69c2558686e344f0855c3e514e6fc57cec91117869d1a87340d602d6d7b7a541

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 16:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 722KB
Sample260710-tr7rnacy2k
SHA256 69c2558686e344f0855c3e514e6fc57cec91117869d1a87340d602d6d7b7a541
MD5 4698a91f408229808e46ef0436aba549
SHA1 f2ff486fd4666a00f366824da47a08f52fafdb92
SHA512 746aee4b28f8635e913c1912c684aac708f853e94bd758e291952812817d4267222c365f459c61fadc629baa1a7733376fdf565bf0573cf5e77ec1444960d274
SSDEEP 12288:KflfAsiVGjSGecvXAflfAsiVGjSGecvX:GMcfcMcf
TLSH
T1A8F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3956	nhfaxvsnkxvpnhfa.exe
2252	nhfaxvsnkxvpnhfa.sys
4408	CreateProcess.exe
2200	kfcxupkfcv.exe
2852	CreateProcess.exe
3252	CreateProcess.exe
5864	i_kfcxupkfcv.exe
5840	khcaxspkhc.sys
1456	CreateProcess.exe
1128	apjhczuspk.exe
4788	CreateProcess.exe
4536	CreateProcess.exe
1864	i_apjhczuspk.exe
3112	mkecwupmke.sys
4416	CreateProcess.exe
5964	hczurmkecu.exe
1732	CreateProcess.exe
700	CreateProcess.exe
2724	i_hczurmkecu.exe
5900	pjhbztrmje.sys
1160	CreateProcess.exe
4864	bztrmjeywr.exe
5468	CreateProcess.exe
5772	CreateProcess.exe
1088	i_bztrmjeywr.exe
1532	jgbywtomge.sys
4300	CreateProcess.exe
1868	bztrlgeywq.exe
3892	CreateProcess.exe
2092	CreateProcess.exe
3272	i_bztrlgeywq.exe
3116	dytjdbvtnl.sys
3320	CreateProcess.exe
4468	igdytqljdb.exe
5372	CreateProcess.exe
5480	CreateProcess.exe
5908	i_igdytqljdb.exe
4552	tqlidbvtnl.sys
2368	CreateProcess.exe
2420	davtnlgayv.exe
2588	CreateProcess.exe
6064	CreateProcess.exe
940	i_davtnlgayv.exe
3800	nlfdxvqnig.sys
3212	CreateProcess.exe
3664	faysqkicav.exe
1088	CreateProcess.exe
3424	CreateProcess.exe
4380	i_faysqkicav.exe
5932	kfdxvpnhfa.sys
260	CreateProcess.exe
5020	axspkicaus.exe
2684	CreateProcess.exe
1836	CreateProcess.exe
5840	i_axspkicaus.exe
4184	hfzxrpjhcz.sys
1652	CreateProcess.exe
2760	xrpjhczusm.exe
2984	CreateProcess.exe
5360	CreateProcess.exe
2616	i_xrpjhczusm.exe
1880	pkhcausmke.sys
5932	CreateProcess.exe
3724	urmkezxrpm.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1093027215\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_2102481366\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1347972785\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_171673810\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1093027215\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1093027215\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1093027215\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1347972785\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_171673810\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 40 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faysqkicav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqoljdbyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqndavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkhfzxusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_apjhczuspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davtnlgayv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqoljdbyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqndavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmkezxrpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbztrmjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfaxvsnkxvpnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywrojgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywrojgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczurmkecu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrlgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davtnlgayv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axspkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daysqlidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnkfcavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkhfzxusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrmjeywr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axspkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igdytqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbztrmjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczurmjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfcxupkfcv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hczurmkecu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrmjeywr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igdytqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faysqkicav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpjhczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_daysqlidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfcxupkfcv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	apjhczuspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrlgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmkezxrpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnkfcavsn.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5152	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3088	ipconfig.exe
5164	ipconfig.exe
248	ipconfig.exe
4596	ipconfig.exe
1852	ipconfig.exe
5376	ipconfig.exe
4536	ipconfig.exe
2652	ipconfig.exe
1832	ipconfig.exe
