115542d23eca3d978a2727f851ea79e9a279c994043538cc9be82d1222491555

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 10:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 722KB
Sample260712-mxws1sas91
SHA256 115542d23eca3d978a2727f851ea79e9a279c994043538cc9be82d1222491555
MD5 f2bda73048607852dfdcf189b947dd89
SHA1 3f50e6269536e8c8b8a474cbb8fe54cfa9af3016
SHA512 ea26cea2b3d7f1934217d767e7c7c624986fa579290539877653b9f3ed190e14a10284e57f87a356b3114ca8e199424306301d60349c7ae7a671dd7d5647e72f
SSDEEP 12288:nflfAsiVGjSGecvXAflfAsiVGjSGecvX:fMcfcMcf
TLSH
T1BEF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4840	dywqolfdyvtqljgb.exe
1500	dywqolfdyvtqljgb.sys
860	CreateProcess.exe
1276	igaywqolgd.exe
3040	CreateProcess.exe
1480	CreateProcess.exe
4912	i_igaywqolgd.exe
6016	davtqlavsq.sys
1724	CreateProcess.exe
5128	nlaysqkida.exe
3200	CreateProcess.exe
2128	CreateProcess.exe
3216	i_nlaysqkida.exe
4760	yqnifaxvpn.sys
5828	CreateProcess.exe
4308	faxspkicav.exe
4588	CreateProcess.exe
4892	CreateProcess.exe
4228	i_faxspkicav.exe
1912	sqkicausnk.sys
5600	CreateProcess.exe
900	hcauspkicx.exe
4088	CreateProcess.exe
2340	CreateProcess.exe
5216	i_hcauspkicx.exe
2264	upnhfzxrpk.sys
1260	CreateProcess.exe
1476	jhfzxrpkhc.exe
5044	CreateProcess.exe
3216	CreateProcess.exe
2868	i_jhfzxrpkhc.exe
2076	upmhezwrom.sys
1464	CreateProcess.exe
2528	mhezxrpjhb.exe
5240	CreateProcess.exe
3116	CreateProcess.exe
1460	i_mhezxrpjhb.exe
2764	zxrojhbztr.sys
4764	CreateProcess.exe
5904	jhbztrljdb.exe
6012	CreateProcess.exe
5908	CreateProcess.exe
3840	i_jhbztrljdb.exe
3492	jgbztrljdb.sys
2668	CreateProcess.exe
4076	bytrljdbwt.exe
2400	CreateProcess.exe
5388	CreateProcess.exe
2020	i_bytrljdbwt.exe
4760	oigaytqljd.sys
3224	CreateProcess.exe
916	dbvtnlgdyv.exe
5596	CreateProcess.exe
3336	CreateProcess.exe
4636	i_dbvtnlgdyv.exe
4284	fdyvqnlfdy.sys
5764	CreateProcess.exe
3716	vtqkidaysq.exe
1088	CreateProcess.exe
4904	CreateProcess.exe
5364	i_vtqkidaysq.exe
5716	kfdxvpnhfa.sys
3648	CreateProcess.exe
2416	dausnkicay.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6140_2031533347\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6140_169820653\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6140_1465411898\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6140_2031533347\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6140_821420339\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6140_821420339\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6140_821420339\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6140_821420339\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6140_1465411898\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhfzxrpkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtnlgdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dausnkicay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnifdyvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hcauspkicx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtnlgdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrljdbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnifdyvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxspkicav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtqkidaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxrpkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkecxupkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomhezxupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqkicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaywqolgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytrljdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtqkidaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dausnkicay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dywqolfdyvtqljgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlaysqkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhfzxrpkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhezxrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbztrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbztrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bytrljdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxrpkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkecxupkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomhezxupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrljdbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigaytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaywqolgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxspkicav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhezxrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigaytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlaysqkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hcauspkicx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwuomgezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwuomgezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqkicavs.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2560	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
6016	ipconfig.exe
1672	ipconfig.exe
4612	ipconfig.exe
5440	ipconfig.exe
5984	ipconfig.exe
3864	ipconfig.exe
5924	ipconfig.exe
4812	ipconfig.exe
