bf1ed959d8210fbd0a630920ee493a55c5cda54bec89565cd04992420f2db148

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 16:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 722KB
Sample260709-tzd5badv8m
SHA256 bf1ed959d8210fbd0a630920ee493a55c5cda54bec89565cd04992420f2db148
MD5 ca3e3367738f9be427e0eed7dd95db42
SHA1 7be576109ef9f849220d1b1a818ca855f9bbe51d
SHA512 751910dccbdfdde01bad1dcaa4b0d9c91b6023548bae68a950e3f358c5adf3bdb76a7ffedd05a1178c1dac08c165f358f150dacfc6b5812b72675c0ded9152ee
SSDEEP 12288:+flfAsiVGjSGecvXAflfAsiVGjSGecvX:6McfcMcf
TLSH
T144F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1592	gezwrpjhbztrmjec.exe
1284	gezwrpjhbztrmjec.sys
5888	CreateProcess.exe
5340	jhezwrmjez.exe
5812	CreateProcess.exe
3344	CreateProcess.exe
3904	i_jhezwrmjez.exe
2932	wuoljebwuo.sys
2544	CreateProcess.exe
5168	dbwtomgbzt.exe
5020	CreateProcess.exe
4540	CreateProcess.exe
4300	i_dbwtomgbzt.exe
1264	dbwtomgeyw.sys
3776	CreateProcess.exe
5048	bytqolgeyw.exe
2840	CreateProcess.exe
4620	CreateProcess.exe
5932	i_bytqolgeyw.exe
5248	aysqlidbvt.sys
1756	CreateProcess.exe
4816	bytqljdbvt.exe
2764	CreateProcess.exe
2532	CreateProcess.exe
1208	i_bytqljdbvt.exe
584	vqnlfdxvqn.sys
3964	CreateProcess.exe
4656	kifaysqnid.exe
5624	CreateProcess.exe
5496	CreateProcess.exe
5328	i_kifaysqnid.exe
5084	sqkicavsnk.sys
3668	CreateProcess.exe
5396	kfdxvpnhfa.exe
2720	CreateProcess.exe
1496	CreateProcess.exe
1188	i_kfdxvpnhfa.exe
5732	zxspkiczxs.sys
5932	CreateProcess.exe
5536	xvpnkicaxs.exe
2564	CreateProcess.exe
2004	CreateProcess.exe
3484	i_xvpnkicaxs.exe
4780	axrpjhfzxu.sys
3572	CreateProcess.exe
2376	zxrpjhfcxu.exe
5268	CreateProcess.exe
1244	CreateProcess.exe
1532	i_zxrpjhfcxu.exe
2020	ezxrpjhbzt.sys
4160	CreateProcess.exe
260	urpkebzurm.exe
4508	CreateProcess.exe
2464	CreateProcess.exe
2980	i_urpkebzurm.exe
2816	urpjhbztrp.sys
2136	CreateProcess.exe
1428	bywuomjdbz.exe
5260	CreateProcess.exe
2836	CreateProcess.exe
2640	i_bywuomjdbz.exe
3040	romgbywqoj.sys
4888	CreateProcess.exe
6124	rojgbytrlj.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3444_496505454\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3444_496505454\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3444_594134859\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3444_594134859\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3444_484559607\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3444_484559607\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3444_484559607\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3444_431664440\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3444_1283048512\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3444_1283048512\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3444_594134859\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3444_594134859\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3444_484559607\_metadata\verified_contents.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwtomgeztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbwtomgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqoigaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigaxvtqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvsqkicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspkhcausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrmkeczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urpkebzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icausnkfvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wurmjhbywu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kifaysqnid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqoigaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigaxvtqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrmkeczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhezwrmjez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbwtomgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kifaysqnid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bywuomjdbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gezwrpjhbztrmjec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnkicaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpjhfcxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvsqkicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfdxvpnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhezwrmjez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytqolgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bytqolgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urpkebzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojgbytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwtomgeztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnkicaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bywuomjdbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icausnkfvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspkhcausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wurmjhbywu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytqljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bytqljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfdxvpnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpjhfcxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojgbytrlj.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1612	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4888	ipconfig.exe
4516	ipconfig.exe
4452	ipconfig.exe
