37da152aba94128377c11650fffdc5fcb942a461f3bd806ad4ac30a647a0c33a

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 23:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 722KB
Sample260719-2228xshy21
SHA256 37da152aba94128377c11650fffdc5fcb942a461f3bd806ad4ac30a647a0c33a
MD5 36aaed2003e4ff914bcdc89f7eccf200
SHA1 dbfc8020f0b2b7d2c4cd6f38bb24e1c634003b43
SHA512 b9653ac751e5ba4f64540f6c827fed07d666d520babf0163d1427391a251374f98a37aa55467d21561f4f1a27b37be5e76bc63b5c07fe720694de06588aec843
SSDEEP 12288:BflfAsiVGjSGecvXAflfAsiVGjSGecvX:pMcfcMcf
TLSH
T1BBF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4956	zwqojgbztrljdbwq.exe
2020	zwqojgbztrljdbwq.sys
3756	CreateProcess.exe
3516	ywqoljdywt.exe
5756	CreateProcess.exe
1200	CreateProcess.exe
1584	i_ywqoljdywt.exe
5880	vtnljdbvtn.sys
4180	CreateProcess.exe
4872	lgdyvqoiga.exe
4920	CreateProcess.exe
3412	CreateProcess.exe
1868	i_lgdyvqoiga.exe
5020	dxvpnlfdav.sys
5376	CreateProcess.exe
1508	ysnlfdavtn.exe
5708	CreateProcess.exe
1316	CreateProcess.exe
2392	i_ysnlfdavtn.exe
2900	xspkicaxsq.sys
4288	CreateProcess.exe
2260	qkicaxvsmk.exe
2648	CreateProcess.exe
2800	CreateProcess.exe
5888	i_qkicaxvsmk.exe
2444	nhfcxvpnhf.sys
5716	CreateProcess.exe
2896	usmkecwupm.exe
2336	CreateProcess.exe
5364	CreateProcess.exe
3860	i_usmkecwupm.exe
1516	zxrpkhczus.sys
5584	CreateProcess.exe
5516	xupmhecxrp.exe
4980	CreateProcess.exe
1056	CreateProcess.exe
2392	i_xupmhecxrp.exe
6016	wurmjhbzxr.sys
2064	CreateProcess.exe
1040	ztrpjhezxr.exe
5548	CreateProcess.exe
5276	CreateProcess.exe
200	i_ztrpjhezxr.exe
4216	wuomgebztr.sys
900	CreateProcess.exe
5352	eywromjeby.exe
4924	CreateProcess.exe
3940	CreateProcess.exe
4828	i_eywromjeby.exe
1516	jdbwtolgdb.sys
3152	CreateProcess.exe
1804	tqoigbytqo.exe
4856	CreateProcess.exe
4720	CreateProcess.exe
4892	i_tqoigbytqo.exe
2720	ywqolgeywq.sys
5656	CreateProcess.exe
620	nljdbvtnlg.exe
2912	CreateProcess.exe
4876	CreateProcess.exe
2668	i_nljdbvtnlg.exe
2232	ytnlidaysq.sys
5020	CreateProcess.exe
5284	qligaysqli.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_174097795\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_174097795\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_174097795\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_738078103\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_256978994\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1002439842\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_174097795\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_256978994\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1864_1002439842\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrpjhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrpjhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfcayspnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxusmkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gebwuomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dywqnigayv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqoljdywt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysnlfdavtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gebwuomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqoljdywt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xupmhecxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywromjeby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqoigbytqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qligaysqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywtrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgeywqoigd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nljdbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfcayspnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkhcausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgeywqoigd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nljdbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdyvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xupmhecxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywromjeby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqoigbytqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dywqnigayv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwqojgbztrljdbwq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdyvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysnlfdavtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkicaxvsmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkicaxvsmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkhcausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_keczxrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qligaysqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxusmkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keczxrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywtrljdbw.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1088	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1132	ipconfig.exe
4544	ipconfig.exe
4964	ipconfig.exe
4360	ipconfig.exe
3472	ipconfig.exe
5448	ipconfig.exe
3492	ipconfig.exe
2976	ipconfig.exe
3144	ipconfig.exe
2024	ipconfig.exe
1212	ipconfig.exe