4404	ipconfig.exe
5396	ipconfig.exe
548	ipconfig.exe
3372	ipconfig.exe
3292	ipconfig.exe
3648	ipconfig.exe
2632	ipconfig.exe
1460	ipconfig.exe
5628	ipconfig.exe
2092	ipconfig.exe
992	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134283270836276211"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{4468675A-E457-4A68-8490-AF01B82CF639}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4840	dywqolfdyvtqljgb.exe
4840	dywqolfdyvtqljgb.exe
4840	dywqolfdyvtqljgb.exe
4840	dywqolfdyvtqljgb.exe
4840	dywqolfdyvtqljgb.exe
4840	dywqolfdyvtqljgb.exe
4840	dywqolfdyvtqljgb.exe
4840	dywqolfdyvtqljgb.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4912	i_igaywqolgd.exe
Token: SeDebugPrivilege	3216	i_nlaysqkida.exe
Token: SeDebugPrivilege	4228	i_faxspkicav.exe
Token: SeDebugPrivilege	5216	i_hcauspkicx.exe
Token: SeDebugPrivilege	2868	i_jhfzxrpkhc.exe
Token: SeDebugPrivilege	1460	i_mhezxrpjhb.exe
Token: SeDebugPrivilege	3840	i_jhbztrljdb.exe
Token: SeDebugPrivilege	2020	i_bytrljdbwt.exe
Token: SeDebugPrivilege	4636	i_dbvtnlgdyv.exe
Token: SeDebugPrivilege	5364	i_vtqkidaysq.exe
Token: SeDebugPrivilege	4692	i_dausnkicay.exe
Token: SeDebugPrivilege	692	i_hfzxrpkhca.exe
Token: SeDebugPrivilege	5896	i_smkecxupkh.exe
Token: SeDebugPrivilege	4960	i_uomhezxupm.exe
Token: SeDebugPrivilege	5192	i_zwuomgezwr.exe
Token: SeDebugPrivilege	2852	i_bztrljdbzt.exe
Token: SeDebugPrivilege	1392	i_qoigaytqlj.exe
Token: SeDebugPrivilege	5784	i_vtnifdyvtn.exe
Token: SeDebugPrivilege	4480	i_aysqkicavs.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6140	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 460 wrote to memory of 4840	460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	87
PID 460 wrote to memory of 4224	460	2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 4224 wrote to memory of 6140	4224	iexplore.exe	89
PID 6140 wrote to memory of 5868	6140	msedge.exe	90
PID 6140 wrote to memory of 4600	6140	msedge.exe	91
PID 6140 wrote to memory of 2560	6140	msedge.exe	92
PID 6140 wrote to memory of 4600	6140	msedge.exe	91
PID 6140 wrote to memory of 4600	6140	msedge.exe	91
PID 6140 wrote to memory of 960	6140	msedge.exe	93
PID 6140 wrote to memory of 960	6140	msedge.exe	93
PID 6140 wrote to memory of 3908	6140	msedge.exe	95
PID 6140 wrote to memory of 3908	6140	msedge.exe	95
PID 6140 wrote to memory of 3908	6140	msedge.exe	95
PID 6140 wrote to memory of 784	6140	msedge.exe	96
PID 6140 wrote to memory of 784	6140	msedge.exe	96
PID 6140 wrote to memory of 784	6140	msedge.exe	96
PID 6140 wrote to memory of 5872	6140	msedge.exe	97
PID 6140 wrote to memory of 2440	6140	msedge.exe	98
PID 6140 wrote to memory of 5872	6140	msedge.exe	97
PID 6140 wrote to memory of 5872	6140	msedge.exe	97
PID 6140 wrote to memory of 2440	6140	msedge.exe	98
PID 6140 wrote to memory of 2440	6140	msedge.exe	98
PID 6140 wrote to memory of 5880	6140	msedge.exe	99
PID 6140 wrote to memory of 5880	6140	msedge.exe	99
PID 4840 wrote to memory of 860	4840	dywqolfdyvtqljgb.exe	103
PID 1276 wrote to memory of 3040	1276	igaywqolgd.exe	106
PID 6140 wrote to memory of 5284	6140	msedge.exe	109
PID 6140 wrote to memory of 5284	6140	msedge.exe	109
PID 6140 wrote to memory of 3732	6140	msedge.exe	110
PID 6140 wrote to memory of 3732	6140	msedge.exe	110
PID 6140 wrote to memory of 4640	6140	msedge.exe	112
PID 6140 wrote to memory of 1908	6140	msedge.exe	113
PID 6140 wrote to memory of 1908	6140	msedge.exe	113
PID 6140 wrote to memory of 2764	6140	msedge.exe	116
PID 6140 wrote to memory of 2764	6140	msedge.exe	116
PID 4840 wrote to memory of 1480	4840	dywqolfdyvtqljgb.exe	117
PID 4840 wrote to memory of 1724	4840	dywqolfdyvtqljgb.exe	121
PID 5128 wrote to memory of 3200	5128	nlaysqkida.exe	123
PID 4840 wrote to memory of 2128	4840	dywqolfdyvtqljgb.exe	126
PID 4840 wrote to memory of 5828	4840	dywqolfdyvtqljgb.exe	130
PID 4308 wrote to memory of 4588	4308	faxspkicav.exe	132
PID 4840 wrote to memory of 4892	4840	dywqolfdyvtqljgb.exe	135
PID 6140 wrote to memory of 2776	6140	msedge.exe	137
PID 6140 wrote to memory of 2776	6140	msedge.exe	137
PID 6140 wrote to memory of 2776	6140	msedge.exe	137
PID 6140 wrote to memory of 4448	6140	msedge.exe	140
PID 6140 wrote to memory of 4448	6140	msedge.exe	140
PID 6140 wrote to memory of 4448	6140	msedge.exe	140
PID 4840 wrote to memory of 5600	4840	dywqolfdyvtqljgb.exe	142
PID 900 wrote to memory of 4088	900	hcauspkicx.exe	144
PID 4840 wrote to memory of 2340	4840	dywqolfdyvtqljgb.exe	147
PID 6140 wrote to memory of 2928	6140	msedge.exe	149
PID 6140 wrote to memory of 4604	6140	msedge.exe	150
PID 6140 wrote to memory of 5008	6140	msedge.exe	151
PID 4840 wrote to memory of 1260	4840	dywqolfdyvtqljgb.exe	154
PID 1476 wrote to memory of 5044	1476	jhfzxrpkhc.exe	156
PID 4840 wrote to memory of 3216	4840	dywqolfdyvtqljgb.exe	159
PID 4840 wrote to memory of 1464	4840	dywqolfdyvtqljgb.exe	163
PID 2528 wrote to memory of 5240	2528	mhezxrpjhb.exe	165
PID 4840 wrote to memory of 3116	4840	dywqolfdyvtqljgb.exe	168
PID 4840 wrote to memory of 4764	4840	dywqolfdyvtqljgb.exe	172
PID 5904 wrote to memory of 6012	5904	jhbztrljdb.exe	174
PID 4840 wrote to memory of 5908	4840	dywqolfdyvtqljgb.exe	177
PID 4840 wrote to memory of 2668	4840	dywqolfdyvtqljgb.exe	181