5048	ipconfig.exe
1708	ipconfig.exe
5540	ipconfig.exe
2104	ipconfig.exe
4208	ipconfig.exe
3792	ipconfig.exe
5324	ipconfig.exe
4516	ipconfig.exe
3544	ipconfig.exe
5820	ipconfig.exe
5452	ipconfig.exe
2876	ipconfig.exe
2132	ipconfig.exe
848	ipconfig.exe
5604	ipconfig.exe
3740	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3575702013-381963388-2545377694-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280881753728720"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3575702013-381963388-2545377694-1000\{BAFECF32-57F3-418A-A98A-6D28B1950DCF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1592	gezwrpjhbztrmjec.exe
1592	gezwrpjhbztrmjec.exe
1592	gezwrpjhbztrmjec.exe
1592	gezwrpjhbztrmjec.exe
1592	gezwrpjhbztrmjec.exe
1592	gezwrpjhbztrmjec.exe
1592	gezwrpjhbztrmjec.exe
1592	gezwrpjhbztrmjec.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3904	i_jhezwrmjez.exe
Token: SeDebugPrivilege	4300	i_dbwtomgbzt.exe
Token: SeDebugPrivilege	5932	i_bytqolgeyw.exe
Token: SeDebugPrivilege	1208	i_bytqljdbvt.exe
Token: SeDebugPrivilege	5328	i_kifaysqnid.exe
Token: SeDebugPrivilege	1188	i_kfdxvpnhfa.exe
Token: SeDebugPrivilege	3484	i_xvpnkicaxs.exe
Token: SeDebugPrivilege	1532	i_zxrpjhfcxu.exe
Token: SeDebugPrivilege	2980	i_urpkebzurm.exe
Token: SeDebugPrivilege	2640	i_bywuomjdbz.exe
Token: SeDebugPrivilege	5712	i_rojgbytrlj.exe
Token: SeDebugPrivilege	3856	i_yvqoigaytq.exe
Token: SeDebugPrivilege	2872	i_oigaxvtqli.exe
Token: SeDebugPrivilege	3880	i_xvsqkicavs.exe
Token: SeDebugPrivilege	1604	i_icausnkfvp.exe
Token: SeDebugPrivilege	4276	i_xspkhcausm.exe
Token: SeDebugPrivilege	5472	i_zxrmkeczus.exe
Token: SeDebugPrivilege	1972	i_wurmjhbywu.exe
Token: SeDebugPrivilege	4100	i_zwtomgeztr.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3444	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3708 wrote to memory of 1592	3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 3708 wrote to memory of 1696	3708	2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 1696 wrote to memory of 3444	1696	iexplore.exe	90
PID 3444 wrote to memory of 1232	3444	msedge.exe	91
PID 3444 wrote to memory of 1392	3444	msedge.exe	92
PID 3444 wrote to memory of 1612	3444	msedge.exe	94
PID 3444 wrote to memory of 1392	3444	msedge.exe	92
PID 3444 wrote to memory of 1392	3444	msedge.exe	92
PID 3444 wrote to memory of 2776	3444	msedge.exe	95
PID 3444 wrote to memory of 2776	3444	msedge.exe	95
PID 3444 wrote to memory of 3920	3444	msedge.exe	96
PID 3444 wrote to memory of 2524	3444	msedge.exe	97
PID 3444 wrote to memory of 3920	3444	msedge.exe	96
PID 3444 wrote to memory of 3920	3444	msedge.exe	96
PID 3444 wrote to memory of 2524	3444	msedge.exe	97
PID 3444 wrote to memory of 2524	3444	msedge.exe	97
PID 3444 wrote to memory of 5860	3444	msedge.exe	98
PID 3444 wrote to memory of 5860	3444	msedge.exe	98
PID 3444 wrote to memory of 5860	3444	msedge.exe	98
PID 3444 wrote to memory of 4492	3444	msedge.exe	99
PID 3444 wrote to memory of 4492	3444	msedge.exe	99
PID 3444 wrote to memory of 4492	3444	msedge.exe	99
PID 3444 wrote to memory of 3364	3444	msedge.exe	100
PID 3444 wrote to memory of 3364	3444	msedge.exe	100
PID 1592 wrote to memory of 5888	1592	gezwrpjhbztrmjec.exe	104
PID 5340 wrote to memory of 5812	5340	jhezwrmjez.exe	107
PID 3444 wrote to memory of 5372	3444	msedge.exe	110
PID 3444 wrote to memory of 604	3444	msedge.exe	111
PID 3444 wrote to memory of 5372	3444	msedge.exe	110
PID 3444 wrote to memory of 604	3444	msedge.exe	111
PID 3444 wrote to memory of 4288	3444	msedge.exe	113
PID 3444 wrote to memory of 5688	3444	msedge.exe	114
PID 3444 wrote to memory of 5688	3444	msedge.exe	114
PID 3444 wrote to memory of 1600	3444	msedge.exe	117
PID 3444 wrote to memory of 1600	3444	msedge.exe	117
PID 1592 wrote to memory of 3344	1592	gezwrpjhbztrmjec.exe	118
PID 1592 wrote to memory of 2544	1592	gezwrpjhbztrmjec.exe	122
PID 5168 wrote to memory of 5020	5168	dbwtomgbzt.exe	124
PID 1592 wrote to memory of 4540	1592	gezwrpjhbztrmjec.exe	127
PID 1592 wrote to memory of 3776	1592	gezwrpjhbztrmjec.exe	131
PID 5048 wrote to memory of 2840	5048	bytqolgeyw.exe	133
PID 1592 wrote to memory of 4620	1592	gezwrpjhbztrmjec.exe	136
PID 1592 wrote to memory of 1756	1592	gezwrpjhbztrmjec.exe	141
PID 4816 wrote to memory of 2764	4816	bytqljdbvt.exe	143
PID 1592 wrote to memory of 2532	1592	gezwrpjhbztrmjec.exe	146
PID 3444 wrote to memory of 4504	3444	msedge.exe	148
PID 3444 wrote to memory of 4180	3444	msedge.exe	149
PID 3444 wrote to memory of 2932	3444	msedge.exe	150
PID 1592 wrote to memory of 3964	1592	gezwrpjhbztrmjec.exe	153
PID 4656 wrote to memory of 5624	4656	kifaysqnid.exe	155
PID 1592 wrote to memory of 5496	1592	gezwrpjhbztrmjec.exe	158
PID 1592 wrote to memory of 3668	1592	gezwrpjhbztrmjec.exe	162
PID 5396 wrote to memory of 2720	5396	kfdxvpnhfa.exe	164
PID 1592 wrote to memory of 1496	1592	gezwrpjhbztrmjec.exe	167
PID 1592 wrote to memory of 5932	1592	gezwrpjhbztrmjec.exe	171
PID 5536 wrote to memory of 2564	5536	xvpnkicaxs.exe	173
PID 1592 wrote to memory of 2004	1592	gezwrpjhbztrmjec.exe	176
PID 1592 wrote to memory of 3572	1592	gezwrpjhbztrmjec.exe	180
PID 2376 wrote to memory of 5268	2376	zxrpjhfcxu.exe	182
PID 1592 wrote to memory of 1244	1592	gezwrpjhbztrmjec.exe	185
PID 3444 wrote to memory of 4180	3444	msedge.exe	187
PID 3444 wrote to memory of 4180	3444	msedge.exe	187
PID 1592 wrote to memory of 4160	1592	gezwrpjhbztrmjec.exe	193
PID 260 wrote to memory of 4508	260	urpkebzurm.exe	195

