f1371e3c365c5bd92e18172555173f9c06faef3a523a610029a8b1bbbf4921df

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/07/2026, 22:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 722KB
Sample260713-2vrtlsat2p
SHA256 f1371e3c365c5bd92e18172555173f9c06faef3a523a610029a8b1bbbf4921df
MD5 324a10c88b094450d2c85d13335ff64f
SHA1 f9753505faed12abf39de85ecf4c22789c869d2b
SHA512 20b7984098ab6d3ac3de17d4a853db2443c75f39a88dcf8fd3117dee9602051539c4dcd81439c7bf3e93cab814e464a31376f1570dcb9d3a8bb13b7d856222d5
SSDEEP 12288:/flfAsiVGjSGecvXAflfAsiVGjSGecvX:nMcfcMcf
TLSH
T1CFF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4136	rpjhczurmkecwupm.exe
4276	rpjhczurmkecwupm.sys
4964	CreateProcess.exe
3664	rpmhfcwrpm.exe
4268	CreateProcess.exe
2148	CreateProcess.exe
5084	i_rpmhfcwrpm.exe
4664	mkecwuomhe.sys
464	CreateProcess.exe
3780	trmjecwurm.exe
1956	CreateProcess.exe
2436	CreateProcess.exe
4432	i_trmjecwurm.exe
3500	heywrojhbz.sys
6056	CreateProcess.exe
4592	wtrmjerojg.exe
3960	CreateProcess.exe
5748	CreateProcess.exe
1280	i_wtrmjerojg.exe
2604	bvtolgeywq.sys
2644	CreateProcess.exe
4384	rljdbvtoig.exe
2488	CreateProcess.exe
1892	CreateProcess.exe
3384	i_rljdbvtoig.exe
1320	jdbvtnlgdy.sys
5380	CreateProcess.exe
4412	bvtnlgdytq.exe
3836	CreateProcess.exe
3616	CreateProcess.exe
2608	i_bvtnlgdytq.exe
5880	nidavsnlfd.sys
2444	CreateProcess.exe
564	dysqnigdyv.exe
3896	CreateProcess.exe
5644	CreateProcess.exe
5760	i_dysqnigdyv.exe
5000	vqnlfdxvqn.sys
2576	CreateProcess.exe
1516	cavsnkfdxv.exe
4088	CreateProcess.exe
3980	CreateProcess.exe
4928	i_cavsnkfdxv.exe
4212	cxvpnhfzxv.sys
3204	CreateProcess.exe
2492	xspnhfaxsp.exe
200	CreateProcess.exe
2352	CreateProcess.exe
3804	i_xspnhfaxsp.exe
4888	hcausmkecx.sys
1528	CreateProcess.exe
4828	wupmhfzxrp.exe
4588	CreateProcess.exe
5304	CreateProcess.exe
3588	i_wupmhfzxrp.exe
2916	zwrpmhezxr.sys
684	CreateProcess.exe
4396	rpjhbztrmj.exe
4352	CreateProcess.exe
2744	CreateProcess.exe
772	i_rpjhbztrmj.exe
4084	urmjhezwuo.sys
1200	CreateProcess.exe
3876	ljgebwtroj.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4236_1468539621\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4236_1183024325\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4236_685556059\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4236_1580311499\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4236_1580311499\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4236_1468539621\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4236_1183024325\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4236_1183024325\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4236_1183024325\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqnigaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkicausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkicavsmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfcxusmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhczurmkecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhbztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljgebwtroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfcxusmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wurmjhbzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wurmjhbzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomjecwurp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cavsnkfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wupmhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtomgeytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkicausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtrmjerojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhbztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trmjecwurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljdbvtoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtnlgdytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dysqnigdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cavsnkfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspnhfaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpmhfcwrpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trmjecwurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtnlgdytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqnigaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wupmhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljgebwtroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomjecwurp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtrmjerojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljdbvtoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtomgeytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trligayvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trligayvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkicavsmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpmhfcwrpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dysqnigdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspnhfaxsp.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2496	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2392	ipconfig.exe
5892	ipconfig.exe
4416	ipconfig.exe
3096	ipconfig.exe
4740	ipconfig.exe
1368	ipconfig.exe
3908	ipconfig.exe
5472	ipconfig.exe
1308	ipconfig.exe
3148	ipconfig.exe
4256	ipconfig.exe
6064	ipconfig.exe
5472	ipconfig.exe
1344	ipconfig.exe
2316	ipconfig.exe
4544	ipconfig.exe
4936	ipconfig.exe
3124	ipconfig.exe
1308	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134284568803165358"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{89CEA444-47CD-4FCA-ADD6-49DDAF98B7D1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4136	rpjhczurmkecwupm.exe
4136	rpjhczurmkecwupm.exe
4136	rpjhczurmkecwupm.exe
4136	rpjhczurmkecwupm.exe
4136	rpjhczurmkecwupm.exe
4136	rpjhczurmkecwupm.exe
4136	rpjhczurmkecwupm.exe
4136	rpjhczurmkecwupm.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5084	i_rpmhfcwrpm.exe
Token: SeDebugPrivilege	4432	i_trmjecwurm.exe
Token: SeDebugPrivilege	1280	i_wtrmjerojg.exe
Token: SeDebugPrivilege	3384	i_rljdbvtoig.exe
Token: SeDebugPrivilege	2608	i_bvtnlgdytq.exe
Token: SeDebugPrivilege	5760	i_dysqnigdyv.exe
Token: SeDebugPrivilege	4928	i_cavsnkfdxv.exe
Token: SeDebugPrivilege	3804	i_xspnhfaxsp.exe
Token: SeDebugPrivilege	3588	i_wupmhfzxrp.exe
Token: SeDebugPrivilege	772	i_rpjhbztrmj.exe
Token: SeDebugPrivilege	2380	i_ljgebwtroj.exe
Token: SeDebugPrivilege	5812	i_bwtomgeytq.exe
Token: SeDebugPrivilege	4160	i_trligayvtn.exe
Token: SeDebugPrivilege	3452	i_sqnigaysqk.exe
Token: SeDebugPrivilege	2420	i_qkicausnkf.exe
Token: SeDebugPrivilege	5716	i_sqkicavsmk.exe
Token: SeDebugPrivilege	1424	i_hfcxusmkfc.exe
Token: SeDebugPrivilege	5556	i_wurmjhbzur.exe
Token: SeDebugPrivilege	800	i_uomjecwurp.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4236	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 4136	4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 4844 wrote to memory of 4208	4844	2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 4208 wrote to memory of 4236	4208	iexplore.exe	90
PID 4236 wrote to memory of 1796	4236	msedge.exe	91
PID 4236 wrote to memory of 4196	4236	msedge.exe	93
PID 4236 wrote to memory of 2496	4236	msedge.exe	92
PID 4236 wrote to memory of 5240	4236	msedge.exe	94
PID 4236 wrote to memory of 4196	4236	msedge.exe	93
PID 4236 wrote to memory of 4196	4236	msedge.exe	93
PID 4236 wrote to memory of 5240	4236	msedge.exe	94
PID 4236 wrote to memory of 3124	4236	msedge.exe	96
PID 4236 wrote to memory of 3124	4236	msedge.exe	96
PID 4236 wrote to memory of 3124	4236	msedge.exe	96
PID 4236 wrote to memory of 3908	4236	msedge.exe	97
PID 4236 wrote to memory of 3908	4236	msedge.exe	97
PID 4236 wrote to memory of 3908	4236	msedge.exe	97
PID 4236 wrote to memory of 248	4236	msedge.exe	98
PID 4236 wrote to memory of 248	4236	msedge.exe	98
PID 4236 wrote to memory of 248	4236	msedge.exe	98
PID 4236 wrote to memory of 3356	4236	msedge.exe	99
PID 4236 wrote to memory of 3356	4236	msedge.exe	99
PID 4236 wrote to memory of 3356	4236	msedge.exe	99
PID 4236 wrote to memory of 2356	4236	msedge.exe	100
PID 4236 wrote to memory of 2356	4236	msedge.exe	100
PID 4136 wrote to memory of 4964	4136	rpjhczurmkecwupm.exe	104
PID 4236 wrote to memory of 2892	4236	msedge.exe	107
PID 4236 wrote to memory of 3988	4236	msedge.exe	108
PID 4236 wrote to memory of 2892	4236	msedge.exe	107
PID 4236 wrote to memory of 3988	4236	msedge.exe	108
PID 3664 wrote to memory of 4268	3664	rpmhfcwrpm.exe	109
PID 4236 wrote to memory of 2380	4236	msedge.exe	113
PID 4236 wrote to memory of 720	4236	msedge.exe	114
PID 4236 wrote to memory of 720	4236	msedge.exe	114
PID 4236 wrote to memory of 1220	4236	msedge.exe	117
PID 4236 wrote to memory of 1220	4236	msedge.exe	117
PID 4136 wrote to memory of 2148	4136	rpjhczurmkecwupm.exe	118
PID 4136 wrote to memory of 464	4136	rpjhczurmkecwupm.exe	122
PID 3780 wrote to memory of 1956	3780	trmjecwurm.exe	124
PID 4136 wrote to memory of 2436	4136	rpjhczurmkecwupm.exe	127
PID 4136 wrote to memory of 6056	4136	rpjhczurmkecwupm.exe	131
PID 4592 wrote to memory of 3960	4592	wtrmjerojg.exe	133
PID 4136 wrote to memory of 5748	4136	rpjhczurmkecwupm.exe	136
PID 4236 wrote to memory of 3976	4236	msedge.exe	138
PID 4236 wrote to memory of 3976	4236	msedge.exe	138
PID 4236 wrote to memory of 3976	4236	msedge.exe	138
PID 4236 wrote to memory of 4160	4236	msedge.exe	141
PID 4236 wrote to memory of 4160	4236	msedge.exe	141
PID 4236 wrote to memory of 4160	4236	msedge.exe	141
PID 4136 wrote to memory of 2644	4136	rpjhczurmkecwupm.exe	143
PID 4384 wrote to memory of 2488	4384	rljdbvtoig.exe	145
PID 4236 wrote to memory of 5092	4236	msedge.exe	148
PID 4236 wrote to memory of 3084	4236	msedge.exe	149
PID 4236 wrote to memory of 3096	4236	msedge.exe	150
PID 4136 wrote to memory of 1892	4136	rpjhczurmkecwupm.exe	151
PID 4236 wrote to memory of 3368	4236	msedge.exe	155
PID 4236 wrote to memory of 3368	4236	msedge.exe	155
PID 4236 wrote to memory of 3368	4236	msedge.exe	155
PID 4136 wrote to memory of 5380	4136	rpjhczurmkecwupm.exe	156
PID 4412 wrote to memory of 3836	4412	bvtnlgdytq.exe	158
PID 4136 wrote to memory of 3616	4136	rpjhczurmkecwupm.exe	161
PID 4136 wrote to memory of 2444	4136	rpjhczurmkecwupm.exe	165
PID 564 wrote to memory of 3896	564	dysqnigdyv.exe	167
PID 4136 wrote to memory of 5644	4136	rpjhczurmkecwupm.exe	170
PID 4136 wrote to memory of 2576	4136	rpjhczurmkecwupm.exe	174

