136ce777781cbcb7f33a22f6c19753957c940abb07aa9fa10cd5f23bbc0e46f3

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 722KB
Sample260710-stem8ab12j
SHA256 136ce777781cbcb7f33a22f6c19753957c940abb07aa9fa10cd5f23bbc0e46f3
MD5 32a17c2059ebc60ddd741872ef213dea
SHA1 11b7d1b1ee69f6a0a36dae4392e1421c21d5f87f
SHA512 702ea2013e36cbf6e4b583d985894b1877de113c32861e6da5e7425396320bdb36bde8700966b8626d9b2213460ab4a5fa253d0d1d3a7de9bb06bdb113357370
SSDEEP 12288:GflfAsiVGjSGecvXAflfAsiVGjSGecvX:SMcfcMcf
TLSH
T150F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4664	nifaysqkidavsnlf.exe
2536	nifaysqkidavsnlf.sys
108	CreateProcess.exe
3008	qnifaysqki.exe
3376	CreateProcess.exe
2836	CreateProcess.exe
5100	i_qnifaysqki.exe
5376	sqlfdxvsqk.sys
5912	CreateProcess.exe
1212	fdxvpkhfax.exe
3744	CreateProcess.exe
1960	CreateProcess.exe
460	i_fdxvpkhfax.exe
3612	fcxusmkfcx.sys
1148	CreateProcess.exe
788	xvpnkfdxvp.exe
976	CreateProcess.exe
5532	CreateProcess.exe
4760	i_xvpnkfdxvp.exe
4976	nhfzxrpkhc.sys
4176	CreateProcess.exe
1568	zwupmkecau.exe
2520	CreateProcess.exe
4852	CreateProcess.exe
2852	i_zwupmkecau.exe
2892	rmjecwuomg.sys
4084	CreateProcess.exe
3140	jhezwrpjhb.exe
2496	CreateProcess.exe
5980	CreateProcess.exe
4704	i_jhezwrpjhb.exe
5416	bwtrojhbzt.sys
3324	CreateProcess.exe
4948	tomgeywroj.exe
5080	CreateProcess.exe
2780	CreateProcess.exe
3496	i_tomgeywroj.exe
4928	qomgeywtom.sys
5816	CreateProcess.exe
3328	wtolgdbwto.exe
3292	CreateProcess.exe
5152	CreateProcess.exe
4792	i_wtolgdbwto.exe
3100	gdbvtolgdb.sys
4196	CreateProcess.exe
4436	bqlidbvtnl.exe
2824	CreateProcess.exe
5672	CreateProcess.exe
1968	i_bqlidbvtnl.exe
936	gdyvqnigay.sys
2776	CreateProcess.exe
4964	bvtnlfdxvq.exe
3736	CreateProcess.exe
3496	CreateProcess.exe
4760	i_bvtnlfdxvq.exe
5612	aysqkiaxsq.sys
4452	CreateProcess.exe
1928	qkicavsnkf.exe
4592	CreateProcess.exe
6068	CreateProcess.exe
3904	i_qkicavsnkf.exe
4676	xrpkhczusp.sys
5892	CreateProcess.exe
5776	spkicxrmkh.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2400_2091166879\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2400_361554051\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2400_361554051\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2400_361554051\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2400_587537158\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2400_587537158\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2400_361554051\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2400_659806045\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2400_2091166879\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 39 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmkecwurpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tomgeywroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bqlidbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkicavsnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkicxrmkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmkecwurpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbzwrojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkicavsnki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnkfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhezwrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqoigbytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usqkicavsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtolgdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bqlidbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebzurmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqoigbytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwupmkecau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bywqojgbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bywqojgbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usqkicavsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkicxrmkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkicavsnki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nifaysqkidavsnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwupmkecau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhezwrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebzurmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvpkhfax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnkfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tomgeywroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtolgdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkicavsnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbzwrojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvpkhfax.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1056	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 18 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1192	ipconfig.exe
3648	ipconfig.exe
3084	ipconfig.exe
5096	ipconfig.exe
1836	ipconfig.exe
3176	ipconfig.exe
852	ipconfig.exe
4256	ipconfig.exe
4440	ipconfig.exe
5988	ipconfig.exe
4892	ipconfig.exe
4284	ipconfig.exe
5176	ipconfig.exe
472	ipconfig.exe
4464	ipconfig.exe