C:\Users\Admin\AppData\Local\Temp\2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_ca3e3367738f9be427e0eed7dd95db42_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Temp\gezwrpjhbztrmjec.exe
  C:\Temp\gezwrpjhbztrmjec.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1592
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhezwrmjez.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5888
  - - C:\Temp\jhezwrmjez.exe
      C:\Temp\jhezwrmjez.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5340
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5812
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5048
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhezwrmjez.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3344
  - - C:\Temp\i_jhezwrmjez.exe
      C:\Temp\i_jhezwrmjez.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3904
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbwtomgbzt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2544
  - - C:\Temp\dbwtomgbzt.exe
      C:\Temp\dbwtomgbzt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5168
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5020
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2132
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbwtomgbzt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4540
  - - C:\Temp\i_dbwtomgbzt.exe
      C:\Temp\i_dbwtomgbzt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4300
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bytqolgeyw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3776
  - - C:\Temp\bytqolgeyw.exe
      C:\Temp\bytqolgeyw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5048
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2840
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:848
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bytqolgeyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4620
  - - C:\Temp\i_bytqolgeyw.exe
      C:\Temp\i_bytqolgeyw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5932
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bytqljdbvt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1756
  - - C:\Temp\bytqljdbvt.exe
      C:\Temp\bytqljdbvt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4816
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2764
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4888
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bytqljdbvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2532
  - - C:\Temp\i_bytqljdbvt.exe
      C:\Temp\i_bytqljdbvt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1208
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kifaysqnid.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3964
  - - C:\Temp\kifaysqnid.exe
      C:\Temp\kifaysqnid.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4656
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5624
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kifaysqnid.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5496
  - - C:\Temp\i_kifaysqnid.exe
      C:\Temp\i_kifaysqnid.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5328
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kfdxvpnhfa.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3668
  - - C:\Temp\kfdxvpnhfa.exe
      C:\Temp\kfdxvpnhfa.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5396
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2720
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5604
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kfdxvpnhfa.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1496
  - - C:\Temp\i_kfdxvpnhfa.exe
      C:\Temp\i_kfdxvpnhfa.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1188
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvpnkicaxs.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5932
  - - C:\Temp\xvpnkicaxs.exe
      C:\Temp\xvpnkicaxs.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5536
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2564
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3792
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvpnkicaxs.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2004
  - - C:\Temp\i_xvpnkicaxs.exe
      C:\Temp\i_xvpnkicaxs.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3484
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxrpjhfcxu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3572
  - - C:\Temp\zxrpjhfcxu.exe
      C:\Temp\zxrpjhfcxu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2376
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5268
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxrpjhfcxu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1244
  - - C:\Temp\i_zxrpjhfcxu.exe
      C:\Temp\i_zxrpjhfcxu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1532
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urpkebzurm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4160
  - - C:\Temp\urpkebzurm.exe
      C:\Temp\urpkebzurm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:260
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4508
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2104
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urpkebzurm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2464
  - - C:\Temp\i_urpkebzurm.exe
      C:\Temp\i_urpkebzurm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2980
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bywuomjdbz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2136
  - - C:\Temp\bywuomjdbz.exe
      C:\Temp\bywuomjdbz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1428
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5260
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4208
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bywuomjdbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2836
  - - C:\Temp\i_bywuomjdbz.exe
      C:\Temp\i_bywuomjdbz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2640
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rojgbytrlj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4888
  - - C:\Temp\rojgbytrlj.exe
      C:\Temp\rojgbytrlj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6124
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1580
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2876
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rojgbytrlj.exe ups_ins
    3⤵
    PID:5744
  - - C:\Temp\i_rojgbytrlj.exe
      C:\Temp\i_rojgbytrlj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5712
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvqoigaytq.exe ups_run
    3⤵
    PID:2728
  - - C:\Temp\yvqoigaytq.exe
      C:\Temp\yvqoigaytq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:256
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4492
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4516
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvqoigaytq.exe ups_ins
    3⤵
    PID:3116
  - - C:\Temp\i_yvqoigaytq.exe
      C:\Temp\i_yvqoigaytq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oigaxvtqli.exe ups_run
    3⤵
    PID:3532
  - - C:\Temp\oigaxvtqli.exe
      C:\Temp\oigaxvtqli.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4124
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1432
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4452
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oigaxvtqli.exe ups_ins
    3⤵
    PID:2640
  - - C:\Temp\i_oigaxvtqli.exe
      C:\Temp\i_oigaxvtqli.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2872
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvsqkicavs.exe ups_run
    3⤵
    PID:5836
  - - C:\Temp\xvsqkicavs.exe
      C:\Temp\xvsqkicavs.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5192
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4660
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5324
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvsqkicavs.exe ups_ins
    3⤵
    PID:4080
  - - C:\Temp\i_xvsqkicavs.exe
      C:\Temp\i_xvsqkicavs.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3880
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\icausnkfvp.exe ups_run
    3⤵
    PID:292
  - - C:\Temp\icausnkfvp.exe
      C:\Temp\icausnkfvp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2952
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3032
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4516
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_icausnkfvp.exe ups_ins
    3⤵
    PID:3496
  - - C:\Temp\i_icausnkfvp.exe
      C:\Temp\i_icausnkfvp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1604
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xspkhcausm.exe ups_run
    3⤵
    PID:4724
  - - C:\Temp\xspkhcausm.exe
      C:\Temp\xspkhcausm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4084
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3696
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xspkhcausm.exe ups_ins
    3⤵
    PID:5916
  - - C:\Temp\i_xspkhcausm.exe
      C:\Temp\i_xspkhcausm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4276
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxrmkeczus.exe ups_run
    3⤵
    PID:4556
  - - C:\Temp\zxrmkeczus.exe
      C:\Temp\zxrmkeczus.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:612
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3052
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5820
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxrmkeczus.exe ups_ins
    3⤵
    PID:3604
  - - C:\Temp\i_zxrmkeczus.exe
      C:\Temp\i_zxrmkeczus.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5472
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wurmjhbywu.exe ups_run
    3⤵
    PID:396
  - - C:\Temp\wurmjhbywu.exe
      C:\Temp\wurmjhbywu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1772
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6088
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3740
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wurmjhbywu.exe ups_ins
    3⤵
    PID:3832
  - - C:\Temp\i_wurmjhbywu.exe
      C:\Temp\i_wurmjhbywu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1972
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwtomgeztr.exe ups_run
    3⤵
    PID:3352
  - - C:\Temp\zwtomgeztr.exe
      C:\Temp\zwtomgeztr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3576
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3724
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5452
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwtomgeztr.exe ups_ins
    3⤵
    PID:6112
  - - C:\Temp\i_zwtomgeztr.exe
      C:\Temp\i_zwtomgeztr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4100
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2cc,0x300,0x7ffadf17c188,0x7ffadf17c194,0x7ffadf17c1a0
      4⤵
      PID:1232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,11332707681254889418,4512070693703716239,262144 --field-trial-handle=2352,i,16673046953017321958,13721703869209889776,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
      4⤵
      PID:1392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,13308508738571186359,12166339442428396,524288 --field-trial-handle=2352,i,16673046953017321958,13721703869209889776,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:11
      4⤵
      System Time Discovery
      PID:1612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2436,i,8514130453971847428,2765098851582303817,524288 --field-trial-handle=2352,i,16673046953017321958,13721703869209889776,262144 --variations-seed-version --mojo-platform-channel-handle=3208 /prefetch:13
      4⤵
      PID:2776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,11844835166221054323,15675092186242693386,2097152 --field-trial-handle=2352,i,16673046953017321958,13721703869209889776,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
      4⤵
      PID:3920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,17057392481022682713,17459164940401849899,2097152 --field-trial-handle=2352,i,16673046953017321958,13721703869209889776,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
      4⤵
      PID:2524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,12187076108423302512,10391330185284365731,2097152 --field-trial-handle=2352,i,16673046953017321958,13721703869209889776,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:1
      4⤵
      PID:5860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,13268662044274395824,3844372560861597729,2097152 --field-trial-handle=2352,i,16673046953017321958,13721703869209889776,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:9
      4⤵
      PID:4492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,13346283899495857859,14548702515118192393,524288 --field-trial-handle=2352,i,16673046953017321958,13721703869209889776,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:14
      4⤵
      PID:3364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,3082623614248900451,11499215109025045591,524288 --field-trial-handle=2352,i,16673046953017321958,13721703869209889776,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
      4⤵
      PID:5372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,3393137345299100529,9287755884977690753,524288 --field-trial-handle=2352,i,16673046953017321958,13721703869209889776,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
      4⤵
      PID:604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,6024579878626855371,17568258713939839055,524288 --field-trial-handle=2352,i,16673046953017321958,13721703869209889776,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
      4⤵
      PID:1660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,6024579878626855371,17568258713939839055,524288 --field-trial-handle=2352,i,16673046953017321958,13721703869209889776,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
      4⤵
      PID:4288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,3543435351949201156,4693280005735511184,524288 --field-trial-handle=2352,i,16673046953017321958,13721703869209889776,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
      4⤵
      PID:5688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,4891999886426001455,9903184783865644298,524288 --field-trial-handle=2352,i,16673046953017321958,13721703869209889776,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
      4⤵
      PID:1600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,720093838534404145,5092057758157951384,524288 --field-trial-handle=2352,i,16673046953017321958,13721703869209889776,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:14
      4⤵
      PID:4504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,4860253082215509674,9581217054515154123,524288 --field-trial-handle=2352,i,16673046953017321958,13721703869209889776,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:14
      4⤵
      PID:4180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,8272891355529830180,11305691779163713521,524288 --field-trial-handle=2352,i,16673046953017321958,13721703869209889776,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:14
      4⤵
      PID:2932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,14756419380903158700,3354839951890230135,524288 --field-trial-handle=2352,i,16673046953017321958,13721703869209889776,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
      4⤵
      PID:4180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,15050176481360795971,4297844122796583376,524288 --field-trial-handle=2352,i,16673046953017321958,13721703869209889776,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:14
      4⤵
      PID:1176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,4353061046360411758,12843415619344290982,524288 --field-trial-handle=2352,i,16673046953017321958,13721703869209889776,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:14
      4⤵
      PID:5552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,10145846297011260525,5298060415005136258,524288 --field-trial-handle=2352,i,16673046953017321958,13721703869209889776,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:14
      4⤵
      PID:4320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6060,i,9081763256528966832,153403582590345330,262144 --field-trial-handle=2352,i,16673046953017321958,13721703869209889776,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:10
      4⤵
      PID:4612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6732,i,14094294252525328660,8068138158772658838,524288 --field-trial-handle=2352,i,16673046953017321958,13721703869209889776,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
      4⤵
      PID:3916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,7747836284640288059,6927213610879959148,524288 --field-trial-handle=2352,i,16673046953017321958,13721703869209889776,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:14
      4⤵
      PID:1532