C:\Users\Admin\AppData\Local\Temp\2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-13_324a10c88b094450d2c85d13335ff64f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Temp\rpjhczurmkecwupm.exe
  C:\Temp\rpjhczurmkecwupm.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4136
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpmhfcwrpm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4964
  - - C:\Temp\rpmhfcwrpm.exe
      C:\Temp\rpmhfcwrpm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3664
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4268
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1344
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpmhfcwrpm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2148
  - - C:\Temp\i_rpmhfcwrpm.exe
      C:\Temp\i_rpmhfcwrpm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5084
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trmjecwurm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:464
  - - C:\Temp\trmjecwurm.exe
      C:\Temp\trmjecwurm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3780
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1956
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4936
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trmjecwurm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2436
  - - C:\Temp\i_trmjecwurm.exe
      C:\Temp\i_trmjecwurm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4432
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtrmjerojg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6056
  - - C:\Temp\wtrmjerojg.exe
      C:\Temp\wtrmjerojg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4592
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3960
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5472
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtrmjerojg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5748
  - - C:\Temp\i_wtrmjerojg.exe
      C:\Temp\i_wtrmjerojg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1280
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rljdbvtoig.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2644
  - - C:\Temp\rljdbvtoig.exe
      C:\Temp\rljdbvtoig.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4384
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2488
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rljdbvtoig.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1892
  - - C:\Temp\i_rljdbvtoig.exe
      C:\Temp\i_rljdbvtoig.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bvtnlgdytq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5380
  - - C:\Temp\bvtnlgdytq.exe
      C:\Temp\bvtnlgdytq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4412
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3836
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1308
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bvtnlgdytq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3616
  - - C:\Temp\i_bvtnlgdytq.exe
      C:\Temp\i_bvtnlgdytq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2608
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dysqnigdyv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2444
  - - C:\Temp\dysqnigdyv.exe
      C:\Temp\dysqnigdyv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:564
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3896
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dysqnigdyv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5644
  - - C:\Temp\i_dysqnigdyv.exe
      C:\Temp\i_dysqnigdyv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5760
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cavsnkfdxv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2576
  - - C:\Temp\cavsnkfdxv.exe
      C:\Temp\cavsnkfdxv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1516
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4088
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cavsnkfdxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3980
  - - C:\Temp\i_cavsnkfdxv.exe
      C:\Temp\i_cavsnkfdxv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4928
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xspnhfaxsp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3204
  - - C:\Temp\xspnhfaxsp.exe
      C:\Temp\xspnhfaxsp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2492
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:200
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xspnhfaxsp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2352
  - - C:\Temp\i_xspnhfaxsp.exe
      C:\Temp\i_xspnhfaxsp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wupmhfzxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1528
  - - C:\Temp\wupmhfzxrp.exe
      C:\Temp\wupmhfzxrp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4828
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4588
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5472
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wupmhfzxrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5304
  - - C:\Temp\i_wupmhfzxrp.exe
      C:\Temp\i_wupmhfzxrp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3588
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpjhbztrmj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:684
  - - C:\Temp\rpjhbztrmj.exe
      C:\Temp\rpjhbztrmj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4396
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4352
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2392
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpjhbztrmj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2744
  - - C:\Temp\i_rpjhbztrmj.exe
      C:\Temp\i_rpjhbztrmj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:772
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljgebwtroj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1200
  - - C:\Temp\ljgebwtroj.exe
      C:\Temp\ljgebwtroj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3876
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4600
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1368
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljgebwtroj.exe ups_ins
    3⤵
    PID:2664
  - - C:\Temp\i_ljgebwtroj.exe
      C:\Temp\i_ljgebwtroj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bwtomgeytq.exe ups_run
    3⤵
    PID:2068
  - - C:\Temp\bwtomgeytq.exe
      C:\Temp\bwtomgeytq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3396
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5472
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bwtomgeytq.exe ups_ins
    3⤵
    PID:5896
  - - C:\Temp\i_bwtomgeytq.exe
      C:\Temp\i_bwtomgeytq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trligayvtn.exe ups_run
    3⤵
    PID:1300
  - - C:\Temp\trligayvtn.exe
      C:\Temp\trligayvtn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4372
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4648
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5892
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trligayvtn.exe ups_ins
    3⤵
    PID:4960
  - - C:\Temp\i_trligayvtn.exe
      C:\Temp\i_trligayvtn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4160
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqnigaysqk.exe ups_run
    3⤵
    PID:5612
  - - C:\Temp\sqnigaysqk.exe
      C:\Temp\sqnigaysqk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1772
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1888
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqnigaysqk.exe ups_ins
    3⤵
    PID:2572
  - - C:\Temp\i_sqnigaysqk.exe
      C:\Temp\i_sqnigaysqk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3452
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qkicausnkf.exe ups_run
    3⤵
    PID:5388
  - - C:\Temp\qkicausnkf.exe
      C:\Temp\qkicausnkf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1232
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2620
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qkicausnkf.exe ups_ins
    3⤵
    PID:5888
  - - C:\Temp\i_qkicausnkf.exe
      C:\Temp\i_qkicausnkf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2420
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqkicavsmk.exe ups_run
    3⤵
    PID:4732
  - - C:\Temp\sqkicavsmk.exe
      C:\Temp\sqkicavsmk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3032
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2768
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2316
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqkicavsmk.exe ups_ins
    3⤵
    PID:5684