3100	ipconfig.exe
4364	ipconfig.exe
1420	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134281706992721468"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2115213192-531537726-3295841909-1000\{C80CDA15-AB42-45F9-8637-058EB841A9FB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	nifaysqkidavsnlf.exe
4664	nifaysqkidavsnlf.exe
4664	nifaysqkidavsnlf.exe
4664	nifaysqkidavsnlf.exe
4664	nifaysqkidavsnlf.exe
4664	nifaysqkidavsnlf.exe
4664	nifaysqkidavsnlf.exe
4664	nifaysqkidavsnlf.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	5100	i_qnifaysqki.exe
Token: SeDebugPrivilege	460	i_fdxvpkhfax.exe
Token: SeDebugPrivilege	4760	i_xvpnkfdxvp.exe
Token: SeDebugPrivilege	2852	i_zwupmkecau.exe
Token: SeDebugPrivilege	4704	i_jhezwrpjhb.exe
Token: SeDebugPrivilege	3496	i_tomgeywroj.exe
Token: SeDebugPrivilege	4792	i_wtolgdbwto.exe
Token: SeDebugPrivilege	1968	i_bqlidbvtnl.exe
Token: SeDebugPrivilege	4760	i_bvtnlfdxvq.exe
Token: SeDebugPrivilege	3904	i_qkicavsnkf.exe
Token: SeDebugPrivilege	3356	i_spkicxrmkh.exe
Token: SeDebugPrivilege	3508	i_rmkecwurpm.exe
Token: SeDebugPrivilege	1728	i_jebzurmkec.exe
Token: SeDebugPrivilege	3172	i_hbzwrojhbz.exe
Token: SeDebugPrivilege	3256	i_bywqojgbyt.exe
Token: SeDebugPrivilege	4396	i_yvqoigbytq.exe
Token: SeDebugPrivilege	120	i_qkicavsnki.exe
Token: SeDebugPrivilege	5500	i_usqkicavsq.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2400	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5516 wrote to memory of 4664	5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	87
PID 5516 wrote to memory of 3868	5516	2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 3868 wrote to memory of 2400	3868	iexplore.exe	89
PID 2400 wrote to memory of 4228	2400	msedge.exe	90
PID 2400 wrote to memory of 5588	2400	msedge.exe	92
PID 2400 wrote to memory of 1056	2400	msedge.exe	93
PID 2400 wrote to memory of 5588	2400	msedge.exe	92
PID 2400 wrote to memory of 5588	2400	msedge.exe	92
PID 2400 wrote to memory of 3096	2400	msedge.exe	94
PID 2400 wrote to memory of 3096	2400	msedge.exe	94
PID 2400 wrote to memory of 5764	2400	msedge.exe	95
PID 2400 wrote to memory of 5764	2400	msedge.exe	95
PID 2400 wrote to memory of 5764	2400	msedge.exe	95
PID 2400 wrote to memory of 2696	2400	msedge.exe	96
PID 2400 wrote to memory of 2696	2400	msedge.exe	96
PID 2400 wrote to memory of 2696	2400	msedge.exe	96
PID 2400 wrote to memory of 3580	2400	msedge.exe	97
PID 2400 wrote to memory of 4336	2400	msedge.exe	98
PID 2400 wrote to memory of 3580	2400	msedge.exe	97
PID 2400 wrote to memory of 3580	2400	msedge.exe	97
PID 2400 wrote to memory of 4336	2400	msedge.exe	98
PID 2400 wrote to memory of 4336	2400	msedge.exe	98
PID 2400 wrote to memory of 5208	2400	msedge.exe	99
PID 2400 wrote to memory of 5208	2400	msedge.exe	99
PID 4664 wrote to memory of 108	4664	nifaysqkidavsnlf.exe	103
PID 2400 wrote to memory of 1804	2400	msedge.exe	104
PID 2400 wrote to memory of 1804	2400	msedge.exe	104
PID 2400 wrote to memory of 3040	2400	msedge.exe	105
PID 2400 wrote to memory of 3040	2400	msedge.exe	105
PID 2400 wrote to memory of 1192	2400	msedge.exe	108
PID 3008 wrote to memory of 3376	3008	qnifaysqki.exe	110
PID 2400 wrote to memory of 5412	2400	msedge.exe	115
PID 2400 wrote to memory of 5412	2400	msedge.exe	115
PID 2400 wrote to memory of 2384	2400	msedge.exe	116
PID 2400 wrote to memory of 2384	2400	msedge.exe	116
PID 4664 wrote to memory of 2836	4664	nifaysqkidavsnlf.exe	118
PID 4664 wrote to memory of 5912	4664	nifaysqkidavsnlf.exe	122
PID 1212 wrote to memory of 3744	1212	fdxvpkhfax.exe	124
PID 2400 wrote to memory of 5124	2400	msedge.exe	127
PID 2400 wrote to memory of 5124	2400	msedge.exe	127
PID 2400 wrote to memory of 5124	2400	msedge.exe	127
PID 2400 wrote to memory of 3564	2400	msedge.exe	128
PID 2400 wrote to memory of 3564	2400	msedge.exe	128
PID 2400 wrote to memory of 3564	2400	msedge.exe	128
PID 4664 wrote to memory of 1960	4664	nifaysqkidavsnlf.exe	129
PID 4664 wrote to memory of 1148	4664	nifaysqkidavsnlf.exe	133
PID 788 wrote to memory of 976	788	xvpnkfdxvp.exe	135
PID 4664 wrote to memory of 5532	4664	nifaysqkidavsnlf.exe	138
PID 4664 wrote to memory of 4176	4664	nifaysqkidavsnlf.exe	143
PID 1568 wrote to memory of 2520	1568	zwupmkecau.exe	145
PID 2400 wrote to memory of 4648	2400	msedge.exe	148
PID 2400 wrote to memory of 3224	2400	msedge.exe	149
PID 2400 wrote to memory of 1196	2400	msedge.exe	150
PID 4664 wrote to memory of 4852	4664	nifaysqkidavsnlf.exe	151
PID 4664 wrote to memory of 4084	4664	nifaysqkidavsnlf.exe	155
PID 3140 wrote to memory of 2496	3140	jhezwrpjhb.exe	157
PID 4664 wrote to memory of 5980	4664	nifaysqkidavsnlf.exe	160
PID 4664 wrote to memory of 3324	4664	nifaysqkidavsnlf.exe	164
PID 4948 wrote to memory of 5080	4948	tomgeywroj.exe	166
PID 4664 wrote to memory of 2780	4664	nifaysqkidavsnlf.exe	169
PID 4664 wrote to memory of 5816	4664	nifaysqkidavsnlf.exe	173
PID 3328 wrote to memory of 3292	3328	wtolgdbwto.exe	175
PID 4664 wrote to memory of 5152	4664	nifaysqkidavsnlf.exe	178
PID 2400 wrote to memory of 5868	2400	msedge.exe	182