5404	ipconfig.exe
4260	ipconfig.exe
5740	ipconfig.exe
384	ipconfig.exe
4564	ipconfig.exe
2548	ipconfig.exe
2576	ipconfig.exe
808	ipconfig.exe
5172	ipconfig.exe
4884	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134281739243477851"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{DD6B6E5A-B8A4-4A53-AD3C-DD75FC568E57}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3956	nhfaxvsnkxvpnhfa.exe
3956	nhfaxvsnkxvpnhfa.exe
3956	nhfaxvsnkxvpnhfa.exe
3956	nhfaxvsnkxvpnhfa.exe
3956	nhfaxvsnkxvpnhfa.exe
3956	nhfaxvsnkxvpnhfa.exe
3956	nhfaxvsnkxvpnhfa.exe
3956	nhfaxvsnkxvpnhfa.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	5864	i_kfcxupkfcv.exe
Token: SeDebugPrivilege	1864	i_apjhczuspk.exe
Token: SeDebugPrivilege	2724	i_hczurmkecu.exe
Token: SeDebugPrivilege	1088	i_bztrmjeywr.exe
Token: SeDebugPrivilege	3272	i_bztrlgeywq.exe
Token: SeDebugPrivilege	5908	i_igdytqljdb.exe
Token: SeDebugPrivilege	940	i_davtnlgayv.exe
Token: SeDebugPrivilege	4380	i_faysqkicav.exe
Token: SeDebugPrivilege	5840	i_axspkicaus.exe
Token: SeDebugPrivilege	2616	i_xrpjhczusm.exe
Token: SeDebugPrivilege	5456	i_urmkezxrpm.exe
Token: SeDebugPrivilege	1308	i_hbztrmjecw.exe
Token: SeDebugPrivilege	5904	i_ywrojgeywq.exe
Token: SeDebugPrivilege	5304	i_ywqoljdbyw.exe
Token: SeDebugPrivilege	3088	i_daysqlidav.exe
Token: SeDebugPrivilege	6012	i_yvqndavsnl.exe
Token: SeDebugPrivilege	5956	i_vpnkfcavsn.exe
Token: SeDebugPrivilege	5780	i_spkhfzxusm.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4384	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 3956	4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	87
PID 4656 wrote to memory of 2956	4656	2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 2956 wrote to memory of 4384	2956	iexplore.exe	89
PID 4384 wrote to memory of 3820	4384	msedge.exe	90
PID 4384 wrote to memory of 1940	4384	msedge.exe	93
PID 4384 wrote to memory of 5152	4384	msedge.exe	92
PID 4384 wrote to memory of 1940	4384	msedge.exe	93
PID 4384 wrote to memory of 1940	4384	msedge.exe	93
PID 4384 wrote to memory of 900	4384	msedge.exe	94
PID 4384 wrote to memory of 900	4384	msedge.exe	94
PID 4384 wrote to memory of 5896	4384	msedge.exe	95
PID 4384 wrote to memory of 5896	4384	msedge.exe	95
PID 4384 wrote to memory of 5896	4384	msedge.exe	95
PID 4384 wrote to memory of 5816	4384	msedge.exe	96
PID 4384 wrote to memory of 5816	4384	msedge.exe	96
PID 4384 wrote to memory of 5816	4384	msedge.exe	96
PID 4384 wrote to memory of 352	4384	msedge.exe	97
PID 4384 wrote to memory of 1096	4384	msedge.exe	98
PID 4384 wrote to memory of 352	4384	msedge.exe	97
PID 4384 wrote to memory of 352	4384	msedge.exe	97
PID 4384 wrote to memory of 1096	4384	msedge.exe	98
PID 4384 wrote to memory of 1096	4384	msedge.exe	98
PID 4384 wrote to memory of 2976	4384	msedge.exe	99
PID 4384 wrote to memory of 2976	4384	msedge.exe	99
PID 3956 wrote to memory of 4408	3956	nhfaxvsnkxvpnhfa.exe	103
PID 2200 wrote to memory of 2852	2200	kfcxupkfcv.exe	106
PID 4384 wrote to memory of 4256	4384	msedge.exe	109
PID 4384 wrote to memory of 5188	4384	msedge.exe	110
PID 4384 wrote to memory of 4256	4384	msedge.exe	109
PID 4384 wrote to memory of 5188	4384	msedge.exe	110
PID 4384 wrote to memory of 3080	4384	msedge.exe	112
PID 4384 wrote to memory of 5848	4384	msedge.exe	113
PID 4384 wrote to memory of 5848	4384	msedge.exe	113
PID 4384 wrote to memory of 5432	4384	msedge.exe	116
PID 4384 wrote to memory of 5432	4384	msedge.exe	116
PID 3956 wrote to memory of 3252	3956	nhfaxvsnkxvpnhfa.exe	117
PID 3956 wrote to memory of 1456	3956	nhfaxvsnkxvpnhfa.exe	121
PID 1128 wrote to memory of 4788	1128	apjhczuspk.exe	123
PID 3956 wrote to memory of 4536	3956	nhfaxvsnkxvpnhfa.exe	126
PID 3956 wrote to memory of 4416	3956	nhfaxvsnkxvpnhfa.exe	130
PID 5964 wrote to memory of 1732	5964	hczurmkecu.exe	132
PID 3956 wrote to memory of 700	3956	nhfaxvsnkxvpnhfa.exe	135
PID 4384 wrote to memory of 3972	4384	msedge.exe	137
PID 4384 wrote to memory of 3972	4384	msedge.exe	137
PID 4384 wrote to memory of 3972	4384	msedge.exe	137
PID 4384 wrote to memory of 2416	4384	msedge.exe	140
PID 4384 wrote to memory of 2416	4384	msedge.exe	140
PID 4384 wrote to memory of 2416	4384	msedge.exe	140
PID 3956 wrote to memory of 1160	3956	nhfaxvsnkxvpnhfa.exe	142
PID 4864 wrote to memory of 5468	4864	bztrmjeywr.exe	144
PID 4384 wrote to memory of 4472	4384	msedge.exe	147
PID 4384 wrote to memory of 5640	4384	msedge.exe	148
PID 4384 wrote to memory of 720	4384	msedge.exe	149
PID 3956 wrote to memory of 5772	3956	nhfaxvsnkxvpnhfa.exe	150
PID 3956 wrote to memory of 4300	3956	nhfaxvsnkxvpnhfa.exe	154
PID 1868 wrote to memory of 3892	1868	bztrlgeywq.exe	156
PID 3956 wrote to memory of 2092	3956	nhfaxvsnkxvpnhfa.exe	159
PID 3956 wrote to memory of 3320	3956	nhfaxvsnkxvpnhfa.exe	163
PID 4468 wrote to memory of 5372	4468	igdytqljdb.exe	165
PID 3956 wrote to memory of 5480	3956	nhfaxvsnkxvpnhfa.exe	168
PID 3956 wrote to memory of 2368	3956	nhfaxvsnkxvpnhfa.exe	172
PID 2420 wrote to memory of 2588	2420	davtnlgayv.exe	174
PID 3956 wrote to memory of 6064	3956	nhfaxvsnkxvpnhfa.exe	177
PID 3956 wrote to memory of 3212	3956	nhfaxvsnkxvpnhfa.exe	181