  - - C:\Temp\i_sqkicavsmk.exe
      C:\Temp\i_sqkicavsmk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfcxusmkfc.exe ups_run
    3⤵
    PID:4804
  - - C:\Temp\hfcxusmkfc.exe
      C:\Temp\hfcxusmkfc.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5396
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3804
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3096
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfcxusmkfc.exe ups_ins
    3⤵
    PID:3388
  - - C:\Temp\i_hfcxusmkfc.exe
      C:\Temp\i_hfcxusmkfc.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1424
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wurmjhbzur.exe ups_run
    3⤵
    PID:2440
  - - C:\Temp\wurmjhbzur.exe
      C:\Temp\wurmjhbzur.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5464
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3500
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4740
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wurmjhbzur.exe ups_ins
    3⤵
    PID:4516
  - - C:\Temp\i_wurmjhbzur.exe
      C:\Temp\i_wurmjhbzur.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5556
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uomjecwurp.exe ups_run
    3⤵
    PID:4824
  - - C:\Temp\uomjecwurp.exe
      C:\Temp\uomjecwurp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4612
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5928
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1308
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uomjecwurp.exe ups_ins
    3⤵
    PID:4188
  - - C:\Temp\i_uomjecwurp.exe
      C:\Temp\i_uomjecwurp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:800
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff84354c188,0x7ff84354c194,0x7ff84354c1a0
      4⤵
      PID:1796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,5527047531754233228,362870936408772254,524288 --field-trial-handle=2488,i,156675877184023686,13834526783153548974,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:11
      4⤵
      System Time Discovery
      PID:2496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,3246596001857097758,317020994605447766,262144 --field-trial-handle=2488,i,156675877184023686,13834526783153548974,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:2
      4⤵
      PID:4196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2272,i,4541612722101264791,18311071422386475466,524288 --field-trial-handle=2488,i,156675877184023686,13834526783153548974,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:13
      4⤵
      PID:5240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,12195654865422897610,4226726360570571107,2097152 --field-trial-handle=2488,i,156675877184023686,13834526783153548974,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
      4⤵
      PID:3124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,3255365536887362948,4688103215308365069,2097152 --field-trial-handle=2488,i,156675877184023686,13834526783153548974,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
      4⤵
      PID:3908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,3479962131842561565,7877374649128363326,2097152 --field-trial-handle=2488,i,156675877184023686,13834526783153548974,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:1
      4⤵
      PID:248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,16347007774789309595,17301414413076215943,2097152 --field-trial-handle=2488,i,156675877184023686,13834526783153548974,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:9
      4⤵
      PID:3356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3704,i,10630779188863153962,7868053684309404106,524288 --field-trial-handle=2488,i,156675877184023686,13834526783153548974,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:14
      4⤵
      PID:2356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,1020342448559318346,5592712850406114458,524288 --field-trial-handle=2488,i,156675877184023686,13834526783153548974,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
      4⤵
      PID:2892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,18210131591260280917,6777364389948709558,524288 --field-trial-handle=2488,i,156675877184023686,13834526783153548974,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
      4⤵
      PID:3988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,6852276067305116604,17437768695949170070,524288 --field-trial-handle=2488,i,156675877184023686,13834526783153548974,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
      4⤵
      PID:5928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,6852276067305116604,17437768695949170070,524288 --field-trial-handle=2488,i,156675877184023686,13834526783153548974,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
      4⤵
      PID:2380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,9729874022774733480,13276718473376929357,524288 --field-trial-handle=2488,i,156675877184023686,13834526783153548974,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
      4⤵
      PID:720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,18200359212691225774,3990468321752471122,524288 --field-trial-handle=2488,i,156675877184023686,13834526783153548974,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
      4⤵
      PID:1220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6584,i,6782856980738118547,11226515552912028120,2097152 --field-trial-handle=2488,i,156675877184023686,13834526783153548974,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:1
      4⤵
      PID:3976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3648,i,674633010465517947,5904620220098830563,2097152 --field-trial-handle=2488,i,156675877184023686,13834526783153548974,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:1
      4⤵
      PID:4160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,5002865637558041819,4063276523897255510,524288 --field-trial-handle=2488,i,156675877184023686,13834526783153548974,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:14
      4⤵
      PID:5092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,5670206767497183346,17158103281177304160,524288 --field-trial-handle=2488,i,156675877184023686,13834526783153548974,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
      4⤵
      PID:3084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,11619217614101287187,9519670856145159708,524288 --field-trial-handle=2488,i,156675877184023686,13834526783153548974,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:14
      4⤵
      PID:3096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=1904,i,9095202685359294881,10873651609556974887,2097152 --field-trial-handle=2488,i,156675877184023686,13834526783153548974,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:1
      4⤵
      PID:3368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=3820,i,11944770811999633442,4056993854531779987,2097152 --field-trial-handle=2488,i,156675877184023686,13834526783153548974,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:1
      4⤵
      PID:2716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4912,i,8330502854706814347,6546221566998399766,524288 --field-trial-handle=2488,i,156675877184023686,13834526783153548974,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
      4⤵
      PID:3976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,2905223894056377862,8290251751368097954,524288 --field-trial-handle=2488,i,156675877184023686,13834526783153548974,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:14
      4⤵
      PID:1948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=928,i,4968935690393029410,7600713825137705059,524288 --field-trial-handle=2488,i,156675877184023686,13834526783153548974,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:14
      4⤵
      PID:5856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,937788599410667081,9229598424228711459,524288 --field-trial-handle=2488,i,156675877184023686,13834526783153548974,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
      4⤵
      PID:2608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5592,i,7137749329004375144,9511281909385317805,262144 --field-trial-handle=2488,i,156675877184023686,13834526783153548974,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:10
      4⤵
      PID:2056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3788,i,12567869914642882874,309264854877957574,524288 --field-trial-handle=2488,i,156675877184023686,13834526783153548974,262144 --variations-seed-version --mojo-platform-channel-handle=1192 /prefetch:14
      4⤵
      PID:2584

