628d40dedc02b49adf86bb30a3d75b50df1b0d8b42a42527d4fd3aa0c1c956cb

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 722KB
Sample260711-pp9e9act2t
SHA256 628d40dedc02b49adf86bb30a3d75b50df1b0d8b42a42527d4fd3aa0c1c956cb
MD5 bbf439406e9a87b3e904588ddd58b925
SHA1 81ba917ebaaed02c83a1d1b0b677c8cc7e167753
SHA512 89bd93edfbd49165a3f249b04031cde9d955243cd06d15dea442b597cecab7a9b317974fcfcb505a2c8dd8b72dab809b812eb8caaea6724eeed9fbc3a9d0c8cd
SSDEEP 12288:iflfAsiVGjSGecvXAflfAsiVGjSGecvX:OMcfcMcf
TLSH
T19DF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2040	ysqlidbvtnlgdywq.exe
3116	ysqlidbvtnlgdywq.sys
4652	CreateProcess.exe
1100	vtqljdbytn.exe
2832	CreateProcess.exe
3440	CreateProcess.exe
1904	i_vtqljdbytn.exe
3568	lidavtnlfd.sys
3216	CreateProcess.exe
4400	aysqkifays.exe
2880	CreateProcess.exe
4140	CreateProcess.exe
4836	i_aysqkifays.exe
5032	causnkfcxv.sys
3008	CreateProcess.exe
4512	qkicaxsqki.exe
2224	CreateProcess.exe
628	CreateProcess.exe
3096	i_qkicaxsqki.exe
904	pkhcausmkf.sys
3800	CreateProcess.exe
4168	fzxrpkhczu.exe
5692	CreateProcess.exe
2900	CreateProcess.exe
3244	i_fzxrpkhczu.exe
2364	mkecwupmhe.sys
5116	CreateProcess.exe
2700	wuomkhezwu.exe
4676	CreateProcess.exe
3472	CreateProcess.exe
1772	i_wuomkhezwu.exe
4424	ztrmjecwuo.sys
4864	CreateProcess.exe
5004	uomgezwuom.exe
3032	CreateProcess.exe
5328	CreateProcess.exe
1204	i_uomgezwuom.exe
2128	ojhbzwrojg.sys
4172	CreateProcess.exe
904	ljgeywtroj.exe
6116	CreateProcess.exe
1240	CreateProcess.exe
3484	i_ljgeywtroj.exe
3088	igbytqoigd.sys
4476	CreateProcess.exe
5212	lgdbvtrljd.exe
3304	CreateProcess.exe
5928	CreateProcess.exe
3372	i_lgdbvtrljd.exe
2412	qoigaytqlj.sys
3652	CreateProcess.exe
4060	dyvqnigays.exe
2848	CreateProcess.exe
5684	CreateProcess.exe
3000	i_dyvqnigays.exe
5152	xvtnlfdavt.sys
2868	CreateProcess.exe
5340	yvqnifaysq.exe
836	CreateProcess.exe
1284	CreateProcess.exe
3956	i_yvqnifaysq.exe
3300	vqnifaysqk.sys
1168	CreateProcess.exe
3568	snkfdxspki.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4840_314442707\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4840_15634431\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4840_726680593\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4840_726680593\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4840_15634431\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4840_1385925884\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4840_1385925884\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4840_726680593\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4840_726680593\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqkifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkicaxsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwurpjhezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebwtrmjeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebwtrmjeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbytqlidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqlidbvtnlgdywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtqljdbytn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqkifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdbvtrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkfdxspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqolgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaysqlidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnlfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomgezwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dyvqnigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwupmhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqolgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kiczxrpnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwupmhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkicaxsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxrpkhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdbvtrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkfdxspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaysqlidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbytqlidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtqljdbytn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljgeywtroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvqnigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqnifaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqnifaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnlfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxrpkhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomgezwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljgeywtroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kiczxrpnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomkhezwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomkhezwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwurpjhezw.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4416	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1652	ipconfig.exe
2060	ipconfig.exe
1136	ipconfig.exe
5652	ipconfig.exe
3240	ipconfig.exe
2620	ipconfig.exe
832	ipconfig.exe
5292	ipconfig.exe
1112	ipconfig.exe
3820	ipconfig.exe