C:\Users\Admin\AppData\Local\Temp\2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_4698a91f408229808e46ef0436aba549_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Temp\nhfaxvsnkxvpnhfa.exe
  C:\Temp\nhfaxvsnkxvpnhfa.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3956
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kfcxupkfcv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4408
  - - C:\Temp\kfcxupkfcv.exe
      C:\Temp\kfcxupkfcv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2200
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2852
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4536
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kfcxupkfcv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3252
  - - C:\Temp\i_kfcxupkfcv.exe
      C:\Temp\i_kfcxupkfcv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\apjhczuspk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1456
  - - C:\Temp\apjhczuspk.exe
      C:\Temp\apjhczuspk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1128
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4788
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3088
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_apjhczuspk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4536
  - - C:\Temp\i_apjhczuspk.exe
      C:\Temp\i_apjhczuspk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hczurmkecu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4416
  - - C:\Temp\hczurmkecu.exe
      C:\Temp\hczurmkecu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5964
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1732
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5164
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hczurmkecu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:700
  - - C:\Temp\i_hczurmkecu.exe
      C:\Temp\i_hczurmkecu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2724
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bztrmjeywr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1160
  - - C:\Temp\bztrmjeywr.exe
      C:\Temp\bztrmjeywr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4864
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5468
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5740
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bztrmjeywr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5772
  - - C:\Temp\i_bztrmjeywr.exe
      C:\Temp\i_bztrmjeywr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1088
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bztrlgeywq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4300
  - - C:\Temp\bztrlgeywq.exe
      C:\Temp\bztrlgeywq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1868
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3892
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2652
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bztrlgeywq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2092
  - - C:\Temp\i_bztrlgeywq.exe
      C:\Temp\i_bztrlgeywq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igdytqljdb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3320
  - - C:\Temp\igdytqljdb.exe
      C:\Temp\igdytqljdb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4468
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5372
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:248
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igdytqljdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5480
  - - C:\Temp\i_igdytqljdb.exe
      C:\Temp\i_igdytqljdb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\davtnlgayv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2368
  - - C:\Temp\davtnlgayv.exe
      C:\Temp\davtnlgayv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2420
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2588
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1832
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_davtnlgayv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6064
  - - C:\Temp\i_davtnlgayv.exe
      C:\Temp\i_davtnlgayv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:940
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\faysqkicav.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3212
  - - C:\Temp\faysqkicav.exe
      C:\Temp\faysqkicav.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3664
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1088
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5404
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_faysqkicav.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3424
  - - C:\Temp\i_faysqkicav.exe
      C:\Temp\i_faysqkicav.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\axspkicaus.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:260
  - - C:\Temp\axspkicaus.exe
      C:\Temp\axspkicaus.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5020
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2684
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_axspkicaus.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1836
  - - C:\Temp\i_axspkicaus.exe
      C:\Temp\i_axspkicaus.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpjhczusm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1652
  - - C:\Temp\xrpjhczusm.exe
      C:\Temp\xrpjhczusm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2760
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2984
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4596
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpjhczusm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5360
  - - C:\Temp\i_xrpjhczusm.exe
      C:\Temp\i_xrpjhczusm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2616
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urmkezxrpm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5932
  - - C:\Temp\urmkezxrpm.exe
      C:\Temp\urmkezxrpm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3724
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2464
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urmkezxrpm.exe ups_ins
    3⤵
    PID:256
  - - C:\Temp\i_urmkezxrpm.exe
      C:\Temp\i_urmkezxrpm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5456
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hbztrmjecw.exe ups_run
    3⤵
    PID:1404
  - - C:\Temp\hbztrmjecw.exe
      C:\Temp\hbztrmjecw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3316
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:976
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5172
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hbztrmjecw.exe ups_ins
    3⤵
    PID:5660
  - - C:\Temp\i_hbztrmjecw.exe
      C:\Temp\i_hbztrmjecw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1308
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywrojgeywq.exe ups_run
    3⤵
    PID:1880
  - - C:\Temp\ywrojgeywq.exe
      C:\Temp\ywrojgeywq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3348
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3332
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1852
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywrojgeywq.exe ups_ins
    3⤵
    PID:4564
  - - C:\Temp\i_ywrojgeywq.exe
      C:\Temp\i_ywrojgeywq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5904
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywqoljdbyw.exe ups_run
    3⤵
    PID:4708
  - - C:\Temp\ywqoljdbyw.exe
      C:\Temp\ywqoljdbyw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3056
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6108
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywqoljdbyw.exe ups_ins
    3⤵
    PID:5948
  - - C:\Temp\i_ywqoljdbyw.exe
      C:\Temp\i_ywqoljdbyw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5304
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\daysqlidav.exe ups_run
    3⤵
    PID:4396
  - - C:\Temp\daysqlidav.exe
      C:\Temp\daysqlidav.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2844
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2904
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2548
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_daysqlidav.exe ups_ins
    3⤵
    PID:1308
  - - C:\Temp\i_daysqlidav.exe
      C:\Temp\i_daysqlidav.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3088
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvqndavsnl.exe ups_run
    3⤵
    PID:2352
  - - C:\Temp\yvqndavsnl.exe
      C:\Temp\yvqndavsnl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5220
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3344
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5376
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvqndavsnl.exe ups_ins
    3⤵
    PID:5840
  - - C:\Temp\i_yvqndavsnl.exe
      C:\Temp\i_yvqndavsnl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6012
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vpnkfcavsn.exe ups_run
    3⤵
    PID:5156
  - - C:\Temp\vpnkfcavsn.exe
      C:\Temp\vpnkfcavsn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2120
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4528
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4884
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vpnkfcavsn.exe ups_ins
    3⤵
    PID:2792
  - - C:\Temp\i_vpnkfcavsn.exe
      C:\Temp\i_vpnkfcavsn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5956
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spkhfzxusm.exe ups_run
    3⤵
    PID:3972
  - - C:\Temp\spkhfzxusm.exe
      C:\Temp\spkhfzxusm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5952
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2616
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2576
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spkhfzxusm.exe ups_ins
    3⤵
    PID:5856
  - - C:\Temp\i_spkhfzxusm.exe
      C:\Temp\i_spkhfzxusm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5780
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hczurmjhbz.exe ups_run
    3⤵
    PID:5872
  - - C:\Temp\hczurmjhbz.exe
      C:\Temp\hczurmjhbz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1832
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3932
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hczurmjhbz.exe ups_ins
    3⤵
    PID:4780
  - - C:\Temp\i_hczurmjhbz.exe
      C:\Temp\i_hczurmjhbz.exe ups_ins
      4⤵
      PID:4400
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x304,0x7ffb17f7c188,0x7ffb17f7c194,0x7ffb17f7c1a0
      4⤵
      PID:3820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,9593069021641534461,11861204151662482790,524288 --field-trial-handle=2292,i,5689057382661900000,3856718759384515889,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:11
      4⤵
      System Time Discovery
      PID:5152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,1100745914134512416,7610814726557012266,262144 --field-trial-handle=2292,i,5689057382661900000,3856718759384515889,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
      4⤵
      PID:1940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,13891149582366043365,18221913624047470130,524288 --field-trial-handle=2292,i,5689057382661900000,3856718759384515889,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:13
      4⤵
      PID:900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,8426730357891181132,12961183874212741706,2097152 --field-trial-handle=2292,i,5689057382661900000,3856718759384515889,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
      4⤵
      PID:5896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,15388387473583766117,17993716767563065083,2097152 --field-trial-handle=2292,i,5689057382661900000,3856718759384515889,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      PID:5816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4328,i,17948160284882789510,7858812141024897905,2097152 --field-trial-handle=2292,i,5689057382661900000,3856718759384515889,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:9
      4⤵
      PID:352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4304,i,9174465884091513205,1710518047821920900,2097152 --field-trial-handle=2292,i,5689057382661900000,3856718759384515889,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:1
      4⤵
      PID:1096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,6924701518738055369,14367985333973357864,524288 --field-trial-handle=2292,i,5689057382661900000,3856718759384515889,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:14
      4⤵
      PID:2976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,8414079426929983650,9633500412211912191,524288 --field-trial-handle=2292,i,5689057382661900000,3856718759384515889,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
      4⤵
      PID:4256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3708,i,17939242056868784049,14764374452912687777,524288 --field-trial-handle=2292,i,5689057382661900000,3856718759384515889,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
      4⤵
      PID:5188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,16431565813162342006,13814654826657920990,524288 --field-trial-handle=2292,i,5689057382661900000,3856718759384515889,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
      4⤵
      PID:6044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,16431565813162342006,13814654826657920990,524288 --field-trial-handle=2292,i,5689057382661900000,3856718759384515889,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
      4⤵
      PID:3080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,16625285485160463994,16368809166403884816,524288 --field-trial-handle=2292,i,5689057382661900000,3856718759384515889,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
      4⤵
      PID:5848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,7410977829909501831,16219416724348646538,524288 --field-trial-handle=2292,i,5689057382661900000,3856718759384515889,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:14
      4⤵
      PID:5432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3544,i,11490100090467125820,17479429381332195695,2097152 --field-trial-handle=2292,i,5689057382661900000,3856718759384515889,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:1
      4⤵
      PID:3972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5048,i,6374919455434226050,13370318681823742543,2097152 --field-trial-handle=2292,i,5689057382661900000,3856718759384515889,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:1
      4⤵
      PID:2416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,8716526280819571188,11297817475734877001,524288 --field-trial-handle=2292,i,5689057382661900000,3856718759384515889,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:14
      4⤵
      PID:4472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,16536790925698450006,13211932976768055331,524288 --field-trial-handle=2292,i,5689057382661900000,3856718759384515889,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
      4⤵
      PID:5640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,14529994418053894692,18159554940974941381,524288 --field-trial-handle=2292,i,5689057382661900000,3856718759384515889,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
      4⤵
      PID:720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2772,i,7522477715504197232,9339309773899678902,524288 --field-trial-handle=2292,i,5689057382661900000,3856718759384515889,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
      4⤵
      PID:5976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,8819355346258651979,7322733997041594247,524288 --field-trial-handle=2292,i,5689057382661900000,3856718759384515889,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:14
      4⤵
      PID:3316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5304,i,17015428953038298288,4128794792040169156,2097152 --field-trial-handle=2292,i,5689057382661900000,3856718759384515889,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:1
      4⤵
      PID:2488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,13064613973304729673,14643346240868205533,524288 --field-trial-handle=2292,i,5689057382661900000,3856718759384515889,262144 --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:14
      4⤵
      PID:2120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,9921629388275812847,4043924528794436182,524288 --field-trial-handle=2292,i,5689057382661900000,3856718759384515889,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:14
      4⤵
      PID:4328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6772,i,12449275551346128278,8677097804547485440,262144 --field-trial-handle=2292,i,5689057382661900000,3856718759384515889,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:10
      4⤵
      PID:1852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,10496629984950711700,12652182444259914035,524288 --field-trial-handle=2292,i,5689057382661900000,3856718759384515889,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:14
      4⤵
      PID:2600