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1248

C:\Temp\gezwrpjhbztrmjec.sys
C:\Temp\gezwrpjhbztrmjec.sys
1⤵
- Executes dropped EXE
PID:1284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1432

C:\Temp\wuoljebwuo.sys
C:\Temp\wuoljebwuo.sys
1⤵
- Executes dropped EXE
PID:2932

C:\Temp\dbwtomgeyw.sys
C:\Temp\dbwtomgeyw.sys
1⤵
- Executes dropped EXE
PID:1264

C:\Temp\aysqlidbvt.sys
C:\Temp\aysqlidbvt.sys
1⤵
- Executes dropped EXE
PID:5248

C:\Temp\vqnlfdxvqn.sys
C:\Temp\vqnlfdxvqn.sys
1⤵
- Executes dropped EXE
PID:584

C:\Temp\sqkicavsnk.sys
C:\Temp\sqkicavsnk.sys
1⤵
- Executes dropped EXE
PID:5084

C:\Temp\zxspkiczxs.sys
C:\Temp\zxspkiczxs.sys
1⤵
- Executes dropped EXE
PID:5732

C:\Temp\axrpjhfzxu.sys
C:\Temp\axrpjhfzxu.sys
1⤵
- Executes dropped EXE
PID:4780

C:\Temp\ezxrpjhbzt.sys
C:\Temp\ezxrpjhbzt.sys
1⤵
- Executes dropped EXE
PID:2020

C:\Temp\urpjhbztrp.sys
C:\Temp\urpjhbztrp.sys
1⤵
- Executes dropped EXE
PID:2816

C:\Temp\romgbywqoj.sys
C:\Temp\romgbywqoj.sys
1⤵
- Executes dropped EXE
PID:3040

C:\Temp\bywqoigdyt.sys
C:\Temp\bywqoigdyt.sys
1⤵
PID:1448

C:\Temp\vqnigaysqk.sys
C:\Temp\vqnigaysqk.sys
1⤵
PID:5116

C:\Temp\nifdavsqca.sys
C:\Temp\nifdavsqca.sys
1⤵
PID:5620

C:\Temp\caysqkicau.sys
C:\Temp\caysqkicau.sys
1⤵
PID:3340

C:\Temp\xrpnkfczxr.sys
C:\Temp\xrpnkfczxr.sys
1⤵
PID:1924

C:\Temp\zxrpjhbzxr.sys
C:\Temp\zxrpjhbzxr.sys
1⤵
PID:4824

C:\Temp\hbzurpjhcz.sys
C:\Temp\hbzurpjhcz.sys
1⤵
PID:5620

C:\Temp\wtrojgeywu.sys
C:\Temp\wtrojgeywu.sys
1⤵
PID:1848

C:\Temp\bwqolgeywq.sys
C:\Temp\bwqolgeywq.sys
1⤵
PID:3856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aysqlidbvt.sys