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2344

C:\Temp\rpjhczurmkecwupm.sys
C:\Temp\rpjhczurmkecwupm.sys
1⤵
- Executes dropped EXE
PID:4276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2132

C:\Temp\mkecwuomhe.sys
C:\Temp\mkecwuomhe.sys
1⤵
- Executes dropped EXE
PID:4664

C:\Temp\heywrojhbz.sys
C:\Temp\heywrojhbz.sys
1⤵
- Executes dropped EXE
PID:3500

C:\Temp\bvtolgeywq.sys
C:\Temp\bvtolgeywq.sys
1⤵
- Executes dropped EXE
PID:2604

C:\Temp\jdbvtnlgdy.sys
C:\Temp\jdbvtnlgdy.sys
1⤵
- Executes dropped EXE
PID:1320

C:\Temp\nidavsnlfd.sys
C:\Temp\nidavsnlfd.sys
1⤵
- Executes dropped EXE
PID:5880

C:\Temp\vqnlfdxvqn.sys
C:\Temp\vqnlfdxvqn.sys
1⤵
- Executes dropped EXE
PID:5000

C:\Temp\cxvpnhfzxv.sys
C:\Temp\cxvpnhfzxv.sys
1⤵
- Executes dropped EXE
PID:4212

C:\Temp\hcausmkecx.sys
C:\Temp\hcausmkecx.sys
1⤵
- Executes dropped EXE
PID:4888

C:\Temp\zwrpmhezxr.sys
C:\Temp\zwrpmhezxr.sys
1⤵
- Executes dropped EXE
PID:2916

C:\Temp\urmjhezwuo.sys
C:\Temp\urmjhezwuo.sys
1⤵
- Executes dropped EXE
PID:4084

C:\Temp\zwtomgebwu.sys
C:\Temp\zwtomgebwu.sys
1⤵
PID:5156

C:\Temp\wqoigeywqo.sys
C:\Temp\wqoigeywqo.sys
1⤵
PID:5804

C:\Temp\sqnlidavtn.sys
C:\Temp\sqnlidavtn.sys
1⤵
PID:2216

C:\Temp\aysqnlfdxv.sys
C:\Temp\aysqnlfdxv.sys
1⤵
PID:6036

C:\Temp\vsqkifdxvs.sys
C:\Temp\vsqkifdxvs.sys
1⤵
PID:5624

C:\Temp\khfzxrpkhf.sys
C:\Temp\khfzxrpkhf.sys
1⤵
PID:5512

C:\Temp\wurmjhfzxr.sys
C:\Temp\wurmjhfzxr.sys
1⤵
PID:2144

C:\Temp\cwurmkeczu.sys
C:\Temp\cwurmkeczu.sys
1⤵
PID:1576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bvtnlgdytq.exe