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5840

C:\Temp\nhfaxvsnkxvpnhfa.sys
C:\Temp\nhfaxvsnkxvpnhfa.sys
1⤵
- Executes dropped EXE
PID:2252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5956

C:\Temp\khcaxspkhc.sys
C:\Temp\khcaxspkhc.sys
1⤵
- Executes dropped EXE
PID:5840

C:\Temp\mkecwupmke.sys
C:\Temp\mkecwupmke.sys
1⤵
- Executes dropped EXE
PID:3112

C:\Temp\pjhbztrmje.sys
C:\Temp\pjhbztrmje.sys
1⤵
- Executes dropped EXE
PID:5900

C:\Temp\jgbywtomge.sys
C:\Temp\jgbywtomge.sys
1⤵
- Executes dropped EXE
PID:1532

C:\Temp\dytjdbvtnl.sys
C:\Temp\dytjdbvtnl.sys
1⤵
- Executes dropped EXE
PID:3116

C:\Temp\tqlidbvtnl.sys
C:\Temp\tqlidbvtnl.sys
1⤵
- Executes dropped EXE
PID:4552

C:\Temp\nlfdxvqnig.sys
C:\Temp\nlfdxvqnig.sys
1⤵
- Executes dropped EXE
PID:3800

C:\Temp\kfdxvpnhfa.sys
C:\Temp\kfdxvpnhfa.sys
1⤵
- Executes dropped EXE
PID:5932

C:\Temp\hfzxrpjhcz.sys
C:\Temp\hfzxrpjhcz.sys
1⤵
- Executes dropped EXE
PID:4184

C:\Temp\pkhcausmke.sys
C:\Temp\pkhcausmke.sys
1⤵
- Executes dropped EXE
PID:1880

C:\Temp\rmjebwuomg.sys
C:\Temp\rmjebwuomg.sys
1⤵
PID:6108

C:\Temp\bwuomgeywr.sys
C:\Temp\bwuomgeywr.sys
1⤵
PID:4756

C:\Temp\ywqoigeywt.sys
C:\Temp\ywqoigeywt.sys
1⤵
PID:616

C:\Temp\oigdyvtnlj.sys
C:\Temp\oigdyvtnlj.sys
1⤵
PID:5420

C:\Temp\xvqnlfdxvq.sys
C:\Temp\xvqnlfdxvq.sys
1⤵
PID:5428

C:\Temp\xvsnkicavs.sys
C:\Temp\xvsnkicavs.sys
1⤵
PID:3952

C:\Temp\pkhfzxvsmk.sys
C:\Temp\pkhfzxvsmk.sys
1⤵
PID:3840

C:\Temp\pmkecxuhfz.sys
C:\Temp\pmkecxuhfz.sys
1⤵
PID:2752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