1268	ipconfig.exe
1560	ipconfig.exe
1444	ipconfig.exe
4332	ipconfig.exe
3100	ipconfig.exe
948	ipconfig.exe
5436	ipconfig.exe
2956	ipconfig.exe
3728	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134282466988837057"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{423A76BE-B54E-4DC5-B950-8CD0FE7119BA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2040	ysqlidbvtnlgdywq.exe
2040	ysqlidbvtnlgdywq.exe
2040	ysqlidbvtnlgdywq.exe
2040	ysqlidbvtnlgdywq.exe
2040	ysqlidbvtnlgdywq.exe
2040	ysqlidbvtnlgdywq.exe
2040	ysqlidbvtnlgdywq.exe
2040	ysqlidbvtnlgdywq.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1904	i_vtqljdbytn.exe
Token: SeDebugPrivilege	4836	i_aysqkifays.exe
Token: SeDebugPrivilege	3096	i_qkicaxsqki.exe
Token: SeDebugPrivilege	3244	i_fzxrpkhczu.exe
Token: SeDebugPrivilege	1772	i_wuomkhezwu.exe
Token: SeDebugPrivilege	1204	i_uomgezwuom.exe
Token: SeDebugPrivilege	3484	i_ljgeywtroj.exe
Token: SeDebugPrivilege	3372	i_lgdbvtrljd.exe
Token: SeDebugPrivilege	3000	i_dyvqnigays.exe
Token: SeDebugPrivilege	3956	i_yvqnifaysq.exe
Token: SeDebugPrivilege	4752	i_snkfdxspki.exe
Token: SeDebugPrivilege	2148	i_kiczxrpnkf.exe
Token: SeDebugPrivilege	5092	i_cwupmhezxr.exe
Token: SeDebugPrivilege	3192	i_zwurpjhezw.exe
Token: SeDebugPrivilege	4696	i_jebwtrmjeb.exe
Token: SeDebugPrivilege	1772	i_ywqolgeywq.exe
Token: SeDebugPrivilege	488	i_gaysqlidbv.exe
Token: SeDebugPrivilege	2488	i_dbytqlidbv.exe
Token: SeDebugPrivilege	3432	i_vpnlfdxvpn.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4840	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 2040	4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 4780 wrote to memory of 3136	4780	2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 3136 wrote to memory of 4840	3136	iexplore.exe	90
PID 4840 wrote to memory of 4876	4840	msedge.exe	91
PID 4840 wrote to memory of 5408	4840	msedge.exe	93
PID 4840 wrote to memory of 4416	4840	msedge.exe	94
PID 4840 wrote to memory of 5408	4840	msedge.exe	93
PID 4840 wrote to memory of 5408	4840	msedge.exe	93
PID 4840 wrote to memory of 260	4840	msedge.exe	95
PID 4840 wrote to memory of 260	4840	msedge.exe	95
PID 4840 wrote to memory of 5984	4840	msedge.exe	96
PID 4840 wrote to memory of 5984	4840	msedge.exe	96
PID 4840 wrote to memory of 5984	4840	msedge.exe	96
PID 4840 wrote to memory of 5416	4840	msedge.exe	97
PID 4840 wrote to memory of 5416	4840	msedge.exe	97
PID 4840 wrote to memory of 5416	4840	msedge.exe	97
PID 4840 wrote to memory of 2996	4840	msedge.exe	98
PID 4840 wrote to memory of 2996	4840	msedge.exe	98
PID 4840 wrote to memory of 2996	4840	msedge.exe	98
PID 4840 wrote to memory of 6008	4840	msedge.exe	99
PID 4840 wrote to memory of 6008	4840	msedge.exe	99
PID 4840 wrote to memory of 6008	4840	msedge.exe	99
PID 4840 wrote to memory of 2380	4840	msedge.exe	101
PID 4840 wrote to memory of 2380	4840	msedge.exe	101
PID 4840 wrote to memory of 5280	4840	msedge.exe	104
PID 4840 wrote to memory of 5280	4840	msedge.exe	104
PID 4840 wrote to memory of 6016	4840	msedge.exe	105
PID 4840 wrote to memory of 6016	4840	msedge.exe	105
PID 2040 wrote to memory of 4652	2040	ysqlidbvtnlgdywq.exe	106
PID 4840 wrote to memory of 1320	4840	msedge.exe	109
PID 1100 wrote to memory of 2832	1100	vtqljdbytn.exe	111
PID 4840 wrote to memory of 5668	4840	msedge.exe	116
PID 4840 wrote to memory of 5668	4840	msedge.exe	116
PID 4840 wrote to memory of 4612	4840	msedge.exe	117
PID 4840 wrote to memory of 4612	4840	msedge.exe	117
PID 2040 wrote to memory of 3440	2040	ysqlidbvtnlgdywq.exe	118
PID 2040 wrote to memory of 3216	2040	ysqlidbvtnlgdywq.exe	122
PID 4400 wrote to memory of 2880	4400	aysqkifays.exe	124
PID 2040 wrote to memory of 4140	2040	ysqlidbvtnlgdywq.exe	127
PID 2040 wrote to memory of 3008	2040	ysqlidbvtnlgdywq.exe	131
PID 4512 wrote to memory of 2224	4512	qkicaxsqki.exe	133
PID 2040 wrote to memory of 628	2040	ysqlidbvtnlgdywq.exe	136
PID 2040 wrote to memory of 3800	2040	ysqlidbvtnlgdywq.exe	141
PID 4168 wrote to memory of 5692	4168	fzxrpkhczu.exe	143
PID 4840 wrote to memory of 1916	4840	msedge.exe	146
PID 4840 wrote to memory of 4124	4840	msedge.exe	147
PID 4840 wrote to memory of 1524	4840	msedge.exe	148
PID 2040 wrote to memory of 2900	2040	ysqlidbvtnlgdywq.exe	149
PID 2040 wrote to memory of 5116	2040	ysqlidbvtnlgdywq.exe	153
PID 2700 wrote to memory of 4676	2700	wuomkhezwu.exe	155
PID 2040 wrote to memory of 3472	2040	ysqlidbvtnlgdywq.exe	158
PID 2040 wrote to memory of 4864	2040	ysqlidbvtnlgdywq.exe	162
PID 5004 wrote to memory of 3032	5004	uomgezwuom.exe	164
PID 2040 wrote to memory of 5328	2040	ysqlidbvtnlgdywq.exe	167
PID 2040 wrote to memory of 4172	2040	ysqlidbvtnlgdywq.exe	171
PID 904 wrote to memory of 6116	904	ljgeywtroj.exe	173
PID 2040 wrote to memory of 1240	2040	ysqlidbvtnlgdywq.exe	176
PID 2040 wrote to memory of 4476	2040	ysqlidbvtnlgdywq.exe	180
PID 5212 wrote to memory of 3304	5212	lgdbvtrljd.exe	182
PID 4840 wrote to memory of 4760	4840	msedge.exe	185
PID 4840 wrote to memory of 4760	4840	msedge.exe	185
PID 2040 wrote to memory of 5928	2040	ysqlidbvtnlgdywq.exe	187
PID 2040 wrote to memory of 3652	2040	ysqlidbvtnlgdywq.exe	193
PID 4060 wrote to memory of 2848	4060	dyvqnigays.exe	195