C:\Users\Admin\AppData\Local\Temp\2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_32a17c2059ebc60ddd741872ef213dea_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5516
- C:\Temp\nifaysqkidavsnlf.exe
  C:\Temp\nifaysqkidavsnlf.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnifaysqki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:108
  - - C:\Temp\qnifaysqki.exe
      C:\Temp\qnifaysqki.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3008
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3376
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4892
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnifaysqki.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2836
  - - C:\Temp\i_qnifaysqki.exe
      C:\Temp\i_qnifaysqki.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5100
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdxvpkhfax.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5912
  - - C:\Temp\fdxvpkhfax.exe
      C:\Temp\fdxvpkhfax.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1212
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3744
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3100
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdxvpkhfax.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1960
  - - C:\Temp\i_fdxvpkhfax.exe
      C:\Temp\i_fdxvpkhfax.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvpnkfdxvp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1148
  - - C:\Temp\xvpnkfdxvp.exe
      C:\Temp\xvpnkfdxvp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:788
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:976
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4284
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvpnkfdxvp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5532
  - - C:\Temp\i_xvpnkfdxvp.exe
      C:\Temp\i_xvpnkfdxvp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4760
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwupmkecau.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4176
  - - C:\Temp\zwupmkecau.exe
      C:\Temp\zwupmkecau.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1568
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2520
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4364
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwupmkecau.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4852
  - - C:\Temp\i_zwupmkecau.exe
      C:\Temp\i_zwupmkecau.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2852
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhezwrpjhb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4084
  - - C:\Temp\jhezwrpjhb.exe
      C:\Temp\jhezwrpjhb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3140
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2496
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1192
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhezwrpjhb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5980
  - - C:\Temp\i_jhezwrpjhb.exe
      C:\Temp\i_jhezwrpjhb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tomgeywroj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3324
  - - C:\Temp\tomgeywroj.exe
      C:\Temp\tomgeywroj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4948
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5080
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1420
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tomgeywroj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2780
  - - C:\Temp\i_tomgeywroj.exe
      C:\Temp\i_tomgeywroj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3496
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtolgdbwto.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5816
  - - C:\Temp\wtolgdbwto.exe
      C:\Temp\wtolgdbwto.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3328
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3292
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3176
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtolgdbwto.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5152
  - - C:\Temp\i_wtolgdbwto.exe
      C:\Temp\i_wtolgdbwto.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4792
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bqlidbvtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4196
  - - C:\Temp\bqlidbvtnl.exe
      C:\Temp\bqlidbvtnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4436
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2824
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:852
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bqlidbvtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5672
  - - C:\Temp\i_bqlidbvtnl.exe
      C:\Temp\i_bqlidbvtnl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1968
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bvtnlfdxvq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2776
  - - C:\Temp\bvtnlfdxvq.exe
      C:\Temp\bvtnlfdxvq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4964
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3736
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3648
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bvtnlfdxvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3496
  - - C:\Temp\i_bvtnlfdxvq.exe
      C:\Temp\i_bvtnlfdxvq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4760
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qkicavsnkf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4452
  - - C:\Temp\qkicavsnkf.exe
      C:\Temp\qkicavsnkf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1928
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4592
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3084
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qkicavsnkf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6068
  - - C:\Temp\i_qkicavsnkf.exe
      C:\Temp\i_qkicavsnkf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3904
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spkicxrmkh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5892
  - - C:\Temp\spkicxrmkh.exe
      C:\Temp\spkicxrmkh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5776
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4632
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5096
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spkicxrmkh.exe ups_ins
    3⤵
    PID:368
  - - C:\Temp\i_spkicxrmkh.exe
      C:\Temp\i_spkicxrmkh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3356
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rmkecwurpm.exe ups_run
    3⤵
    PID:2168
  - - C:\Temp\rmkecwurpm.exe
      C:\Temp\rmkecwurpm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4528
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4680
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rmkecwurpm.exe ups_ins
    3⤵
    PID:236
  - - C:\Temp\i_rmkecwurpm.exe
      C:\Temp\i_rmkecwurpm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3508
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jebzurmkec.exe ups_run
    3⤵
    PID:988
  - - C:\Temp\jebzurmkec.exe
      C:\Temp\jebzurmkec.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5952
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2948
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jebzurmkec.exe ups_ins
    3⤵
    PID:792
  - - C:\Temp\i_jebzurmkec.exe
      C:\Temp\i_jebzurmkec.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1728
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hbzwrojhbz.exe ups_run
    3⤵
    PID:4088
  - - C:\Temp\hbzwrojhbz.exe
      C:\Temp\hbzwrojhbz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3924
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5700
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5176
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hbzwrojhbz.exe ups_ins
    3⤵
    PID:5960
  - - C:\Temp\i_hbzwrojhbz.exe
      C:\Temp\i_hbzwrojhbz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3172
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bywqojgbyt.exe ups_run
    3⤵
    PID:2424
  - - C:\Temp\bywqojgbyt.exe
      C:\Temp\bywqojgbyt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2996
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5096
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:472
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bywqojgbyt.exe ups_ins
    3⤵
    PID:1832
  - - C:\Temp\i_bywqojgbyt.exe
      C:\Temp\i_bywqojgbyt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvqoigbytq.exe ups_run
    3⤵
    PID:5312
  - - C:\Temp\yvqoigbytq.exe
      C:\Temp\yvqoigbytq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:256
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1988
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4440
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvqoigbytq.exe ups_ins
    3⤵
    PID:5740
  - - C:\Temp\i_yvqoigbytq.exe
      C:\Temp\i_yvqoigbytq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4396
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qkicavsnki.exe ups_run
    3⤵
    PID:2328
  - - C:\Temp\qkicavsnki.exe
      C:\Temp\qkicavsnki.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5176
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1220
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5988
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qkicavsnki.exe ups_ins
    3⤵
    PID:1456
  - - C:\Temp\i_qkicavsnki.exe
      C:\Temp\i_qkicavsnki.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usqkicavsq.exe ups_run
    3⤵
    PID:4668
  - - C:\Temp\usqkicavsq.exe
      C:\Temp\usqkicavsq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4840
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4868
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4464
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usqkicavsq.exe ups_ins
    3⤵
    PID:816
  - - C:\Temp\i_usqkicavsq.exe
      C:\Temp\i_usqkicavsq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5500
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x314,0x7ffccc4fc188,0x7ffccc4fc194,0x7ffccc4fc1a0
      4⤵
      PID:4228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2016,i,11797961424302514417,3926619789003126991,262144 --field-trial-handle=3048,i,6661210444033840527,11871738055316436883,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:2
      4⤵
      PID:5588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2120,i,16163575098848918631,14281734895359545304,524288 --field-trial-handle=3048,i,6661210444033840527,11871738055316436883,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:11
      4⤵
      System Time Discovery
      PID:1056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,18370367791723100159,18314752094718003446,524288 --field-trial-handle=3048,i,6661210444033840527,11871738055316436883,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:13
      4⤵
      PID:3096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,4862485291227769554,15760114411775055697,2097152 --field-trial-handle=3048,i,6661210444033840527,11871738055316436883,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
      4⤵
      PID:5764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,8403584075554331642,13968443129338802435,2097152 --field-trial-handle=3048,i,6661210444033840527,11871738055316436883,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
      4⤵
      PID:2696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,5152213377207474730,13533532441323266755,2097152 --field-trial-handle=3048,i,6661210444033840527,11871738055316436883,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:1
      4⤵
      PID:3580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,11647071700265854289,17196932441157126844,2097152 --field-trial-handle=3048,i,6661210444033840527,11871738055316436883,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:9
      4⤵
      PID:4336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,9629912785212818060,18386804956273892810,524288 --field-trial-handle=3048,i,6661210444033840527,11871738055316436883,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
      4⤵
      PID:5208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,10289775319224060561,8776617791439919712,524288 --field-trial-handle=3048,i,6661210444033840527,11871738055316436883,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
      4⤵
      PID:1804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,1237811181770923925,8312865461498310342,524288 --field-trial-handle=3048,i,6661210444033840527,11871738055316436883,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
      4⤵
      PID:3040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,8176318543653619238,13284760708506795607,524288 --field-trial-handle=3048,i,6661210444033840527,11871738055316436883,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
      4⤵
      PID:704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,8176318543653619238,13284760708506795607,524288 --field-trial-handle=3048,i,6661210444033840527,11871738055316436883,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
      4⤵
      PID:1192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,14530901990273402688,3824069892811672419,524288 --field-trial-handle=3048,i,6661210444033840527,11871738055316436883,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
      4⤵
      PID:5412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,9934684803321355598,17205283627986848864,524288 --field-trial-handle=3048,i,6661210444033840527,11871738055316436883,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:14
      4⤵
      PID:2384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6376,i,10351274440230146608,12895706673699009249,2097152 --field-trial-handle=3048,i,6661210444033840527,11871738055316436883,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:1
      4⤵
      PID:5124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6656,i,10928636616092413072,5664466477211298732,2097152 --field-trial-handle=3048,i,6661210444033840527,11871738055316436883,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:1
      4⤵
      PID:3564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1424,i,4571832562208604908,6144937492878105883,524288 --field-trial-handle=3048,i,6661210444033840527,11871738055316436883,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:14
      4⤵
      PID:4648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1420,i,16650607230023084564,5107528007307858954,524288 --field-trial-handle=3048,i,6661210444033840527,11871738055316436883,262144 --variations-seed-version --mojo-platform-channel-handle=1284 /prefetch:14
      4⤵
      PID:3224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1444,i,17977542147614033608,7593060559655771094,524288 --field-trial-handle=3048,i,6661210444033840527,11871738055316436883,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:14
      4⤵
      PID:1196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,4086220606038800681,13129628723295075531,524288 --field-trial-handle=3048,i,6661210444033840527,11871738055316436883,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
      4⤵
      PID:5868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,3580863317857626107,15394333726009457263,524288 --field-trial-handle=3048,i,6661210444033840527,11871738055316436883,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
      4⤵
      PID:5740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1424,i,1486892166187962497,15777857313655378778,524288 --field-trial-handle=3048,i,6661210444033840527,11871738055316436883,262144 --variations-seed-version --mojo-platform-channel-handle=1280 /prefetch:14
      4⤵
      PID:3620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,195864515685509870,17591114474960794057,524288 --field-trial-handle=3048,i,6661210444033840527,11871738055316436883,262144 --variations-seed-version --mojo-platform-channel-handle=928 /prefetch:14
      4⤵
      PID:2072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6212,i,7613648139085836629,14459327910906696410,262144 --field-trial-handle=3048,i,6661210444033840527,11871738055316436883,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:10
      4⤵
      PID:1040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,15095165102974386262,10870553436368550313,524288 --field-trial-handle=3048,i,6661210444033840527,11871738055316436883,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
      4⤵
      PID:5612

