0a0c5b29c01788e8d11a4258314995c57d1e3af12f23633792372fd9b0af3ab3

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 17:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 722KB
Sample260709-vxwf9aev8k
SHA256 0a0c5b29c01788e8d11a4258314995c57d1e3af12f23633792372fd9b0af3ab3
MD5 5fe8712c2a3a1722679b67891c44c51a
SHA1 34a22e6350da2c03335cf068866fc27575684406
SHA512 bb25d4964ebe2e3535d8ed95e8e3fbb55f68b79a4d171e6f69d522415fe366e258481d088d82d5f3c084aed5c86696b3677682ac79850acef5a39eb0d8d9dc83
SSDEEP 12288:gflfAsiVGjSGecvXAflfAsiVGjSGecvX:8McfcMcf
TLSH
T19AF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
5588	wuomhezwrpjhczur.exe
3372	wuomhezwrpjhczur.sys
5788	CreateProcess.exe
2044	wuomgeywro.exe
4892	CreateProcess.exe
2296	CreateProcess.exe
2376	i_wuomgeywro.exe
5816	jbytrljdbw.sys
1496	CreateProcess.exe
5360	wtrljebwto.exe
3392	CreateProcess.exe
3252	CreateProcess.exe
4792	i_wtrljebwto.exe
4796	vtgdyvqoig.sys
3260	CreateProcess.exe
4724	gaywqoigby.exe
5716	CreateProcess.exe
2860	CreateProcess.exe
672	i_gaywqoigby.exe
5516	gaytqljdbv.sys
772	CreateProcess.exe
3568	nigaysqnig.exe
3628	CreateProcess.exe
1080	CreateProcess.exe
2308	i_nigaysqnig.exe
6096	nicavsnlid.sys
3888	CreateProcess.exe
3484	cavsnlfdav.exe
2928	CreateProcess.exe
3780	CreateProcess.exe
2060	i_cavsnlfdav.exe
4196	hcausnkfdx.sys
2444	CreateProcess.exe
5388	xspkicausm.exe
3060	CreateProcess.exe
2272	CreateProcess.exe
5532	i_xspkicausm.exe
1776	hczusmkecw.sys
5112	CreateProcess.exe
5836	xupkhfzxrp.exe
5976	CreateProcess.exe
2672	CreateProcess.exe
3444	i_xupkhfzxrp.exe
4524	urmkecwupm.sys
4712	CreateProcess.exe
3180	cwuomgezxr.exe
2368	CreateProcess.exe
3056	CreateProcess.exe
2576	i_cwuomgezxr.exe
5188	mhbzxrojge.sys
6100	CreateProcess.exe
5644	ecztjebwuo.exe
5300	CreateProcess.exe
5632	CreateProcess.exe
2228	i_ecztjebwuo.exe
4660	omgeywqojg.sys
3440	CreateProcess.exe
3240	geywqojgeb.exe
2432	CreateProcess.exe
1424	CreateProcess.exe
5992	i_geywqojgeb.exe
4264	ljdbvtolgd.sys
1584	CreateProcess.exe
5156	ljdbvqoigb.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2884_969611262\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2884_1717157392\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2884_1406739459\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2884_1406739459\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2884_1406739459\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2884_1717157392\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2884_200554946\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2884_200554946\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2884_1406739459\office_endpoints_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdbvtolgez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspkicausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrpjhbztrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljebwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nigaysqnig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xupkhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrpjhbztrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nigaysqnig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfzxspkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaywqoigby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecztjebwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecztjebwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idavtnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfzxspkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdbvtolgez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomhezwrpjhczur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtrljebwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaywqoigby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkicavsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkfcaxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtrljebwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwuomgezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurpmheczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurpmheczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xupkhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwuomgezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywqojgeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idavtnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkicavsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljebwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cavsnlfdav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cavsnlfdav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspkicausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywqojgeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkfcaxsqk.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3536	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5656	ipconfig.exe
4392	ipconfig.exe
1940	ipconfig.exe
3896	ipconfig.exe
1252	ipconfig.exe
4424	ipconfig.exe
716	ipconfig.exe
4992	ipconfig.exe
4264	ipconfig.exe
2880	ipconfig.exe
5116	ipconfig.exe
5520	ipconfig.exe
2396	ipconfig.exe
3432	ipconfig.exe
5596	ipconfig.exe
704	ipconfig.exe
2872	ipconfig.exe
5084	ipconfig.exe
472	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280913724641919"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-515251955-468707340-1782030364-1000\{9DF1FD11-B871-42E9-BB40-73C9E541CB61}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5588	wuomhezwrpjhczur.exe
5588	wuomhezwrpjhczur.exe
5588	wuomhezwrpjhczur.exe
5588	wuomhezwrpjhczur.exe
5588	wuomhezwrpjhczur.exe
5588	wuomhezwrpjhczur.exe
5588	wuomhezwrpjhczur.exe
5588	wuomhezwrpjhczur.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2376	i_wuomgeywro.exe
Token: SeDebugPrivilege	4792	i_wtrljebwto.exe
Token: SeDebugPrivilege	672	i_gaywqoigby.exe
Token: SeDebugPrivilege	2308	i_nigaysqnig.exe
Token: SeDebugPrivilege	2060	i_cavsnlfdav.exe
Token: SeDebugPrivilege	5532	i_xspkicausm.exe
Token: SeDebugPrivilege	3444	i_xupkhfzxrp.exe
Token: SeDebugPrivilege	2576	i_cwuomgezxr.exe
Token: SeDebugPrivilege	2228	i_ecztjebwuo.exe
Token: SeDebugPrivilege	5992	i_geywqojgeb.exe
Token: SeDebugPrivilege	2896	i_ljdbvqoigb.exe
Token: SeDebugPrivilege	1720	i_idavtnlfdx.exe
Token: SeDebugPrivilege	2732	i_sqkicavsnk.exe
Token: SeDebugPrivilege	4108	i_snkfcaxsqk.exe
Token: SeDebugPrivilege	5840	i_nhfzxspkhc.exe
Token: SeDebugPrivilege	5952	i_zurpmheczu.exe
Token: SeDebugPrivilege	2680	i_wrpjhbztrp.exe
Token: SeDebugPrivilege	6060	i_trljebwuom.exe
Token: SeDebugPrivilege	2416	i_gdbvtolgez.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2884	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 5588	4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 4496 wrote to memory of 3160	4496	2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 3160 wrote to memory of 2884	3160	iexplore.exe	90
PID 2884 wrote to memory of 3692	2884	msedge.exe	91
PID 2884 wrote to memory of 5932	2884	msedge.exe	93
PID 2884 wrote to memory of 3536	2884	msedge.exe	94
PID 2884 wrote to memory of 5932	2884	msedge.exe	93
PID 2884 wrote to memory of 5932	2884	msedge.exe	93
PID 2884 wrote to memory of 2284	2884	msedge.exe	95
PID 2884 wrote to memory of 2284	2884	msedge.exe	95
PID 2884 wrote to memory of 4420	2884	msedge.exe	96
PID 2884 wrote to memory of 4420	2884	msedge.exe	96
PID 2884 wrote to memory of 4420	2884	msedge.exe	96
PID 2884 wrote to memory of 2212	2884	msedge.exe	97
PID 2884 wrote to memory of 2212	2884	msedge.exe	97
PID 2884 wrote to memory of 2212	2884	msedge.exe	97
PID 2884 wrote to memory of 3648	2884	msedge.exe	98
PID 2884 wrote to memory of 1208	2884	msedge.exe	99
PID 2884 wrote to memory of 3648	2884	msedge.exe	98
PID 2884 wrote to memory of 3648	2884	msedge.exe	98
PID 2884 wrote to memory of 1208	2884	msedge.exe	99
PID 2884 wrote to memory of 1208	2884	msedge.exe	99
PID 2884 wrote to memory of 4680	2884	msedge.exe	100
PID 2884 wrote to memory of 4680	2884	msedge.exe	100
PID 5588 wrote to memory of 5788	5588	wuomhezwrpjhczur.exe	104
PID 2044 wrote to memory of 4892	2044	wuomgeywro.exe	107
PID 2884 wrote to memory of 3236	2884	msedge.exe	110
PID 2884 wrote to memory of 1640	2884	msedge.exe	111
PID 2884 wrote to memory of 3236	2884	msedge.exe	110
PID 2884 wrote to memory of 1640	2884	msedge.exe	111
PID 2884 wrote to memory of 5384	2884	msedge.exe	113
PID 2884 wrote to memory of 1340	2884	msedge.exe	116
PID 2884 wrote to memory of 1340	2884	msedge.exe	116
PID 2884 wrote to memory of 5992	2884	msedge.exe	117
PID 2884 wrote to memory of 5992	2884	msedge.exe	117
PID 5588 wrote to memory of 2296	5588	wuomhezwrpjhczur.exe	118
PID 5588 wrote to memory of 1496	5588	wuomhezwrpjhczur.exe	122
PID 5360 wrote to memory of 3392	5360	wtrljebwto.exe	124
PID 5588 wrote to memory of 3252	5588	wuomhezwrpjhczur.exe	127
PID 5588 wrote to memory of 3260	5588	wuomhezwrpjhczur.exe	131
PID 4724 wrote to memory of 5716	4724	gaywqoigby.exe	133
PID 5588 wrote to memory of 2860	5588	wuomhezwrpjhczur.exe	136
PID 2884 wrote to memory of 1532	2884	msedge.exe	138
PID 2884 wrote to memory of 1532	2884	msedge.exe	138
PID 2884 wrote to memory of 1532	2884	msedge.exe	138
PID 2884 wrote to memory of 5012	2884	msedge.exe	142
PID 2884 wrote to memory of 5012	2884	msedge.exe	142
PID 2884 wrote to memory of 5012	2884	msedge.exe	142
PID 5588 wrote to memory of 772	5588	wuomhezwrpjhczur.exe	143
PID 3568 wrote to memory of 3628	3568	nigaysqnig.exe	145
PID 2884 wrote to memory of 2732	2884	msedge.exe	148
PID 2884 wrote to memory of 1688	2884	msedge.exe	149
PID 2884 wrote to memory of 2152	2884	msedge.exe	150
PID 5588 wrote to memory of 1080	5588	wuomhezwrpjhczur.exe	151
PID 5588 wrote to memory of 3888	5588	wuomhezwrpjhczur.exe	155
PID 3484 wrote to memory of 2928	3484	cavsnlfdav.exe	157
PID 5588 wrote to memory of 3780	5588	wuomhezwrpjhczur.exe	160
PID 5588 wrote to memory of 2444	5588	wuomhezwrpjhczur.exe	164
PID 5388 wrote to memory of 3060	5388	xspkicausm.exe	166
PID 5588 wrote to memory of 2272	5588	wuomhezwrpjhczur.exe	169
PID 5588 wrote to memory of 5112	5588	wuomhezwrpjhczur.exe	173
PID 5836 wrote to memory of 5976	5836	xupkhfzxrp.exe	175
PID 5588 wrote to memory of 2672	5588	wuomhezwrpjhczur.exe	178
PID 2884 wrote to memory of 4768	2884	msedge.exe	182