C:\Users\Admin\AppData\Local\Temp\2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_f2bda73048607852dfdcf189b947dd89_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:460
- C:\Temp\dywqolfdyvtqljgb.exe
  C:\Temp\dywqolfdyvtqljgb.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igaywqolgd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:860
  - - C:\Temp\igaywqolgd.exe
      C:\Temp\igaywqolgd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1276
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3040
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igaywqolgd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1480
  - - C:\Temp\i_igaywqolgd.exe
      C:\Temp\i_igaywqolgd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4912
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlaysqkida.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1724
  - - C:\Temp\nlaysqkida.exe
      C:\Temp\nlaysqkida.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5128
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3200
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:992
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlaysqkida.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2128
  - - C:\Temp\i_nlaysqkida.exe
      C:\Temp\i_nlaysqkida.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3216
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\faxspkicav.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5828
  - - C:\Temp\faxspkicav.exe
      C:\Temp\faxspkicav.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4308
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4588
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5440
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_faxspkicav.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4892
  - - C:\Temp\i_faxspkicav.exe
      C:\Temp\i_faxspkicav.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4228
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hcauspkicx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5600
  - - C:\Temp\hcauspkicx.exe
      C:\Temp\hcauspkicx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:900
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4088
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6016
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hcauspkicx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2340
  - - C:\Temp\i_hcauspkicx.exe
      C:\Temp\i_hcauspkicx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5216
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhfzxrpkhc.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1260
  - - C:\Temp\jhfzxrpkhc.exe
      C:\Temp\jhfzxrpkhc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1476
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5044
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3292
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhfzxrpkhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3216
  - - C:\Temp\i_jhfzxrpkhc.exe
      C:\Temp\i_jhfzxrpkhc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2868
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mhezxrpjhb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1464
  - - C:\Temp\mhezxrpjhb.exe
      C:\Temp\mhezxrpjhb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2528
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5240
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mhezxrpjhb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3116
  - - C:\Temp\i_mhezxrpjhb.exe
      C:\Temp\i_mhezxrpjhb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhbztrljdb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4764
  - - C:\Temp\jhbztrljdb.exe
      C:\Temp\jhbztrljdb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5904
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6012
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhbztrljdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5908
  - - C:\Temp\i_jhbztrljdb.exe
      C:\Temp\i_jhbztrljdb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bytrljdbwt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2668
  - - C:\Temp\bytrljdbwt.exe
      C:\Temp\bytrljdbwt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4076
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2400
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3648
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bytrljdbwt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5388
  - - C:\Temp\i_bytrljdbwt.exe
      C:\Temp\i_bytrljdbwt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2020
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbvtnlgdyv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3224
  - - C:\Temp\dbvtnlgdyv.exe
      C:\Temp\dbvtnlgdyv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:916
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5596
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4404
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbvtnlgdyv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3336
  - - C:\Temp\i_dbvtnlgdyv.exe
      C:\Temp\i_dbvtnlgdyv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4636
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtqkidaysq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5764
  - - C:\Temp\vtqkidaysq.exe
      C:\Temp\vtqkidaysq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3716
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1088
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5396
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtqkidaysq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4904
  - - C:\Temp\i_vtqkidaysq.exe
      C:\Temp\i_vtqkidaysq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5364
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dausnkicay.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3648
  - - C:\Temp\dausnkicay.exe
      C:\Temp\dausnkicay.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2416
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:468
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:548
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dausnkicay.exe ups_ins
    3⤵
    PID:3584
  - - C:\Temp\i_dausnkicay.exe
      C:\Temp\i_dausnkicay.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4692
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfzxrpkhca.exe ups_run
    3⤵
    PID:6132
  - - C:\Temp\hfzxrpkhca.exe
      C:\Temp\hfzxrpkhca.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6080
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4876
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2632
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfzxrpkhca.exe ups_ins
    3⤵
    PID:5412
  - - C:\Temp\i_hfzxrpkhca.exe
      C:\Temp\i_hfzxrpkhca.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:692
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\smkecxupkh.exe ups_run
    3⤵
    PID:932
  - - C:\Temp\smkecxupkh.exe
      C:\Temp\smkecxupkh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5572
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2960
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_smkecxupkh.exe ups_ins
    3⤵
    PID:3044
  - - C:\Temp\i_smkecxupkh.exe
      C:\Temp\i_smkecxupkh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uomhezxupm.exe ups_run
    3⤵
    PID:240
  - - C:\Temp\uomhezxupm.exe
      C:\Temp\uomhezxupm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1180
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5788
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5924
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uomhezxupm.exe ups_ins
    3⤵
    PID:4916
  - - C:\Temp\i_uomhezxupm.exe
      C:\Temp\i_uomhezxupm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4960
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwuomgezwr.exe ups_run
    3⤵
    PID:3728
  - - C:\Temp\zwuomgezwr.exe
      C:\Temp\zwuomgezwr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3488
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2060
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1672
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwuomgezwr.exe ups_ins
    3⤵
    PID:4404
  - - C:\Temp\i_zwuomgezwr.exe
      C:\Temp\i_zwuomgezwr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5192
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bztrljdbzt.exe ups_run
    3⤵
    PID:2740
  - - C:\Temp\bztrljdbzt.exe
      C:\Temp\bztrljdbzt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2760
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2540
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bztrljdbzt.exe ups_ins
    3⤵
    PID:3560
  - - C:\Temp\i_bztrljdbzt.exe