C:\Users\Admin\AppData\Local\Temp\2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_bbf439406e9a87b3e904588ddd58b925_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Temp\ysqlidbvtnlgdywq.exe
  C:\Temp\ysqlidbvtnlgdywq.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtqljdbytn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4652
  - - C:\Temp\vtqljdbytn.exe
      C:\Temp\vtqljdbytn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1100
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2832
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3100
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtqljdbytn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3440
  - - C:\Temp\i_vtqljdbytn.exe
      C:\Temp\i_vtqljdbytn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1904
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aysqkifays.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3216
  - - C:\Temp\aysqkifays.exe
      C:\Temp\aysqkifays.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4400
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2880
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1136
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aysqkifays.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4140
  - - C:\Temp\i_aysqkifays.exe
      C:\Temp\i_aysqkifays.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qkicaxsqki.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3008
  - - C:\Temp\qkicaxsqki.exe
      C:\Temp\qkicaxsqki.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4512
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2224
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qkicaxsqki.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:628
  - - C:\Temp\i_qkicaxsqki.exe
      C:\Temp\i_qkicaxsqki.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3096
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fzxrpkhczu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3800
  - - C:\Temp\fzxrpkhczu.exe
      C:\Temp\fzxrpkhczu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4168
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5692
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:948
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fzxrpkhczu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2900
  - - C:\Temp\i_fzxrpkhczu.exe
      C:\Temp\i_fzxrpkhczu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3244
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wuomkhezwu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5116
  - - C:\Temp\wuomkhezwu.exe
      C:\Temp\wuomkhezwu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2700
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4676
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1444
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wuomkhezwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3472
  - - C:\Temp\i_wuomkhezwu.exe
      C:\Temp\i_wuomkhezwu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1772
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uomgezwuom.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4864
  - - C:\Temp\uomgezwuom.exe
      C:\Temp\uomgezwuom.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5004
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3032
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5436
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uomgezwuom.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5328
  - - C:\Temp\i_uomgezwuom.exe
      C:\Temp\i_uomgezwuom.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1204
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljgeywtroj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4172
  - - C:\Temp\ljgeywtroj.exe
      C:\Temp\ljgeywtroj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:904
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6116
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1112
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljgeywtroj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1240
  - - C:\Temp\i_ljgeywtroj.exe
      C:\Temp\i_ljgeywtroj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3484
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lgdbvtrljd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4476
  - - C:\Temp\lgdbvtrljd.exe
      C:\Temp\lgdbvtrljd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5212
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3304
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2956
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lgdbvtrljd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5928
  - - C:\Temp\i_lgdbvtrljd.exe
      C:\Temp\i_lgdbvtrljd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3372
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dyvqnigays.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3652
  - - C:\Temp\dyvqnigays.exe
      C:\Temp\dyvqnigays.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4060
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2848
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3820
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dyvqnigays.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5684
  - - C:\Temp\i_dyvqnigays.exe
      C:\Temp\i_dyvqnigays.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3000
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvqnifaysq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2868
  - - C:\Temp\yvqnifaysq.exe
      C:\Temp\yvqnifaysq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5340
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:836
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1268
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvqnifaysq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1284
  - - C:\Temp\i_yvqnifaysq.exe
      C:\Temp\i_yvqnifaysq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3956
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\snkfdxspki.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1168
  - - C:\Temp\snkfdxspki.exe
      C:\Temp\snkfdxspki.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3568
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4508
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5652
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_snkfdxspki.exe ups_ins
    3⤵
    PID:2684
  - - C:\Temp\i_snkfdxspki.exe
      C:\Temp\i_snkfdxspki.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4752
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kiczxrpnkf.exe ups_run
    3⤵
    PID:1432
  - - C:\Temp\kiczxrpnkf.exe
      C:\Temp\kiczxrpnkf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1992
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5184
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kiczxrpnkf.exe ups_ins
    3⤵
    PID:4684
  - - C:\Temp\i_kiczxrpnkf.exe
      C:\Temp\i_kiczxrpnkf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cwupmhezxr.exe ups_run
    3⤵
    PID:2152
  - - C:\Temp\cwupmhezxr.exe
      C:\Temp\cwupmhezxr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6052
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4528
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cwupmhezxr.exe ups_ins
    3⤵
    PID:1056
  - - C:\Temp\i_cwupmhezxr.exe
      C:\Temp\i_cwupmhezxr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwurpjhezw.exe ups_run
    3⤵
    PID:4672
  - - C:\Temp\zwurpjhezw.exe
      C:\Temp\zwurpjhezw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3924
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2524
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2620
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwurpjhezw.exe ups_ins
    3⤵
    PID:5712
  - - C:\Temp\i_zwurpjhezw.exe
      C:\Temp\i_zwurpjhezw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3192
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jebwtrmjeb.exe ups_run
    3⤵
    PID:1336
  - - C:\Temp\jebwtrmjeb.exe
      C:\Temp\jebwtrmjeb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4108
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5756
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:832
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jebwtrmjeb.exe ups_ins
    3⤵
    PID:2688
  - - C:\Temp\i_jebwtrmjeb.exe
      C:\Temp\i_jebwtrmjeb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywqolgeywq.exe ups_run
    3⤵
    PID:2056
  - - C:\Temp\ywqolgeywq.exe
      C:\Temp\ywqolgeywq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4856
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1500
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5292
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywqolgeywq.exe ups_ins
    3⤵
    PID:3820
  - - C:\Temp\i_ywqolgeywq.exe
      C:\Temp\i_ywqolgeywq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1772
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gaysqlidbv.exe ups_run
    3⤵
    PID:1448
  - - C:\Temp\gaysqlidbv.exe
      C:\Temp\gaysqlidbv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5588
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2128
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3728
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gaysqlidbv.exe ups_ins
    3⤵
    PID:1112
  - - C:\Temp\i_gaysqlidbv.exe
      C:\Temp\i_gaysqlidbv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:488
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbytqlidbv.exe ups_run
    3⤵
    PID:3104
  - - C:\Temp\dbytqlidbv.exe
      C:\Temp\dbytqlidbv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4376
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3412
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1652
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbytqlidbv.exe ups_ins
    3⤵
    PID:2404
  - - C:\Temp\i_dbytqlidbv.exe
      C:\Temp\i_dbytqlidbv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2488
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vpnlfdxvpn.exe ups_run
    3⤵
    PID:892
  - - C:\Temp\vpnlfdxvpn.exe
      C:\Temp\vpnlfdxvpn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1896
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4696
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vpnlfdxvpn.exe ups_ins
    3⤵
    PID:3336
  - - C:\Temp\i_vpnlfdxvpn.exe
      C:\Temp\i_vpnlfdxvpn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3432
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x30c,0x7ffe4c0fc188,0x7ffe4c0fc194,0x7ffe4c0fc1a0
      4⤵
      PID:4876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2008,i,17767765758683196555,14137664044691049008,262144 --field-trial-handle=2552,i,9748702844629605817,15146973225959058137,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:2
      4⤵
      PID:5408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2164,i,9984452326373400769,11234088168349031328,524288 --field-trial-handle=2552,i,9748702844629605817,15146973225959058137,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:11
      4⤵
      System Time Discovery
      PID:4416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,9846324180046568713,1916448975469620105,524288 --field-trial-handle=2552,i,9748702844629605817,15146973225959058137,262144 --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:13
      4⤵
      PID:260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3540,i,17355206362126613998,1345933097535739779,2097152 --field-trial-handle=2552,i,9748702844629605817,15146973225959058137,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
      4⤵
      PID:5984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,14210622213420574284,9984645780855287401,2097152 --field-trial-handle=2552,i,9748702844629605817,15146973225959058137,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
      4⤵
      PID:5416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,2392054708244388834,5876956384306190026,2097152 --field-trial-handle=2552,i,9748702844629605817,15146973225959058137,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:1
      4⤵
      PID:2996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,12868708641762600021,13374576104582376359,2097152 --field-trial-handle=2552,i,9748702844629605817,15146973225959058137,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:9
      4⤵
      PID:6008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,12579029743105279595,17690027497949430850,524288 --field-trial-handle=2552,i,9748702844629605817,15146973225959058137,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:14
      4⤵
      PID:2380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,11500301877183977937,13961131885479187697,524288 --field-trial-handle=2552,i,9748702844629605817,15146973225959058137,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
      4⤵
      PID:5280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3668,i,12327389786537819741,4588189931130321940,524288 --field-trial-handle=2552,i,9748702844629605817,15146973225959058137,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
      4⤵
      PID:6016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,13156113171177320541,15432080240163183257,524288 --field-trial-handle=2552,i,9748702844629605817,15146973225959058137,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
      4⤵
      PID:436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,13156113171177320541,15432080240163183257,524288 --field-trial-handle=2552,i,9748702844629605817,15146973225959058137,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
      4⤵
      PID:1320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,15342021758290169661,4328451153732461822,524288 --field-trial-handle=2552,i,9748702844629605817,15146973225959058137,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
      4⤵
      PID:5668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,18277814348312771534,1370694789911133171,524288 --field-trial-handle=2552,i,9748702844629605817,15146973225959058137,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:14
      4⤵
      PID:4612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1276,i,839754803885723071,5559086727315058440,524288 --field-trial-handle=2552,i,9748702844629605817,15146973225959058137,262144 --variations-seed-version --mojo-platform-channel-handle=1268 /prefetch:14
      4⤵
      PID:1916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1404,i,15529842680292117661,9643177034432867191,524288 --field-trial-handle=2552,i,9748702844629605817,15146973225959058137,262144 --variations-seed-version --mojo-platform-channel-handle=1244 /prefetch:14
      4⤵
      PID:4124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1400,i,17438184137969006563,14118797605727954273,524288 --field-trial-handle=2552,i,9748702844629605817,15146973225959058137,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:14
      4⤵
      PID:1524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,8924784288083833776,15365057462124102452,524288 --field-trial-handle=2552,i,9748702844629605817,15146973225959058137,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:14
      4⤵
      PID:4760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,3671752420951797156,5275359245971174006,524288 --field-trial-handle=2552,i,9748702844629605817,15146973225959058137,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
      4⤵
      PID:2864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,5546077936579192043,4071186509214742696,524288 --field-trial-handle=2552,i,9748702844629605817,15146973225959058137,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:14
      4⤵
      PID:5436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,7729366870460342718,1933361678014694486,524288 --field-trial-handle=2552,i,9748702844629605817,15146973225959058137,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:14
      4⤵
      PID:3332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6392,i,10245623246265311864,17782644102504600002,262144 --field-trial-handle=2552,i,9748702844629605817,15146973225959058137,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:10
      4⤵
      PID:4560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,12275296224393365634,1946308392438270593,524288 --field-trial-handle=2552,i,9748702844629605817,15146973225959058137,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
      4⤵
      PID:2852