5060	ipconfig.exe
4888	ipconfig.exe
2444	ipconfig.exe
2152	ipconfig.exe
2868	ipconfig.exe
1220	ipconfig.exe
4696	ipconfig.exe
2920	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134289759408792135"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{4F17E638-BEC2-4665-8182-B539055CBB13}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4956	zwqojgbztrljdbwq.exe
4956	zwqojgbztrljdbwq.exe
4956	zwqojgbztrljdbwq.exe
4956	zwqojgbztrljdbwq.exe
4956	zwqojgbztrljdbwq.exe
4956	zwqojgbztrljdbwq.exe
4956	zwqojgbztrljdbwq.exe
4956	zwqojgbztrljdbwq.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1584	i_ywqoljdywt.exe
Token: SeDebugPrivilege	1868	i_lgdyvqoiga.exe
Token: SeDebugPrivilege	2392	i_ysnlfdavtn.exe
Token: SeDebugPrivilege	5888	i_qkicaxvsmk.exe
Token: SeDebugPrivilege	3860	i_usmkecwupm.exe
Token: SeDebugPrivilege	2392	i_xupmhecxrp.exe
Token: SeDebugPrivilege	200	i_ztrpjhezxr.exe
Token: SeDebugPrivilege	4828	i_eywromjeby.exe
Token: SeDebugPrivilege	4892	i_tqoigbytqo.exe
Token: SeDebugPrivilege	2668	i_nljdbvtnlg.exe
Token: SeDebugPrivilege	1640	i_qligaysqli.exe
Token: SeDebugPrivilege	2692	i_nhfcayspnh.exe
Token: SeDebugPrivilege	3168	i_fzxusmkfcx.exe
Token: SeDebugPrivilege	4692	i_smkhcausmk.exe
Token: SeDebugPrivilege	2724	i_keczxrpjhc.exe
Token: SeDebugPrivilege	4404	i_gebwuomgey.exe
Token: SeDebugPrivilege	4964	i_eywtrljdbw.exe
Token: SeDebugPrivilege	796	i_lgeywqoigd.exe
Token: SeDebugPrivilege	4844	i_dywqnigayv.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1864	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 4956	4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 4600 wrote to memory of 2772	4600	2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 2772 wrote to memory of 1864	2772	iexplore.exe	91
PID 1864 wrote to memory of 5816	1864	msedge.exe	92
PID 1864 wrote to memory of 5156	1864	msedge.exe	94
PID 1864 wrote to memory of 1088	1864	msedge.exe	95
PID 1864 wrote to memory of 5156	1864	msedge.exe	94
PID 1864 wrote to memory of 5156	1864	msedge.exe	94
PID 1864 wrote to memory of 460	1864	msedge.exe	96
PID 1864 wrote to memory of 460	1864	msedge.exe	96
PID 1864 wrote to memory of 2992	1864	msedge.exe	97
PID 1864 wrote to memory of 2992	1864	msedge.exe	97
PID 1864 wrote to memory of 5664	1864	msedge.exe	98
PID 1864 wrote to memory of 2992	1864	msedge.exe	97
PID 1864 wrote to memory of 5664	1864	msedge.exe	98
PID 1864 wrote to memory of 5664	1864	msedge.exe	98
PID 1864 wrote to memory of 6052	1864	msedge.exe	99
PID 1864 wrote to memory of 1900	1864	msedge.exe	100
PID 1864 wrote to memory of 6052	1864	msedge.exe	99
PID 1864 wrote to memory of 6052	1864	msedge.exe	99
PID 1864 wrote to memory of 1900	1864	msedge.exe	100
PID 1864 wrote to memory of 1900	1864	msedge.exe	100
PID 1864 wrote to memory of 716	1864	msedge.exe	102
PID 1864 wrote to memory of 716	1864	msedge.exe	102
PID 4956 wrote to memory of 3756	4956	zwqojgbztrljdbwq.exe	105
PID 1864 wrote to memory of 2216	1864	msedge.exe	108
PID 1864 wrote to memory of 3344	1864	msedge.exe	109
PID 1864 wrote to memory of 2216	1864	msedge.exe	108
PID 1864 wrote to memory of 3344	1864	msedge.exe	109
PID 3516 wrote to memory of 5756	3516	ywqoljdywt.exe	110
PID 1864 wrote to memory of 6020	1864	msedge.exe	114
PID 1864 wrote to memory of 5228	1864	msedge.exe	116
PID 1864 wrote to memory of 5228	1864	msedge.exe	116
PID 1864 wrote to memory of 2456	1864	msedge.exe	118
PID 1864 wrote to memory of 2456	1864	msedge.exe	118
PID 4956 wrote to memory of 1200	4956	zwqojgbztrljdbwq.exe	119
PID 1864 wrote to memory of 4316	1864	msedge.exe	123
PID 1864 wrote to memory of 4316	1864	msedge.exe	123
PID 1864 wrote to memory of 4316	1864	msedge.exe	123
PID 4956 wrote to memory of 4180	4956	zwqojgbztrljdbwq.exe	124
PID 4872 wrote to memory of 4920	4872	lgdyvqoiga.exe	126
PID 1864 wrote to memory of 5852	1864	msedge.exe	129
PID 1864 wrote to memory of 5852	1864	msedge.exe	129
PID 1864 wrote to memory of 5852	1864	msedge.exe	129
PID 4956 wrote to memory of 3412	4956	zwqojgbztrljdbwq.exe	130
PID 4956 wrote to memory of 5376	4956	zwqojgbztrljdbwq.exe	134
PID 1508 wrote to memory of 5708	1508	ysnlfdavtn.exe	136
PID 4956 wrote to memory of 1316	4956	zwqojgbztrljdbwq.exe	139
PID 4956 wrote to memory of 4288	4956	zwqojgbztrljdbwq.exe	144
PID 2260 wrote to memory of 2648	2260	qkicaxvsmk.exe	146
PID 1864 wrote to memory of 5832	1864	msedge.exe	149
PID 1864 wrote to memory of 5832	1864	msedge.exe	149
PID 1864 wrote to memory of 5832	1864	msedge.exe	149
PID 4956 wrote to memory of 2800	4956	zwqojgbztrljdbwq.exe	150
PID 1864 wrote to memory of 4844	1864	msedge.exe	152
PID 1864 wrote to memory of 4216	1864	msedge.exe	153
PID 1864 wrote to memory of 4160	1864	msedge.exe	154
PID 4956 wrote to memory of 5716	4956	zwqojgbztrljdbwq.exe	157
PID 2896 wrote to memory of 2336	2896	usmkecwupm.exe	159
PID 4956 wrote to memory of 5364	4956	zwqojgbztrljdbwq.exe	162
PID 4956 wrote to memory of 5584	4956	zwqojgbztrljdbwq.exe	166
PID 5516 wrote to memory of 4980	5516	xupmhecxrp.exe	168
PID 4956 wrote to memory of 1056	4956	zwqojgbztrljdbwq.exe	171
PID 4956 wrote to memory of 2064	4956	zwqojgbztrljdbwq.exe	175