      C:\Temp\i_bztrljdbzt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2852
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoigaytqlj.exe ups_run
    3⤵
    PID:1172
  - - C:\Temp\qoigaytqlj.exe
      C:\Temp\qoigaytqlj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3908
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4468
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4612
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoigaytqlj.exe ups_ins
    3⤵
    PID:5732
  - - C:\Temp\i_qoigaytqlj.exe
      C:\Temp\i_qoigaytqlj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1392
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnifdyvtn.exe ups_run
    3⤵
    PID:3408
  - - C:\Temp\vtnifdyvtn.exe
      C:\Temp\vtnifdyvtn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4816
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2404
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3372
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnifdyvtn.exe ups_ins
    3⤵
    PID:4692
  - - C:\Temp\i_vtnifdyvtn.exe
      C:\Temp\i_vtnifdyvtn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5784
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aysqkicavs.exe ups_run
    3⤵
    PID:1624
  - - C:\Temp\aysqkicavs.exe
      C:\Temp\aysqkicavs.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1504
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2000
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5628
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aysqkicavs.exe ups_ins
    3⤵
    PID:696
  - - C:\Temp\i_aysqkicavs.exe
      C:\Temp\i_aysqkicavs.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4480
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:6140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7fff5e5bc188,0x7fff5e5bc194,0x7fff5e5bc1a0
      4⤵
      PID:5868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1576,i,1841421533077933135,10763508664272451343,262144 --field-trial-handle=2236,i,1240647987361265162,14334097176200370234,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
      4⤵
      PID:4600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,2718723597338453335,9438455620393997560,524288 --field-trial-handle=2236,i,1240647987361265162,14334097176200370234,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:11
      4⤵
      System Time Discovery
      PID:2560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2224,i,8394461501838621381,13717608322110783536,524288 --field-trial-handle=2236,i,1240647987361265162,14334097176200370234,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:13
      4⤵
      PID:960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,13377752594218880052,8842286490079569060,2097152 --field-trial-handle=2236,i,1240647987361265162,14334097176200370234,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
      4⤵
      PID:3908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,13427168428961615495,7968895063219889859,2097152 --field-trial-handle=2236,i,1240647987361265162,14334097176200370234,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
      4⤵
      PID:784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4340,i,17667769490594119082,17472014922238753011,2097152 --field-trial-handle=2236,i,1240647987361265162,14334097176200370234,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:1
      4⤵
      PID:5872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4352,i,2050400831494340332,11399364946319030398,2097152 --field-trial-handle=2236,i,1240647987361265162,14334097176200370234,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:9
      4⤵
      PID:2440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3824,i,15971118053578641750,7804705176254769524,524288 --field-trial-handle=2236,i,1240647987361265162,14334097176200370234,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
      4⤵
      PID:5880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,17606447640361462744,3373162416591903924,524288 --field-trial-handle=2236,i,1240647987361265162,14334097176200370234,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
      4⤵
      PID:5284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,4165811348777082009,3759785597346623673,524288 --field-trial-handle=2236,i,1240647987361265162,14334097176200370234,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:14
      4⤵
      PID:3732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,12822053337230772380,15724004594798831962,524288 --field-trial-handle=2236,i,1240647987361265162,14334097176200370234,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
      4⤵
      PID:4324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,12822053337230772380,15724004594798831962,524288 --field-trial-handle=2236,i,1240647987361265162,14334097176200370234,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
      4⤵
      PID:4640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,16334707112106029134,6829507027841501318,524288 --field-trial-handle=2236,i,1240647987361265162,14334097176200370234,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
      4⤵
      PID:1908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,7081168987072424197,7676090387218230831,524288 --field-trial-handle=2236,i,1240647987361265162,14334097176200370234,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:14
      4⤵
      PID:2764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5356,i,16949914769130496920,1459827833999137548,2097152 --field-trial-handle=2236,i,1240647987361265162,14334097176200370234,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:1
      4⤵
      PID:2776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3764,i,8617251173428744430,5934376850488815099,2097152 --field-trial-handle=2236,i,1240647987361265162,14334097176200370234,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:1
      4⤵
      PID:4448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6908,i,12350422225920558783,7674989851349461062,524288 --field-trial-handle=2236,i,1240647987361265162,14334097176200370234,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:14
      4⤵
      PID:2928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6916,i,3752330587725746450,17290407153715376514,524288 --field-trial-handle=2236,i,1240647987361265162,14334097176200370234,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:14
      4⤵
      PID:4604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6904,i,7487875148075775016,8446065663628766933,524288 --field-trial-handle=2236,i,1240647987361265162,14334097176200370234,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:14
      4⤵
      PID:5008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,15551559667315867475,4769021700181333939,524288 --field-trial-handle=2236,i,1240647987361265162,14334097176200370234,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
      4⤵
      PID:5752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2840,i,3212051936648666674,80195732544452467,524288 --field-trial-handle=2236,i,1240647987361265162,14334097176200370234,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
      4⤵
      PID:5500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6652,i,5206165411980715737,11486429733699188878,2097152 --field-trial-handle=2236,i,1240647987361265162,14334097176200370234,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:1
      4⤵
      PID:996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,11385393869888796325,12901581022976393080,524288 --field-trial-handle=2236,i,1240647987361265162,14334097176200370234,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:14
      4⤵
      PID:1964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6664,i,3224428094658368830,9785003780992935618,2097152 --field-trial-handle=2236,i,1240647987361265162,14334097176200370234,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
      4⤵
      PID:4700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6924,i,7734900628561883024,10094280458699283822,524288 --field-trial-handle=2236,i,1240647987361265162,14334097176200370234,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:14
      4⤵
      PID:5796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6956,i,11004181241960341867,2614874248445200020,262144 --field-trial-handle=2236,i,1240647987361265162,14334097176200370234,262144 --variations-seed-version --mojo-platform-channel-handle=6960 /prefetch:10
      4⤵
      PID:6068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1204,i,5281594703246782663,10625216307274214794,524288 --field-trial-handle=2236,i,1240647987361265162,14334097176200370234,262144 --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:14
      4⤵
      PID:4412