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3828

C:\Temp\ysqlidbvtnlgdywq.sys
C:\Temp\ysqlidbvtnlgdywq.sys
1⤵
- Executes dropped EXE
PID:3116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6080

C:\Temp\lidavtnlfd.sys
C:\Temp\lidavtnlfd.sys
1⤵
- Executes dropped EXE
PID:3568

C:\Temp\causnkfcxv.sys
C:\Temp\causnkfcxv.sys
1⤵
- Executes dropped EXE
PID:5032

C:\Temp\pkhcausmkf.sys
C:\Temp\pkhcausmkf.sys
1⤵
- Executes dropped EXE
PID:904

C:\Temp\mkecwupmhe.sys
C:\Temp\mkecwupmhe.sys
1⤵
- Executes dropped EXE
PID:2364

C:\Temp\ztrmjecwuo.sys
C:\Temp\ztrmjecwuo.sys
1⤵
- Executes dropped EXE
PID:4424

C:\Temp\ojhbzwrojg.sys
C:\Temp\ojhbzwrojg.sys
1⤵
- Executes dropped EXE
PID:2128

C:\Temp\igbytqoigd.sys
C:\Temp\igbytqoigd.sys
1⤵
- Executes dropped EXE
PID:3088

C:\Temp\qoigaytqlj.sys
C:\Temp\qoigaytqlj.sys
1⤵
- Executes dropped EXE
PID:2412

C:\Temp\xvtnlfdavt.sys
C:\Temp\xvtnlfdavt.sys
1⤵
- Executes dropped EXE
PID:5152

C:\Temp\vqnifaysqk.sys
C:\Temp\vqnifaysqk.sys
1⤵
- Executes dropped EXE
PID:3300

C:\Temp\kicaxrpnki.sys
C:\Temp\kicaxrpnki.sys
1⤵
PID:3880

C:\Temp\mkecxupnhf.sys
C:\Temp\mkecxupnhf.sys
1⤵
PID:1448

C:\Temp\wuomkhczxr.sys
C:\Temp\wuomkhczxr.sys
1⤵
PID:4420

C:\Temp\gebztrmjeb.sys
C:\Temp\gebztrmjeb.sys
1⤵
PID:4612

C:\Temp\eywqoigbyt.sys
C:\Temp\eywqoigbyt.sys
1⤵
PID:3840

C:\Temp\trljgbytrl.sys
C:\Temp\trljgbytrl.sys
1⤵
PID:5444

C:\Temp\fdyvqnlfdy.sys
C:\Temp\fdyvqnlfdy.sys
1⤵
PID:1956

C:\Temp\spnlfdavsq.sys
C:\Temp\spnlfdavsq.sys
1⤵
PID:5604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aysqkifays.exe