apjhczuspk.exe

Path C:\Temp\apjhczuspk.exe
Size 722KB
SHA256 ea55252ca51b95149c31d1334b4c304686de5881039e1316f310ffa24b992f8c
MD5 6a1c3c80ad289ea7d8f116ab368aa427
SHA1 3c2cda916e2fd3ec52f28a8341c00f18782c3fc0
SHA512 9858d9fdb08eb29002fa32688725f05af3818ba4abb8bc9424d11d2eb6b189093047bac8892f39e4c2df61acce062f063d6695ab110d82cd53c46ce0c8af39e6
SSDEEP 12288:5flfAsiVGjSGecvXAflfAsiVGjSGecvX:RMcfcMcf
TLSH
T1EFF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztrlgeywq.exe

Path C:\Temp\bztrlgeywq.exe
Size 722KB
SHA256 589c1e843967318a2dcc09a68543259ad60184b56e98b0d09a76647a44cb3603
MD5 e2ccf75c22e1cd372371338e349454bf
SHA1 74e88344868422bbe7a1694f39321ce7814160e0
SHA512 764d5f6e8c419cfe524d23c7b74b00b872d2b824e586c0b8469cb4c50401bbc2cbc0236cbf70eaa729176901518e2d9717c258835d8380990b47aa1ea8d9bd8e
SSDEEP 12288:RflfAsiVGjSGecvXAflfAsiVGjSGecvX:ZMcfcMcf
TLSH
T11CF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztrmjeywr.exe

Path C:\Temp\bztrmjeywr.exe
Size 722KB
SHA256 f3faf9ec88eba252f0c3a4b5fa5ea90bd3800635fd584b66343e5900a6a48d56
MD5 b1461c536251eb2f84fa48dafe8ac72f
SHA1 bcc800d30cf288f68f7fb02ffdda501feb3b3284
SHA512 623a2b95106d62d659df7cb1c4bf22e81c7279e5581315642a59880ec4ecc33a165489486fa9f379859d94f2c52a249a99f257b0c5192767f0aba26bf532bd71
SSDEEP 12288:hflfAsiVGjSGecvXAflfAsiVGjSGecvX:JMcfcMcf
TLSH
T1E0F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dytjdbvtnl.sys

Path C:\Temp\dytjdbvtnl.sys
Size 293KB
SHA256 0e1685724ba386cb53718d6206bdf8cfbc23f943a9e3b183bb2397551444e172
MD5 f305fdb765e7eae2e1f858d201096ab7
SHA1 729caac0473727208fb2f1a044abf1a591dc3c46
SHA512 e945022d7378b866cf357a92b100ad3566e02e86c02a81dbb967f6a77b415ab562b09a8c773868add90199b37e324471584e26737b4d6e2ce881f1bc0112208e
SSDEEP 3072:MtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:MIJjiJcbI03GBc3ucY5DCSj
TLSH
T124545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hczurmkecu.exe

Path C:\Temp\hczurmkecu.exe
Size 722KB
SHA256 f21a8e3adf7af3712a2a80390a3f525de6fecdc65d9e2237b3ec4e2bea92abed
MD5 1ee9efdac676ee100f7b3fc79c0fe2d3
SHA1 097c88cb70e03e23236a4a9fb9eb5104e5d8c771
SHA512 d94ea2ba1bfbc297c5319494b6223a6f7b93f852b4d0362aff9f31e247d656cc6526392bf977e2f4b9c0b0b7b692fc6b73da2af9e593b720c5af46cbca803737
SSDEEP 12288:NflfAsiVGjSGecvXAflfAsiVGjSGecvX:lMcfcMcf
TLSH
T11EF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_apjhczuspk.exe

Path C:\Temp\i_apjhczuspk.exe
Size 722KB
SHA256 b51e260ab10f6f86c296cdfb90a84a76e182a73d7c9a16f02639c6b60d414071
MD5 62185f39174971f46044f355e4fb04b4
SHA1 195edb410adc479e760aef5ec3cf51007e3c5e4b
SHA512 d5f7f199559ec9acde78cf3f519a7dea60a68b600d4739fe3564dbdda3de73846db0f1117f7f794f9179d1850d39f837a962df134e4391be13ded3690d84e5b0
SSDEEP 12288:MflfAsiVGjSGecvXAflfAsiVGjSGecvX:YMcfcMcf
TLSH
T106F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bztrlgeywq.exe

Path C:\Temp\i_bztrlgeywq.exe
Size 722KB
SHA256 a52805f6183d335a681bd65cbfda03f2e4b467acaeca348856f7f9a2f14b81e1
MD5 8e1c00be4104419609839641d65f0dec
SHA1 ec7cd25093b901a5313c2a7fe3aa385707c03108
SHA512 9490f592768e0f905698f3f52f5e328fe7099387748c30102dad2558a6a116955998d48223ed6225369e3f8d25c6371ab780e76df94d7e1401dcabac257afdab
SSDEEP 12288:bflfAsiVGjSGecvXAflfAsiVGjSGecvX:zMcfcMcf
TLSH
T188F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bztrmjeywr.exe