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5984

C:\Temp\dywqolfdyvtqljgb.sys
C:\Temp\dywqolfdyvtqljgb.sys
1⤵
- Executes dropped EXE
PID:1500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5292

C:\Temp\davtqlavsq.sys
C:\Temp\davtqlavsq.sys
1⤵
- Executes dropped EXE
PID:6016

C:\Temp\yqnifaxvpn.sys
C:\Temp\yqnifaxvpn.sys
1⤵
- Executes dropped EXE
PID:4760

C:\Temp\sqkicausnk.sys
C:\Temp\sqkicausnk.sys
1⤵
- Executes dropped EXE
PID:1912

C:\Temp\upnhfzxrpk.sys
C:\Temp\upnhfzxrpk.sys
1⤵
- Executes dropped EXE
PID:2264

C:\Temp\upmhezwrom.sys
C:\Temp\upmhezwrom.sys
1⤵
- Executes dropped EXE
PID:2076

C:\Temp\zxrojhbztr.sys
C:\Temp\zxrojhbztr.sys
1⤵
- Executes dropped EXE
PID:2764

C:\Temp\jgbztrljdb.sys
C:\Temp\jgbztrljdb.sys
1⤵
- Executes dropped EXE
PID:3492

C:\Temp\oigaytqljd.sys
C:\Temp\oigaytqljd.sys
1⤵
- Executes dropped EXE
PID:4760

C:\Temp\fdyvqnlfdy.sys
C:\Temp\fdyvqnlfdy.sys
1⤵
- Executes dropped EXE
PID:4284

C:\Temp\kfdxvpnhfa.sys
C:\Temp\kfdxvpnhfa.sys
1⤵
- Executes dropped EXE
PID:5716

C:\Temp\xvpnkfaxsp.sys
C:\Temp\xvpnkfaxsp.sys
1⤵
PID:4460

C:\Temp\zxrpkhczus.sys
C:\Temp\zxrpkhczus.sys
1⤵
PID:3936

C:\Temp\bzurmkecwu.sys
C:\Temp\bzurmkecwu.sys
1⤵
PID:1488

C:\Temp\ebwtrmjebw.sys
C:\Temp\ebwtrmjebw.sys
1⤵
PID:5216

C:\Temp\uomgeywqoj.sys
C:\Temp\uomgeywqoj.sys
1⤵
PID:3444

C:\Temp\yvtolgeywq.sys
C:\Temp\yvtolgeywq.sys
1⤵
PID:4948

C:\Temp\gaysqlidav.sys
C:\Temp\gaysqlidav.sys
1⤵
PID:3376

C:\Temp\kidavtnlfd.sys
C:\Temp\kidavtnlfd.sys
1⤵
PID:4476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

davtqlavsq.sys

Path C:\Temp\davtqlavsq.sys
Size 293KB
SHA256 ca4391f782bb6ded91783bdbf89d9daefc002910d781702d6519c2a319338b36
MD5 0dd1350683b72428369ee6cfd33b46ea
SHA1 b10745683eafffae43de286f8aa2bca8256092f1
SHA512 a323ea6e1bad63275fc46018ac48b1c9c20635fb35e94da2758fe3026c503273ba11b0423e7451f1134e7f33e46fb4e60af6fff6ee6a30c44e8a00a411d05775
SSDEEP 3072:UtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:UIJjiJcbI03GBc3ucY5DCSj
TLSH
T135545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dywqolfdyvtqljgb.exe

Path C:\Temp\dywqolfdyvtqljgb.exe
Size 722KB
SHA256 afffcf6df0904bf962fa32a7d9402c12544fd3a4b0418374f675743f93f4fedf
MD5 f55dd23fc04dc2e6d8f91279f8497e1e
SHA1 5f21e313444c14e099837f6bc26c190be64e6da5
SHA512 26daa19c15cd9a6aadb473a943d946e5c88003842892d99b5af6c159d30c5334ea3048bda113f7e9a2718407caae82ec0a616bb273563ff5f5c5d0a6aff128e9
SSDEEP 12288:gflfAsiVGjSGecvXAflfAsiVGjSGecvX:8McfcMcf
TLSH
T15CF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dywqolfdyvtqljgb.sys

Path C:\Temp\dywqolfdyvtqljgb.sys
Size 293KB
SHA256 9459ef35c864d38205789908d3b232dfc6ff5ef111df1913a4963cb3038f1476
MD5 15bda5d5e0a8a27c821559ff0d3f85e0
SHA1 b7b6a55f618a4711cd9439fd7fb5abdf7d882779
SHA512 66a2cb78c5eafebc133a72151610ddb2ec2da4ed5d876cda1e63f011d5bb65574efee0706ba6cff03bc377f3aafe948db44c73499b65b1fdad76c13bdeccb28b
SSDEEP 3072:jtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:jIJjiJcbI03GBc3ucY5DCSj
TLSH
T182545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faxspkicav.exe

Path C:\Temp\faxspkicav.exe
Size 722KB
SHA256 c5512c79b40eceaf7b21958b708d8931b91a6125131684d7430ea5cea157f122
MD5 c303cd7edd216ef36e5bcf3132cad9cd
SHA1 a285291e4256c301166636883042aa27cdeeefb1
SHA512 66a308c84e9552788361e733fc25d65256160a52455be0330d595ae919bac7d0999a0cf7b810c455fc63ac308785aa02feb3513eb9a0aade006a7489649db676
SSDEEP 12288:2flfAsiVGjSGecvXAflfAsiVGjSGecvX:iMcfcMcf
TLSH
T123F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hcauspkicx.exe

Path C:\Temp\hcauspkicx.exe
Size 722KB
SHA256 37a12cdebfaaa3b970f061a9fb04424b35af1154049574573b208957d4233274
MD5 d5dd0c8d4e88abe10cf878362f916c51
SHA1 d9fb2237c3564b729d2f7fa5518c7ee0f3e2f703
SHA512 7260c2d5ad1c782fc54e91458912f3f68760d8c9eccaa0b4d77248d03620f36111f11fb7e9e0eadd5b9805a3944b96568b709a194ebe172dfb441713e5f3d784
SSDEEP 12288:bflfAsiVGjSGecvXAflfAsiVGjSGecvX:zMcfcMcf
TLSH
T109F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_faxspkicav.exe

Path C:\Temp\i_faxspkicav.exe
Size 722KB
SHA256 05fd7ab958750807d47c3fcf693acd6cdf81befd5ee4d1c54354e23af7f24b34
MD5 f68154ad5e8121b39c22a18645686e28
SHA1 ae58315b362dfe194fbe61c41b7dd9647afdda6a
SHA512 4a8c5caf5fb80fe11a12829b5d8d8ffd71d3b8929807dad1538220e0d1723dc5bf8b20391db15b455858c170ce7d9b7ed348e4db62e2a1ddbd850f99fe5e3743
SSDEEP 12288:kflfAsiVGjSGecvXAflfAsiVGjSGecvX:AMcfcMcf
TLSH
T1A8F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hcauspkicx.exe

Path C:\Temp\i_hcauspkicx.exe
Size 722KB
SHA256 7630df140a1e0a5c13bed0b4e5cb25a0cc44dac20b925ffc987d614095f2cd62
MD5 fb5365888eeff262f2252d07169c1924
SHA1 cdfd3e6b291515a21e049a18addb9c001c9d52cf
SHA512 d409d2b2763e061c5bc0c24b1f8dd1baae1cdd3e9ab424fc1ce31830adfb37e5a65ce2daa52f0c8a8b6f6df48a23caa3d650dcef51cee889c08afe19448b9803
SSDEEP 12288:cflfAsiVGjSGecvXAflfAsiVGjSGecvX:IMcfcMcf
TLSH
T178F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igaywqolgd.exe