C:\Users\Admin\AppData\Local\Temp\2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_36aaed2003e4ff914bcdc89f7eccf200_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Temp\zwqojgbztrljdbwq.exe
  C:\Temp\zwqojgbztrljdbwq.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywqoljdywt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3756
  - - C:\Temp\ywqoljdywt.exe
      C:\Temp\ywqoljdywt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3516
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5756
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3492
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywqoljdywt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1200
  - - C:\Temp\i_ywqoljdywt.exe
      C:\Temp\i_ywqoljdywt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1584
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lgdyvqoiga.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4180
  - - C:\Temp\lgdyvqoiga.exe
      C:\Temp\lgdyvqoiga.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4872
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4920
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2152
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lgdyvqoiga.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3412
  - - C:\Temp\i_lgdyvqoiga.exe
      C:\Temp\i_lgdyvqoiga.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1868
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ysnlfdavtn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5376
  - - C:\Temp\ysnlfdavtn.exe
      C:\Temp\ysnlfdavtn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1508
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5708
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2976
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ysnlfdavtn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1316
  - - C:\Temp\i_ysnlfdavtn.exe
      C:\Temp\i_ysnlfdavtn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2392
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qkicaxvsmk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4288
  - - C:\Temp\qkicaxvsmk.exe
      C:\Temp\qkicaxvsmk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2260
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2648
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4888
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qkicaxvsmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2800
  - - C:\Temp\i_qkicaxvsmk.exe
      C:\Temp\i_qkicaxvsmk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5888
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usmkecwupm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5716
  - - C:\Temp\usmkecwupm.exe
      C:\Temp\usmkecwupm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2896
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2336
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1132
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usmkecwupm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5364
  - - C:\Temp\i_usmkecwupm.exe
      C:\Temp\i_usmkecwupm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3860
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xupmhecxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5584
  - - C:\Temp\xupmhecxrp.exe
      C:\Temp\xupmhecxrp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5516
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4980
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xupmhecxrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1056
  - - C:\Temp\i_xupmhecxrp.exe
      C:\Temp\i_xupmhecxrp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2392
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ztrpjhezxr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2064
  - - C:\Temp\ztrpjhezxr.exe
      C:\Temp\ztrpjhezxr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1040
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5548
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3144
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ztrpjhezxr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5276
  - - C:\Temp\i_ztrpjhezxr.exe
      C:\Temp\i_ztrpjhezxr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eywromjeby.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:900
  - - C:\Temp\eywromjeby.exe
      C:\Temp\eywromjeby.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5352
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4924
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2444
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eywromjeby.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3940
  - - C:\Temp\i_eywromjeby.exe
      C:\Temp\i_eywromjeby.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqoigbytqo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3152
  - - C:\Temp\tqoigbytqo.exe
      C:\Temp\tqoigbytqo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1804
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4856
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2868
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqoigbytqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4720
  - - C:\Temp\i_tqoigbytqo.exe
      C:\Temp\i_tqoigbytqo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4892
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nljdbvtnlg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5656
  - - C:\Temp\nljdbvtnlg.exe
      C:\Temp\nljdbvtnlg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:620
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2912
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2024
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nljdbvtnlg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4876
  - - C:\Temp\i_nljdbvtnlg.exe
      C:\Temp\i_nljdbvtnlg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qligaysqli.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5020
  - - C:\Temp\qligaysqli.exe
      C:\Temp\qligaysqli.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5284
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3992
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4964
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qligaysqli.exe ups_ins
    3⤵
    PID:5180
  - - C:\Temp\i_qligaysqli.exe
      C:\Temp\i_qligaysqli.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1640
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nhfcayspnh.exe ups_run
    3⤵
    PID:4760
  - - C:\Temp\nhfcayspnh.exe
      C:\Temp\nhfcayspnh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3136
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3292
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4360
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nhfcayspnh.exe ups_ins
    3⤵
    PID:1344
  - - C:\Temp\i_nhfcayspnh.exe
      C:\Temp\i_nhfcayspnh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2692
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fzxusmkfcx.exe ups_run
    3⤵
    PID:4640
  - - C:\Temp\fzxusmkfcx.exe
      C:\Temp\fzxusmkfcx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4440
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5432
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1220
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fzxusmkfcx.exe ups_ins
    3⤵
    PID:1244
  - - C:\Temp\i_fzxusmkfcx.exe
      C:\Temp\i_fzxusmkfcx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3168
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\smkhcausmk.exe ups_run
    3⤵
    PID:4492
  - - C:\Temp\smkhcausmk.exe
      C:\Temp\smkhcausmk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2760
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3556
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1212
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_smkhcausmk.exe ups_ins
    3⤵
    PID:5428
  - - C:\Temp\i_smkhcausmk.exe
      C:\Temp\i_smkhcausmk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4692
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\keczxrpjhc.exe ups_run
    3⤵
    PID:5676
  - - C:\Temp\keczxrpjhc.exe
      C:\Temp\keczxrpjhc.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1540
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4896
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_keczxrpjhc.exe ups_ins
    3⤵
    PID:5868
  - - C:\Temp\i_keczxrpjhc.exe
      C:\Temp\i_keczxrpjhc.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2724
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gebwuomgey.exe ups_run
    3⤵
    PID:4444
  - - C:\Temp\gebwuomgey.exe
      C:\Temp\gebwuomgey.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4528
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5528
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gebwuomgey.exe ups_ins
    3⤵
    PID:3984