Path C:\Temp\bvtnlgdytq.exe
Size 722KB
SHA256 71e9b3de84c22e1619aa8c1e9394f0def5afb7bd764547760df3ac639eafe847
MD5 7923f315bbfbe494fbe9e35caec2cb57
SHA1 9b68bc0574f896c4dd110a71ecdfec338224a487
SHA512 5f1820f5f1dc4d30e30420c8c885e2820cd4e327facf553fd624a08bf633c267450168f133e402750f5ef2cb264336214d517566795d2dfb2cdfb6d01e460f96
SSDEEP 12288:aflfAsiVGjSGecvXAflfAsiVGjSGecvX:2McfcMcf
TLSH
T114F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bvtolgeywq.sys

Path C:\Temp\bvtolgeywq.sys
Size 293KB
SHA256 5a0aa3a60185b100d3f38f7f0b7195a73333bb6733c341c47689c823543e8d9f
MD5 ebdb05ee6b112b843b442c5cae4ff1f7
SHA1 f5d3f67590440ce0730dfc83f9318d6d7906df0e
SHA512 9bc9482275252cc56adad285b07daaf10a5d12873c9c45986a0271385a2b92b7dce0c1470a501bdfd9cba86e6cd0a3e44b53d4dc6d633e480c5b86c1362a0ef1
SSDEEP 3072:0tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:0IJjiJcbI03GBc3ucY5DCSj
TLSH
T1E7545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dysqnigdyv.exe

Path C:\Temp\dysqnigdyv.exe
Size 722KB
SHA256 c0e4b58eefdbe13e5ad3a15b168db558ddb5a8a8f400333372a9ca4322e01d38
MD5 e9bfb4301f54d91c330bcc09906cc1fa
SHA1 ee11268950686728f1e6284e2518715e2ad6ba47
SHA512 e73ae34f8f15b359cf904900958a9ce87f4d692c49b17755f34a15e1e207d4f0a3a737ddd858faf9f76b2397919ea82a49751f7994ea78100d25a8344d11e92a
SSDEEP 12288:bflfAsiVGjSGecvXAflfAsiVGjSGecvX:zMcfcMcf
TLSH
T12DF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

heywrojhbz.sys

Path C:\Temp\heywrojhbz.sys
Size 293KB
SHA256 3a3e34e56957553cd399d206f5d51829b6afa9ac4af1eec748a0b63e5d34cedc
MD5 914cd5916bedd8eed3590acaad626d39
SHA1 c8b6992de8e569d9590fb2dc47b3c75cd030d44c
SHA512 9db40364829283ba777a0fa9439ac30d2bf449528dc606381630b51c6e48b11c3ac26c454a770b56ecb1bd5c3895df93c4bf4d18fcd41c09fc3d2d714108be24
SSDEEP 3072:LtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:LIJjiJcbI03GBc3ucY5DCSj
TLSH
T17C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bvtnlgdytq.exe

Path C:\Temp\i_bvtnlgdytq.exe
Size 722KB
SHA256 bb19f70e2c76ee079f57301c35da7a740bec3bdc67d2c61fd9cb3b49de659421
MD5 c35675de6b212a98a87313bed649d818
SHA1 e7a87076bb0d856ae320cf5100231993b887900d
SHA512 533dcf0447568a5dd56189c48b4c6ea554c784be8aa495a505073f7abcc4dfc6f7b02876fda188a94d72741f6869a858c6e3d32350f1bc2b4cff10ee2b7cc193
SSDEEP 12288:uflfAsiVGjSGecvXAflfAsiVGjSGecvX:KMcfcMcf
TLSH
T117F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rljdbvtoig.exe

Path C:\Temp\i_rljdbvtoig.exe
Size 722KB
SHA256 f84e90dd20c3ce3b2245829b903a37ab8f6bbdd79b7cf49fa9b5f445f550f45a
MD5 18209645d7f42cc85865296e05ac6e9c
SHA1 0caff524ab62a9f114b5127e12670e0fdf340b0b
SHA512 fe807a2af2dbfc538e5edf6cefd47f18b5c251a0c1e7a28a1b7b662c7d49f0699dfc358c9b999badcab9ed81c03acb48972025ce3a5390aa14864d5a3b1717fe
SSDEEP 12288:/flfAsiVGjSGecvXAflfAsiVGjSGecvX:nMcfcMcf
TLSH
T15CF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rpmhfcwrpm.exe

Path C:\Temp\i_rpmhfcwrpm.exe
Size 722KB
SHA256 cfd7545f0cc471731acc32a1c8e17fad98e9fb27e61c3ad942548907b6c6dfcf
MD5 98a7b96bb98ed3b61ece32975a71c2f4
SHA1 8532440e239cdc2bbade9e23d4c2e03db046d8d4
SHA512 bd06d131b73d08f90e993fb367789160985cd9e585e9c6617b60d3f725e0bc355a144a2f846750cc7cce02c4b41b63def0e3539ebc80b228c607b78007b0968f
SSDEEP 12288:2flfAsiVGjSGecvXAflfAsiVGjSGecvX:iMcfcMcf
TLSH
T1FEF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_trmjecwurm.exe

Path C:\Temp\i_trmjecwurm.exe
Size 722KB
SHA256 5321914eb556cbcdc074b5695f801c97de8e58519e1fd446cba574486209c3b0
MD5 6a31499ca59ebc07c13ef9e8bf7dd80b
SHA1 a1151b556886df99066fe51f80dddc03d95e8d1f
SHA512 8a74241f314016c6c7de3ec6d8fa1a2b6bb9bd6ea84afec76271c919e2bc5f06f0615a85444a532a4f2066942b3d573c78876b5f6b5ef8731f4cae06e89923d3
SSDEEP 12288:/flfAsiVGjSGecvXAflfAsiVGjSGecvX:nMcfcMcf
TLSH
T112F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wtrmjerojg.exe