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5004

C:\Temp\nifaysqkidavsnlf.sys
C:\Temp\nifaysqkidavsnlf.sys
1⤵
- Executes dropped EXE
PID:2536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3252

C:\Temp\sqlfdxvsqk.sys
C:\Temp\sqlfdxvsqk.sys
1⤵
- Executes dropped EXE
PID:5376

C:\Temp\fcxusmkfcx.sys
C:\Temp\fcxusmkfcx.sys
1⤵
- Executes dropped EXE
PID:3612

C:\Temp\nhfzxrpkhc.sys
C:\Temp\nhfzxrpkhc.sys
1⤵
- Executes dropped EXE
PID:4976

C:\Temp\rmjecwuomg.sys
C:\Temp\rmjecwuomg.sys
1⤵
- Executes dropped EXE
PID:2892

C:\Temp\bwtrojhbzt.sys
C:\Temp\bwtrojhbzt.sys
1⤵
- Executes dropped EXE
PID:5416

C:\Temp\qomgeywtom.sys
C:\Temp\qomgeywtom.sys
1⤵
- Executes dropped EXE
PID:4928

C:\Temp\gdbvtolgdb.sys
C:\Temp\gdbvtolgdb.sys
1⤵
- Executes dropped EXE
PID:3100

C:\Temp\gdyvqnigay.sys
C:\Temp\gdyvqnigay.sys
1⤵
- Executes dropped EXE
PID:936

C:\Temp\aysqkiaxsq.sys
C:\Temp\aysqkiaxsq.sys
1⤵
- Executes dropped EXE
PID:5612

C:\Temp\xrpkhczusp.sys
C:\Temp\xrpkhczusp.sys
1⤵
- Executes dropped EXE
PID:4676

C:\Temp\fcxupnhfzx.sys
C:\Temp\fcxupnhfzx.sys
1⤵
PID:2008

C:\Temp\xrpmhfzxrp.sys
C:\Temp\xrpmhfzxrp.sys
1⤵
PID:5552

C:\Temp\mjebztrljh.sys
C:\Temp\mjebztrljh.sys
1⤵
PID:5032

C:\Temp\igeywqojgb.sys
C:\Temp\igeywqojgb.sys
1⤵
PID:852

C:\Temp\ndbvtnlgdy.sys
C:\Temp\ndbvtnlgdy.sys
1⤵
PID:5324

C:\Temp\gdyvtnlfdy.sys
C:\Temp\gdyvtnlfdy.sys
1⤵
PID:4492

C:\Temp\caysqkicav.sys
C:\Temp\caysqkicav.sys
1⤵
PID:1496

C:\Temp\fdxvpnhfax.sys
C:\Temp\fdxvpnhfax.sys
1⤵
PID:1984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bwtrojhbzt.sys