  - - C:\Temp\i_gebwuomgey.exe
      C:\Temp\i_gebwuomgey.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4404
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eywtrljdbw.exe ups_run
    3⤵
    PID:4988
  - - C:\Temp\eywtrljdbw.exe
      C:\Temp\eywtrljdbw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6064
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5984
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3472
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eywtrljdbw.exe ups_ins
    3⤵
    PID:4292
  - - C:\Temp\i_eywtrljdbw.exe
      C:\Temp\i_eywtrljdbw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4964
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lgeywqoigd.exe ups_run
    3⤵
    PID:3536
  - - C:\Temp\lgeywqoigd.exe
      C:\Temp\lgeywqoigd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3200
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4948
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lgeywqoigd.exe ups_ins
    3⤵
    PID:5308
  - - C:\Temp\i_lgeywqoigd.exe
      C:\Temp\i_lgeywqoigd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dywqnigayv.exe ups_run
    3⤵
    PID:4452
  - - C:\Temp\dywqnigayv.exe
      C:\Temp\dywqnigayv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6124
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4116
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2920
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dywqnigayv.exe ups_ins
    3⤵
    PID:2680
  - - C:\Temp\i_dywqnigayv.exe
      C:\Temp\i_dywqnigayv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4844
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffe8b9bc188,0x7ffe8b9bc194,0x7ffe8b9bc1a0
      4⤵
      PID:5816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,2385046866488122072,9459998574094506695,262144 --field-trial-handle=2908,i,13788724863793246238,5004792877363555062,262144 --variations-seed-version --mojo-platform-channel-handle=2904 /prefetch:2
      4⤵
      PID:5156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,3696663095939386082,5479388535739497243,524288 --field-trial-handle=2908,i,13788724863793246238,5004792877363555062,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:11
      4⤵
      System Time Discovery
      PID:1088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2340,i,7603332554721532982,8331805334551998669,524288 --field-trial-handle=2908,i,13788724863793246238,5004792877363555062,262144 --variations-seed-version --mojo-platform-channel-handle=2788 /prefetch:13
      4⤵
      PID:460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,18283589757121910209,6512833463134968272,2097152 --field-trial-handle=2908,i,13788724863793246238,5004792877363555062,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
      4⤵
      PID:2992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,5210133244088806637,7090206896650664757,2097152 --field-trial-handle=2908,i,13788724863793246238,5004792877363555062,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
      4⤵
      PID:5664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,2523578102041710999,13410670668604929319,2097152 --field-trial-handle=2908,i,13788724863793246238,5004792877363555062,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:1
      4⤵
      PID:6052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,10389997820324049554,1118219363564488471,2097152 --field-trial-handle=2908,i,13788724863793246238,5004792877363555062,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:9
      4⤵
      PID:1900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3824,i,6023977245554076703,7719612440262723664,524288 --field-trial-handle=2908,i,13788724863793246238,5004792877363555062,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:14
      4⤵
      PID:716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,14451437860428491307,3965848282058837057,524288 --field-trial-handle=2908,i,13788724863793246238,5004792877363555062,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
      4⤵
      PID:2216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,13541476760067157199,18180017278930208107,524288 --field-trial-handle=2908,i,13788724863793246238,5004792877363555062,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:14
      4⤵
      PID:3344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,4565463888728446021,11259245030678355574,524288 --field-trial-handle=2908,i,13788724863793246238,5004792877363555062,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
      4⤵
      PID:2428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,4565463888728446021,11259245030678355574,524288 --field-trial-handle=2908,i,13788724863793246238,5004792877363555062,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
      4⤵
      PID:6020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,2985671586807326427,5484239590728164553,524288 --field-trial-handle=2908,i,13788724863793246238,5004792877363555062,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
      4⤵
      PID:5228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,10267871574329203889,6372945126657998257,524288 --field-trial-handle=2908,i,13788724863793246238,5004792877363555062,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
      4⤵
      PID:2456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6320,i,16778965130138928770,17277242383181446960,2097152 --field-trial-handle=2908,i,13788724863793246238,5004792877363555062,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:1
      4⤵
      PID:4316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3616,i,18335610120306059429,9009883989472823695,2097152 --field-trial-handle=2908,i,13788724863793246238,5004792877363555062,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:1
      4⤵
      PID:5852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6380,i,3158604409735788343,9267321468027467575,2097152 --field-trial-handle=2908,i,13788724863793246238,5004792877363555062,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:1
      4⤵
      PID:5832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,3967071489358662017,7069357211820957550,524288 --field-trial-handle=2908,i,13788724863793246238,5004792877363555062,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:14
      4⤵
      PID:4844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,3552431587780205937,11472083960833138861,524288 --field-trial-handle=2908,i,13788724863793246238,5004792877363555062,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
      4⤵
      PID:4216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,8172310153300673316,4486981704913310187,524288 --field-trial-handle=2908,i,13788724863793246238,5004792877363555062,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
      4⤵
      PID:4160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6796,i,17353084229416298731,17136310641391791014,524288 --field-trial-handle=2908,i,13788724863793246238,5004792877363555062,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:14
      4⤵
      PID:3716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6000,i,10806204825913826014,12155137628892051348,2097152 --field-trial-handle=2908,i,13788724863793246238,5004792877363555062,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:1
      4⤵
      PID:3116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,5336579163658574797,710806091621890017,524288 --field-trial-handle=2908,i,13788724863793246238,5004792877363555062,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:14
      4⤵
      PID:3496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3456,i,12940289606706124472,17515342922537203503,524288 --field-trial-handle=2908,i,13788724863793246238,5004792877363555062,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:14
      4⤵
      PID:2680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6832,i,15166469383531280839,18012457698551022866,524288 --field-trial-handle=2908,i,13788724863793246238,5004792877363555062,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
      4⤵
      PID:4252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3768,i,5151346684460358401,4172708208570996750,262144 --field-trial-handle=2908,i,13788724863793246238,5004792877363555062,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:10
      4⤵
      PID:4716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5940,i,12964222083440409325,4174858807659319739,2097152 --field-trial-handle=2908,i,13788724863793246238,5004792877363555062,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:1
      4⤵
      PID:988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,7731595445213717773,5655493604787052012,524288 --field-trial-handle=2908,i,13788724863793246238,5004792877363555062,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:14
      4⤵
      PID:4556