Path C:\Temp\i_bztrmjeywr.exe
Size 722KB
SHA256 ba5c390ca8027cb6960716dc8b82f0cb79bab8d8fda2b487aa33f2d73c63cbdb
MD5 40d38a8beb816b2b0cfc6e5ed20cc4b4
SHA1 655f0e489b4834c5fba8d28d07593d1b5c86e468
SHA512 630da866690ff79a5b9bfb64de421dd77e18c173902e76704dea93fb9a18e08549723f661c14b8040cfba4b9c80838103c64ba64f3a80b461b05ec21089c4a99
SSDEEP 12288:4flfAsiVGjSGecvXAflfAsiVGjSGecvX:kMcfcMcf
TLSH
T115F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hczurmkecu.exe

Path C:\Temp\i_hczurmkecu.exe
Size 722KB
SHA256 8b52124510ee82c8900cc861823842ce24a280c504f631b924433643fa1b675d
MD5 d9674160ba21f844e09a95b677f91820
SHA1 7dedb87fdf0ef164a2d40abd073140d2d7381daf
SHA512 ea4f290fc784157fc42127a26bb0690537b804939b537665f363b65771f7b1e4e2589374aea607ce691bb236a00913026ae13590c85a7aee079dc3782faf2eb3
SSDEEP 12288:wflfAsiVGjSGecvXAflfAsiVGjSGecvX:sMcfcMcf
TLSH
T112F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kfcxupkfcv.exe

Path C:\Temp\i_kfcxupkfcv.exe
Size 722KB
SHA256 7eb47af1749e4c090c22af233de49a409115da64a0a4d9a46d9aa9d350fc2c1a
MD5 220091ac76e17f22bf531b5044c52ed2
SHA1 388af7103e44f25147f23a02ba0681f650c7ff17
SHA512 1c41996a1768f746fb8b2cc120c838c0624b85d6dffd4e7be4e14b2afc823b602fb825b951c2412c7e09a5cf07ea8b0efec7147133dee40a55476d54aedbb657
SSDEEP 12288:IflfAsiVGjSGecvXAflfAsiVGjSGecvX:UMcfcMcf
TLSH
T13DF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igdytqljdb.exe

Path C:\Temp\igdytqljdb.exe
Size 722KB
SHA256 c41468effaf32a75d5e0efe3cf0b3d145e00c5e6e6b4a4e934668a64029c1785
MD5 5a25394cc04982a2c0f3ed077290946b
SHA1 127202961e69e2cbcd96abb17b32dbbd9ff4ddf6
SHA512 2ef4c71d550f237e27da235eebd7402bcb8f4071d06b0aefb8294a7da85cad004633d46612dc20607dc300b405b0f0233a259d597592af7c3c572e5e6e690f49
SSDEEP 12288:fflfAsiVGjSGecvXAflfAsiVGjSGecvX:HMcfcMcf
TLSH
T15AF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgbywtomge.sys

Path C:\Temp\jgbywtomge.sys
Size 293KB
SHA256 adf033a6195b1a139080c610f99ad84d8e04a25a216c300d0defe5a7ec52b52e
MD5 ca3c8143b10bef929af1664b2e4b8424
SHA1 6f6171f67c67ad8a48c29dbee038671e8b454bd0
SHA512 300ea5dce9d58062ab7a3767c57a9e26681f3f1c11fd9362a6a1a5175207928a7775d20a202df8cb43acc3f97bed9b027bec93e5d840d3c6c761e29b8c43af89
SSDEEP 3072:0tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:0IJjiJcbI03GBc3ucY5DCSj
TLSH
T109545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfcxupkfcv.exe

Path C:\Temp\kfcxupkfcv.exe
Size 722KB
SHA256 a440e3e16a72add3b605dc73c6e025e478786eef9acbba4879b6265e1b280e2c
MD5 13b535cffe8284eb3f18e6754f93ef6c
SHA1 c56a944be1203d2aa76c6ab1e543150bef820e5c
SHA512 ce5a97888b5062dd75ed20a80f32da447d1b907641f8dd1bb5b013c4f4d9eb9ba5336bfc401efad83530b3b848048f1f90533a516a739a132bc883f873da0b1c
SSDEEP 12288:OflfAsiVGjSGecvXAflfAsiVGjSGecvX:qMcfcMcf
TLSH
T10EF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khcaxspkhc.sys

Path C:\Temp\khcaxspkhc.sys
Size 293KB
SHA256 991bdafb6616b46ff08af03d76d9294d07cd543b407cd8d2ece240655a178ae0
MD5 2402c3d74efbc91d93239493cf80538a
SHA1 925259e5716a3f5de2e05124f75649c1c57c2e48
SHA512 6ee19b54d4695458e2dfa81674b3a44d58862ca0635cd38bda0446f72ee39e682cc8e4fbf76678e46eb371272eee610784463bc25e7301469717a07e20e70af8
SSDEEP 3072:ptKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:pIJjiJcbI03GBc3ucY5DCSj
TLSH
T1AE545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkecwupmke.sys

Path C:\Temp\mkecwupmke.sys
Size 293KB
SHA256 9af60e615afec87273c002c0e17175e714ba9a5a89aa9c542e55bb54e2b11131
MD5 e3b1a73402c5e4bef85d5de1beb4aa81
SHA1 a5163dcef140fd6905e20e4d2f0f380f60de671b
SHA512 55544d58635ad26880c0a63ffa8f76dbb534b1675c154dc40771152fe91dc0931b357ed9b63afd9ad4a67a6f3914cb780b671431a4dc5208df941866455bd91d
SSDEEP 3072:VtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:VIJjiJcbI03GBc3ucY5DCSj
TLSH
T112545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfaxvsnkxvpnhfa.exe

Path C:\Temp\nhfaxvsnkxvpnhfa.exe
Size 722KB
SHA256 68ec59f87768872d542034a1d845dcbf05195c9336fa71f92bfd09ce73f4675b
MD5 f9d11cec9d540777d93f11ccf70913e7
SHA1 83714903b64e553918fa4e8c0cb61159222ec500
SHA512 dd69165331b5be5c1320e20fb79c526915680bef1dc1ad5ba627264d107665c715d30b7d829fe25ce53ad0a9b826a5ea5782a541377619382ebd92f642e84d81
SSDEEP 12288:cflfAsiVGjSGecvXAflfAsiVGjSGecvX:IMcfcMcf
TLSH
T165F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfaxvsnkxvpnhfa.sys

Path C:\Temp\nhfaxvsnkxvpnhfa.sys
Size 293KB
SHA256 ab29d0ba2a7f8f1c6a1ed5f0a3dee2605e632d04db5017ea14df7333e1d20cb0
MD5 7c19a53bb7c8240c4a57db7785ad3cc2
SHA1 6d43afb57e7f7f1c083ffbb58c3763c5e1653d3b
SHA512 9d5a35068433f90fc3084360369a7ebe0c84ceb9400dce5855865caab8584e4b1fc7bf44151ca45fa69e4ef8fa97403715028f83e45ec1e5d71eff75cc1b2b3e
SSDEEP 3072:mtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:mIJjiJcbI03GBc3ucY5DCSj
TLSH
T152545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhbztrmje.sys

Path C:\Temp\pjhbztrmje.sys
Size 293KB
SHA256 0b8b348655327ebae52c812a575c3ac128427f42eeb5bae02107de052b3f7d15
MD5 f64e65abf3b8fb3eb806c5fe1cbdbfb4
SHA1 33fb5eef60ba093cf36fbc9814c5c6c53c173a97
SHA512 e2978f31ad19505e8dda1e26bc3770426ddf7d5b4976040000ff2a100ffbc88128628fb823daae30c3150cb065e54549023a69fa03ffedfc12f5cc146e12e07e
SSDEEP 3072:atKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:aIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F4545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