Path C:\Temp\i_igaywqolgd.exe
Size 722KB
SHA256 dd2eeb54199947eaaa4ddc37fe578ce3dc02f3278b8830cbd8d75a00eaf3c1aa
MD5 e0be3aa827df110fa728a1599cd8ec5e
SHA1 087e37debc0a462c1e9c38c3e2dcdcf8fc87c503
SHA512 006d16543229872c21f3818e7df08f1471f5ffe3981d53ff1c14c071b4aacc37935190872c179007a74ab91b0481b8b0d64feb974812be2dde458aaf58b65d7c
SSDEEP 12288:/flfAsiVGjSGecvXAflfAsiVGjSGecvX:nMcfcMcf
TLSH
T1A4F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jhfzxrpkhc.exe

Path C:\Temp\i_jhfzxrpkhc.exe
Size 722KB
SHA256 77210123431b5b19bff10194256928c299d158c06b05e906d4f381722d5cd509
MD5 37617d492fc1729ebd8136bc59f59583
SHA1 d5e357c01af30ac64861a76d036ff437af22a92e
SHA512 dda453b2c3e3a7ae3643a414e60abee1481e564aae9fac9bf67c51ffa153b0da11430c22d50a9dcc48610fc414ee9a0e1ee623ae302883252558145e57aad400
SSDEEP 12288:8flfAsiVGjSGecvXAflfAsiVGjSGecvX:oMcfcMcf
TLSH
T1C7F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nlaysqkida.exe

Path C:\Temp\i_nlaysqkida.exe
Size 722KB
SHA256 c292c1c35fd1ef44c314dca590d82f0e2eb92a77ee582ee43fa85c0d5f00b430
MD5 62c151031557ddcacf260aaeaa1cc100
SHA1 09553fb2fb63bfecca757b72981add1419e8e624
SHA512 452abdc636856085ce11cb6481c0f8af7635ce0345277de30532b91bba73cdcbfe1d9a1c3fce1df34b432f21711f286b2df34c9ed9eb599bf3c26b52a1de3e9c
SSDEEP 12288:FflfAsiVGjSGecvXAflfAsiVGjSGecvX:NMcfcMcf
TLSH
T12DF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igaywqolgd.exe

Path C:\Temp\igaywqolgd.exe
Size 722KB
SHA256 b77f17c372a5ee59acd307d7d2ad23c4017fbc0aaa1d343671cf673f619e257a
MD5 c3e7f8398a38a2c4fb217c7011b8973f
SHA1 d446baaf55bed2376361572a142a362d4dec80c2
SHA512 0df2de804479a8b59c57d281ddc9e82298aa6f3971e2357c6247d32dd9f7774910dbb338eb478fffb1de6992bea3674c37c514225ac1692f32eefc158bff057f
SSDEEP 12288:wflfAsiVGjSGecvXAflfAsiVGjSGecvX:sMcfcMcf
TLSH
T105F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhfzxrpkhc.exe

Path C:\Temp\jhfzxrpkhc.exe
Size 722KB
SHA256 5796d4c80aa8763cf3ad7c9ba39825bffa0f18035da99ea226b289e7912a625b
MD5 a4d9b8fd6ec37cc07e0677a0e9ac7dd4
SHA1 786cc2ec8519f3e13a39e414813bb7a0ff0b31da
SHA512 a50b4655542356768a8184f1ee5030cffdfca223db0536d12cbb2727c267830cd42bcd764a34059b88f65df6ecc2029973159389abff8ba89f8f1dcf9f859e56
SSDEEP 12288:lflfAsiVGjSGecvXAflfAsiVGjSGecvX:tMcfcMcf
TLSH
T1FEF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhezxrpjhb.exe

Path C:\Temp\mhezxrpjhb.exe
Size 722KB
SHA256 0a09fb49d6ba777219cd09a62944f361f75d42c74f2fd2cbbbcf4e407504e6cb
MD5 9ea31adda7a676ce90987e5e67b5902c
SHA1 76d43c44797f019a329f1d9e7a7f357b090778db
SHA512 c7bb9cea157ecf42908f47eb5625a0e7eb22ace203f6b40b981df35df8d2ef052d4ca9367a7e16f415324359de3c38e5cbbf08eb5707aae11b479830f599a40e
SSDEEP 12288:2flfAsiVGjSGecvXAflfAsiVGjSGecvX:iMcfcMcf
TLSH
T1C6F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlaysqkida.exe

Path C:\Temp\nlaysqkida.exe
Size 722KB
SHA256 2e02dedf00a3310abafcd8b02bf25d727b0d5ba77dbe63ef8ca8f6e167985876
MD5 9cd88e7a8d348363a67ac2d4b8eb56f9
SHA1 41c086055837a4562f6f0fd279245f7b7095a8d5
SHA512 53ea53d263c1ce00a486f0f06527d13911852760810ed7628678757ca5cfa849c363488168663d2eadcd32e83d1ec66a3f925379917cf16573540f9eee7d8a7c
SSDEEP 12288:ZflfAsiVGjSGecvXAflfAsiVGjSGecvX:xMcfcMcf
TLSH
T146F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkicausnk.sys