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6096

C:\Temp\zwqojgbztrljdbwq.sys
C:\Temp\zwqojgbztrljdbwq.sys
1⤵
- Executes dropped EXE
PID:2020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:856

C:\Temp\vtnljdbvtn.sys
C:\Temp\vtnljdbvtn.sys
1⤵
- Executes dropped EXE
PID:5880

C:\Temp\dxvpnlfdav.sys
C:\Temp\dxvpnlfdav.sys
1⤵
- Executes dropped EXE
PID:5020

C:\Temp\xspkicaxsq.sys
C:\Temp\xspkicaxsq.sys
1⤵
- Executes dropped EXE
PID:2900

C:\Temp\nhfcxvpnhf.sys
C:\Temp\nhfcxvpnhf.sys
1⤵
- Executes dropped EXE
PID:2444

C:\Temp\zxrpkhczus.sys
C:\Temp\zxrpkhczus.sys
1⤵
- Executes dropped EXE
PID:1516

C:\Temp\wurmjhbzxr.sys
C:\Temp\wurmjhbzxr.sys
1⤵
- Executes dropped EXE
PID:6016

C:\Temp\wuomgebztr.sys
C:\Temp\wuomgebztr.sys
1⤵
- Executes dropped EXE
PID:4216

C:\Temp\jdbwtolgdb.sys
C:\Temp\jdbwtolgdb.sys
1⤵
- Executes dropped EXE
PID:1516

C:\Temp\ywqolgeywq.sys
C:\Temp\ywqolgeywq.sys
1⤵
- Executes dropped EXE
PID:2720

C:\Temp\ytnlidaysq.sys
C:\Temp\ytnlidaysq.sys
1⤵
- Executes dropped EXE
PID:2232

C:\Temp\nkfdxvsnki.sys
C:\Temp\nkfdxvsnki.sys
1⤵
PID:2564

C:\Temp\nkicaxsqki.sys
C:\Temp\nkicaxsqki.sys
1⤵
PID:2232

C:\Temp\pkhfzxrpnh.sys
C:\Temp\pkhfzxrpnh.sys
1⤵
PID:4828

C:\Temp\mhfzxrpjhb.sys
C:\Temp\mhfzxrpjhb.sys
1⤵
PID:1520

C:\Temp\ebwuomjebz.sys
C:\Temp\ebwuomjebz.sys
1⤵
PID:5380

C:\Temp\jhbzwrojgb.sys
C:\Temp\jhbzwrojgb.sys
1⤵
PID:1828

C:\Temp\lgdywqolge.sys
C:\Temp\lgdywqolge.sys
1⤵
PID:5500

C:\Temp\dyvtnlidby.sys
C:\Temp\dyvtnlidby.sys
1⤵
PID:3144

C:\Temp\dsnlfdxvpn.sys
C:\Temp\dsnlfdxvpn.sys
1⤵
PID:2620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dxvpnlfdav.sys

Path C:\Temp\dxvpnlfdav.sys
Size 293KB
SHA256 bce224b31e5e477eda4c6c45b231fcc36eaeb02554caea6d5d64e6982ca26a58
MD5 a51d6d3a5c7604643bfffeaccef27ff1
SHA1 dd0b85ba503d0bb2168783e7e4aa688df3d30d15
SHA512 ce58ef96dda2c410e8c45979fc5fe2e8f844b7f97e35ee1da496efb3040b7c22eb89854c9a61e81a557956133c2c55b6fe372d9d9108ed025f26593d2cd17d2d
SSDEEP 3072:ktKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:kIJjiJcbI03GBc3ucY5DCSj
TLSH
T157545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lgdyvqoiga.exe

Path C:\Temp\i_lgdyvqoiga.exe
Size 722KB
SHA256 3986e0f3946cc20ba8cbdda1194027d551f5dac96635c94c1ba063c6cfcfa3ce
MD5 ca392b1cd554520e6a8f5cf8d0e49284
SHA1 735d46fee4f4b41fb795eed548f66d2afd8310d4
SHA512 e529c619e840f322f77d4c950bb4084aa0a1e857c2bad4d739f4c82d3950aa140d7f0ed7ad8981295f565d89a0a5ef98a2c4fa0909365bed9c27e3bf1c7d891c
SSDEEP 12288:4flfAsiVGjSGecvXAflfAsiVGjSGecvX:kMcfcMcf
TLSH
T13CF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qkicaxvsmk.exe

Path C:\Temp\i_qkicaxvsmk.exe
Size 722KB
SHA256 b1224c092a5e26669ec2b528d5578fc5646c35f814074b31fd57c34e735ba920
MD5 855b254889b1915ad30de5d4e34e5580
SHA1 8802ee65aa69bb460226691760b10fc3be6feca5
SHA512 c1a4540bc4fca1e480ed9e2e19284d781ccf811030a5846d486a0b1c80ac58fde1f9832b55f5e214739df9a8bb81f619b5b0cc7ea2bc476962dca9d2bc91daa5
SSDEEP 12288:GflfAsiVGjSGecvXAflfAsiVGjSGecvX:SMcfcMcf
TLSH
T13AF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_usmkecwupm.exe

Path C:\Temp\i_usmkecwupm.exe
Size 722KB
SHA256 3c2f98d7e75b2f444696b0a7d8e18592d6f18617a9ca23cf1e5485af9718545f
MD5 06962cb09316fb93389e65bf4fd4d4df
SHA1 212f6a3e9905bcef94dd2b56849bbf9cab1ee621
SHA512 83852eef3133a86b8f9c21084a198b52d2cc63d412db708975d93d84e6a61c12748347a43fe6974576ce84e536dac32c0e4bb13fd5eab1b105efb9d898382df4
SSDEEP 12288:+flfAsiVGjSGecvXAflfAsiVGjSGecvX:6McfcMcf
TLSH
T195F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ysnlfdavtn.exe

Path C:\Temp\i_ysnlfdavtn.exe
Size 722KB
SHA256 ba00b11fb6f1eea6e81d73388e7df77cf80b11272ca0901e940ce1c3f91e35a4
MD5 afffefd10539390152acdbc9cf6f25fb
SHA1 846ad57205c3435b7d8390c7070bb494fae91fc1
SHA512 e533db104ad3c32270ab325574d934493af41e6eff2abe39520f806d23ee27840cac436692d4e2fb4a8439ee466bbf8e651a406676fc8825bd6cc47f4e2839be
SSDEEP 12288:tflfAsiVGjSGecvXAflfAsiVGjSGecvX:FMcfcMcf
TLSH
T1EAF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ywqoljdywt.exe

Path C:\Temp\i_ywqoljdywt.exe
Size 722KB
SHA256 d2a0a5b03ea160be1e1012354732e0ba852f812d1d63ebf74f063ea6e9044f12
MD5 d0c0e86337a16bb09281d5cdca53a821
SHA1 dc175f034761fc664be1de3d43b6a14254fd3e27
SHA512 ca1ac13b5104553f5842a556f994cdec6304f03b28aa331595b06daed92a82dc5d85227e318d03de15c90e7bb58d5469cd8f2175bae7ccef6aeb7e0f709de175
SSDEEP 12288:cflfAsiVGjSGecvXAflfAsiVGjSGecvX:IMcfcMcf
TLSH
T1A8F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgdyvqoiga.exe