C:\Users\Admin\AppData\Local\Temp\2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_5fe8712c2a3a1722679b67891c44c51a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Temp\wuomhezwrpjhczur.exe
  C:\Temp\wuomhezwrpjhczur.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5588
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wuomgeywro.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5788
  - - C:\Temp\wuomgeywro.exe
      C:\Temp\wuomgeywro.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2044
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4892
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wuomgeywro.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2296
  - - C:\Temp\i_wuomgeywro.exe
      C:\Temp\i_wuomgeywro.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2376
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtrljebwto.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1496
  - - C:\Temp\wtrljebwto.exe
      C:\Temp\wtrljebwto.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5360
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3392
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4424
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtrljebwto.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3252
  - - C:\Temp\i_wtrljebwto.exe
      C:\Temp\i_wtrljebwto.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4792
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gaywqoigby.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3260
  - - C:\Temp\gaywqoigby.exe
      C:\Temp\gaywqoigby.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4724
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5716
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4992
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gaywqoigby.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2860
  - - C:\Temp\i_gaywqoigby.exe
      C:\Temp\i_gaywqoigby.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:672
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nigaysqnig.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:772
  - - C:\Temp\nigaysqnig.exe
      C:\Temp\nigaysqnig.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3568
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3628
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5520
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nigaysqnig.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1080
  - - C:\Temp\i_nigaysqnig.exe
      C:\Temp\i_nigaysqnig.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2308
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cavsnlfdav.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3888
  - - C:\Temp\cavsnlfdav.exe
      C:\Temp\cavsnlfdav.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3484
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2928
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2872
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cavsnlfdav.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3780
  - - C:\Temp\i_cavsnlfdav.exe
      C:\Temp\i_cavsnlfdav.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xspkicausm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2444
  - - C:\Temp\xspkicausm.exe
      C:\Temp\xspkicausm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5388
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3060
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xspkicausm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2272
  - - C:\Temp\i_xspkicausm.exe
      C:\Temp\i_xspkicausm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5532
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xupkhfzxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5112
  - - C:\Temp\xupkhfzxrp.exe
      C:\Temp\xupkhfzxrp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5836
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5976
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5084
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xupkhfzxrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2672
  - - C:\Temp\i_xupkhfzxrp.exe
      C:\Temp\i_xupkhfzxrp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3444
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cwuomgezxr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4712
  - - C:\Temp\cwuomgezxr.exe
      C:\Temp\cwuomgezxr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3180
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2368
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4264
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cwuomgezxr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3056
  - - C:\Temp\i_cwuomgezxr.exe
      C:\Temp\i_cwuomgezxr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2576
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecztjebwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6100
  - - C:\Temp\ecztjebwuo.exe
      C:\Temp\ecztjebwuo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5644
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5300
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:472
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecztjebwuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5632
  - - C:\Temp\i_ecztjebwuo.exe
      C:\Temp\i_ecztjebwuo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2228
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\geywqojgeb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3440
  - - C:\Temp\geywqojgeb.exe
      C:\Temp\geywqojgeb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3240
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2432
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5656
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_geywqojgeb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1424
  - - C:\Temp\i_geywqojgeb.exe
      C:\Temp\i_geywqojgeb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5992
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdbvqoigb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1584
  - - C:\Temp\ljdbvqoigb.exe
      C:\Temp\ljdbvqoigb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5156
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3704
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2880
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdbvqoigb.exe ups_ins
    3⤵
    PID:2872
  - - C:\Temp\i_ljdbvqoigb.exe
      C:\Temp\i_ljdbvqoigb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\idavtnlfdx.exe ups_run
    3⤵
    PID:3420
  - - C:\Temp\idavtnlfdx.exe
      C:\Temp\idavtnlfdx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5948
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1964
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2396
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_idavtnlfdx.exe ups_ins
    3⤵
    PID:3164
  - - C:\Temp\i_idavtnlfdx.exe
      C:\Temp\i_idavtnlfdx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1720
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqkicavsnk.exe ups_run
    3⤵
    PID:5076
  - - C:\Temp\sqkicavsnk.exe
      C:\Temp\sqkicavsnk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4404
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4788
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4392
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqkicavsnk.exe ups_ins
    3⤵
    PID:5680
  - - C:\Temp\i_sqkicavsnk.exe
      C:\Temp\i_sqkicavsnk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2732
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\snkfcaxsqk.exe ups_run
    3⤵
    PID:5736
  - - C:\Temp\snkfcaxsqk.exe
      C:\Temp\snkfcaxsqk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3564
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2412
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1940
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_snkfcaxsqk.exe ups_ins
    3⤵
    PID:4144
  - - C:\Temp\i_snkfcaxsqk.exe
      C:\Temp\i_snkfcaxsqk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4108
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nhfzxspkhc.exe ups_run
    3⤵
    PID:4396
  - - C:\Temp\nhfzxspkhc.exe
      C:\Temp\nhfzxspkhc.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5612
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5884
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3432
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nhfzxspkhc.exe ups_ins
    3⤵
    PID:5792
  - - C:\Temp\i_nhfzxspkhc.exe
      C:\Temp\i_nhfzxspkhc.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zurpmheczu.exe ups_run
    3⤵