Path C:\Temp\aysqkifays.exe
Size 722KB
SHA256 862273327a74276f7f1aeed647ad0100e4ef9fdac5c31a4a5c408fb12cfe7c47
MD5 47a699b89d341105c02905486abf4ac3
SHA1 a3ce17f22cf03df978a72ad3ae9093fef070af94
SHA512 02a23f8036baea73d9aa7a3cf5e9f631458a9eb066ccf76453fc58b635a24ab2f8d925a76606dada087909e8d710039576689df86a7063924adb65939cad0930
SSDEEP 12288:yflfAsiVGjSGecvXAflfAsiVGjSGecvX:+McfcMcf
TLSH
T11EF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

causnkfcxv.sys

Path C:\Temp\causnkfcxv.sys
Size 293KB
SHA256 c84e08044887e9675098c30cd8476e6265e1a853f8a5312aa37ae16d49917b57
MD5 bc9faedf49778eb9d3947e88bcfd80c6
SHA1 63700bfd81ae7e2b89ade26c23c28413036883b9
SHA512 052432f9fd3a02b4b2025afc92f01e89c95affe44799d731c732454d09f0a2947e59eabf8cbf8363044d8258fade5a61f40fff848d5375a8899e66f0ef4ef4cf
SSDEEP 3072:mtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:mIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D9545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxrpkhczu.exe

Path C:\Temp\fzxrpkhczu.exe
Size 722KB
SHA256 72a80ce5c6699522e0bf40795869a88c8f7146fce3251ad25a6d966338ab22e4
MD5 351bbb1912871f591c8331a5deb46730
SHA1 588b056c207bc2de4451e0a4be7cbff1c65f0ce8
SHA512 3d9908516c99ee000fc41c417ec0dce501ab6e881ef49c117bcba472a1565a09845c4a70c80fa8d352a7c9597082a21079f7cb88008355d725098acdf22296b6
SSDEEP 12288:CflfAsiVGjSGecvXAflfAsiVGjSGecvX:uMcfcMcf
TLSH
T1F3F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_aysqkifays.exe

Path C:\Temp\i_aysqkifays.exe
Size 722KB
SHA256 e4ce35061629d0f8236ddc23a4a530e7abd271943628446af2316dae52676222
MD5 d26e0b2b84ee01cb6b181fffba33ec69
SHA1 3792f2a24b63e9e20b62003c143b9e402585c971
SHA512 790a424e837ca27a86aa2270082bcb2316f76fe493cb532719ee06fa2e49967a6c00c7c169272c9a1ab7a5bd40d60a5aa4aeeb84802862285c8295509cf235a3
SSDEEP 12288:jflfAsiVGjSGecvXAflfAsiVGjSGecvX:rMcfcMcf
TLSH
T144F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fzxrpkhczu.exe

Path C:\Temp\i_fzxrpkhczu.exe
Size 722KB
SHA256 0f2adb0580a9b8b0e7140daf117406e4aa9175eac3c775afda03ee5f9dd77f7a
MD5 c47e43ba6bc25515080328fb047a42d4
SHA1 d8ed13df714b7e4e58920894fdb917881ae228e8
SHA512 0799015f0375388b61b4544da1de5621e6e1e2f5dc73eec2d57265fad2146718329faa7a2c74ac6e388236f60bda4f75d89783f4a57bce94cf93569cbc327c7e
SSDEEP 12288:jflfAsiVGjSGecvXAflfAsiVGjSGecvX:rMcfcMcf
TLSH
T102F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qkicaxsqki.exe

Path C:\Temp\i_qkicaxsqki.exe
Size 722KB
SHA256 53671ff58427d27fd9a4d35302a824b09949c82fa4b2253165113619b7b11505
MD5 284fd63ae26372a7134b19acc244f4fa
SHA1 3b7996d06eea62ac936c408005a76539061f9b6d
SHA512 2b06cb78cb7468c23f8bf8df992b0c2ca28be73bae752081a693bae1b1731a821560e03a68dd0e0e44e98ec16d3f0fa99b3c72ea9e518a5285752b39431629c5
SSDEEP 12288:3YflfAsiVGjSGecvXAflfAsiVGjSGecvXg:UMcfcMcf
TLSH
T1AFF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtqljdbytn.exe

Path C:\Temp\i_vtqljdbytn.exe
Size 722KB
SHA256 7d22220515633f0bb6c3d64a5640276f46b0912a562891562f4a6044600eb879
MD5 8436d3f87835b6485dc37580ac65e487
SHA1 b6b5afe8c85ea22bc806a06f4749d2b98bcc0735
SHA512 b11fdc678ae344f732d7c880e06da65f815cb74ae6f2db0d773d7c73d2f1e146e6f2c56c400117b71ff94d2a12f98e7eeb7fcd61432cf68d22b52468e644253e
SSDEEP 12288:2flfAsiVGjSGecvXAflfAsiVGjSGecvX:iMcfcMcf
TLSH
T199F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wuomkhezwu.exe

Path C:\Temp\i_wuomkhezwu.exe
Size 722KB
SHA256 c3961594b8450095d18ce33f9c8f358181f01844f84eecde5f110a4e396480f1
MD5 ab90cedcef73bee2e44093da3ac90b79
SHA1 a987ffd5319f0cca2c0b530130f0ab360339987e
SHA512 79cac408079a8e257293c20c94e89f84dc35e3e2ad626f1b64ab525f543c1ddabddd13883e73e6342cad4f33caa8d836d2822da6d413ff592e27328277e7f25b
SSDEEP 12288:AflfAsiVGjSGecvXAflfAsiVGjSGecvX:cMcfcMcf
TLSH
T163F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lidavtnlfd.sys