Path C:\Temp\i_wtrmjerojg.exe
Size 722KB
SHA256 19bfb8948b456771e4d60f3879b6f3d129463fb90eeda04e38ae839a9bba02fc
MD5 338793fad0bd3e78cbd6855d17b60706
SHA1 5425fd4389301b48413dd6f94a38212bd7149183
SHA512 d8ef243e8a2d76c4c56956bd3fc8ed43b15e2cdde3db2212327f0a722db20210e5d0513554e5b9af8e33751b0635ea9b79bbeb3c2ce245eaffbd70543518010c
SSDEEP 12288:qflfAsiVGjSGecvXAflfAsiVGjSGecvX:mMcfcMcf
TLSH
T136F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbvtnlgdy.sys

Path C:\Temp\jdbvtnlgdy.sys
Size 293KB
SHA256 47c8b6807b6b31d2576e8054f393349aa6f0b0018a46359d4f6df81f9091dd5d
MD5 b6c02ae4b1f39adac997cde4ad777f4f
SHA1 d5b460e7b4b9221f4de6f600d856b90ea3d876f2
SHA512 8da7ac6f291e448a6cad550c173900a76d35cc6111fbfd389067521676f18e3033b7459155d3aa87bc960a806e560a2dccdeb09018fdb7db6dbc661ff748825c
SSDEEP 3072:dtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:dIJjiJcbI03GBc3ucY5DCSj
TLSH
T171545B44AAA4B0F6D9D5043C00EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkecwuomhe.sys

Path C:\Temp\mkecwuomhe.sys
Size 293KB
SHA256 bf0f319581456979f149a57ad517c643b3da6c6027867a47123908da8aa94a75
MD5 2e173f5263321b76b382f2a9b10db2cf
SHA1 22e30875815a38cce3ec7c8f2cc8d89f17b1d56b
SHA512 f60801e12de71a5a00fe21b39528dfdea5b3b0aea38b77ef61efd2d6318a929035d77ec4fa7190595ef34457e8a06f236e05fbd8e0a0d32957a95a4606275309
SSDEEP 3072:ItKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:IIJjiJcbI03GBc3ucY5DCSj
TLSH
T140545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nidavsnlfd.sys

Path C:\Temp\nidavsnlfd.sys
Size 293KB
SHA256 1498b25749c8317e3b96f21edd23079539ceb37027db6cc4578dde2273092938
MD5 303a88b066b6531cfbe5713da26cec97
SHA1 85eafc9820f7d82c3e05b2f5e02402be503e7d1e
SHA512 cd4afc26d4236a197be7ea8e65ad9d3d6e31a92e32bac5f311b77d4048dc9666652360054c9d7e7487c35deadd269e6f172df5c809f97cef8d86a8834ea66b8a
SSDEEP 3072:dtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:dIJjiJcbI03GBc3ucY5DCSj
TLSH
T17F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljdbvtoig.exe

Path C:\Temp\rljdbvtoig.exe
Size 722KB
SHA256 6964b45c19f146ba2d397ea886bd47a6ff9a56ecff1d0fcfeb62982dea2b1cb6
MD5 7733fe9126f6af6ffc1ed2ccf5dd2c90
SHA1 4a9ba8cf36556f2469018939ecc65776e86e1803
SHA512 6a15e208a08256596acdad4c6cad5319794c0c69d095b90b62366cd659fbbed7bff2af4326f205b3b9f02770d3a3428e08b103ad870c4821c7d1f89ea2cce33f
SSDEEP 12288:gflfAsiVGjSGecvXAflfAsiVGjSGecvX:8McfcMcf
TLSH
T1D0F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpjhczurmkecwupm.exe

Path C:\Temp\rpjhczurmkecwupm.exe
Size 722KB
SHA256 7f31ada4cbdc22f498d5e3cd89c150f64aa9840d759c5348c0b96c9bc56a4143
MD5 bfb2e08c7b4e41a9d5c11c403fd31dde
SHA1 0d78444234b36e4159aaee2ab9c1fd38b222a5bc
SHA512 ab76ee88eeda3116be6e141768139cbc92d5229e71ca318407f4e2030bffa3bb51867cb72abfd66813a51d395bf3ce16c9b2ccec2d38178bc428afc1e82d5581
SSDEEP 12288:WflfAsiVGjSGecvXAflfAsiVGjSGecvX:CMcfcMcf
TLSH
T1B4F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpjhczurmkecwupm.sys

Path C:\Temp\rpjhczurmkecwupm.sys
Size 293KB
SHA256 a7c1b52278419e0bc364f0ed69ca7db46f10fa3dc408913a223b2e8616f63a85
MD5 7584f18c708833528c8cc3ad07bd3ff7
SHA1 72d7ac994887a7e8758292758b0efabccf2a8960
SHA512 df2df3cfa7e6ce3c041928163c3af8f52598364c35612c7e3d245e1ff6fc242c96878d1fa7581ce561e9acc73cfbb5311bde5cf9a92f735e7743a6e3f0d20d17
SSDEEP 3072:0mtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9Ej:0mIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E0545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpmhfcwrpm.exe

Path C:\Temp\rpmhfcwrpm.exe
Size 722KB
SHA256 26c025a873660521892fd488ca8adc2dda67bd919aa20b0b4a062703c170e72b
MD5 2d588c90bf40250dc4688bd50f9ce572
SHA1 47dbaf0eb0ebac281b0c91b5ab6a5d4659060d79
SHA512 559fd552d7bf69ea80008ef3b988631a9cba50b8ca07282368686912b6a4638bc38877c34a90747171eed3b05170d80cb1031e75d0f33bf3945282316534509f
SSDEEP 12288:MflfAsiVGjSGecvXAflfAsiVGjSGecvX:YMcfcMcf
TLSH
T189F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trmjecwurm.exe