    PID:4708
  - - C:\Temp\zurpmheczu.exe
      C:\Temp\zurpmheczu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2856
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2084
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zurpmheczu.exe ups_ins
    3⤵
    PID:3852
  - - C:\Temp\i_zurpmheczu.exe
      C:\Temp\i_zurpmheczu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5952
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wrpjhbztrp.exe ups_run
    3⤵
    PID:3284
  - - C:\Temp\wrpjhbztrp.exe
      C:\Temp\wrpjhbztrp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4948
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4804
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5116
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wrpjhbztrp.exe ups_ins
    3⤵
    PID:4264
  - - C:\Temp\i_wrpjhbztrp.exe
      C:\Temp\i_wrpjhbztrp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2680
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trljebwuom.exe ups_run
    3⤵
    PID:1060
  - - C:\Temp\trljebwuom.exe
      C:\Temp\trljebwuom.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3064
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1252
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5596
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trljebwuom.exe ups_ins
    3⤵
    PID:5920
  - - C:\Temp\i_trljebwuom.exe
      C:\Temp\i_trljebwuom.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gdbvtolgez.exe ups_run
    3⤵
    PID:3404
  - - C:\Temp\gdbvtolgez.exe
      C:\Temp\gdbvtolgez.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5352
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2228
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gdbvtolgez.exe ups_ins
    3⤵
    PID:5372
  - - C:\Temp\i_gdbvtolgez.exe
      C:\Temp\i_gdbvtolgez.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2416
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffaedcac188,0x7ffaedcac194,0x7ffaedcac1a0
      4⤵
      PID:3692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1904,i,15841054893784859790,17422234571234272658,262144 --field-trial-handle=2496,i,10028849240464247038,5731462307015254692,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:2
      4⤵
      PID:5932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2052,i,13655721890901301194,2946723985973688392,524288 --field-trial-handle=2496,i,10028849240464247038,5731462307015254692,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:11
      4⤵
      System Time Discovery
      PID:3536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,7121890523530706326,4419243286777710160,524288 --field-trial-handle=2496,i,10028849240464247038,5731462307015254692,262144 --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:13
      4⤵
      PID:2284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,3179548436349063391,13731567404146895325,2097152 --field-trial-handle=2496,i,10028849240464247038,5731462307015254692,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
      4⤵
      PID:4420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,7869229936472672563,12666643270852558637,2097152 --field-trial-handle=2496,i,10028849240464247038,5731462307015254692,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
      4⤵
      PID:2212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,13526724009777885513,11575625467733166204,2097152 --field-trial-handle=2496,i,10028849240464247038,5731462307015254692,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:1
      4⤵
      PID:3648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4172,i,14788942630563748821,349888090361699492,2097152 --field-trial-handle=2496,i,10028849240464247038,5731462307015254692,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:9
      4⤵
      PID:1208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,5349164919465206909,16929888810414254029,524288 --field-trial-handle=2496,i,10028849240464247038,5731462307015254692,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:14
      4⤵
      PID:4680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,12524719236678252788,15765054307436577740,524288 --field-trial-handle=2496,i,10028849240464247038,5731462307015254692,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:14
      4⤵
      PID:3236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,15275838721085152932,17615285836186081821,524288 --field-trial-handle=2496,i,10028849240464247038,5731462307015254692,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:14
      4⤵
      PID:1640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,4202066529687847407,2132969561819860093,524288 --field-trial-handle=2496,i,10028849240464247038,5731462307015254692,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:14
      4⤵
      PID:2164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,4202066529687847407,2132969561819860093,524288 --field-trial-handle=2496,i,10028849240464247038,5731462307015254692,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:14
      4⤵
      PID:5384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,3058737072653837972,12836318962392242457,524288 --field-trial-handle=2496,i,10028849240464247038,5731462307015254692,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
      4⤵
      PID:1340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,9662869369856167040,14069053631171424115,524288 --field-trial-handle=2496,i,10028849240464247038,5731462307015254692,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:14
      4⤵
      PID:5992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3552,i,15442366993311607877,6653095471466825932,2097152 --field-trial-handle=2496,i,10028849240464247038,5731462307015254692,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
      4⤵
      PID:1532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3672,i,6599718573093114344,13378738316133990672,2097152 --field-trial-handle=2496,i,10028849240464247038,5731462307015254692,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
      4⤵
      PID:5012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1436,i,9145414015442833960,163083849725368832,524288 --field-trial-handle=2496,i,10028849240464247038,5731462307015254692,262144 --variations-seed-version --mojo-platform-channel-handle=1404 /prefetch:14
      4⤵
      PID:2732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1444,i,3731666122513379321,9858291946608702299,524288 --field-trial-handle=2496,i,10028849240464247038,5731462307015254692,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
      4⤵
      PID:1688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1452,i,9684635346574463503,8377547183373862383,524288 --field-trial-handle=2496,i,10028849240464247038,5731462307015254692,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:14
      4⤵
      PID:2152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6016,i,7647663263970246131,7201829479800623018,2097152 --field-trial-handle=2496,i,10028849240464247038,5731462307015254692,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:1
      4⤵
      PID:4768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,15039719434420879250,12881047885855782442,524288 --field-trial-handle=2496,i,10028849240464247038,5731462307015254692,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
      4⤵
      PID:4400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,11189199294032719452,1407749811532345266,524288 --field-trial-handle=2496,i,10028849240464247038,5731462307015254692,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:14
      4⤵
      PID:5980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,2511621749123003836,16366440557771237689,524288 --field-trial-handle=2496,i,10028849240464247038,5731462307015254692,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:14
      4⤵
      PID:2700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6788,i,140129402072581122,7328847960947438363,524288 --field-trial-handle=2496,i,10028849240464247038,5731462307015254692,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:14
      4⤵
      PID:5580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6896,i,12880338520543641552,4411993072029084601,262144 --field-trial-handle=2496,i,10028849240464247038,5731462307015254692,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:10
      4⤵
      PID:1936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,7994482973952209539,15845465461807885874,524288 --field-trial-handle=2496,i,10028849240464247038,5731462307015254692,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
      4⤵
      PID:5456