Path C:\Temp\sqkicausnk.sys
Size 293KB
SHA256 7b91167b8ce891ae2ecf765326226c10a85f95ddbdfef72ae453301ad6f9f64f
MD5 95d931bf6b0e55c77fab2c55e58aa6df
SHA1 2f9801ceeeecba6cb96a84943e8ac84e44e38644
SHA512 55c814cd94218704a86378f680ae5e1a2e4389ddf4db740d18c64e7af9bb901ea08fe79f4ee7ab997b02e8e44b0f3e2bc905246bc9af65da4ca0760eb09ab177
SSDEEP 3072:vtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:vIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E4545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

upmhezwrom.sys

Path C:\Temp\upmhezwrom.sys
Size 293KB
SHA256 8203bb6f05e1f3043fefeef33c641b36d7b61032a9ef7bbc6e8104a740b46639
MD5 8dd814786194835d8fa9434b763a7b6b
SHA1 8a10ac6693ea80178b511152014a47746938eb7b
SHA512 0abe145a78151bf33fb30814e878f80c29358207a32ca46d6f6be9937db458e036eb3cc2928f1b391c872347ecf122093dcfef952bf9bc3ce8ff45e9c438a3d8
SSDEEP 3072:atKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:aIJjiJcbI03GBc3ucY5DCSj
TLSH
T180545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

upnhfzxrpk.sys

Path C:\Temp\upnhfzxrpk.sys
Size 293KB
SHA256 d2b06b655c40967465406ec44dfba32953301dfc28273f1b280f4c695ec89ab6
MD5 539eec418ed9aa5fbd48fcf75a3f073a
SHA1 03a8053e3cb625fd6088843923d2e16a5c55de6c
SHA512 db8659472cacfe656c140b8f9df8a0c47f7758d6cb02443fc627c7beadd4409912e26deaeddfcc41bcddc39e8cf9ee1bd5d9a73acc5480d598f0bf90806b3c3f
SSDEEP 3072:utKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:uIJjiJcbI03GBc3ucY5DCSj
TLSH
T137545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yqnifaxvpn.sys