1ae687a9-ca4c-4035-8fa3-fd879416f668.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1ae687a9-ca4c-4035-8fa3-fd879416f668.tmp
Size 13KB
SHA256 19ccb39f9b9672927a6e34c6f446742eb29cea952f68783fab5fa1927331687e
MD5 143dc9f78823b64e4e4e641ad321ad16
SHA1 1c194fc6bd4cce33f1e64b20a337e0816957a373
SHA512 be26dfc52cdc009f2f7abe9679c3ab0ec56b5c30a1b1a24d17d84512316b45c5407f9665305202a2b453703a3083c37b397f65845f2000c8aa9a0aebf24e8b64
SSDEEP 192:sxRWRaVyM/jK1Ml8wCc/fusGA1QZnzzoA8pi/g6+WNIYnY3hQGTIgtJ:sxRWov8c/fus31Oii/5I5RH3
TLSH
T19C52DA056A385D7B8CDBD209FA557F93D6F91563A2945E44EAFCCA0C00E7ADC221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 cf717a01df9f47dc18c94a1792aa8e11c50f9079b1404ad541e4c1d282bb5299
MD5 7ee54cdb50808dcd6daeedaf38f6884c
SHA1 6803fd540f2069b1493d8a520353201647f0cbd0
SHA512 b93cdc0bec7deeadae1867de5bd514c9e83b1c2859920e79065f48eea021bdaded73d55743f0a052353f9a72abcedcd8c23736e8639eed35e39102ce4c678fad
TLSH
T12161214B236E04E9D36A4A7254D9774436F086704D07BF8080F6DEBADC2AF5892F921F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5930ca.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5930ca.TMP
Size 3KB
SHA256 846ba08965f46fd6705ccdc5ace73f8255799ac3573b4786eef88ab47d55b297
MD5 89a779268920c662ea21051f4fd1b5da
SHA1 7cf4c1ddf2c5b977d8ba369c5368de55b9a8a90a
SHA512 1dc152f3619c9197fd3cb10d87c97c8fe6dffc83a1ddc1f41286678852368a0021af9d972801de40df035c71d7d53b8af6c35dad6be6f0d5cecc4b6a72a67fed
TLSH
T12161234A235D04E9D36A4A7255D9774436F086704D07BF80C0F6DEBADC2AF5892F921F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8098a487-40e4-4fba-adb7-3240dfc428e0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8098a487-40e4-4fba-adb7-3240dfc428e0.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 9ae7d75a15e3b10187135e58de82fecc6b2a1204b7b4b14e4cc90b822f06be5d
MD5 0d9e65dfd6811ab0cd83041ccd436b50
SHA1 aacb57b8883684d2e784acd53b03f93f6c02299b
SHA512 6d08a15070098f40e1b6e16f1eeb9c71761b456b3b09c06930a44c78607534a3805bd7acdb1ceab8f4e1f47640216c4ee5e521482e8087b7358a0365deedd754
TLSH
T17451E0F3C3E8866EC90196F0AA187E1BCE1D0915432C3C5AC5E4EF5B93E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 0eac8b3c34056a00f5104acc92b54c283d009367f6bc4398930deac38af7f6cb
MD5 7bfe04a8237d9672960a5cbc844a4514
SHA1 59dd8d8de4f13aa3fcff0c909f3da02113a7fb68
SHA512 6828f5db2915248f553f8ff417e406bd36ed41d80719d063d49948ab455f6f539b402a6614c4602d15e43198b931b6f66a32c683a0ada843e0f2a87d4c54a1e1
SSDEEP 192:sxRtRaVyM/jK1Ml8wCc/fusCA1QZnzzoA8pi/g6+WNIYnY3hQGTIgDrrJ:sxRtov8c/fusj1Oii/5I5RHd
TLSH
T1A052EA456A385D7B8CDBD209FA55BF93D6F81563A2945E48EAFCCA0C00E76DC221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 294348f41a865502c0f3703cc7a2a2e0920f8b8cb701fcec79ac3e0369657d62
MD5 1dcb94bae5e85e61a83a23048f57d0ec
SHA1 e442bd3ec7878471fdbb109db19d387f74adc0f9
SHA512 5e6228d661e65a43b2ba651ef0dfda470292a14105013e307cb7d351663faf67236179af1e556987f816c362741e071cc13c519522ab57fc875277ba31532838
SSDEEP 192:sxRtRaVyM/jK1Ml8wCc/fusCAhQZnbzoA8prg/g6+WNCec/Yn0qhQGTIgDrhJ:sxRtop8c/fusjhO60/5c/RoHL
TLSH
T10F62EA45AA245D7B8CDBD209FA55BF93D2F85563A2941E48ABFCCB0C00E76DD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 4bfea247e5d4edbc917bb0a50d007180669c1253bb45e73bfb7d5234c244a4df
MD5 16c819516be83086c9a227d245d8c243
SHA1 0ecb45e4d52d428420750648b4aeb7885eed8145
SHA512 07e33b15c6a126e441930460ae1363b1291a0d2e68dc0821ea4456022ce307a084673fc8e2c2e14fb8618f7be857389c22e8f4ffeaac804c5021c3b1c91aa237
SSDEEP 192:sxRtRaVyM/jK1Ml8UQqbCc/fusCAhQZnbzoA8prg/g6+WNCec/Yn0qhQGTIgDrhJ:sxRtopqdc/fusjhO60/5c/RoHL
TLSH
T1B762EA45AA245D7B8CDBD209FA55BF93D2F85563A2941E48ABFCCB0C00E76DD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 9e0ff96fc48da67fe9449099931ff810bbb64f9e0c7698a5f7c8e11b7e728a05
MD5 a42c889a4aea17e27d11dd1b247747c0
SHA1 e45c93494b85b4730b2dd663808b5d8b49722d68
SHA512 8cd9eaad424deb2715a8fb55bb76813974e748f5e09db4620ce17e153c859bc72acfc648304d52fe153b6048c7808a5bad86dfae848f0493c4a10652447e6020
SSDEEP 768:wGedPg7pLuL7X6WgoufDM8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaROu4YnroSb8JQ:wGedPsE7X6WgoufDMu1jaxROVY0NQ
TLSH
T154E2DB3B680CCB7E4F804EDCEC29BE9FADA801CB56D8C95447EA840C03C66EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c5e04c0859b2f7e911fd605ab6dd0177e5897b3a0b27bae079c901ca0cd85ac6
MD5 618d8be1ec0f91d1f5cdda8e497741e2
SHA1 1b6ad8099ded95f5185ff618d2d900d740e3bf3e
SHA512 fd37d0fc50709cde078950cf54e1526d10fded0185f347cd080486a80f097eb20a7e17422ec8124cd1de306381574506cd8bef71104b5afccb90f91f9a1e9157
SSDEEP 96:KRtaTHd3LfWTI2gPfK4Ogxfc1NAj70HS3eyEkUyW8pBgiyK43gYyciKxQ5JSKyY5:CtaTHd3LeTInPlOgxU1NAj70HS3eyEkD
TLSH
T1D2913556303B038038BDBA5C8064C91B92C274B27415B4ABB7E952B10F6AE575FFF4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59cd39.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59cd39.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3a312c4fbf1adb2fd8099253f1a4506a972689ff6b490da1d306b1ec0de7f214
MD5 c64f3ce8b8e124e46e3bc2563ad158f4
SHA1 9726c154abe12e0465e49a8082208e59c3b2891d
SHA512 e1b459badec674e53e67216eeddd44590b551307dd227dbb2cc928fb7d66df14c30dc4d72efe625b2273a5ffec5c123eb0381e86da995cbeb64df66f9a79beaf
SSDEEP 768:6rv+4UNbds3PBDZIO0sNzc4ReyIsXbeVH1S5D:6bsbS3Vtc44bsLEH1Y
TLSH
T1A603CF32A8788937FCF6A686B50B72137EF8611B82981F94C5DE5F4C464B5DD130B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 24afaf57027d14a3e184e101b6410acb7d775480ec26eae7bb4794b253f8406f
MD5 c8ca69826dc7a07b4f66e27ee96c5bf7
SHA1 04324761e2f6c6c2f038b147ddff6eb16d039993
SHA512 9389e424013610d0df7d84d1364e2089e61f372bd5f2755d20563f3cc3c96ae36a5a0d509af0ef74a276bacf62e3e539456c32e92d493535ea83004196ad5c04
SSDEEP 384:nTtNn/s3n9SH38Nt5dPBeNWsewJDZNfNoXOVSUU+GXRFiETRzcoXfK86sfxEZxxQ:Tj+9U3aHszDZIO0XFNzc4ReyIsPHb9MW
TLSH
T1D3F2BF31EC798D639CE65356B60B3696BEF0217B81C91E88DADD9F0C49832EC075B813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1ea67be5f10de1bb41aed274d2d13d367e1473617dcc1fcd08bfed6397d6e1ac
MD5 99e9e470cdb6039887eda0e3602d847a
SHA1 7576f83f494f51151e1f8c311168371cf7ef81d5
SHA512 b359f0a4809e0a24afa11b27ae2ee5acdbb5fc579d57f113c5bb1603ac5f7a5608ce15494b90a3c143b147bee8e82f35cc9f229b63326cd75728a9fdb2857cda
SSDEEP 768:TF1j+9w3Ywg4csKZQ5O0XwNzc4ReyIsPHb9MW:C9w3qtc44bs/b+W
TLSH
T187039D36EC65CE67ACE65796B70A3697EEF0116782CDADC8DAC95E4C04831ED070BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

fc15856e-d1d3-4674-8d01-e28ee70073d6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fc15856e-d1d3-4674-8d01-e28ee70073d6.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4384_1855326017\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 58ee99682f1fff551b24a92a429e545fe453ade201b92e80e7a43cfde8d642e1
MD5 f12c055d9fce4ac08c933bb57a8422dc
SHA1 fc6da41dc5c520eab620342ebe8184320d91fb89
SHA512 6554d2b347c836a06182d9cec8215b1a5c705a4a2fede5f39f3e00dd01bfc4516980f8dc0bc411725781efa91ae147421ff706935db8c03f0e6abcdf4c6728d1
TLSH
T14A71238357A8C9B3C2DA5BF403835244F1FB223C472330204BA559C7AB70B3A58B8F18
MD5 SHA1 SHA512 TLSH

Submit Download

memory/616-432-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1532-282-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1880-380-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2252-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2752-497-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3112-241-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3116-312-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3800-324-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3840-472-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3952-468-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4184-364-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4552-320-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4756-412-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5420-436-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5428-447-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5840-194-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5900-269-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5932-339-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6108-392-0x0000000000010000-0x00000000000AB000-memory.dmp

Download