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5664

C:\Temp\wuomhezwrpjhczur.sys
C:\Temp\wuomhezwrpjhczur.sys
1⤵
- Executes dropped EXE
PID:3372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5844

C:\Temp\jbytrljdbw.sys
C:\Temp\jbytrljdbw.sys
1⤵
- Executes dropped EXE
PID:5816

C:\Temp\vtgdyvqoig.sys
C:\Temp\vtgdyvqoig.sys
1⤵
- Executes dropped EXE
PID:4796

C:\Temp\gaytqljdbv.sys
C:\Temp\gaytqljdbv.sys
1⤵
- Executes dropped EXE
PID:5516

C:\Temp\nicavsnlid.sys
C:\Temp\nicavsnlid.sys
1⤵
- Executes dropped EXE
PID:6096

C:\Temp\hcausnkfdx.sys
C:\Temp\hcausnkfdx.sys
1⤵
- Executes dropped EXE
PID:4196

C:\Temp\hczusmkecw.sys
C:\Temp\hczusmkecw.sys
1⤵
- Executes dropped EXE
PID:1776

C:\Temp\urmkecwupm.sys
C:\Temp\urmkecwupm.sys
1⤵
- Executes dropped EXE
PID:4524

C:\Temp\mhbzxrojge.sys
C:\Temp\mhbzxrojge.sys
1⤵
- Executes dropped EXE
PID:5188

C:\Temp\omgeywqojg.sys
C:\Temp\omgeywqojg.sys
1⤵
- Executes dropped EXE
PID:4660

C:\Temp\ljdbvtolgd.sys
C:\Temp\ljdbvtolgd.sys
1⤵
- Executes dropped EXE
PID:4264

C:\Temp\fdbvsqoigd.sys
C:\Temp\fdbvsqoigd.sys
1⤵
PID:4108

C:\Temp\gaysqkidav.sys
C:\Temp\gaysqkidav.sys
1⤵
PID:3324

C:\Temp\snkicaxspn.sys
C:\Temp\snkicaxspn.sys
1⤵
PID:1928

C:\Temp\pkhcausmki.sys
C:\Temp\pkhcausmki.sys
1⤵
PID:1704

C:\Temp\wurpjhczus.sys
C:\Temp\wurpjhczus.sys
1⤵
PID:5864

C:\Temp\ezxrpjhbzu.sys
C:\Temp\ezxrpjhbzu.sys
1⤵
PID:1128

C:\Temp\bztrljebwt.sys
C:\Temp\bztrljebwt.sys
1⤵
PID:6084

C:\Temp\jgbywqoigb.sys
C:\Temp\jgbywqoigb.sys
1⤵
PID:5040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cavsnlfdav.exe

Path C:\Temp\cavsnlfdav.exe
Size 722KB
SHA256 f1182d8ae5a587b16b1f1baa75caa89c5b307187cab994431987461ae5f2c747
MD5 489ea865f67b4cdd47e5269c67907865
SHA1 7fb676850c8bc8118c70d9dbb8e5b45dfaf809f8
SHA512 aef3c8ec44f183293c28a655d6a6d8a1a0c03dc0f7890d450e8d21b47f0834328ba4bafeab77c700a5fa901ddfc07a43aefb7c558e19266bbb9c5e3b233615e7
SSDEEP 12288:5flfAsiVGjSGecvXAflfAsiVGjSGecvX:RMcfcMcf
TLSH
T10DF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaytqljdbv.sys