Path C:\Temp\lidavtnlfd.sys
Size 293KB
SHA256 84bb752966d53f1a2fb795f1a8faa9095a863da619e098106e0fe6b61093d1cb
MD5 5e694c9e7aa36dc39893f0bdecdc741f
SHA1 1ff9bafb169ec0a1cb6df2ceca60c71cf3f6e6cc
SHA512 fb6e86df989a4c156cb92115b14379d26c06452ee2264f0d6244058e9c5623ea1e1a0348225538ade944845a353f7088988c8fb5c4af198c8ea3d4c0ec8da4f9
SSDEEP 3072:xtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:xIJjiJcbI03GBc3ucY5DCSj
TLSH
T197545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkecwupmhe.sys

Path C:\Temp\mkecwupmhe.sys
Size 293KB
SHA256 bdff1991d4703b3ac3fe54231f6e99ce5cba10b77c0b980dd8d7dbcc74b6d051
MD5 be95cd7379b4ac1a4a40508358ae84e1
SHA1 278c4fcec8138787743fc23a7ab8df5671b4221e
SHA512 8f2f14f90029b27209e931b8c0945de3a729b43f163cfd3034c441876bfcab44a047a178baea14264c0d51110a4f93f5eadae7686603efbdb656395d6dc5bf59
SSDEEP 3072:PtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:PIJjiJcbI03GBc3ucY5DCSj
TLSH
T1EB545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkhcausmkf.sys

Path C:\Temp\pkhcausmkf.sys
Size 293KB
SHA256 1649c90b0dfb4c16f8aa5bcf56a70ab4f967a4e2804d78bdfc5c6adbe0e62304
MD5 43cf7696784ccb1325a5a29235480798
SHA1 7de59da6b656714cf488cea8a11b603563bcb4c4
SHA512 a2a767bf3fe1150d366267254bd8bb1d07cd5218c3826171e9182f7a275270585deeb3207450449e98673fd56893424aacd29b030cb747915f5db84262cbe686
SSDEEP 3072:utKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:uIJjiJcbI03GBc3ucY5DCSj
TLSH
T15E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkicaxsqki.exe

Path C:\Temp\qkicaxsqki.exe
Size 722KB
SHA256 f130e89ff6bb2d848adf06117dfcba0b622915ca31a649ffc4dd9e19b6ac55fa
MD5 36fc9ae5daf1589d668dd97abd936ca3
SHA1 114df5ec2f1b8c47f4deb2591c5208bd4e36f047
SHA512 140f03a86cb01f07f51a1a39d268869ee5bcf9ca4454bfb032d815234915629d18e020d6303b0ca5e950fe88f291192b12b2f43cf81ec47035b3c86a9163e005
SSDEEP 12288:IflfAsiVGjSGecvXAflfAsiVGjSGecvX:UMcfcMcf
TLSH
T1DBF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uomgezwuom.exe

Path C:\Temp\uomgezwuom.exe
Size 722KB
SHA256 6692f0601e5f7093efea97b8f9020705a4a46b533186ac72d9f752c66e4e5a02
MD5 864914ed0173780375ddfb8ece74b74f
SHA1 a53e6109425f95391f21efac946c349bbffe908b
SHA512 47c2b1bb006ab5068d1bb9b15cb2b3eb02f16b3e055e2dc74e07e56f5dc9b46ed1a215735dddc0b94cde34d9e7a4e667ad842fde88dd0d8c400a45338cc4ed86
SSDEEP 12288:+flfAsiVGjSGecvXAflfAsiVGjSGecvX:6McfcMcf
TLSH
T14AF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtqljdbytn.exe

Path C:\Temp\vtqljdbytn.exe
Size 722KB
SHA256 d105578ff3e05c519189724c515e479fa525f69e25140cd705214a0f18b29c43
MD5 1e8e7d476c9b1d0e602a46efb08d331e
SHA1 daa3af1ce45d8e7e90675a1465f2b344c8be97c7
SHA512 cffee2358c6f2c16c7668ac22a3d60daf6c44789733fd50c3d059650da09e76de624cf1b49af1d4dde101a32a480dae375ca9f7ac883783964c414fe6256fa90
SSDEEP 12288:GflfAsiVGjSGecvXAflfAsiVGjSGecvX:SMcfcMcf
TLSH
T1AAF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomkhezwu.exe

Path C:\Temp\wuomkhezwu.exe
Size 722KB
SHA256 bfd6a4e8aa6c7821a474bdddfaf83c6ee701d2bc98eb24492344b5ee8e29b87e
MD5 bf82a7efac5bc8bafffc0f0aa0f99e06
SHA1 0f24c1ea5b062c8d1a9ac41a11994b1eb706ebbb
SHA512 a06efe887299085565c9feaaa86b78ca120e0d49817b9e32492ac9774d206991035113fb2b4304a539064e1098d9e4b9bd08e24a28c637a84e94b6f059efdbef
SSDEEP 12288:bflfAsiVGjSGecvXAflfAsiVGjSGecvX:zMcfcMcf
TLSH
T1CCF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqlidbvtnlgdywq.exe

Path C:\Temp\ysqlidbvtnlgdywq.exe
Size 722KB
SHA256 bc8c650b31ae5d8c45e9c80ac966aa295df1d7b287248667b2c605a3d0025027
MD5 30469e6b1ed7e557123951128113096b
SHA1 58df5fe84d37569a6a988ff88467268a80c2ddf8
SHA512 3d41d6170806d0c9cb2d0304e99d9bd7a99a67f698bdb6a20966d6681e33d4aa8e1bab3fb0ba6b36fbc59fec0d14d106774f602a677a674b3a718582c11fad78
SSDEEP 12288:XflfAsiVGjSGecvXAflfAsiVGjSGecvX:vMcfcMcf
TLSH
T164F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqlidbvtnlgdywq.sys

Path C:\Temp\ysqlidbvtnlgdywq.sys
Size 293KB
SHA256 f9ae8e689ae265529bf74635a351b3bfe6e3c714fb12082a292fed6786916f6a
MD5 77c28843f030671f95f35d135d6eb5a9
SHA1 42ad2a39107df08898224862bf8ae3ec49454dc7
SHA512 ecdb2ec00c940f3a0c06117904fcb9bf3568d0587a61f4a96e8da94216f7c326516138cb049f603c3e4c116f54af32e9647a5e07e7ffc747be1777d5210e2c2f
SSDEEP 3072:JtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:JIJjiJcbI03GBc3ucY5DCSj
TLSH
T1DA545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrmjecwuo.sys