Path C:\Temp\bwtrojhbzt.sys
Size 293KB
SHA256 6699551fba2ea17a722fbd4ba4fd1a592898091f17445d5648cfb885730fcce6
MD5 2081c9d09d15b86989d7e1bb1a66c8d3
SHA1 81b69e28cea7eba64825c96551f3b1c1f2b7e8ac
SHA512 8e1f9368eb8c432a4cbf2327ffee19cf5455c6605257a0fb68175fb7bc96d734c6c2ecbf2e2b0d56942cc50583eafbc41f96db8981b06e876dca8002ec059ebe
SSDEEP 3072:dtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:dIJjiJcbI03GBc3ucY5DCSj
TLSH
T11B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcxusmkfcx.sys

Path C:\Temp\fcxusmkfcx.sys
Size 293KB
SHA256 0c54893b8a3fcec1e4616bbbc4a4b014245a8eaa4d571c8695971979a15d09fa
MD5 d5bbe960e7e43fbe0b595eab91b110ad
SHA1 94b046387d4ee05dad8f05cb9bd62f7cad184b88
SHA512 2016715e88ee1ee3bf9f958aaa1fe7ef83631606ec702ec86544272428d2e4bbc68ab613c841689bb2f6f128ccbe69ad9707420533f2baf48001406d97ab2dab
SSDEEP 3072:ftKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:fIJjiJcbI03GBc3ucY5DCSj
TLSH
T155545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvpkhfax.exe

Path C:\Temp\fdxvpkhfax.exe
Size 722KB
SHA256 4ac5f6990b611e073dbc1bdfe0bc3c4bf0efd5a599de21b76a0c3f27ea1dd97e
MD5 78a245e5c2ebd5f0a8487cf3ba09aa76
SHA1 8c8e75032de3e29e1c488d34e317661fbb3c2a59
SHA512 63c9a0d7f8d1097994ad73fbdbd999039cda48c186bee823921eff89a4d5f08bdbec8e1e33a58969a2175460062b3a6a99a1ad5ae0c545a40d1829e8bf6e72a3
SSDEEP 12288:IflfAsiVGjSGecvXAflfAsiVGjSGecvX:UMcfcMcf
TLSH
T121F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fdxvpkhfax.exe

Path C:\Temp\i_fdxvpkhfax.exe
Size 722KB
SHA256 54e7eb5fe45a38352b3724bba567f082f9b1b59217aec47011bbe5817bfcdd47
MD5 65ea1d9a4faa429f00413102fc4d1e0e
SHA1 1c1da5915b2d31025652c86cd5e846a8070f0e2a
SHA512 d44452ddf1afda7be9c134f637a29d5aacb14f48d276e55ca797a735a4b96882695d71e795059575185f53578032c80a42c58d7d088b7e4da58b87fcc5a4aa7d
SSDEEP 12288:YflfAsiVGjSGecvXAflfAsiVGjSGecvX:EMcfcMcf
TLSH
T104F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jhezwrpjhb.exe

Path C:\Temp\i_jhezwrpjhb.exe
Size 722KB
SHA256 18878f8a2cd24b3d718a38d0bcfa7d3e05ad7296f8287831816dd7a1350ed2dd
MD5 de3b9d55f485fe45fd32cb8f306b4b3f
SHA1 0c2ccd9b5f2edfbc793d7fc946b7985418117104
SHA512 3275e294dfe6bd5b01c1f5bad6e1c279637ba21b39b4350a05aa95c70923c76db8c1d5cb5b92eb0ed86d69ac40e838316180d95ca32374731706977ea3ef6374
SSDEEP 12288:QflfAsiVGjSGecvXAflfAsiVGjSGecvX:MMcfcMcf
TLSH
T192F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qnifaysqki.exe

Path C:\Temp\i_qnifaysqki.exe
Size 722KB
SHA256 9e414d5ab19637d1cf79bc48279c6a923cd0c38108907afd58b4847ebf86fd2d
MD5 bcc8a74ad237c98605b9046097bdaffa
SHA1 e594df994bcc3f5a8e90e08c10c59c3e1e8cd188
SHA512 48b75ed7624c7a7eea8be05a38c5da07ae95e039ebe85df1d92368ad76a913786050a3b7eb561ce2fc87131439629eaff9efd8adf5e18b135b0d53dd3009d5f0
SSDEEP 12288:9flfAsiVGjSGecvXAflfAsiVGjSGecvX:1McfcMcf
TLSH
T127F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xvpnkfdxvp.exe

Path C:\Temp\i_xvpnkfdxvp.exe
Size 722KB
SHA256 6fd7d42c326850c42b29d136014122be7c617279a3469f9c16bf74762cd299c7
MD5 8592b868db3c337e8a0220c56692891a
SHA1 a7ccda79f6b90651c2908bf5a2d4648cdc59d44a
SHA512 6d9e7ef0ecd37dd602e00060758e17d2ee150b1e813560750f1114063bc16ca56a963f98696c7fb08212bbb51f698b86454a92543bdd32fc118ed36d0675813e
SSDEEP 12288:GflfAsiVGjSGecvXAflfAsiVGjSGecvX:SMcfcMcf
TLSH
T1D0F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zwupmkecau.exe

Path C:\Temp\i_zwupmkecau.exe
Size 722KB
SHA256 ba9dc69a015285d4c2e1ae8c612686fc12f44226414848a6b1c41669e8619988
MD5 1d864f555835282774f66427f01de1e4
SHA1 cd965d1f626a190d5c285e03413a35ca6ddb52d8
SHA512 d83981778ed69a67a787bfa79f802b3db2bf3798d99172acd529118f738115b3a3463bd7e3efe19832eb1f063b7a1b98f686eeca6b80b73e6b8da56896e1bc2b
SSDEEP 12288:DflfAsiVGjSGecvXAflfAsiVGjSGecvX:LMcfcMcf
TLSH
T1CCF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhezwrpjhb.exe