Path C:\Temp\yqnifaxvpn.sys
Size 293KB
SHA256 dfbb21855cea5902e59c619c8d6c30a062376ef4a26ffb6353a34059e9336475
MD5 ea6a10d51058666ba997f4bfd37f1b83
SHA1 ba0b7fbf218ddf2229b509c0a89ef01ddc04d4c9
SHA512 150d214b3a9ef935ee9b615d1499bc454efe584cfaef838f75594fd593fe3026fb25d732ff2cf9e2b8c004d07bc48b27c0a7bcc97967e6218b4f93afdeb08c6e
SSDEEP 3072:ptKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:pIJjiJcbI03GBc3ucY5DCSj
TLSH
T150545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 2bc92214c18dbc45c770f8c934bfd7ceb880ad9429aa4f8579b7cbd8de6741f8
MD5 285e25096bbdea75d190ef3aa1959d34
SHA1 42c449ee75570e79237aa5a7faaca84484a4fa64
SHA512 9e6a1a3cb2d4b87ce6a5e0bd2f57b8de67c2ae6962f1b3e7a380f168fd73445be40c9ef8c24aa0adc140485f4ff34589295abe64444d9e557c2473f2e890b651
TLSH
T1CF51B7E303271DC2C7E582B214E1ACFA7A39C6FA41CF9E95788EA4B4864331E31D5024
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d99d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59d99d.TMP
Size 2KB
SHA256 3493004b040ca4e77fc2b5a31d7a677613e743d56d35b9ab87d442cb104a8d22
MD5 d45e021024926571c81ee7f21340081a
SHA1 12e76fc25804d7f06aebb62396323d2e3906769c
SHA512 0b1ec9cae09b188d1465227114509415ef6c05177ed9b9d3bdab447f8b1343912d20ca0005d6fc16a563f94cb0adecdc2bf167fb2f14f42ecf7d74c03eaa264c
TLSH
T17251CAE303171DC2C7E582B254E0ACFA793AC6FA41CF9ED5788E94B4864331E31D5024
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e43d1f83d280e7d3cf6de105bb8454a88bbd6163b015c6148507b8d347e44364
MD5 32f28ae4956e6ec6bde2d08f38c088cc
SHA1 b728d9cf7a86ee4bcea6815bb2b4db597137972b
SHA512 353ea62438d84133786d1aef65a75319a1c58a6f4015340a533d7dba78e316226569aa870e67ad409fbf0cb4b4f8db93615873b5cb5fa85fcb76ca70eff63fa8
TLSH
T13B51AAF3C7E8862E891156F0AB187E2BCE1D0915432C3D5A89E4AE1BA3E2871E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d67bfa44dfdf23349005457d5d2f6a77d1e4a46b7877d93a2ebcf27bcdc3d44a
MD5 2622b46ef6778c8d632fc8528eb3e9ff
SHA1 bb9988aacd2cc7ad83a3a0316467b2331f2140c2
SHA512 89f2b3c0ea169889951ef7443170017b30af45befce54fa00bbb4799a023fed441a361e37fac2852b4779f3fae70ba54d27fb8b5d77ee6acda4870336f333ad4
SSDEEP 192:sxRjR2yM/jK1Ml8wCG/fTsE46b7VkZ5/ZCzoD8pi/g6+WNIYCsuO0GJIgtJ:sxRjc8G/fTsMBaJZ+i/5Iel3
TLSH
T16C52EA166A345977DCDBD20DFA51BF93D6F91473A2501E44AAFCCA0C00E6AEC621381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f8857f7d74e315773695045fbdb5fc4695e9c30de0556ebf72c34336ce00c823
MD5 24d2cf15c5d7e7e978473297a653e54d
SHA1 cf40991d7034ea81b6a83b894da9de098901d852
SHA512 5676f2b36f6a73325acd22924ea9efbba24a0d7bacbf8fb040aec62231d395cb87410b4fcb3c862b6fedf67114c3cc15ae4a010c75a1f3c3effdf7672c19c3bc
SSDEEP 192:sxRgR2yM/jK1Ml8UQGCG/fTsy46b7PkZ5/ZazoD8prB/g6+WNIYCKuO0GJIgDoJ:sxRgcqhG/fTsOLaJZGt/5Islg
TLSH
T1E662FA16AA245D77DCDBD20DFA41BF93D6F91473A1501E44AAFCCA0C04E66EC621381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d261957c78f87fef817e000ccb63e27c384f339a17247d5ac57baae49da93ae1
MD5 24d34ff69255fcad30d5676b792d3c99
SHA1 711cfc177481c6b7843e55c13f9d6f3eb177b784
SHA512 fe1b959cd656f16a7edd09a2cf187e4f55313192c18fdc9e26949a4b7b30971e85a912736a429ddb2c03826d4d1b688d5a9b2cbf6bc6b2feacc960ba60d343c6
SSDEEP 192:sxRgR2yM/jK1Ml8wCG/fTsy46b7VkZ5/ZCzoD8pi/g6+WNIYCsuO0GJIgDmJ:sxRgc8G/fTsOBaJZ+i/5IelW
TLSH
T1B852EA16AA345977DCDBD20DFA51BF93D6F91473A2501E44AAFCCA0C04E6AEC621381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 5b8a1b066d670a617cbe5f1def085ec0b2eb7503cb2f10008d2876f9c0183998
MD5 86a99de90a534fd95035aaf1990bf01f
SHA1 7c476aa4c68e36143c6982cd745b5fd5b2b255fc
SHA512 38f0e7fa266d7a36f9e9af909caba97ab960ec98da9e9547d577d6984652e687e2ca23827f5383f10ce75fc3276f35697da1f00e5518f11ae08b516ed12acf2f
SSDEEP 768:j/8vNN7pLuL7tQWgQ+fB+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVVEMQqqKrovQ:j/8vN7E7tQWgQ+fB+u1jaqEMVqh4
TLSH
T19BE2FB7B680CCB7E4F404E9CED29BE9AADE801CF5698CD5447EA840C03C57EB561A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a7447.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a7447.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 767def725305229c0d7bc224fb18e38f9e303bc005092cd5ed1cd477bf1cdb51
MD5 8d0f0b8c796fbe2720daceec8a07dd65
SHA1 8c3311754d81e7231d8fb68ce93fc8c2ade591bd
SHA512 a9ee37aff70b9afc9d8dc303698ff476a053afed984e206f9d029a5d635ca2832a106642b1ccfc1f9a4672ee8bb5c67637d88dc68185f4bea9522c5d7830e8c3
SSDEEP 768:Irv+4UNbdD3bc4Np8+p3bd66j+4BRv86aLIiz2bwCl1:Ibsbp3BL8+p3Z6n4yN0ww
TLSH
T11903CE73F9A899739CE6C644B2467A433FF811A3A6C10EC4D5DD2B4E419A19E630BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ff5dd8ed4cd7b1bee48bc5741686136c2c64180e2e7c663b0c8397a0e35454a3
MD5 e77c7505fd82abd33e01d32f648da054
SHA1 5dd0f7629efc64f0f4ddeb3f0794cf32b415bbcf
SHA512 c0a70c7a4fc34322ea91a9f84970a4ac27b27ad9f5405c1ef01c857793759a583d45fb043fb6bbff843196a0169f17fdb4f87beaf31350360509a00bb9e580d3
SSDEEP 768:pF1j+9K3Twg7kmb0cp8+p3bd66j+4BRv86aLIWwb9Mc:Y9K3p8+p3Z6n4yOb+c
TLSH
T1DE039E76E895CE77ACE68B85B3567787EEF011A386C45DC8E9C8AF4D008719D070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 e7a6e9425cad9c40cde903070fa4f386e8c34e07edd643b4db997ecbe41089a2
MD5 c5668167e37a53899e581e4aa6d7d7a2
SHA1 5d1a91c480ac9f82d51e0f8bec897dcfc0a3d5ff
SHA512 daad82770df323ea206f8c799d3596519aa098c1b4467763d6cbb424a688b5c008885cd4f326d04db7addbefe9097f1c5d9a1bd9f39ef2eba6ba295a1e14bbd5
SSDEEP 768:5rv+4UNbdF3ckQvEJVqp8+p3bd66j+4BRv86aLIWwb9Ml:5bsbz35U8+p3Z6n4yOb+l
TLSH
T12413BF31F869DD739CF6C604B19776837FF421A395C00E98E5D9AB4E054B19D2B0B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d7e23a8a3d00242dcd0154122521617a2ef77e143c1712c69fb9e580c5588f4f
MD5 d45f3fb8d475e173bf002369a19acc53
SHA1 8aa6ea9ce0331ec7732b1f66dd0d70202358c25a
SHA512 8f7bc258370d78d82f1d70f3d206a0938cc55424d8f23ca839c812eb4afceddf829749b66c0802aa5c7119f0cc30f78ec3916cb4ef05ebc4433fcca3f2e43b66
SSDEEP 768:6j+9/3nkmEJV5p8+p3bd66j+4BRv86aLIWwb9Mc:59/3In8+p3Z6n4yOb+c
TLSH
T15DF2AF71E89ADD738CE5C654B2573787BFF411A396C01E88E9D8AF0E048729D5B0B426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 fef22e3b902fdd450045f873f90663f0a889742341bab9629be1675b43a30353
MD5 f06e371776749744489868af36b7a4ea
SHA1 c90211b2d22d68785f035e7ce4c7bf338dea7b65
SHA512 e1d992ba1fd7a18302e8fd19f8de50772975d4a7b153368a601e2a957fe9e060e6542aebabc1b5f161357aeb81e746bb6f95d5806103da3d93c3239848d82b7d
SSDEEP 768:Cj+9/3ckmEJV5p8+p3bd66j+4BRv86aLIWwb9Mc:x9/35n8+p3Z6n4yOb+c
TLSH
T182F2AF71E89A9D738CE5C654B25737C7BFF411B396C01E88E9D8AF0E048729D5B0B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6140_1083650999\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 e200b11d696a62c70b7a4c90c1c8432f234957931342d0ebed35cae97184092d
MD5 14a6bda84066fa9f41c52c49eb7272c3
SHA1 5843c6d6e4ea42b202374bb4d287194cf1da28aa
SHA512 fe2f8d9d02a2a2b320c6245187dc0d62f16d09acafc036d3b97fa1a76f419da364eac071c64b287b85b22c6369214e97e0b57f338920f912ec7131039f1c22e9
TLSH
T13971048356A8C5B2C19A5FF012C39544F2BB123C076330200B555586E630E7954B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1488-444-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1500-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1912-271-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2076-313-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2264-318-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2264-284-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2764-321-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3376-473-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3444-448-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3492-325-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3936-413-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4284-365-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4460-393-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4476-498-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4760-242-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4760-340-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4760-272-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4948-469-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5216-436-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5716-373-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6016-243-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6016-195-0x0000000000010000-0x00000000000AB000-memory.dmp

Download