Path C:\Temp\lgdyvqoiga.exe
Size 722KB
SHA256 b2e5b695334fec7f5fe73b1b280a12eaa78a827be03fa777969fdcf241b623e8
MD5 9c598d3cdf71a8bf09ca6e46e454035d
SHA1 6c15e9387e5bc78caae4ff535388c9e194eeab72
SHA512 f33eedfea64cfa4de21d999d467a9b7d42b3ab56eeefe5207c4c8089421c4ef41a855322e86b89e94ef7b02ce79f66d72207d15675ea957b958c3742c38c31f0
SSDEEP 12288:iflfAsiVGjSGecvXAflfAsiVGjSGecvX:OMcfcMcf
TLSH
T133F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfcxvpnhf.sys

Path C:\Temp\nhfcxvpnhf.sys
Size 293KB
SHA256 9b0471b358b693090f6e796ee4063f7a2bf37f5d7a902007604892e978834e9a
MD5 0e6ab6454ae6e09a39c254cf0b1692ff
SHA1 ba8607b7d497fb621642c3b83bac280e5d2531eb
SHA512 8d407e4698beb0a0d12241af43a4ce10c1676968ff59ac862f1514fcd6342fb086684c719a600e79c1774e0631f2ff01ff26cb6ff67cb6f7dd138996d6ce59c8
SSDEEP 3072:ZtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:ZIJjiJcbI03GBc3ucY5DCSj
TLSH
T179545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkicaxvsmk.exe

Path C:\Temp\qkicaxvsmk.exe
Size 722KB
SHA256 2beb7a811d9bc5c13427751046a5e00fc581bfee6492171bee36491b63ad31ff
MD5 928bde31bb7fff43ede7f815b7acaba4
SHA1 7f56cf6b4b4f1d7d10ac220c4bd62b4905d48e84
SHA512 e8535ec658aa28f9f47bb256f74b8b66f3b5a5c991ca9f7d667a67f70072d221eb093d2bff290d540f9c3ce7052f6ab7e7d096bc4b9c0b682179908a17061760
SSDEEP 12288:vflfAsiVGjSGecvXAflfAsiVGjSGecvX:3McfcMcf
TLSH
T147F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmkecwupm.exe

Path C:\Temp\usmkecwupm.exe
Size 722KB
SHA256 17c3a768e3d600b3fd4dde59b912f6a10119942832e839995fdede0d08397c09
MD5 0132e7e38b2112e01cbb96ca5d5d5435
SHA1 bd3915f291c93cba4913b6870a4259e082aac63d
SHA512 f3fc0b21118afa441e979dded76dad360657ef00ce00047277da7dfa7768ee9124f517e808588b3130dc460ad02c52d843966a18378ac2fb470b294db697c222
SSDEEP 12288:oflfAsiVGjSGecvXAflfAsiVGjSGecvX:0McfcMcf
TLSH
T1EBF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnljdbvtn.sys

Path C:\Temp\vtnljdbvtn.sys
Size 293KB
SHA256 25f5350753d2ace0dfcf9a0ee713b5a258ce7a69315624416ece866a2a350ed5
MD5 f6ef9e614d81fd4ea9f533a97385cfe3
SHA1 d75a78b15d1b69151a31aff783ace4f55e364f1b
SHA512 77b6a9ef67ed0f9d42c6abce84a30ed906a22f87af5e64f4d7b8d4065c72c7b0c57ab27ed3d1d68958036a3e189d4cd09eb5e38adcdea00527ad0297d65df250
SSDEEP 3072:xtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:xIJjiJcbI03GBc3ucY5DCSj
TLSH
T126545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xspkicaxsq.sys

Path C:\Temp\xspkicaxsq.sys
Size 293KB
SHA256 7dad17671ee6a458e0a96d955e747d95ee20a50f34704883ce38f256e761a022
MD5 ae211449e3b8f86cd426ee90e273de5d
SHA1 a2d6d8c15e38503ed00bfe29e5f42847e60e1b45
SHA512 23ee9b483a90bcdd8ef6ba7646609e5336e5c0a32d259731c00d7b298ec68696b193b1de5c7e0cf1098f5ed19ad6bc183c1102a41438b9b78bfe1fb98ae572c9
SSDEEP 3072:HtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:HIJjiJcbI03GBc3ucY5DCSj
TLSH
T16C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysnlfdavtn.exe

Path C:\Temp\ysnlfdavtn.exe
Size 722KB
SHA256 822754c5942fc75715d4a9dc8d6545367e6306d642c00d29f2c3568b7ef9c338
MD5 c376bb2cf0a0403e84b953976d1501ea
SHA1 1c7f88a79fc36b748d55814f7ae7d00220a5eec9
SHA512 9cfc97190ccb67dbab3103526b92239478543b3e4ae61d7b757a144859fdd8cdb04c611f62931bd282fb96e0b068b3428ffdf6ddc4e06973afa2c81ae03e30d8
SSDEEP 12288:vflfAsiVGjSGecvXAflfAsiVGjSGecvX:3McfcMcf
TLSH
T11DF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqoljdywt.exe

Path C:\Temp\ywqoljdywt.exe
Size 722KB
SHA256 d8b4dc38f306ba8b5c06f6c5511f67eb5419c57bc3081a47def6e8754f8f844f
MD5 8205937d36e302df48fb842b69667b39
SHA1 9dc98d7cbdcdc30f94b1f0b2a434ae5444d64131
SHA512 a0f648fa002def414006ae86ff281097ff1e3ea3280f085fd322200d38cbaa5880db8835c64f847f9f4124d0f7daf2ea245c3093be4f633594c6d42c7244962e
SSDEEP 12288:TflfAsiVGjSGecvXAflfAsiVGjSGecvX:7McfcMcf
TLSH
T1E7F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwqojgbztrljdbwq.exe