Path C:\Temp\gaytqljdbv.sys
Size 293KB
SHA256 9c35e0f50f063a48e772b2c0a535514275231fcb76832116d6bdee1d14cd5faf
MD5 bd37eb4cc2538b0a4b2ee361ce7b3b13
SHA1 b35afa67dfa51c2f1e1d0df9b810afdd4c1768d5
SHA512 41f8e991a211b1250b9e57d2ac95d52a7401a8298c4a3d4ee052ff27d8db78e1d681f3464ca7420060fcdf779a675980bc973e0cb7794f28dd84e0ec9fe8c2b9
SSDEEP 3072:qtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:qIJjiJcbI03GBc3ucY5DCSj
TLSH
T1AF545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaywqoigby.exe

Path C:\Temp\gaywqoigby.exe
Size 722KB
SHA256 b8c6e0d24e77255db7904d8a6c4a0b5025b441d14f4d9d2f16a87bbe70b593f4
MD5 eb21fa0a01f37a98807a8ec9fdcd4409
SHA1 74378210a8473e502283e4df4792a4d44fd867a5
SHA512 69943eb3cdf0c2cd490f4c067de51f4cf4f1ed42b3c91f80bc17e0889d139b97e1d666cdd9ac1b364b9980c57a7e3c299a9234bd9698a8ced4d6a8c161e77465
SSDEEP 12288:vflfAsiVGjSGecvXAflfAsiVGjSGecvX:3McfcMcf
TLSH
T1CBF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hcausnkfdx.sys

Path C:\Temp\hcausnkfdx.sys
Size 293KB
SHA256 475c11d3175bccc649d58d7fe6c6186d28bc140634cf81c391632d91cce08f77
MD5 021966c8336459b15772355b65909dd6
SHA1 075a7b8372aae9f1f3e8717deb4421967deefa0a
SHA512 99ae5eaf9ee630498a3b46a44184f3c64676144dcab9e6ee9648c5f7223f86ff7237f534bfd9dd7da95b58c081fb0331941fadcb80c61f8559df826ce3736d18
SSDEEP 3072:PtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:PIJjiJcbI03GBc3ucY5DCSj
TLSH
T179545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cavsnlfdav.exe

Path C:\Temp\i_cavsnlfdav.exe
Size 722KB
SHA256 8b4096a14768f259223ebae33d302462728b6266c26d2e337671f4a682f9815a
MD5 2ffb437e0fc57bee1491882d2a046f51
SHA1 c39ae9b6c4da14825a3a945796fee2a29577aa5d
SHA512 bf101a44527b65708d475db26327472ec076e4a6b0502d2ff06c3a0271d07ae468e334f2b8e02e88a9151322a71e7457e4d0aed7b1ac3e31bfdea70f5337fe82
SSDEEP 12288:KflfAsiVGjSGecvXAflfAsiVGjSGecvX:GMcfcMcf
TLSH
T1E9F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gaywqoigby.exe

Path C:\Temp\i_gaywqoigby.exe
Size 722KB
SHA256 905b6e207cb7007ff3272c5d0c5c29c599dfe8f2a0f9aa235f176b365bc5038e
MD5 9f2d6b5ab65a998c6cbd1bbae5e37df5
SHA1 2ff8a19ad164697865d27c497db56dec93b37b05
SHA512 8f5c59e4775a0ff47fce2333fa6e178ef47bf1b40209c04cfc253aee50ad0ff732dbd2f201608281def939f081b3b84bcb7fd16f4fd4e7aca35cc3ac47f91e35
SSDEEP 12288:LflfAsiVGjSGecvXAflfAsiVGjSGecvX:DMcfcMcf
TLSH
T135F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nigaysqnig.exe

Path C:\Temp\i_nigaysqnig.exe
Size 722KB
SHA256 ef81950a16f9dbbf9b48185234a5ffaedc452879a74becc70ab5037fc4a4bc1b
MD5 3e427d9abca9083c31ac6e5bf5ed2f23
SHA1 21beb316728827c2e79b368a2d717a493812c7a3
SHA512 41df5cf35844c4e03bd659d3dd39b06da636ea57c5a3163cffbce00238c4c14395478df7cce60418b7fb4d2a739135617ab668ac3c46ab9729587e3fb24d5b01
SSDEEP 12288:rflfAsiVGjSGecvXAflfAsiVGjSGecvX:jMcfcMcf
TLSH
T19BF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wtrljebwto.exe

Path C:\Temp\i_wtrljebwto.exe
Size 722KB
SHA256 74eb4735b1021ffc7710b85799767691b39adf64b68e680d2dd3b89706ad7658
MD5 1cfd5ff168e65788b7c75a7619c6e51e
SHA1 6badbc68466423d2dacf3b1bccafc06c82c3d9d5
SHA512 821ad68c5e5cc6be4ead205322140f5164aad2bef5fb9c27461b56fee9c3da31b29396ecacf5caf8b53b7b668e173327887b0a4875183a40b775a440ff156fda
SSDEEP 12288:xflfAsiVGjSGecvXAflfAsiVGjSGecvX:5McfcMcf
TLSH
T1F0F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wuomgeywro.exe

Path C:\Temp\i_wuomgeywro.exe
Size 722KB
SHA256 3b6fc53f3b9c8fe35ed7d48bfd11f9bf9932cc6fa7bbe25e8d932b4887fb0720
MD5 550991f455dd2a3aea2e92ffc802b544
SHA1 94763a6ea84f2b76eed067e48103c216fc2898e2
SHA512 caca467fd67ad848cc15de0e2279fe24c3b0dd9fe3da65fbb7a08378fe882cc325fb5eef7fbb5ac9c341e4a7e69789d55bc564529ec916747f2cb85a811c91e5
SSDEEP 12288:UflfAsiVGjSGecvXAflfAsiVGjSGecvX:QMcfcMcf
TLSH
T156F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jbytrljdbw.sys

Path C:\Temp\jbytrljdbw.sys
Size 293KB
SHA256 bdc9d3c7cbc8af9581a58b4487ca1349a495159cf42a5ebae86e6b5cd3d58a00
MD5 feaef3d391a74058d23e3aad07a25f21
SHA1 22904af41d06be6cfd1287fc4d925d3df135982f
SHA512 54639cfef966f7164a5fd6716aeadb5b21b9008ad9cab7171cd15c943b6e6778a8169911144ae633fdefbae8f53cef5f0754512629c6fc3104c08a32d5ebc898
SSDEEP 3072:wtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:wIJjiJcbI03GBc3ucY5DCSj
TLSH
T1B1545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nicavsnlid.sys