Path C:\Temp\trmjecwurm.exe
Size 722KB
SHA256 ab181c313f32ded96f210b8d1af21f144969dd2250d15f8bdce1407c01b913d1
MD5 e208f46385ec31bef0f5cba76ad40064
SHA1 0177aad9967788ad27738ece0e79d4c128f58819
SHA512 b06b1331d0440c08a238316409b20569f1ae07a87084d239cb881c2c01ac99bf07e64dec5d2cf6cc424dea909b89344cbe8cba00efae5032f163f10c34c8dc23
SSDEEP 12288:DflfAsiVGjSGecvXAflfAsiVGjSGecvX:LMcfcMcf
TLSH
T146F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtrmjerojg.exe

Path C:\Temp\wtrmjerojg.exe
Size 722KB
SHA256 ebead2e702a164d2e3b067595dcb3930dca1956ccfdd779d8296c4a52e07eab2
MD5 a9498a0c0c86fb2523487d94d64705c8
SHA1 086d16a9d6045263eb7e357f55dfa455f8fad7d1
SHA512 530b237af2cbbae715919d44be534e83501037101605e6a350dcc017d22a54c326b4ff6f5e1fe08d7b4bb7c83344a8efea4275c91d7636f4fbde3470d30a4fe9
SSDEEP 12288:kflfAsiVGjSGecvXAflfAsiVGjSGecvX:AMcfcMcf
TLSH
T11FF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 a009be503672ba318a83b413021b9798cbffefd80ea12319e968f68825f9d6e7
MD5 c1d56fda022c83018139a71985fb5097
SHA1 0a7f019faf9938345f4d72c1ac8cb1465fde90fe
SHA512 2d1af7b61bd0829ac04efeda6a033c6e90bf93a6fe95296a639500807bbe719d4d6700006703a8050c9622b84f228bc2cea6668df29db2126a3c5a745992f06f
TLSH
T1F5419392532417D1D7A14EB265E1B65832FCD4BD8607AEC97A002D7CAF09F389AD1463
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595db6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595db6.TMP
Size 2KB
SHA256 b30074784b261bf236b9d20959b9a63fe78d413819276c0e37fc284322273bfa
MD5 38e8a567f4ea5f5114b4bab96dd54ae0
SHA1 65fe5683f4413c5b1cfd7ff462910c2dc19a30fa
SHA512 35ac351fd41c9449e322e209d812234cef042fb64b25e00a5a0e91c86057e250653c51ddd01ccec17e8fc18700a0d4eb1505b0ddf375f39976196ed889de76e6
TLSH
T1C541A482532417D1D7A14EB365E1B65832FCD0BD8607AECA7A002D7CAF05F389BD1463
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f538756c40977dccd902f4780684aecfece161c27470cc164d28f1609d126ed8
MD5 87043106c75d77103551d4976ce32871
SHA1 fb29c60a7d7980f1277a8c33be34eaabe7554e45
SHA512 29b5cd4be9a40d088e4ecd55b8a4076e02967f6d7d123b4111c2967312d484bfc63e638c8a1f7ff5a80026b8c3178ac74550cb149b9586a23ac4d6fd874c8ec7
TLSH
T1C851ADF7C3E8866E891156F4BA147E2BCE1D0914432C3D5A89E4EF1BA3E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ccf8663582d395c0e4cfbf0bbe52002689679cf48588e272dda9364194e7677c
MD5 debbe11879082bee7b7235af73dfb086
SHA1 a8c9e8eb52d8c4ef9ca9d16005bd0f45aec8ba50
SHA512 6ce3c5f32a6bafd87a6cd1729468076377a3ba3be36c71827d2019c6d3170a12f4580c6f44aee39fc32ee8b17593a77bf9670f6bfd123ee65ccb3cd961cb819a
SSDEEP 192:sxRAR7yM/jK1Ml8wCE/fHs/iM3ZuQFBzoD8pi/g6+WNIYCsuOsGpIgtJ:sxRAb8E/fHsaMJvLi/5Iet3
TLSH
T1C552D9056A34597BDCDBD20DFA517F93D6F81523A2901E44AAFC8A0C00F6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7ab09d8237dc94208997b7e89fb7fd70252a2e7445de9bc0ab459291f49d30d0
MD5 7ed944ea166ec6c107153c87244f71c7
SHA1 0bbd9a37377638d73d8248264194d0e4ba028daf
SHA512 db8ac8e79c9eb82d114b0e35d2c2d1fdaf4140af69c45647b51a5670b206731b1a5116d5eb1d3d468bfa9b41978f10837187b167ff50cb3fd71bda970fe5af42
SSDEEP 192:sxRzR7yM/jK1Ml8UQaCE/fHsKii3ZuQFVzoD8prg/g6+WNC/V/YCvuOsGpIgDLJ:sxRz1qdE/fHs9iJvz0/58/rt5
TLSH
T1FA62D71666245D7B9CDBD20DFA51BF93D6F85563E2901E44AAFCCB0C00F66ED221382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b46d239e5790e61b861b204919403aa17962a1b85f49b08da6b78c617ac07db6
MD5 0a8e43a2a0207cabae772e173f64205d
SHA1 f1eb769ce8a808aaca7562256cc9509dd3dca596
SHA512 1a10caeb1402f3a57194da015c74f23eb196205fa9e6cb3934001322edd867a02d5ac127201a0a7d12e356d76c3f4621df82d6cb99b910ecc210632e1990dbeb
SSDEEP 192:sxRzR7yM/jK1Ml8wCE/fHsKii3ZuQFVzoD8prg/g6+WNC/V/YCvuOsGpIgDLJ:sxRz18E/fHs9iJvz0/58/rt5
TLSH
T10362C80666245D7BDCDBD20DFA51BF93D6F85563E2901E44AAFC8B0C01F66ED221382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 37b596aead0ee0a078ba6fd43f4f6f0b9066f6d5fde695bb50d8c3acf7426109
MD5 67f357b13416c2345c80ca968874c826
SHA1 d7d5e5108df5698f597fb050208487b6e13d6572
SHA512 b9b41864056b3f84a0fb6bbc547165d9488178257b0d12d14e8097c796b2035b97e7b46cd2d7426307130af4193445082c4d3fab72b14238ced3be420ca21ed3
SSDEEP 192:sxRzR7yM/jK1Ml8wCE/fHsKiM3ZuQFBzoD8pi/g6+WNIYCsuOsGpIgDJJ:sxRzb8E/fHs9MJvLi/5Ietv
TLSH
T1AA52C9056A34597B9CDBD20DFA517F93D6F81563E2901E44AAFC8A0C00F66ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 29b973af8e393db735249fa172009fca3e1585ceb0da3c9a1bd89e9358f9ae39
MD5 9a3e02ad003b21ed3b7cccab0538ade1
SHA1 f5b5d2c65cccbf62c5dbd6aa5d2385eb8b744e51
SHA512 987dedd3a489a307ded76ad76b3ba3e296b0a21e2aecba8f4532ec40211eb6a50e48a5e2fa95478c00404baaec17ff719aa5e3bd3a635e66d43402f0f10909ae