Path C:\Temp\jhezwrpjhb.exe
Size 722KB
SHA256 163f8b0c628d3ea7e883e03495edd98f9bec17e136a6364f5c387c0013b1f348
MD5 3436750a868b3d8e7a15e1549af48e92
SHA1 175b10ce905731e42c532137cac9e6def2dde4d1
SHA512 e2f0e2b59741fc1b3073dd4bbfd3e244b8f432db1b2aa3cbcc17350c9cf0deb9e9af5537900b8ebf305deeea7ae156b39b87b5e3641b90a70a9841af85744465
SSDEEP 12288:aflfAsiVGjSGecvXAflfAsiVGjSGecvX:2McfcMcf
TLSH
T1A1F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfzxrpkhc.sys

Path C:\Temp\nhfzxrpkhc.sys
Size 293KB
SHA256 6f82decdff55435bcb9517b7a73995c204f99d73291252f45c8987c65bb61d0a
MD5 047fa4c093e76dcbde21d5cf42dbfaa2
SHA1 541cb5da04972274d782a4a1cf25b56cab126145
SHA512 41f7b31a510f0740fe8864c2662cd31721ecd16624670f947efba9f8644593acca5c3e47a31e576ce78ad791bc57475ca334e64bebe53e597042b4f09bfb9041
SSDEEP 3072:QtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:QIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A2545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nifaysqkidavsnlf.exe

Path C:\Temp\nifaysqkidavsnlf.exe
Size 722KB
SHA256 1ebfacc85c2c873cef37213bbef23132741242085fa8e4569f24cba4c1a9d1c6
MD5 450f32539aa964446e2b4765de9977ef
SHA1 1dd00bc98f8ec0013e2861a6cf94b96ed24b4834
SHA512 3de92bdd92f1b5eee6448e0625ecb8eb66063fe417a2ed8ebb88b298449003b395ff8e4bb1ccc570d31012acee6095bbee3571382bc2bd5a22119cda6c2de235
SSDEEP 12288:CflfAsiVGjSGecvXAflfAsiVGjSGecvX:uMcfcMcf
TLSH
T1B2F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nifaysqkidavsnlf.sys

Path C:\Temp\nifaysqkidavsnlf.sys
Size 293KB
SHA256 6fa7f3000ed76404714836c8327690388f2560d43ee098a6be8320606848ed19
MD5 dba39c8b041cfe25e4470b48b435d25e
SHA1 3a82325aed4d36ce1a22c66905ff927273f66c8c
SHA512 2502181b7206c23246b02a081fa7443d509433dd55a81c28430b61ae8c1efc1400b638ffd5067b309949c94a1af471fc23c12c64f19895e4074cd983f95836ec
SSDEEP 3072:DtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:DIJjiJcbI03GBc3ucY5DCSj
TLSH
T12F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnifaysqki.exe

Path C:\Temp\qnifaysqki.exe
Size 722KB
SHA256 8a7c8fc4031f54f3816f40ba2ddf5c04c3489ff1ea2dbcb7b1ad22e7158eea57
MD5 7451bb17bc7988b8bf3ac0f5585b1ec0
SHA1 f8214d4e15eaf618e602cc039d49a867bf374c66
SHA512 b5c263d6e87076dfec0d7d40697a7f4f900360769910dda96a21e4a9e9ed6d523f658a215c8df4c09dfc43ac5a6143167e03e3d6d556aaa879ffd18e5355c1c2
SSDEEP 12288:tflfAsiVGjSGecvXAflfAsiVGjSGecvX:FMcfcMcf
TLSH
T180F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmjecwuomg.sys

Path C:\Temp\rmjecwuomg.sys
Size 293KB
SHA256 4dbd049f4510b54f5175d4990b65bb809426f367ff3be5ae99218aeca406f897
MD5 f1c421e47c91138490a03e70929c099e
SHA1 bf9469481cd8d5075a3fee661a6482bea2391d46
SHA512 d5e012c24298eca1f393e059b519ecc448b2edcfc71d8bca5dac4eeba33b493f7a2ba5e7decc3df3d32e7bd4ae71f9b34e204cc47a21f08db437a27948525d81
SSDEEP 3072:DtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:DIJjiJcbI03GBc3ucY5DCSj
TLSH
T1EE545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlfdxvsqk.sys

Path C:\Temp\sqlfdxvsqk.sys
Size 293KB
SHA256 0abe105f1f1b7915ca237752b73354d98ebdb7bbd43da536eeefb1bc90b9223b
MD5 68e0527a301c3b2b70c3039e5cf1abf8
SHA1 a670cc01d029fa32236c4f8a8e8b99b6ee03716d
SHA512 4cec47fc111e251e37b5ba3cb0dcd26b118e53240d545c5e16aa40f45bbc737211317565b52ad9131990db3062119e998400ad41b91d3e8810185d939fd06983
SSDEEP 3072:TtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:TIJjiJcbI03GBc3ucY5DCSj
TLSH
T176545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tomgeywroj.exe

Path C:\Temp\tomgeywroj.exe
Size 722KB
SHA256 139990fad57d90973a02ae232d947d956db9f9873df3f3de7f813598550880ef
MD5 00155dbf3b9d2faf9860fe1a9805049a
SHA1 ac4ca9a0df035c7f0fca12fa460c67d702c5e617
SHA512 f7b074946522fbb1b61218a045b7711d575df4caaee2a7960d65adc61c9021421633b3d7cff7c1e0a9609f8d7e5aee28278b19b94b93f0781c9356be2a4e7c90
SSDEEP 12288:DflfAsiVGjSGecvXAflfAsiVGjSGecvX:LMcfcMcf
TLSH
T179F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvpnkfdxvp.exe