Path C:\Temp\nicavsnlid.sys
Size 293KB
SHA256 0800b735e908981358c19d266a5212755dffadabf57137bf56a0c7de7a2c8fc4
MD5 fc3cdb7f85515c6683d58752a7bd5c86
SHA1 3d616611eb26b68b8d5907c4c0769133191e0d55
SHA512 b4c3a59b1597e8985708a6dbe65928e8c494452d0a7d5bee879ac7ee5b78e5c936cd4119286fafcdbfb85c9f4673b85a4a28b2651dac60ccab734537b15e192f
SSDEEP 3072:stKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:sIJjiJcbI03GBc3ucY5DCSj
TLSH
T197545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nigaysqnig.exe

Path C:\Temp\nigaysqnig.exe
Size 722KB
SHA256 58f23044f43d1bd6fc99bcf876ca28b72ff24ffe6d96f76036bc4ecb3297c392
MD5 302f08ffb501edce546f809c4ec5287f
SHA1 a389fc2848fde32f2ada186a978485baa8f546ec
SHA512 6c19dacce0356f8d68c5430c74011ea47c7dce1788899a7150c3693d46696b37781984e5f7f738da03718a47909afb6c75ba06b69339e2557a27dfe2f69e00df
SSDEEP 12288:jflfAsiVGjSGecvXAflfAsiVGjSGecvX:rMcfcMcf
TLSH
T1F9F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtgdyvqoig.sys

Path C:\Temp\vtgdyvqoig.sys
Size 293KB
SHA256 9d047abbf9dbba9b9d7cd757419bfc52cf777a31d635de6232b5fac5b1cdce32
MD5 4a030263754e8c1b6eb24b78543c3266
SHA1 e3ecfe62b5ea19b41e27f03c8e6dd6e0b5569832
SHA512 114e69eab3437b4cb5a42f7df04d0491d757c101e4255ab2ba239078b8316999ee39b7b24ec734a28345fe5848a755a311c8276ed2b473174876210edcb527de
SSDEEP 3072:jtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:jIJjiJcbI03GBc3ucY5DCSj
TLSH
T12F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtrljebwto.exe

Path C:\Temp\wtrljebwto.exe
Size 722KB
SHA256 8c104c60e64bf0331e28d4f5b842e0807d4f00042c3eae89319ecebe71414854
MD5 742c03f9d50c2d6eb57355fb73b597df
SHA1 766282ed2ed21b035315065879bc4e45b25e7384
SHA512 6512339b673f86211161056b5e5f041b7cf3dd5774a140cf1110cf92fa4eea898e0f138e5ec21e49656c1cc9c4497a161b0cc2b63017311d688371ade78d0d45
SSDEEP 12288:lflfAsiVGjSGecvXAflfAsiVGjSGecvX:tMcfcMcf
TLSH
T1C2F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomgeywro.exe

Path C:\Temp\wuomgeywro.exe
Size 722KB
SHA256 b05d81d7ddaf4c651ba61af88795e27ac4524ffd5bec01d0ea4431c28ecacc55
MD5 d79736ef6342aec0ebc7c9655530871c
SHA1 d02dbb3d6b42c354be4992a816c6d1a3976b12ef
SHA512 549b3bdc6f5ef3648d60a1e2672b1634ecd9126d6f49a53c5594fc350e72fd45bc6f5d3ec3e29a3e8f9f7ccd2946d398d3cb2c7159e6974608105537e5f82f43
SSDEEP 12288:ZflfAsiVGjSGecvXAflfAsiVGjSGecvX:xMcfcMcf
TLSH
T136F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomhezwrpjhczur.exe

Path C:\Temp\wuomhezwrpjhczur.exe
Size 722KB
SHA256 b29dfffff8f3fc4bf1a0d91f68954deeb3508c6f1a3f54a8892d314247038f74
MD5 7da888fb1274bf357262fc0fab760c62
SHA1 b302af03f9f03e865d2e5f2f08fe068e4a155a44
SHA512 dc2ce8d4efdd7321d8b308bbb6ebfc3a3860fa1aaf59b83e94ec8aa2fcb83be69896cc4d3860fc136094d96afd295fe7305c484dbfe8c412df1e04d43b7b2ffa
SSDEEP 12288:6flfAsiVGjSGecvXAflfAsiVGjSGecvX:WMcfcMcf
TLSH
T182F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomhezwrpjhczur.sys

Path C:\Temp\wuomhezwrpjhczur.sys
Size 293KB
SHA256 6e8c2eca16586d1d8984014df93de7c9934d6548701827df2309c7c1d4df54eb
MD5 47b69fe811a14f005866a8e517b8c197
SHA1 7e8cd9ea23e61e977a58830bc219c8c4ac005688
SHA512 d18d9d6225c15ac21e5ba52262261e9bc50b4e5fe3beb1ab891d62f29775a392b9b7360e477fcdc0467267356a55b27a7487469d0d8b2b7f8ace58fc22780459
SSDEEP 3072:atKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:aIJjiJcbI03GBc3ucY5DCSj
TLSH
T1AC545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xspkicausm.exe