Path C:\Temp\aysqlidbvt.sys
Size 293KB
SHA256 378decd4b7e7c19e4da1b0a2f41af6cdf0a61d837c364ac4519665b191411857
MD5 ec3d81ed01734d6b63839a38602c5389
SHA1 a2fab12bdd9e60a373cfd74b88620021682cdc44
SHA512 1f7c9c51e06a894e39eb1c653e5aa6721767d8f9cba8bcaea6469650152d9e109ed52822590915b69be4e2183872e1ffa0717a06f40c64e671c15ec35f37793d
SSDEEP 3072:ktKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:kIJjiJcbI03GBc3ucY5DCSj
TLSH
T182545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bytqljdbvt.exe

Path C:\Temp\bytqljdbvt.exe
Size 722KB
SHA256 756de559bcdd0b898447772adabe97a0c2a03a047f56d944d9f4937283c2b829
MD5 3fdb6f890caccd4343be9b05845df41c
SHA1 87c8de3caf12a2b855c92933586da763b1d9ffca
SHA512 f3c0f2147df6e9d0cb23047be5245d6f96fe2fd4d5dc2d5ed75843534df786e4552e615f3e8d32bfa6d6853693b8400d4e764360eefae9f4fe063127647a0fd6
SSDEEP 12288:2flfAsiVGjSGecvXAflfAsiVGjSGecvX:iMcfcMcf
TLSH
T133F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bytqolgeyw.exe

Path C:\Temp\bytqolgeyw.exe
Size 722KB
SHA256 448af22db3dbd3708e71b6a5f4545860e5ab905dda03b1ce595f25f5526d48f6
MD5 85d6353c0516329bde65643bc3c8a68f
SHA1 5f0b251fff1b463a481bbb1bcc5dcb182a8ff88d
SHA512 d6222021e51d2ac287ae406ea310dacb8e50fbe6b4bba06c0e645f8f63e270489681f2dbc9b989eabd7a95625779cd14d86d7e7287b5b28a5b9561983cb497bf
SSDEEP 12288:JflfAsiVGjSGecvXAflfAsiVGjSGecvX:BMcfcMcf
TLSH
T14DF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbwtomgbzt.exe

Path C:\Temp\dbwtomgbzt.exe
Size 722KB
SHA256 ab2d0acd44c9e9d4465b5258d20291f03e3f011a8613715cf16f993f7138af76
MD5 cdf6e81d6d10c8c6b6c83908cd9f4090
SHA1 20aef932fef2cf77206ceebe62b62e8a1d98e151
SHA512 44566203aa5a621d950aefef5f0c6fcfc8ae67e4ba9b7dc056c17cdbb8dadda319850465f9790b77990ba08cfc9e1b7c54b6d3030e2c012c09ae31014d4e58a1
SSDEEP 12288:oflfAsiVGjSGecvXAflfAsiVGjSGecvX:0McfcMcf
TLSH
T137F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbwtomgeyw.sys

Path C:\Temp\dbwtomgeyw.sys
Size 293KB
SHA256 5b8c171aab63c99bc8aa829df3024af9fb7a1ab94d7f779e9f22f7f12586c50d
MD5 813891016ad6ab74f388271c818b6c9a
SHA1 9809aeaf50cbab8aa3aaed89ef71700558e71eee
SHA512 92c23db15d711135cb63c2f1097b2dfcea20f3f5b19eebdf7f7a556598aa85c82de172ad0fd53432b9aa9a0f3c510db2cae215bbe0178e041de7b39a467b5dc6
SSDEEP 3072:utKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:uIJjiJcbI03GBc3ucY5DCSj
TLSH
T17B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gezwrpjhbztrmjec.exe

Path C:\Temp\gezwrpjhbztrmjec.exe
Size 722KB
SHA256 9677724934b06b65e99dcb7a5a77f13ed79c4248933e349c2a6fd95d62f66b10
MD5 31a0439cd0b9f74cfb0014299274d982
SHA1 88122eee19e460c7862617cacdb00e4e7296ce45
SHA512 0c989959dffc6196043a131678821a4a63011a3269c1f38e45a9dff23b3be20352267eb2e3334d06632378f40e015bf497b67841cc8c01a029be65397e153271
SSDEEP 12288:JflfAsiVGjSGecvXAflfAsiVGjSGecvX:BMcfcMcf
TLSH
T172F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gezwrpjhbztrmjec.sys

Path C:\Temp\gezwrpjhbztrmjec.sys
Size 293KB
SHA256 aab1dc02c31b716c03cdd42c45cb8248abb8615473ca8934fecb81f37672268a
MD5 bfd96287aecfdbb87a451b7c7ec98ad2
SHA1 69129f233cf12024e630f3f1578ece06a385f4b2
SHA512 4a3812b0d77f7c8b5f385eaaf37ae45f636cbeb16112e6b87ba344aff4ef3491a6d0d85eeef6f345874e211892db8f3e05bc462ad81477e06b8a3b63d4703918
SSDEEP 3072:UtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:UIJjiJcbI03GBc3ucY5DCSj
TLSH
T125545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bytqljdbvt.exe

Path C:\Temp\i_bytqljdbvt.exe
Size 722KB
SHA256 9494fbb1d598f417c034661577e495f501c2d70a71ac54841d98e8aca91576bf
MD5 957cb392b2ceec3bcccf2ffaca7b6b65
SHA1 e7e3889377807ad649547a23f8bf4ada78f01ded
SHA512 d178eb3c04fc7cd4e2bcf5cb2f1eb531f94fbae0ba37c2cb35e5d1880ce4539df8327932048fb49512b036c88815cca8566106ef3e7dfde0f9b6a5ce6ecdb533
SSDEEP 12288:lflfAsiVGjSGecvXAflfAsiVGjSGecvX:tMcfcMcf
TLSH
T17EF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bytqolgeyw.exe