SSDEEP 768:j/8vNN7pLuL7tQWgQ+fB+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVy7MQqqLrov5:j/8vN7E7tQWgQ+fB+u1jaF7MVq4B
TLSH
T14CE2FB3B680CCB7E4F404E9CED29BD9AADA801CF9698CD5447EA840C03C57EB561A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2fcf3e2f9fea1631109214fd4d418b52b470fcee3bcf1e880cb453d24b098fe6
MD5 a04a94a74b4349efaa936e7251399bd3
SHA1 aee175249512ef230c5cbafd3d58a970ad737844
SHA512 5ffdf604af3317c5ef908972bd12f3f18986af60f35887fd523a2bfaf883815f0ace46641ddb1cfd2df7bb32f582fff14bd0317777e63eb60f8caaa824e5ec65
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHyX+SkE0SWcJhgCSK4Xg4ScCqRwSbHYp8y:CbEBVj5JAdSp9/EgTK7j6dJOHyX+SkE/
TLSH
T1EB912300313B02C0383DBA5CC1B99C6EC6C274727416A56B3FA945AA4F67E479EFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8a99c785-33bd-446c-bbd6-70be33514d75.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8a99c785-33bd-446c-bbd6-70be33514d75.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 14cca49619afee1c01fbe193c90643ed6fbb1b782624e2534f8fc7305395cf3b
MD5 10d3ced3ffe4596f62ecf1569c45e781
SHA1 882a8642696685f4b02ecee0228815693a88bd70
SHA512 6b2d4f351c62737c0def5708c2d29e8889129a43ae6f1d0622a06405cdf4b6aee3eae016fd0f1854f6cc9acda4636f5e42327f18db02aa6f772ef9f4f87f8147
SSDEEP 768:CF1j+9+3XwgtAtVp8+p3bd66j+4BRv86aLIW9Nb9M2:39+3K8+p3Z6n4yTNb+2
TLSH
T1E7038E76D869CE7BACE28B85B3463B87AEF011A386C45DD4E9C86F4D00971ED170BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0c0159695b88466af89b46d2ee8560ba213c923407e559d5b52ff2970e5914df
MD5 84e803873767a5cd7484f93eed44cf19
SHA1 c4645a8ca026e7dd73ab854b6d5053940f0e6aab
SHA512 965102ccbb6250fca62106338ea260bd41b24dec077ff5971f5b232fe992cb0238a2be924304c75659ace5be9179d8d3425616d68e93d2302b06787aa7a1170e
SSDEEP 768:Irv+4UNbdD3PcONp8+p3bd66j+4BRv86aLIir2bwCl1:Ibsbp3/L8+p3Z6n4yt0ww
TLSH
T1B903BE73F9A899339CF6C64472867B437FF851A396C10AC4D5CD2B4E41AA19E630BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 fec059b1f150b3bd4511377def656dca9bef4846c7bef38327c6ddf6158710df
MD5 32737c934f090fec4e83056aff2cfdf5
SHA1 5710a76da41fbe365f51c8833c06aba957b99443
SHA512 bb731b8e47d05a2400798f83bd52641002091fc52b306817c521e7894a9b65f4f50f89c92af493affac9661a9c71e97fad5d6f68b3a760656b2a9b5a0f6b7d58
SSDEEP 768:Jj+9T3U745gp8+p3bd66j+4BRv86aLIW9Nb9M2:U9T3D+8+p3Z6n4yTNb+2
TLSH
T15CF2B071E86ACD738CE1C748B2873B877FF451B395C01E98E9D86B0D05972AD5B0742A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 19882f0e17bf160ad19c2bf0e0bd8d849c7c2fe5c73a1a513572e0afe44699f5
MD5 1be9dee83ba2203e117d7122eed3ba8c
SHA1 f1f061f2bf3796962f06ba6257594a4b3fdd19bc
SHA512 d4d15d2e5dbfff5128cfcb4059bd9a5ab090860f26018766ff2e588499d57ec5cb4b4d3aafa34a78258c8ebdb940f3f0d27cd4950796a5441ecf7ca664f8caf8
SSDEEP 768:Rj+9T3l745wp8+p3bd66j+4BRv86aLIW9Nb9M2:M9T3cO8+p3Z6n4yTNb+2
TLSH
T120F2B071E86ACD738CE1C744B2973B877FF411B396C01E98E9D86B0D05972AD5B0B42A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4236_614049994\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 83c7ccc5dcdf17f9914466a5920977a692fa957f4112f97c77d9cbb51036fb94
MD5 3d3d794b22bfb514ba9b985c516b4878
SHA1 c6865e8344e031b83615bf6088b0969b26b7527a
SHA512 e02014535588c78020ff982410d5811bed49b5302e3e8f38a258a44b17eb11e5d4ed5950a608b40ac76fd0ba7db17f394138b4b32043d532a9e6c97aabdbbd2e
TLSH
T13171238357B9C9F2C1DA5FF002835204F5FB233C077330204B55554AAB30A7A54B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1320-285-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1576-507-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2144-482-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2216-441-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2604-272-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2916-365-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3500-242-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4084-373-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4212-325-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4276-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4664-195-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4888-340-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5000-321-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5156-401-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5512-477-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5624-456-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5624-478-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5804-421-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5880-315-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6036-445-0x0000000000010000-0x00000000000AB000-memory.dmp

Download