Path C:\Temp\xspkicausm.exe
Size 722KB
SHA256 95898f2fe94e62166bc8a00aacef5cd5d17ec5677d355d346df2f9781dcef405
MD5 15b5f18889feab8311edd1348175438e
SHA1 a680e6358be2d1672f4ea9f233a050bc309293cd
SHA512 01d790013f404032a24b772f66ddd0cbdff969a75e758d47a01d67a2af77683b13545e6fa0d967fa6a32f8e83b1acfd7452c9537f757e547278150fd77d681b6
SSDEEP 12288:aflfAsiVGjSGecvXAflfAsiVGjSGecvX:2McfcMcf
TLSH
T186F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b2d903efec8d558eba6ee4ac12873ce1439014705e9d819ff4dfcffa10c4b270
MD5 d9964ad138b9b56ea7891b8576b8a6ce
SHA1 e8153c0a553b8b81a07f1bbc77037f1700b79956
SHA512 7028c8597edeb715bb44be72ae48ceb181161e73b5380897f449df22a8c2b5302f664d632f2373c4c7a712d85a4b0ca70a4a062d6af265eefcac45dd99a660f1
TLSH
T1FCD092A4BB40EC0ECA91287B25B69A19B6409831BC56061A8966B0F88C517831A1B0EE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c1d0eccd9de1dbbf6cbedcb541fa52903c78d66d4d260136bc73243b056beb74
MD5 12c06f300a4b88646d6fda378a48455e
SHA1 86d58840d0666ad8999198dad1983a8cfd61fd18
SHA512 76e813720fc8cd4d829570b1b32d711d2d751540dea1fcac581dd9a5963c4e3161cffa07350cc8d5477fa02d0eb7b1c29b8ffb567f85b5a94259654ff2af3928
TLSH
T118D092A8BB40ED0ECA91287B25B59A19B6509831FC56061A8866B0E88C517831A1B0FE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b4a1654665a65a31aa3cedd6b65b4de9c8c2b2c7aa8721030a4782b531f425ae
MD5 f6f7f7d779ac3e554e1bc4e3ea0607d0
SHA1 cb86bf00a40b7734b3f99db9569e5b24fe834a85
SHA512 ebb81d460342298cb9ff1fb61b2c11115cb4e8c8e315f89f879c45f9d365c3cdf0e611c69a3335dda395ebd32869d7fb160c111b30ec90de14118b8636b90a09
TLSH
T18E6162B583F29BE1DB6BCDFE98D000D93AB456A6155B7E21808CA8F44C8EFC67472530
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599149.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599149.TMP
Size 3KB
SHA256 be9508d274af12c8df7934b8c3891da0da00ceafdea8cd52553268fdf1de4b25
MD5 e536f00ff0499f5e18b72d09891d640b
SHA1 29351bf30fe1df3b3abedeb8c1fb76e18482d274
SHA512 ddec5239f5267bbcebe9c50d3c73c33f389fa9f2341ec958d549d5c2ebeb48a17abaae0254cfb8392b1f4c5fdaa3c619b0aeb5f73b1176799d2b2e0b7a5a7b24
TLSH
T1C16173B583F29BE1DB6BCDFE98D000D93AB456A6155B3E21808CA8F44C8EFC67472130
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 07a6089bafa785fedd1d34ea4f5992614a54a949cad5fa972f388f0b3fe75460
MD5 70aaf805a238e61ad3985466214ec8b7
SHA1 5f31df54f11466ecdd7b11f36916dbd1c0a05573
SHA512 d142b1c70bcb3321c4d5016abea1d5451993cb3e533fb82eab154d411d8eff9a1a1bc17c389c9d9850af16753a938c13e39f6254aef3ea1771da88f1fa3ae14e
TLSH
T1D141CEF3C3E4856E891196F0AA187E2BCE1D0915432C3D5AC9E4AF1B93E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 aaf79aef1fbc1660addac3817c2ab91f8f6fe4bc3700ef14eac6e13fb0957024
MD5 7ea01103a43293e6809fa02dafa3a812
SHA1 fc9235ca1fb132c9e4d03358f170024ceb93eb22
SHA512 ec2302bcac379219c95fd3c3f9e8e178881734d0b970d71b06919e436bb77f152920d96fc581ab6e67f165f4879ca85186fff7b2d238ce717a30fea8d433d3ff
SSDEEP 192:sxRVR4yM/jK1Ml8wCB/fYslZQ8IZuSzoA8pi/g6+WNIYnOt0+GsIgtJ:sxRV+8B/fYslj2ufi/5IX0m3
TLSH
T16752E9056A349977CCDBD209FA567F53D6F81573A2901E44AAFCCA0C00E7AED621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3350af2baee37fc53e6d801e167a1fe609d296c54b7447b4bb8257490f8d6758
MD5 e7684fd5325e4180f324fe87e349b98b
SHA1 5361a7bb486b24184afb699a55079951908a888e
SHA512 04379b0e3fe28be1b4f055867aa006738887e98a7ab55fb753e9befa65f577ce4c9d600a0116b9ae5b7bc2ab0cf2d606e7c51250c51a0e986f0e47d19bdcff70
SSDEEP 192:sxR+R4yM/jK1Ml8UQWCB/fYsuZQAIZuqzoA8prU3/g6+WNCRn/Yn1t0+GsIgDGJ:sxR+GqRB/fYsuj2unw3/58/Y0mu
TLSH
T1D762E9066A349977CCDBD209FA467F93D6F81473A2941E44AAFCCA0C01E76DD621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 0d38f135c4dcac012350e576b5f797d91daad2215065228c3e2a66576dff8875
MD5 49c335b063c350b038264fa188cfc672
SHA1 775f4fb44d3060f649eb481e8b41ce175480538c
SHA512 9035573b3145ca4eee9300bb35e052f4af118f9d44f20f65570a745077531ba36517e3bb6025c8d89d098165453ba441a3e752f8fdfd45eb5b64a4f4fbace9f5
SSDEEP 192:sxR+R4yM/jK1Ml8wCB/fYsuZQAIZuqzoA8prU3/g6+WNCRn/Yn1t0+GsIgDGJ:sxR+G8B/fYsuj2unw3/58/Y0mu
TLSH
T1B762EA066A349977CCDBD209FA467F93D6F81573A2941E44AAFCCA0C01E76DD621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 77d24af2a5802622ee987d469c55c2423c19935a9b16626e2cf6990623b4661a
MD5 8dbf72d9425dab7e65463555270e82dc
SHA1 8b95140f49701566c5afb5821eebcb00d5d9816b
SHA512 7483191b359e53c097151d305a5be33ff43866c009fa67328f2675a7ee22903283e12172b2c389b72d7d32bea96ee8c239383b2fe730c46ea90a357c42c69428
SSDEEP 192:sxR+R4yM/jK1Ml8wCB/fYsuZQ8IZuSzoA8pi/g6+WNIYnOt0+GsIgDQJ:sxR++8B/fYsuj2ufi/5IX0mA
TLSH
T1C852E9056A349977CCDBD209FA467F93D6F81573A2941E44AAFCCA0C00E76ED621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 b8cd66486617feebdc02e1b43e527410072cf04baabb6ec9dbc31cad3319639c
MD5 3b7c1211f4c93fd35d24b02964abf232
SHA1 a1cd1d44062cdbb06573f7d1365603692e619ba0
SHA512 cf34699cd11ddce6803898daeec9d65e3bd6f1c19f71ec857b5f26702f41f799291156bd6133a70c38bda8a42e801906d09af6809e3b148cae80ed8f24746545
SSDEEP 768:Jl6hhs7pLuL7b2WgqcfHw8F1+UoAYDCx9Tuqh0VfUC9xbog/OVqG3XgukroMiPBN:Jl6hhQE7b2WgqcfHwu1japG3QuvMi/