Path C:\Temp\i_bytqolgeyw.exe
Size 722KB
SHA256 caf5917f6b8cf38f054dde9c2d314754d03e6171c5760363f7797c70751d98ae
MD5 1f015c87e5ccadb0cfa28d6d136f1fc3
SHA1 6c535471e4071a38ddad0ba172bf01fe7a90fda2
SHA512 b0fe1f9c5bcd40ac04639941233d9bbfecee58d60290523e5f0249ae0cd4c6ac59806ce35e3b05e113ce370c559f7171eba70a9034086affb8106be1ca5b6e63
SSDEEP 12288:LflfAsiVGjSGecvXAflfAsiVGjSGecvX:DMcfcMcf
TLSH
T13DF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbwtomgbzt.exe

Path C:\Temp\i_dbwtomgbzt.exe
Size 722KB
SHA256 46bdf78f00129a91335faa99de89375f969db2716ac37f10fcb07b5818e0c53c
MD5 69c278fff9800119207604ccf9168df0
SHA1 87836398aaa378e78d6cc255b312a8ef79bd827e
SHA512 3f86daec81e05d42e7179250beffbef6ea74b4bf18338c78fa15598174a6db570a96f45ea0e36d905a342ce22ac8f9232bd212665c99aed8d83db84bae94ac09
SSDEEP 12288:XflfAsiVGjSGecvXAflfAsiVGjSGecvX:vMcfcMcf
TLSH
T15BF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jhezwrmjez.exe

Path C:\Temp\i_jhezwrmjez.exe
Size 722KB
SHA256 ad94168be37fd35d8dad2fb7748fc5605a6935929640288186980386391ab86e
MD5 6e6589d6910c52c9f62a29ec1c545153
SHA1 fe8192a3bbbe58f3fd4b2022e5a0ff73cbad97ab
SHA512 1b537510a90e8eded307cab0b14c9725425429957eb0390c974962b06cfde33282f22191c57e50d1a4b5e055bc13dec0ccaa1604b5d9aa05e7c36399dec65904
SSDEEP 12288:2flfAsiVGjSGecvXAflfAsiVGjSGecvX:iMcfcMcf
TLSH
T122F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kifaysqnid.exe

Path C:\Temp\i_kifaysqnid.exe
Size 722KB
SHA256 3e06d2c78e5d946e33f8672bb4bc543241792b05b138035e5bc533c31230168e
MD5 7c81056a23614849c7b86d37f8b29f8f
SHA1 de60af84bcdf899b2dea0ee53a25c2abea3548f0
SHA512 175160739f2d78b3e33d7f336c38d8709164da0ce323f8f84b4da0b8b723836c6a24aa1bfeea07daa9aebf9ba0a5e0642bea770b1568499f963d76a937427b5e
SSDEEP 12288:UflfAsiVGjSGecvXAflfAsiVGjSGecvX:QMcfcMcf
TLSH
T14CF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhezwrmjez.exe

Path C:\Temp\jhezwrmjez.exe
Size 722KB
SHA256 1842037c6870633b134c94b82cf405f5288ede12f54b6cea9dc790482662daeb
MD5 9d096ee48db1d57412a08f7cc9b3d804
SHA1 d6298d18065e0016a7815728a9e214faa1fddd03
SHA512 f6613ad105c04b4ad742be0c3a43f111ef408cd754a10546315cc7f84ef01b65db0636ae6a90172849a72717451e6fa870f7fb7d856c659f29cd04e57f1ea9d3
SSDEEP 12288:pflfAsiVGjSGecvXAflfAsiVGjSGecvX:hMcfcMcf
TLSH
T187F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfdxvpnhfa.exe

Path C:\Temp\kfdxvpnhfa.exe
Size 722KB
SHA256 4f37b7725fddfd88ec575b10b72dc8281ad055e0fd150342f23d397072fc3e61
MD5 607d88a5e0f3b1f9b0738a58d685ddcb
SHA1 4ebf037f95d2c55541d46af68632567626128c94
SHA512 a61ba661fdcd438278de53a38facecb867ba74af843724cc1a5960d79924e537f7b5911db94b0d3d668acd87ec4c86bcf0ec243bfd917826a2ddf3a70101a7c6
SSDEEP 12288:MflfAsiVGjSGecvXAflfAsiVGjSGecvX:YMcfcMcf
TLSH
T1ADF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kifaysqnid.exe

Path C:\Temp\kifaysqnid.exe
Size 722KB
SHA256 d0621edac4cc42dab423e9e3717204a34f48c43db1d01d65a2a7419e44fe1539
MD5 74f15ec2fcdc7e222823977cd4677d8a
SHA1 2657b4531d880f3c6f300bcfeeab95019f86ed1d
SHA512 5d4a265b88dac31975bfa596a0fe1122128f3b557b0397c61dd3ed7291d451ce34c99d1be18f8ec848fa31e34b33f77b2be7576c2dd53174c5ab62d26e420c59
SSDEEP 12288:WflfAsiVGjSGecvXAflfAsiVGjSGecvX:CMcfcMcf
TLSH
T157F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkicavsnk.sys

Path C:\Temp\sqkicavsnk.sys
Size 293KB
SHA256 f5e36f96b9144db123b9c32bdd7dac53fef04d3aa7cb1192e44fec33977f8a13
MD5 16aef16f5d25b2ff7b8adcd017222240
SHA1 48045cc292029a951ce68bd99a1920b1034bb7e2
SHA512 a99e86396d2070e76339fc94344fdd1dd4d7afcb0350e1a1bd462f6a962897ef6dbd9d544ccfd48ff431add9eb3a6523f19ae28457c077346eac4e41cbe30d5b
SSDEEP 3072:PtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:PIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A9545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqnlfdxvqn.sys

Path C:\Temp\vqnlfdxvqn.sys
Size 293KB
SHA256 c8b8395ce9bdd914a85ea8d7ad21027f3fa704329f10b6ab2d005e82b627ebb9
MD5 4ccc79fc81e35dde03d13c0b20abcdb9
SHA1 e013ce10fe045d6cf2fdfd39696fb5b4a8b4e64e
SHA512 5d5c6fc14a035dbadefa93f26e3b8c5396d2168d1be176d28769e56730fa7e6a2c27c563e75bf0a3d6e9cad5667fc997b7e833ca41566947dde5ca596a73937d
SSDEEP 3072:btKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:bIJjiJcbI03GBc3ucY5DCSj
TLSH
T193545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuoljebwuo.sys