Path C:\Temp\ztrmjecwuo.sys
Size 293KB
SHA256 217b84162761913f7eef4b64b194c0054de4e13870a8bbc2ef35b4c79c216229
MD5 c0fbb93c92971ed6159b7e73fc638643
SHA1 3cea76aa8d8c2e98cd5ad5490c2966df7363ae89
SHA512 3a7e502a7ae49981455b71a04e81c4e6f2ad718b3155c654289f5f2b114fbd3666bbd724841f000e49200c938b13699516cbd1972f3467846cbd533c5c3084fb
SSDEEP 3072:stKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:sIJjiJcbI03GBc3ucY5DCSj
TLSH
T157545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 3fe174137a133bdd05df2b89e8da671649f9edbb9baf6cc26997558da7e4c2bc
MD5 01aa92e2a50a106d5dd2c35b99fd724c
SHA1 900ea6cd5e3c6655f2a04a5959d9707a363f644e
SHA512 5469f2cd0ba84c4d03a9f4f3db494719bae7b480753d6c35932e22439d44034c15135670832473ceceb8b29ee9def69904e6852b40d67e80ba7d8b787fa0083c
TLSH
T174512C1DA33614D6E3240772BDD394883FF5CC9A08075E1BA4409EB868C2F17AED2AD7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e71a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59e71a.TMP
Size 2KB
SHA256 43f49300111d254e64f1990516f9144dab667179a521cab8c0ec194a3c2a4a68
MD5 ba5f6b9116645b9e7b6a59c09c3266f7
SHA1 db54c08e28fb9cfe2f1173d4600dd5d9f72bb62c
SHA512 fa9f7a8b3bcc2058e3f3d529be450e5b2e94224c3d5512741bfa9b1a16a89bad29cbe63334324843a3a1c7fbd2fc960dd9c9914560720d03d9cd59b19fb129e8
TLSH
T1FA511C1DA37614D6E3240772BDD394983FF5CC9A08075E1BA4419EB868C2F17AED2AD3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 422c26ab9126d4f0377ff6d37659f5538ce6a1c6e17b1a0bbb82ca7bf5d6c2e1
MD5 15710952d2ff9d2d78573d5c09746ad5
SHA1 b889478f8183b55816d76c1849057f8dbc768986
SHA512 f8e79a40fbdc5f279a489e78485a91914998680a473437ea16aa568db7cd3ff65b9332b9321ebe73e72afaf9ede4ae459bcdee76b4391e28db21dfb15180144f
TLSH
T11341ACF7C3E4866EC91196F0AB187E2BCE1D0914432C3D5AC9E4AE5BA3E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1c140bc708f192eb8e0903810862b5e8ef445fac93bed012f0df88d407e15ded
MD5 a5da5afc402d44fedc41ee33926eb263
SHA1 baa233f6ce22a92cd5eb5e5d690bdeb80296b9bd
SHA512 a58afc53c5901332894b13ff3ceaa432d0006dd89c94488f8e11d00272995dab6ff0cd76a687ad714fd9a87a8526a1cd563fffec5dad5f3675baa590b88ab174
SSDEEP 192:sxRsRfyM/jK1Ml8wCk/fKsLqFzZTbtUzoA8pi/g6+WNIYnY3hzGaIgtJ:sxRs38k/fKsGF9nHi/5I5R73
TLSH
T19D52F8166A34593BDCDBD209FA557F93D6F81573A2901E44AAFCCA0C00E66ED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 9ca326d03ba5516e31e00668cd960863a844b0ce161a4e4cf6820d66decc8f74
MD5 c66f1e76f7229116a836112cc94fc9db
SHA1 15d89c9a3a3b1b09c07ac8e67368311c7d631f33
SHA512 fa72a06460d57055f4697c28354c3f2e7517badc5fb00daf0b294cc435be27e4be0ded76f6031a7352b0e08a0d1bf8e5d794c3e3aac76c61b4e6ffbea0342778
SSDEEP 192:sxRvRfyM/jK1Ml8UQ8Ck/fKsFqZZzZTbtQzoA8prEz/g6+WNCEYII/Ynf/fhzGaE:sxRvhq7k/fKsoZZ9nPoz/5rRI/A/Z7E
TLSH
T1BF62E816AA245D7BDCDBD209FA557F93D6F81473A2941E44AAFCCB0C00E66DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 29f50d691f07e05b9aa16d64b8cbe9f77fe21414da87f5e451b4193ab70ff52e
MD5 010ea1f6423abfc078deaeb752bd4e57
SHA1 6a60565688a72fe2675589195c8f0f69162e8912
SHA512 7dc63dad8a69b84d72cfd4f05b58bfc61275dcec69a5d4fe0681fe9763fd60f130eed0efb942f05eb7409fe6fc4510f03dab2405e6d8848024ee54c2562af60c
SSDEEP 192:sxRvRfyM/jK1Ml8wCk/fKsFqZZzZTbtQzoA8p9Ez/g6+WNCEYII/Ynf/fhzGaIgE:sxRvh8k/fKsoZZ9nPaz/5rRI/A/Z7E
TLSH
T1F762E816AA245D7BDCDBD209FA557F93D6F81573A2901E44AAFCCB0C00E66DD220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ac36c5e3e03c29a9ad2c167e671f8aee2830f2cbb13c414964595f1b86742973
MD5 4d15e03324ec72ff2b196cf7e269e967
SHA1 08848cbe93e90747887c1fbdd3036caf3f388230
SHA512 a430db2febf96099cf8c96e9e50ea737eab6447aed7f6184e2cce30877159e296d3f24550354f8baa44562a9ab4b8603d4661279e25ec4cfee514bd671137587
SSDEEP 192:sxRvRfyM/jK1Ml8wCk/fKsFqFzZTbtUzoA8pi/g6+WNIYnY3hzGaIgDiJ:sxRv38k/fKsoF9nHi/5I5R76
TLSH
T10C52E816AA34593BDCDBD209FA557F93D6F81473A2901E44AAFCDA0C04E66DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 6b7f5b56e6e62b4638409dd415ad7c39c7988f782dfd76ed1b5f775d28569606
MD5 36f3e124c5ffb8172853f1514ffcfc68
SHA1 5b8ff14e14370043e72dad4eac01a847f94d0343
SHA512 e10b79bf6c6195955d4f0cc0fd03609c9dc36920200332819411729ffb8e5a44900d7956670c2125083dfd296e93a878600f0ec822ea66835ec7e90e5a6d2932
SSDEEP 768:wGedPg7pLuL7X6WgoufDM8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3Rhu4Y1roSe8fo:wGedPsE7X6WgoufDMu1ja0RhVYOaZ2
TLSH
T109E2EB3B680CCB7E4F844EDCEC29BE9FADE801CB56D8895447EA840C03C56EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d08319f691f8025e3bb909d0f5b75b65a639f0920b19c8ff3ad80662237718a1
MD5 26c30ea52ba956dbe22f71d7250754b8
SHA1 b8ab04d54683a4f609ffe3c5741115de7e200d4f
