2D869AFCC167B5841984BBC45E0CCC861BFCA06815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 db60bcb6bea2b9549f97205e125ff0c006341d671d9dc39666b5b0f314f7aa31
MD5 367749c08e18fcb907453b5d9d9db9d3
SHA1 dcf7f9ef522b61d9b05316106445301031d64990
SHA512 a57838dc3798a203b3e97028d98660e7306a5d72fb490ed436a2f105cfd01f7a5eb8377b1064201f749974721810e3ac9fc3f80d0bc11a5925b704337134d503
SSDEEP 768:Arv+4UNbd93F1Jmwif7XE8aHuVboPzkZLNx9OFNb9Mm:AbsbL33fTdHOawZLNqDb+m
TLSH
T1B813C031B429DD37DCA79698B18B3987BFF8215789840B88C9D86B4C055B4AD2F0BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir480_71584558\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 dcb57577bb2bd50288387a70d70cfd59d6aa7808701fec300b48a8994a7680b9
MD5 81244824977a6208427957572b53b317
SHA1 187d8ac47beca1acf1db338ca96303cc0547834c
SHA512 d94825fcccb25f3deb0aadf0049155bd61077c90f02070e13aa4a1af4df26416b363b62d2b342a0ae0932863286be4f946e883d8c8ac03d96de22a6c1f1ddadd
TLSH
T1DE7123835AB8D9F2C1DB5BF002C35648F6FF22380723306547555586AB30A7E14B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/916-331-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1108-270-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1380-332-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1380-320-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1636-425-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2724-482-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2788-449-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2956-242-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3252-445-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3284-336-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3608-385-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3608-371-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4584-292-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4692-351-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4836-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4912-384-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5364-405-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5384-510-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5404-480-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5624-485-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6088-195-0x0000000000010000-0x00000000000AB000-memory.dmp

Download