Path C:\Temp\zwqojgbztrljdbwq.exe
Size 722KB
SHA256 c70c624bc51e4c4058bd32eee09c3ee725a2e93e69fb04af24489144c33a5f80
MD5 656875128827fd554597fb7b2d21b304
SHA1 a7bed79cc239ea2c2ec0e61176b33aa40c8e73c1
SHA512 b70cefd40970348526da9e277f01fbc089147319a1efb02dd3e6364bed5f5d4036b0d78ba27c545104af8bfe487e12970951e22057eba9932fd9b913e7f75e17
SSDEEP 12288:kflfAsiVGjSGecvXAflfAsiVGjSGecvX:AMcfcMcf
TLSH
T16CF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwqojgbztrljdbwq.sys

Path C:\Temp\zwqojgbztrljdbwq.sys
Size 293KB
SHA256 1848754de157f0531d0b573a8e6a74cfc46cb0990fd639cdba698210713352a9
MD5 50076fe806279b26bb7b71aed3bcf54e
SHA1 64aefe6e93c4a0c51eeb9c654491456aa5861cc9
SHA512 73f5cba56071f73a16b85d742e9f7d45c307d318077af59aac4f05938ccc815fdec145341fd9f65ed4287f8fc5a24c9fbfcc909d6775d145a7919a29cbd4e3ff
SSDEEP 3072:KtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:KIJjiJcbI03GBc3ucY5DCSj
TLSH
T1AC545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxrpkhczus.sys