SHA512 8162d1a9b5725354c43973ff12f64f6fbe4c4183ed5d48b17fb25942830ee03932bc5c12242d145d66bf9be48e496a087d9ac764245c095fc35e695e644314b0
SSDEEP 96:KRoZs4q26gWeDzgggK41gCgcwgziItHU1gkeCGEWCPvgsEK4hgmEcEkvefUgK/qv:CoZs4q26neDsgU1gC/wgziItHU1gkeCh
TLSH
T1BB914485703B0284387E7A1C85B4895AE6C17863316DF8EB7FE841620F67E425DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7852e459-39e0-45fd-a9b6-a3e8f1740c80.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\7852e459-39e0-45fd-a9b6-a3e8f1740c80.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 51dae5c04432adf68d23bf2b5a531ca5426dae49784686551406cb252dc3a529
MD5 609fe6290b0abaad61603cf2808ca924
SHA1 c359f1592602febc815e58218e105388ca75765c
SHA512 4947134f389cb5646a4fb12bd7be734ddb45d214b12dc13d3a922615da94682d5d93e09493a883fa6945cfdc8c679c03dc1be196af11ea03ccfbf60b72766bbf
SSDEEP 384:nstNn/s3n9SR38NdjkVWmihJDZNfNoXOVSUURXvFAiXSFLETRzcoXfK86sfxEZx3:sj+963plmDZIO0Z/FNzc4ReyIsP7b9M3
TLSH
T103F2BF32F825CD63ACDA5745F20B36A2BEF4517B81C51E84DADD9F0C09832AD176B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d25b4a72a4f674e3223cbcf28bfef4b33d0726d372b1808fff8731429860153e
MD5 66559e636d7a92333c90128cfe9be0a7
SHA1 5b3b6cd1554648a1fd247c8bc97a682e78db3df2
SHA512 5d09925c8b592273da4e15b47be10400375dc9c5137524d8bf0683bb1e5ad08618082fac8be1594b0fcbfbc7ed9ef8d04e237b3c99dca603a5bcfb617aa5db62
SSDEEP 768:6rv+4UNbds3HkDZIO0ZaNzc4ReyIsXpeVH1S5D:6bsbS3Itc44bs5EH1Y
TLSH
T1D603CF32E8788937ACE66785B14B76537EF8912782D81BD0C5DE6F0C4A4B1DD131B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 46c26d95d9e872fad93cb1764e6d3beab372f460d1d2f8b425c97e399dd9e469
MD5 e2d8e6b244d378b6ed25df92da8c7901
SHA1 4622189f513288fa549c2048b5bad6280c2a887e
SHA512 7b0aea6d40ab9269b5e485b8ef0465b3376a0216c40a50e967471b07849fff50101ce3c7239a833eb330715863a95837cb33da93d676efa3a6f4aac0069576c3
SSDEEP 768:pF1j+9y3kwgvknZQ5O0Z/4Nzc4ReyIsP7b9M3:Y9y3vtc44bsDb+3
TLSH
T1CF1306F698D78976E89E5787A33D2D52ADFCC167B1885984B7C85E0CCC821BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 4bddf56606f9973997de60e02ad95d894e8a5099b772aaa7494b5b9f37dab15e
MD5 71db9ddd16cad99516c30cbfdd58283a
SHA1 8dc5100593dad5073e9b716850ade0ac7c7b3d8d
SHA512 bbb33e7567ef306ff111e77bfa0e644cb86cefdec88ce90a0e5c0306b7e60c4792b27ec5b0beaa063a9aed030043959c804ba1a14320044b3989ca366f3ec8f2
SSDEEP 768:Prv+4UNbdg3pImDZIO0Z/FNzc4ReyIsP7b9MP:Pbsb+3Utc44bsDb+P
TLSH
T19A13BE32F828CE73ACEA6645F14B35A37EF4216B81C80A84DAD95F0C0A475ED171F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e7055a08-6b1a-4c45-9220-8f3d271a7fd2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\e7055a08-6b1a-4c45-9220-8f3d271a7fd2.tmp
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

be576bd2-0d3d-40e6-9551-f25e137ec57b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\be576bd2-0d3d-40e6-9551-f25e137ec57b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4840_552660964\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 71216fe453328fd4981576e8265ecd9d507ab54db0032886e624307e8692a2b0
MD5 3108045a68b48997d4df9d3b352f0417
SHA1 e085359a5a980b5198b68e2671c3b3331ca0c9d2
SHA512 f86846f5529bc00da714042764acafcad2e56f1124e1f3595f2930b391f937ac7b362579fb848528e5c0b5cc54d0b1ea3f23327d31d6614fabe03be7af56a4b8
TLSH
T17A71239356B9C9B2C5DE5FF112839244F6FB22380B63702407A15587EB70E3A64B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/904-275-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1448-420-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1956-480-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2128-326-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2364-287-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2412-347-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3088-330-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3116-65-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3300-380-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3568-257-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3568-211-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3840-455-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3880-400-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4420-424-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4424-317-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4612-444-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5032-246-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5152-372-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5444-460-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5604-492-0x0000000000010000-0x00000000000AB000-memory.dmp

Download