TLSH
T184E2EC3B780CCB7F4F804A9CEC29799A6DE801CB96D8CD5447FA884C03C66EB511A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 314d60b32738526f280439d03400ec2ac5bce26af60f4c049fa8ebdc04f573af
MD5 23fb112830d17edb8b3bda6b638c8476
SHA1 cbebe55f14f1b1adde0d4b7cef80aa7fa9152971
SHA512 430e7ddc1f63cb7bfe325b14c9e5a0d4a637520cf6cafd0f3057ea8b6196763a7fc846df4d7c13cb07457c5193ee0d7d7d71f70e305bf1e59119d0ccf0f3f672
SSDEEP 96:KRQh0gS+yoW2r7gooK4tgaocII7aglHc9oMmqesWa33gUsK45gesc8M32cM5MWM3:CQh0gS+y/2rEostgaHII7aglHc9oMmq0
TLSH
T1C391340470770284397E756A90A89D5FCAC170A3751AB86B7B6903D61F37E028FFE8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3b9c3fab-0886-44af-9f0a-e94c81f8b326.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\3b9c3fab-0886-44af-9f0a-e94c81f8b326.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 7eb108013675661865d99960a286cbba77ccb9b14b3e846be92f77c3a1105ebe
MD5 21eae2a11995c22bff91bc4e5d10685e
SHA1 a7575cd21456eff8009bd6a297b280bdf6c96947
SHA512 0e321202a9b03e379ed2bde6d1ee19e5bc71fae6d8d2433cb04dd1f0d4457dba1a3273ee86c768e031788312086c6358e5a13d6a86a4486c7a9569a4c9fc833f
SSDEEP 768:Vrv+4UNbda33PYreNSLfifvX7DGFzoqPcNMCNZA/eVH1SkM:Vbsb43Apfifv3WkqPaYEH1Y
TLSH
T1DB03BEB5A8B445378CE3C685B71B3A176FF4025746840B94D8ED2F0E879F5AD130BA2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 37989a1bfdea9500415b62201158b5353e37229f7676013266f393221c66df99
MD5 5fe7888a06f8e5bb61e92eeb14d0259e
SHA1 44a3962b954bf6f0bc9dc7b7946f1cef342dee8b
SHA512 8c94232e9cbf851efc326576a270cf605e5d82fbce19dc1d324cedcfb94d2b97770b183dcf40d12826e254ef2db14c2c0168913d6aef488633c29f1cfa704437
SSDEEP 768:eF1j+9e3HwgEHVfifyfDX7DGFzoqPcNMCNFeb9M3d:b9e3QfifyfD3WkqPagb+t
TLSH
T19F038DB6DC61CA2B9DE387C5B71A3A8BEFE0026785C85DC4DAD95E0D01872ED030BD19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 bdc6e6a88c2c5a2563103967205e9fddcde7b856bd8d7c905bde25ff124bafd3
MD5 1c8b3c18c85f2bf11319683de1ba9f1b
SHA1 e8f270fb0fb20b0fc362eb31a7306a889250ed33
SHA512 d1a061830ba4129a56f2d145a858d30937cccddb2c89c80cdaf257a5026e5cc6feba98fb02afdd12feb36943a8ef193dc0cadd2519d85e0458bfed57c5531c87
SSDEEP 768:yrv+4UNbdr3nEYreNSLfifyf5X7DGFzoqPcNMCNFeA:ybsb53jpfifyf53WkqPagA
TLSH
T16D03BFB1E87489374CE7C288B70B3A87BFF4165359C50B54D9E95B0E468B2ED130F92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 23ddfd3a6141310fae28076dcb42c307e6fd8609ccebf758cb75b6eaa54f2368
MD5 bf8a05ed7cdcfa2b9b1efbd8928da569
SHA1 9a16007d83be99ff3a1e624adfc32f5c89a3bd2f
SHA512 580acfccfb7c408a6b352be9747afdbc6e6697193df700c40e49eaba28634c00447def42f90ca5d8ced155d82667a8f98daf14f99116df9d1044b59e2653701a
SSDEEP 768:Pj+9t3JEYreNSLfifyf+X7DGFzoqPcNMCNFeb9M3d:i9t3Jpfifyf+3WkqPagb+t
TLSH
T193F2BFB4EC714D274CE3C288B71B3A9BEFE0166755C41E48D9E96F0E46872AD030B929
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 94f7cf9bb687567fd46af58659b4dddaa404ae30af2e58fc85e5578f5a80bb2c
MD5 4f14650bf886f47f358d114294032320
SHA1 a78cf6e4b4d622703d489387af45e1e52432065b
SHA512 7c0db2349d145f9ef35f3ef15554a35b87565a23c8e5966808bd3c0e1ecda6e54b5115496b4cdb1f51249200aefae0e5db07a79de2821314183ac2226c5b72eb
SSDEEP 768:Kj+9t3cEYreNSLfifyf+X7DGFzoqPcNMCNFeb9M3d:p9t3mpfifyf+3WkqPagb+t
TLSH
T178F2BFB5EC714D278CE3C288B71B3A9BEFE0166755C41E48D9E96F0E46872BD030B919
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2884_1547381522\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 7d481a098d78c7a37442c2d5c313178c964801cb726cf0dd9984dc37f9803a57
MD5 d25e2c17c5ef4289d332ddadd5015090
SHA1 9a098c9afec6292bf4321d00709e56b25d553152
SHA512 4c4f154ce1e75c5f8d7d4de5a6055d634b2d7624bc0cc030c1eb7cb3e9d8c3ea3b22929ccf1a7749db6ba1cbe3e1a5b89a3538c0f536c047b90e1c078740afd0
TLSH
T16D7100835AB9C5B2C29A5FF402835648F1FF22384B6330340B515546AB30A7A68B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1128-477-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1704-445-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1776-321-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1928-441-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3324-421-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3372-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4108-401-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4196-314-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4264-372-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4524-325-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4660-381-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4796-244-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5040-506-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5188-340-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5516-272-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5816-197-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5864-456-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6084-481-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6096-286-0x0000000000010000-0x00000000000AB000-memory.dmp

Download