Path C:\Temp\wuoljebwuo.sys
Size 293KB
SHA256 863470458dc92c3318537629bf6ab9e0a16ae6d345ae0cf672120ba04afafbf6
MD5 43987027365fa497f50484cfd53b4a4f
SHA1 3f0639127750c8ad777b7363dca915b25fddc33f
SHA512 001d3250a2a935e1c098417812e947b30b071baefefe662e7fd15adfc1693b14cd6c9ef0fd6e520cf2f533409665e6d8e2d40a15068c1b87b80f5abc5653a2e0
SSDEEP 3072:RtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:RIJjiJcbI03GBc3ucY5DCSj
TLSH
T16F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fff4f5462f00db2197bad3d5dba44e0ed82332400e95ccd8e5aacbd03ea21ee9
MD5 5de064ddd4c36dfd1714ea6c60646443
SHA1 48976457417008f63c629290b82b7fcabfe4a7d6
SHA512 7cceae45d0afd44ac6288bfcc0bb9265585ec202aeed97194d26f5a717e32b99e16c516c465e3a99e12146fb39abc1e5707717e4ab27a4263928a6eadc9da500
TLSH
T1D6D09B747671D508DB40267265E55767F2015D35541D010C4041F17948557D106574AB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5373dba236158f8b47a5d7b664d171a8c47fe1fccd7b9ce0e1bd4afa2951d836
MD5 94a2023674c565156f1a36186c104810
SHA1 86e289a50e37125a5f15b949883b1e7188e31934
SHA512 d74a13f710bdf2137189f88217902762a3207a2efa776e19c74d44824ac997d398c4d0995f1b45894fe98d29700bf2a4ab26ab89b59bd32b83e714bdb7d03691
TLSH
T115D09B747661D508DB40267265E55767F2115D35681D010C4041F16948557D106574BF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4b48b516bc698126daf2ec207efe5aebf397622bb38014c29f225c1e94d91d9b
MD5 c1b086ec7762036077d36df45019f972
SHA1 b10df5c21bcf60526ee8b382f4b6de5cef2f7ff0
SHA512 5c16fea7aa3c91a55891e7d60b04ba48f7f8bafed9d4538c6a88f26df6a027b18b376d686925be0bf39ce6dcb98d3e239fc74ae458cf0cf4e0d56797b81c24c5
TLSH
T1EE615D2423FB0FD1FBE54DB7D3E1B04939786676C2C71E511088953118B2BBCA7D2825
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5984c6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5984c6.TMP
Size 3KB
SHA256 925faf11b8f89e09c970d43ca5844d1bb16582a828d6d58fb31f9764ba6f8e57
MD5 0ecfe8193edfc1f4bec01899f2c648e1
SHA1 b28231f4bac9c5694b5e5fd88ecb296730cdb5c5
SHA512 fdcdbadc6d60162982ef7deec1918995ae44368ba56e35f7d69edf74705d373940cd9c91bc8cac7d4867e957224c2dd373451c6b1668a452ef49675a3f1d0722
TLSH
T193615C2423FB0FD1FBE54DB3D3E1B049393866B6C2C71E110098993118B2BBCA7D2425
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ead8cf57d4e5ce4cb35e76c02a3a15e0e2d6ead7ccc47db0ebe97adfa65d62c3
MD5 4737905c7a9b94df6d7f538c53107a6e
SHA1 a24a5ec2e538dcec4adede668342f4576dcbd489
SHA512 65f519e166ccf0d8884b7d397f43bc3d78281ae376cac2d29e2714cb3eee2e63d246650ef3e0407a05cb4a40e77401e7d0900d1d0a19f25f75eebbb40af7a911
TLSH
T14941C0F3C3E8866E8A1156F0FA186F1BCE1D0915432C3D9AC9E4AE1B93E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 0c55b4b0e91b549d965ed16b3d0e9b3c325d63fc6bac20cf448135cdf141622d
MD5 799b6b7618a8ca61445d94194ff55e9b
SHA1 f6fd9c54512288304a03390ed23d0c977a318b61
SHA512 664cf58088d77afa052070c09e45142a6e7e86685d347b78e6d96b8d874415a1cf22b44d8c2d45c0c06c224457ae8ded42cabcbba13e2a06a110db7a54163eb0
SSDEEP 192:sxRCRxyM/jK1Ml8wCD/f6sGx6eTZkS0cTzoA8pi/g6+WNIYPJ7tiTGjQ8OaIgtJ:sxRC58D/f6sGxfdci/5IWJNf3
TLSH
T1CD52DA156A24993B8CDBD20DFA557F53D6F81563A2901E04AAFCDB0C05E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 9f9506ddee9480b2b62ffc5f79629bd298e561d24864bedf6d30cec264e67274
MD5 2e4a7572bdfaac9795c972248d42c0c8
SHA1 54139f0c571fa1123e983572c067043c66731540
SHA512 86f959c576320c4d886c3e5d6cf4680ed63e63a287195bfbb3bf983ed881bdc8199fe2344968cb80f48cfed0ea808f6bbe48673c1e6518a173bc05c124c91e70
SSDEEP 192:sxR5RxyM/jK1Ml8wCD/f6srx6eTZkS0YTzoA8p9B/g6+WNC8K/YPT7tiTGjQ8Oah:sxR578D/f6srxfd0T/5k/4JNfh
TLSH
T14462D916AA249D3B8CDBD209FA517F53D6F81563E2901E449AFCDB0C05E7AED211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d878987a7347033d48263d4c6329e589bbc8732483c49bad85400b8335197621
MD5 2c21338370d92e49c22cb6e6d4d480ae
SHA1 8398570d7f4df1274956acd15085838143306e38
SHA512 5fcca444d65b5a359173f992682fcf518d88d1fa22d0b616382ddea9ae73d19e5862cc3518ad5f33f670ba65bbb8c23a275f2fd222f950e224bea9990c986d84
SSDEEP 192:sxR5RxyM/jK1Ml8UQRCD/f6srx69TZkS0YTzoA8prB/g6+WNC8K/YPN7tiTGjQ81:sxR57qID/f6srxEd0F/5k/AJNfv
TLSH
T17E62D916AA249D3B8CD7D20DFA517F53D6F85563A2901E04AAFCCB0C05E7ADD211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 2081a924bc82c05dde123dd7f03d5ad82d7ad3acc373c34db7b5b4dd9716e573
MD5 2c1eafab71afaddb873f2683f509650f
SHA1 6b6a5ac60dc139f8c7ee41d0a19896165a7b2a63
SHA512 6684dd7f965435b0262f53cb1b026d45d4b2bf08c1618de91fd9c50ecaa27aa3ebba9f827d9fe1fd6c8aeb3c98bfb262cc29f9eba731a3a160b92f996770cbba
SSDEEP 768:+Pw4HY7pLuL7QBWg5tf+T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaQcUx29rotww:+Pw4HEE7QBWg5tf+Tu1jaJQcW22h
TLSH
T1B2E2EC3B680CCB7E4F404A9CEC29BD8AADE801CF56D8C95447FE881C03C66EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a204b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a204b.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 9c8343e6ab6e8e5bf57a0fa62fe21be7bbb93f07631fafa08c0b0bf7457b2ef8