Path C:\Temp\xvpnkfdxvp.exe
Size 722KB
SHA256 e349af51e5b26fa911ed8690561991266f75d4712f75d8ec074b4c8f10f7ab3a
MD5 d70c8ee7279dd5ff66b04dc12a166855
SHA1 7b0feb4a1b59270d6bf4a5e36618fc70121b0726
SHA512 f1ea469e44d8fa8403fe1a0fb8b511bec8c70e0216de1b5bf68107b1355d2562100393297449767a645a6c79d6d86af34f1a5c5bf466466fdeba28fa5cd3524e
SSDEEP 12288:3flfAsiVGjSGecvXAflfAsiVGjSGecvX:PMcfcMcf
TLSH
T126F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwupmkecau.exe

Path C:\Temp\zwupmkecau.exe
Size 722KB
SHA256 bc14af91cbc7d3b8f1b60c7a700567d50ffb3c9d8e42c822a404446cca05c140
MD5 de5e9dba37ee9f1f579f637b5bfc3d38
SHA1 299fb683e8583b0add19db30d23ee94fb7c9dab6
SHA512 56355562251cb7b29a15cbf5b6f8f49e7fd9bf72edabe07336974f8cd370c7e91782c0fc851584eeac112f0a20f9048309fa968c26746a6f2c39caf257010e10
SSDEEP 12288:iflfAsiVGjSGecvXAflfAsiVGjSGecvX:OMcfcMcf
TLSH
T179F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee00825bbd5a4f21308ad2e10e5a9d3c4512f07fbd288ec8ac76788de6019e25
MD5 c3584e6bc22b3ad2f168ede48d20a993
SHA1 ffb4ecef8f65638ca17e16a32806195193977c7e
SHA512 5fd777359305e67e9f30fc404af9013a876846b1d6db271fa73dfcf2ee22fb25a8e26d4d0c970cc3a8219df11038dc6b4c2c411db652593bda1c3d7643753c0b
TLSH
T18AD02B7637C40404C0D0747621F34602D530C520584C81088801B03CCC207C3010A8DB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c80f71026fa07cc9b3e69c8779d4b4b40710cf7bc2893b740943db0d0f79591a
MD5 590eca05f11ec72644a09f205b548fbc
SHA1 c6521700bee3b500259ee3a70292b90201f20597
SHA512 fddd457c35c61ceb727f99bd39f55314cdeb7d062798c573a377675121f972ed95109fec329f911c502139a1794b70e5a98a57dd3b21b5a70e6518890a361f66
TLSH
T1E7D02B7A37C40404C0D0747221F24602D530C520AC4C81088801702CCC207C3010B8EF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e24cffe39cac4cde8e7f4899249b4a73b1938c2224c870ad8c3f8b712e4fe5ca
MD5 7dfd0d0b00321cc8d30b8e8d2dd704cd
SHA1 fc3bbf455a7d2c83d1d605892c9b9aeb16187e25
SHA512 4f95f6ae38cbc948ad2add0aefe19e17e23fffa88512411dddceeb22f52b535deb0431bd8571b1d15cc394324f8fadb5e189bb5542983ad09b27f4526f886389
TLSH
T1DE613C5C2B6905F1D7DC5CB941ED54A932FB84500F0BBA01C4586DB7EC2AF3452C1363
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f8ae.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59f8ae.TMP
Size 3KB
SHA256 ff8705a3ca59e1652f18d41e751e0d83a2a778d6aeb56c0913c2e3a72ed11422
MD5 1a96e497f2ab641e1f1164b2350ab0b8
SHA1 59deb048045742316a5cfce867b9e1de55333131
SHA512 1296e6eca2dff879f264e30e3b33960005e42652e423482a08e683099a0dfe9d41c5d146e5205eb38429f587bf7146f1114b51faa10bd64dba4a25af0c4eeb70
TLSH
T1A2613C5C2B5905F1D7DC5CB981AD54A932FB84540E0BBA01C45C6DB7EC2AF3852C5363
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9e5f16d9-bdcd-4833-bf26-4550cd4f01e9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9e5f16d9-bdcd-4833-bf26-4550cd4f01e9.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 de89475755308c80412f10d7be54f99580762cc4f30d9f6a79615a5abda650f5
MD5 650792fd55e52bd6a74e9d61dd85edb7
SHA1 dc73e69740956e79d17d679cdf04a372d22e2827
SHA512 9e19d13c251d55734773fb61457aea873cbe6d71f9e8ad6aefa8c1ff366ce6e3dededce931b2a9fd841e0c1ff1520f1be58828d4f5639548174f2dd6bda883d2
TLSH
T1A251EEF3C7E8866EC90155F4AB187E2BCE1D0915832C3D5A89E4EF1BA3E2471E14195E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 48e7c7ea70347a64b836c9960e75714ef80323b915c7e79978c7bc1fa919cb19
MD5 de7153b7d0efa271fc2793a833f6de3c
SHA1 e1fced011f8a4cac5c6222bdc5c9344e9bff4ca3
SHA512 4e1bcbf387da94cd58d1e01c71975e3094b9a9c26c3057b26b30393865e28efeb8b18c4f7167af22b48ca4f64b5726efa0495e5b6dd633d75c843371971744fe
SSDEEP 192:sxRmR+yM/jK1Ml8wCi/fZsIDikSZ2/OzoA8pi/g6+WNIYZFL8bGnIgtJ:sxRmg8i/fZsyik02ri/5ISL3
TLSH
T1D052DA166A2499778CCBD31CFA557F93D6F81563A2941E44ABFCCA0C40E7ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 82770b7f5325ff0e40fae867b2485691de0c91b1fc57fee62b2cacaa1e51661b
MD5 8e9dfcba387831ac26fc480aa44f8dd3
SHA1 1cca84a94e7a58bc0d7ef5272b4883b251625600
SHA512 85db0f57a3cb24788fb2f4d5e6ad742f8ebfa641fe187f0e9595e572bd7f744553221cdbb601de2d44047154b15473b4f28ef234c2c27621d07671276c06aecd
SSDEEP 192:sxRFR+yM/jK1Ml8wCi/fZsjDikSZ2/qzoA8p99/g6+WNIYZFLKbGnIgDRJ:sxRFg8i/fZsPik02PP/5ISpP
TLSH
T1E062DA166A2499778CCBD218FA557F93D6F81563A2941E44ABFCCB0C40E7BDD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 793593df9b7f569645000b4db3ccf889ea327d9726f68df68b942d806998fc8a
MD5 2d930788a5e086fe17da4e899b55674c
SHA1 138b17f15dd6c168220bfad7f993b6ba6ea53092
SHA512 d303ba85807532e7d4e03c015107d9c28eb247fc8bc1b6127973b11447218aaa7b0ded52d902681912753754f2101db5d96e15935d29cd641a543f9e02f02305
SSDEEP 192:sxRFR+yM/jK1Ml8UQyCi/fZsjDBkSZ2/qzoA8pr9/g6+WNIYZFLgbGnIgDDJ:sxRFgqFi/fZsPBk02Ph/5ISXZ
TLSH