Path C:\Temp\zxrpkhczus.sys
Size 293KB
SHA256 d7df2077f23f3569b814cce53b0d8df48255d4bdf1061f54280a106c53c97ce3
MD5 e8ea66a39fb11e79c5c99213465d6b6c
SHA1 38fa1c3a86492320e94fdf04f8101e81cd5180c9
SHA512 3adf2a6f2b7f9346eab90bf74f75e412063588aa9c3272ed8dc97e1440df2207409e9301eaba41d09ed38bb3fac2a9b30dc7350184b2be4ba9b01f411a9e44c9
SSDEEP 3072:ttKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:tIJjiJcbI03GBc3ucY5DCSj
TLSH
T13C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57b2a2ef-7401-432b-90db-648d134eed50.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\57b2a2ef-7401-432b-90db-648d134eed50.tmp
Size 38KB
SHA256 bcdcc764fe44b175ba8ee823f8a1661071c16a0403b3fa223e6c4fcf454a40d2
MD5 bdf8dde6c8b8166151a426884bd42685
SHA1 7e9ec8fd1498ef83e663014dc8e9ad65d4549e6a
SHA512 843757595adb4162782a2e432380eadcc7229f6ccef720993934aa31262446fb5822554bffd337115f1dc013345c0b05cf6257c95cf4e42d490cc65e08e47c45
SSDEEP 768:Prv+4UNbd/3TAK7/p8+p3bd66j+4BRv86aLIWY2L:Pbsb53DR8+p3Z6n4yOU
TLSH
T1BE03AD72F869DD739CF6C644B18677837FB820A395C00E98E9D96B4E019719E270F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 af6903e23bab3400c62f279236f0c8c13098d68438554a7eeee06f97fd1d698e
MD5 0072e0458aec4a4a52dfc4f146d9fa25
SHA1 708f24d3dce09391c6380e6792db66d705b87f74
SHA512 333599e4439efa151db59c49d4caf3d7dd8879722d717d2303d92aa7db60354d99a7ed64f7a2064f00d7d1bc90caefa906fc60cbd6866088af5deb0a8ca87cf1
TLSH
T1A1519EB807B129F2CBA447765AD1E60A32F8889500B3DE5B40401DF55B07F6D16D2FAB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c2e9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59c2e9.TMP
Size 2KB
SHA256 4d2610132a3816aab1b8147b312aaa2d88390085dd8295d5eedb908d585a794b
MD5 1b845028cd4a7c6d7b7ead503b9db639
SHA1 edb095aea963f085ac57211b40de528d19714de7
SHA512 10352c7db6ae99359e265b81b7fb3e1615080624df7d4a70a4973f412e3eb3013b69d74eb74bee630a6892dc380c31fa21753173f308d973573864be021109db
TLSH
T11451A0B807B129F2CBA446755AD1E60A32F8889900B7DE5B40401DF55F07F6D17D2FAB
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 56c5b07f62fee6165d4bce1b92e19e8e6f38d26e62f9a64d4b8c2ac95a02258a
MD5 b0804fff9436595c1560e7adfed11b00
SHA1 bc1656688d09520434286af973853c0ee60291b1
SHA512 7ec0b6e7c898701011904e4042d21ba0241b9690532ae197c5ae3d12fd113fbbe59d1d3fc172dd955ee55b46d0f06f9d3fe113d9ff11ef941c3b1038dbdc758c
TLSH
T19341C0F3C7E8862D890156F0A7147E2BDE1D0914832C3D5AC9E4AF1BA7F2471D14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 3706e0d1ab3350a52bd365278554b812300cb7631b92c6d4b48deb5d27a0af61
MD5 d2e26da84785c9826f489ba5e8211f30
SHA1 5ec249794ffeea7660678b019a6ae16e5fc00e3e
SHA512 da661055241adce2afdb9ea26e41433dec1820d6aa1caa776dc904febb15eb132e946a6764ef19b7eff2159c6e793d80c0bd274ea47a8de1035aff197159f101
SSDEEP 192:sxRVrC+/f5sny3iZzDhSzoD8pi/g6+WNIYCsuOKsG3IgtJ:sxRVe+/f5sny3kHci/5Ie23
TLSH
T1F132B6166E28993B9CC7D21DFB25BF53D6F95032A1942A48FBFC860C04EB6DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 5710ff06abe0ba1d7a10438a738189aabed1514e1908e5ef1d1fcfc6f76b1cde
MD5 9fd72c1803c822e4eee7d0234044b4f6
SHA1 ea3fab1d4458aaa99012faeb80bdbe28ee87697b
SHA512 098a9b3b843edade6ee7cd791efff2b407101b357fe8a04f045c0117a229a0eaf7d8856e1a0376b702739fc5e930261d46470e885e5053e882d01cec2c1330ff
SSDEEP 192:sxRyrC+/f5sKy3iZzDpSzoD8p9W/g6+WNIYCyuOKsG3IgDTJ:sxRye+/f5sKy3kHEI/5IQ2h
TLSH
T1E032A6566E28993B9CC7D21DFB65BF53D6F95032A1942E48EBFC860C04EB6DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e0c6b86bdd82b7a41dd55d7599ef3d195b5e9e85c4e71390aa8420dd06fe73dd
MD5 7d999ab552513557c4ef02a41c4776d0
SHA1 8db8af31e7a64f949609168cc0773d8618eb2025
SHA512 b443defbbdb330c1a3e49c3d16c7ff24f9dd46708ddc444d4c1f0e26107abb8e85be4d31625a3d50e94b0ff8a63752361ccf086d5158dcab73d9e68fca51487d
SSDEEP 192:sxRyrC+/f5sKydiZzDpSzoD8p9W/g6+WNIYCRuOKsG3IgDZJ:sxRye+/f5sKydkHEI/5I52v
TLSH
T13942A6566A28997B9CC7D21DFB65BF53D2F95032A1942E48EBFC870C04EB6CD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 3efa3217539afe9da2a590cd4193a43504df89e20e1269f129d7d6bbf92c9170
MD5 4c4f3778b8351fc9b5d47443065b3c08
SHA1 d686dd0377eae17635750fb4ffef3188d8c58602
SHA512 eb29f40754aac9f559b8d4d129462d7b23fe4e2e9b5f1cdc5ddfb147f12536eb95eb35cb17d5cc8b3875fcc87bfdaef2002840d4ebab518a7c32060d12a48bd1
SSDEEP 768:jC+vfN7pLuL7JQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OV8M0QqcqroZ5:jC+vf7E7JQWgQ+f4+u1jaHM0VcB/
TLSH
T1B6D2EB7B640DCB7F4F804ADDED197A9F6DA802CB9698CD4047FA841C02C67EB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a5e1f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a5e1f.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 c471263722015c5ab774af556225e85a5b2e1a48c329dd78efa9bfb5ec502ed7
MD5 0efe69e16bdfc522bfcb281e68c819db
SHA1 d3186b6240f11e2caed742e8bd0291e6c1cb46db
SHA512 d2a79d303869ce2c493984343378eed14c032b5a4d9f95b7b7dfae78cab1a0f4c325ded7a04593b00d1dd28b253b602ea3263d28de1ac81950553133e9239554
SSDEEP 768:Sj+9l3PAK7Kp8+p3bd66j+4BRv86aLIWY2X:h9l3f08+p3Z6n4yOw
TLSH
T108E29EB1E899DD738CE5C649B24637C3AFF411A395C01E98D9DC6F0E019729E270B83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 325c6983470e163512e979847468e880694ecd89e4c82f82c86267a227205bed
MD5 2971b8111744c5b26975c04f8dbf0845
SHA1 9b6a2f4d216da918b42996bf3b79c8345f99a888
SHA512 43321aa6b5225b665d86c09dfa5a3bede5d432c179811fdd025fa7433defc71fb3916def5246b7ea9d6b9610c3e33364e4f5cbd3a70d68f80bcb9f535c52fa60
SSDEEP 768:4F1j+9F3YwgI3nRp8+p3bd66j+4BRv86aLIWY2X:19F318+p3Z6n4yOw
TLSH
T1F6F27D72E895CE7BACE68B85B7067783AFF411A385C45DD8DAC86E4D00C719E170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 8f66befe48dcce6f9a084f1ee45b90ee8b425db3fd063a539fbadcb20da2c85f
MD5 2452eac619c113a06882ff25d5b0dbd8
SHA1 e8fe4353caf1df2fd6659916dd24472e3a1aaad0
SHA512 d4414cc9dff4c423f0bfa482d542dff70c090b6a9e9a70e6fc0826df6da1a74281049c22fb399f6d17de4f9ffd4177beefd7f1b9c1a67203a2a035d0d66867b6
SSDEEP 768:Irv+4UNbdD3McwNp8+p3bd66j+4BRv86aLIio2bwCl1:Ibsbp3cL8+p3Z6n4yK0ww
TLSH
T1CC03CE73F8A899739CE6C644B2467A837FF811A396C00EC4D4DD2B4E419A19E230BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 8b09e254e85d3af180cdedebc84fa2799d2faac456a265db30eea00a8b6add54
MD5 e345bb44e5dde893abb9c5d43ba2f950
SHA1 12d93bb443615e818a57bca1c21894e07a44f9ad
SHA512 12efbfdd167310734deaef82d3b1096cefb8144b73c9e562b9cf0e57c60709ee873237a8599ff2e4361b89adaa67442e2612db5f29b99230dfebbd1f8109f5bf
SSDEEP 768:Wj+9l3PAK7Kp8+p3bd66j+4BRv86aLIWY2X:F9l3f08+p3Z6n4yOw
TLSH
T139E29E71E899DD738CE5C649B24637C3AFF411A395C01E99D9DCAF0E019729E270B83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

e6b7c782-f910-40c0-a8ff-1a8c6c046bd0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e6b7c782-f910-40c0-a8ff-1a8c6c046bd0.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1864_587982901\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 800d35a1b35bed35ee143bd63a3800ac78eb2c49c72155a126285b799c3fab99
MD5 0c66b9292d1eeb30d256901b9345c085
SHA1 12b6771554f09f680f983b145ea15a11f4dd3d3e
SHA512 b7e91167e5661b7eba6f9f0f68062786170291c25aee4e94977fb1db10bd2a0862eedc3fac3e27d87cadbb428eda950456dc962dbee1e2453152c0f94630b386
TLSH
T14A71238357A8D6F3C1DE9BF102835644F2FB2238077330200B95598AEB30A7A68B8F14
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1516-336-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1516-301-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1520-434-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1828-450-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2020-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2232-431-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2232-369-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2232-409-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2444-302-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2444-272-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2564-389-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2620-492-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2720-356-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2900-260-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3144-475-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4216-313-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4828-413-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5020-230-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5380-445-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5500-471-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5880-183-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6016-309-0x0000000000010000-0x00000000000AB000-memory.dmp

Download