MD5 7470f233988205325c9c88de9dbeaf2f
SHA1 f34fe491b0576ffa0c4d18e3e90c7e19827e2d3a
SHA512 1476113ea1fda35553a4c73ec8fc86aa176e76f656f65c0752e29141cf9186d10661f48641a3d3b58697dde9d3f8931435a7438c54c7c004d3e46a94b618ff4d
SSDEEP 768:Yrv+4UNbd43uCEYLEcuyvKweY5PWu3N+pmmwUigCI:YbsbW3uqBua4e/xU53
TLSH
T1A103C033E8A4D9778CE7A291F24BB693BFB81153D2840B98C5E82B0D475B45D2307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 ba40fca5b5490dfc95e1bf7eaa24a6f0975c13ac7bb011e57c23b58b43f45675
MD5 d23b82e75affee2ed824a340cf1579e6
SHA1 ba570cdb233495ac356d3d4bb41fa6168ce49ef8
SHA512 59df5d09527a76dd57c7b7fce797f85ceec8bcd2cfdd381071f0f61c6e5b5d460c88411b21f9de6fbf5f0810f77aad1dd84fe11f0ce196367a6bd4125938bc0f
SSDEEP 768:vj+9X3ofcYLqkcuyvKweY5PWu3N+pyYb9My:C9X3onqhua4e/2b+y
TLSH
T18CF2BF31A8A2CD778CEBA395F25B37D6AFF81167C6840F48D2E86F0D064369C174681B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a717c93a1f7c00dc41dcdca3397c7182893709141119c5f3bef4a9c4113a52d3
MD5 b7697c5e303d9b737fd572e1c82d5f38
SHA1 9da788f5b0f802fc099316d428ae8656e4176406
SHA512 d905d536a6d43a3b4582281c8de806161785f9903a30823cdbf2ed7c47d0cb40bfd8b845ee406d024411cdba5825c787f22134c8a0172c1b04b41663ee33b1b0
SSDEEP 768:Qj+9X3TzcYLqycuyvKweY5PWu3N+pyYb9My:v9X3TTqvua4e/2b+y
TLSH
T184F2AE31A8A2DD778CDB9295F25737D6AFF81167C6840F48D2E86F0D0A4369C2B4681B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 794e74a5df7ad666d800f2d08cfa0d6d42ab037df6264bd4b4492486822e2642
MD5 e7d1ca502c720c425fcb96d3b49d3eb7
SHA1 1139868e0976a6254bd4eb8d0e4e4355cfb5afec
SHA512 c2939d84912c7eef4c1b845456bb96b9ed6f94a83e4e52cc48cf1fe4abd9a6f30d8cd9560c805ce8e40972eeebcb5c815e5d97dabb49583944a09f4699eee459
SSDEEP 768:Uj+9X3IzcYLqycuyvKweY5PWu3N+pyYb9My:D9X3ITqvua4e/2b+y
TLSH
T1FBF2AF31ACA2DD778CEB9295F25B37D6AFF81167C6840F48D2E86F0D064365C274681B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 991c21d671ebeb76ce43e148f94e6e9e386c3734ce0ce388ad0894e4356d400f
MD5 8291681b4ba2cb13a0fb28cefbafff1d
SHA1 ab31cdbc42de11da54d7b161c489685821b72f31
SHA512 5b1115bd091c18a882cbeadbd1b2049f315e64b9af51abb5adbcb2293f304fd335979fcdac21349f5581441885c57ce3e8eaaf6799ed748704db0c35bd955bc2
SSDEEP 768:Gj+9X3I7cYLqKcuyvKweY5PWu3N+pyYb9My:V9X3IbqXua4e/2b+y
TLSH
T188F2AF31A8A2DD778CEB9295F25B37D6AFF81167C6840F48D2E86F0D0A4365C274681A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 3c395250d70b43eb7f49ce115c60044c8db0fb49cc7a2e1576f840346492de20
MD5 b1089be4a1a3c975ec2f851fcd9a6f3f
SHA1 c77b350f64dbe2eea21de117388fd86db06d8c96
SHA512 3bedc7ff930de53d6b8652fd5be0501616f3bf9e84322e14ed268d5fa2c39c4eec224cd4b789802ab8c3a88a88643e4b2151681a7199b16cffc18152e47e39f0
SSDEEP 768:FFKj+9/33wgbvj7qUcuyvKweY5PWu3N+pyYb9My:99/3ZXqxua4e/2b+y
TLSH
T1EF1328F298D38A36D89E5793A33E6E869EFCC163B5884984F7D41D0CCD421BFD606815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3444_53903374\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 b2ccfb3d462f945007dfd3d1799031edfc3413441f55b08d47f5b5b0a541c348
MD5 7beae1c1c4f7d60c129d1c6452ea7de9
SHA1 22e291509aa4c01b406e11a492a7b4c59a88beb6
SHA512 12cd77821761bb893c04a016643e0b79458803c43a1908d2a10ad4c737e5be7b140a73e2ae6026d6a525115649a709a2cf52649ae7df52a80e4bc4e9d44afb46
TLSH
T18271008357B9C9F3C1EB5BF502835244F5BB22384B2320350B659546AA34A7A28B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/584-320-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/584-290-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1264-242-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1284-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1448-429-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1848-514-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1924-464-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2020-348-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2816-356-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2932-195-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3040-381-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3340-444-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3856-518-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4780-333-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4824-482-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5084-303-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5116-428-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5248-270-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5620-440-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5620-486-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5732-329-0x0000000000010000-0x00000000000AB000-memory.dmp

Download