T1B462D9166A2499779CCBD208FA557F93D6F81573A2941E44ABFCCB0C40E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 57afc3f48bc659947d1304b14a7e9bd589a24854cdd2cb03f7439f9920e75680
MD5 27c9d9b3939e4fa7792095a64043d887
SHA1 2f19e747e7ba1d11835cdf8a2758960c17008a3e
SHA512 ee970cf57f92a2a64fc7c0dd4a0df2901431139b6b5b7cc898007e246c3eadd0fbae7e787faedac93ccc30a5afb834faf72e0b84a08d217d490e0dbd34175f57
SSDEEP 768:KduEf67pLuL7RwWgNhfsN8F1+UoAYDCx9Tuqh0VfUC9xbog/OVD7gwLI+roJz4K0:KduEfSE7RwWgNhfsNu1jaU7ggIVJ8K0
TLSH
T197E2EB7B680CCB7E4F804E9CEC29BDDAADE801CB56D8C95447EA880C03C67EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a16f3dbe-22ad-4969-ba50-cf95127950ab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a16f3dbe-22ad-4969-ba50-cf95127950ab.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c267618cbd002a35e4f5dc9c57ac733f419876211e14c1a87a7e39531e6a544e
MD5 bab32e0cf54de536fafba0e6fd1ff374
SHA1 4a3c61d95f71a476724f6fb0e9619e30ef27bc4f
SHA512 f98c9bfd2ca0089b8d18470950e95024bdbf3cb4caf4391e1e9ba1a3971658f02e35f806813ea22b6cc277a26b6dc94bec0c3ff9cbeb4a6471dee9054c288c5b
SSDEEP 768:srv+4UNbda3tLnl+LeSFOUDIX4fouOToPvB2thtA9VAgiC:sbsbg3BsnnwthttXC
TLSH
T1F903BE32A4AD8D73DDE6D298720B76D36FB411A358C00F88EAD95B4D058B9DE1B0BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 54bb6e9edb65cbdeb0c217dccf75c32d503285f0f8d118de9d70c621a2699b80
MD5 3970e4f00cf579e7fbe8db39716d375e
SHA1 8ec221c73e9edebd6224a85f4cc10af117faaa2e
SHA512 f22a2c0f9015cbbea6be98b6b5b1cf58c704c226b5e769350ba4d922f73a62e0137aaedae2bafca5908f80a1d00ec3e86e5868c25b1cf3dfeb50cba03f4b8775
SSDEEP 768:grv+4UNbdH3oA+LeSFOUDHX4fouOToPvB2thtA9VAwUeVH1SlX:gbsbh36snnwthttlEH1Y
TLSH
T13103CF32A8A88933DDD6D388310B72572FF4916396900FC4DADD2B4D069B9DE170BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 68cd796ae5afeb979499c46e206a99b43b96a019bef0b9c19ab83a89fc666f62
MD5 0b3028a12f924a7e03d42822d4d5a078
SHA1 5751ee6e56d7e6476a5d11d998ee988740dfb455
SHA512 9d44c0a70757ef8353e1a533dddde070037c1639f5ea182ca140cc790b74cb45ddbc4e0122925a91b4f21e34c8857b34a6ce84dec5ce37c4645424d3247c50de
SSDEEP 768:mF1j+9q3hwgYLWAl1OUDuX4fouOToPvB2thtA9VAgib9M9:T9q3PsnnwthttXb+9
TLSH
T15B039D32D899CE6BEDE6C7D9730A76869EE011A385C85EC8DBD85E4D00C76ED0B0BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a0e1082409eaf6324ab1080a920b62e9b672d40d97f82a31cbddfda1249f28c9
MD5 806ae2fe2007a48e91b230676190c129
SHA1 df094882fbf92504c57669d6f1a289636bf0ae94
SHA512 8ef5e2a528c29b17ed52d5813719fbb40d83d3b559143a52270bc2139e39e5ccc160a25d9e51467cdfb661d8110b12f3f9743a9d042cc6ec555511eef8439b2a
SSDEEP 768:9j+9c3tLWl+LeSFOUDSX4fouOToPvB2thtA9VAgib9M9:49c3wsnnwthttXb+9
TLSH
T134F2AE32A89A8D63DDD6D3A8721B37D26FF051B355C01F88DFD95B0D0587AAD0B0B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

8f3c60cf-457f-4baa-b96c-47cf819ab1a2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8f3c60cf-457f-4baa-b96c-47cf819ab1a2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2400_959156963\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 90f54725e7069f48d433fe44fc2f39386a4f46ee2646b5843ff404683d29cef4
MD5 373d86cb6c681904aa40ca3207bd2d19
SHA1 1229d408a83d4772cc9e9fea598f43ea150c9379
SHA512 dd784deea303e7f840c213cb09e1a5a745c7da98f95bf444a5c13cc23d2beae21b882d0a67052afbe94a144c55e28ee402ed2183e23a3e69fb00296ee9414d06
TLSH
T13A71238356ADCAB2C1DE5FF102835644F6FB2238476330200BA55587AB70B3B54B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/852-437-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/936-340-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/936-370-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1496-487-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1984-507-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2008-402-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2536-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2892-283-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3100-324-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3612-241-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4492-462-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4676-390-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4928-319-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4976-269-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5032-426-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5324-458-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5376-206-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5416-312-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5416-320-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5552-422-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5612-369-0x0000000000010000-0x00000000000AB000-memory.dmp

Download