Overview

overview

7

Static

static

3

2026-08-10...op.exe

windows10-2004-x64

7

2026-08-10...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/08/2026, 19:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-10_bd0b4cf531f1930bf26d0173759f7c65_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
  • Size 722KB
  • Sample260810-yhmsca1zhy
  • SHA256 434723ee413f7ce9f0fd39562406d7779ea496ca60485eb3087776379b048a93
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwarediscoveryspyware

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers network information 2 TTPs 19 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 20 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_bd0b4cf531f1930bf26d0173759f7c65_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-10_bd0b4cf531f1930bf26d0173759f7c65_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2500
    • C:\Temp\uojgezwrojgezwuo.exe
      C:\Temp\uojgezwrojgezwuo.exe run
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3368
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\ywuomjecwr.exe ups_run
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:5440
        • C:\Temp\ywuomjecwr.exe
          C:\Temp\ywuomjecwr.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3960
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:3456
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:5416
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_ywuomjecwr.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:4896
        • C:\Temp\i_ywuomjecwr.exe
          C:\Temp\i_ywuomjecwr.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2828
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\oljdywqoig.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:4656
        • C:\Temp\oljdywqoig.exe
          C:\Temp\oljdywqoig.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4936
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:5336
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:5128
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_oljdywqoig.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:2492
        • C:\Temp\i_oljdywqoig.exe
          C:\Temp\i_oljdywqoig.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2948
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\olgdyvqoig.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:4468
        • C:\Temp\olgdyvqoig.exe
          C:\Temp\olgdyvqoig.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2860
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:4856
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:4288
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_olgdyvqoig.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:5264
        • C:\Temp\i_olgdyvqoig.exe
          C:\Temp\i_olgdyvqoig.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3140
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\xvqnifdbvs.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:3700
        • C:\Temp\xvqnifdbvs.exe
          C:\Temp\xvqnifdbvs.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5528
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:5340
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:4912
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_xvqnifdbvs.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:3920
        • C:\Temp\i_xvqnifdbvs.exe
          C:\Temp\i_xvqnifdbvs.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3772
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\pnlfdxvqni.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:3448
        • C:\Temp\pnlfdxvqni.exe
          C:\Temp\pnlfdxvqni.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1336
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:5864
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:1704
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_pnlfdxvqni.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:3460
        • C:\Temp\i_pnlfdxvqni.exe
          C:\Temp\i_pnlfdxvqni.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3560
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\xspkhfdxvs.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:2848
        • C:\Temp\xspkhfdxvs.exe
          C:\Temp\xspkhfdxvs.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5360
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:764
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:3964
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_xspkhfdxvs.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:3816
        • C:\Temp\i_xspkhfdxvs.exe
          C:\Temp\i_xspkhfdxvs.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2520
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\zxrpkhcaus.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:1348
        • C:\Temp\zxrpkhcaus.exe
          C:\Temp\zxrpkhcaus.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5064
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:1960
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:4660
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_zxrpkhcaus.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:4860
        • C:\Temp\i_zxrpkhcaus.exe
          C:\Temp\i_zxrpkhcaus.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:936
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\gecwurmkec.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:5948
        • C:\Temp\gecwurmkec.exe
          C:\Temp\gecwurmkec.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4636
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:1116
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:5432
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_gecwurmkec.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:4212
        • C:\Temp\i_gecwurmkec.exe
          C:\Temp\i_gecwurmkec.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2856
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\bztrmjhbzu.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:3108
        • C:\Temp\bztrmjhbzu.exe
          C:\Temp\bztrmjhbzu.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:716
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:4724
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:3856
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_bztrmjhbzu.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:4560
        • C:\Temp\i_bztrmjhbzu.exe
          C:\Temp\i_bztrmjhbzu.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2804
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\rojgeywrlj.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:3940
        • C:\Temp\rojgeywrlj.exe
          C:\Temp\rojgeywrlj.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:568
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:5468
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:3860
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_rojgeywrlj.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:3956
        • C:\Temp\i_rojgeywrlj.exe
          C:\Temp\i_rojgeywrlj.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4272
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\jdbytrljdb.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:1224
        • C:\Temp\jdbytrljdb.exe
          C:\Temp\jdbytrljdb.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2388
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
              PID:3412
              • C:\windows\system32\ipconfig.exe
                C:\windows\system32\ipconfig.exe /release
                6⤵
                • Gathers network information
                PID:4884
        • C:\temp\CreateProcess.exe
          C:\temp\CreateProcess.exe C:\Temp\i_jdbytrljdb.exe ups_ins
          3⤵
            PID:3308
            • C:\Temp\i_jdbytrljdb.exe
              C:\Temp\i_jdbytrljdb.exe ups_ins
              4⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:3832
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\Temp\aysqkidavt.exe ups_run
            3⤵
              PID:4484
              • C:\Temp\aysqkidavt.exe
                C:\Temp\aysqkidavt.exe ups_run
                4⤵
                • System Location Discovery: System Language Discovery
                PID:1856
                • C:\temp\CreateProcess.exe
                  C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                  5⤵
                    PID:4556
                    • C:\windows\system32\ipconfig.exe
                      C:\windows\system32\ipconfig.exe /release
                      6⤵
                      • Gathers network information
                      PID:6008
              • C:\temp\CreateProcess.exe
                C:\temp\CreateProcess.exe C:\Temp\i_aysqkidavt.exe ups_ins
                3⤵
                  PID:4416
                  • C:\Temp\i_aysqkidavt.exe
                    C:\Temp\i_aysqkidavt.exe ups_ins
                    4⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1344
                • C:\temp\CreateProcess.exe
                  C:\temp\CreateProcess.exe C:\Temp\nigaysqdax.exe ups_run
                  3⤵
                    PID:3528
                    • C:\Temp\nigaysqdax.exe
                      C:\Temp\nigaysqdax.exe ups_run
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:4504
                      • C:\temp\CreateProcess.exe
                        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                        5⤵
                          PID:4600
                          • C:\windows\system32\ipconfig.exe
                            C:\windows\system32\ipconfig.exe /release
                            6⤵
                            • Gathers network information
                            PID:5256
                    • C:\temp\CreateProcess.exe
                      C:\temp\CreateProcess.exe C:\Temp\i_nigaysqdax.exe ups_ins
                      3⤵
                        PID:6104
                        • C:\Temp\i_nigaysqdax.exe
                          C:\Temp\i_nigaysqdax.exe ups_ins
                          4⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          PID:5796
                      • C:\temp\CreateProcess.exe
                        C:\temp\CreateProcess.exe C:\Temp\causqkhfax.exe ups_run
                        3⤵
                          PID:5872
                          • C:\Temp\causqkhfax.exe
                            C:\Temp\causqkhfax.exe ups_run
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:6036
                            • C:\temp\CreateProcess.exe
                              C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                              5⤵
                                PID:4552
                                • C:\windows\system32\ipconfig.exe
                                  C:\windows\system32\ipconfig.exe /release
                                  6⤵
                                  • Gathers network information
                                  PID:3832
                          • C:\temp\CreateProcess.exe
                            C:\temp\CreateProcess.exe C:\Temp\i_causqkhfax.exe ups_ins
                            3⤵
                              PID:5084
                              • C:\Temp\i_causqkhfax.exe
                                C:\Temp\i_causqkhfax.exe ups_ins
                                4⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4576
                            • C:\temp\CreateProcess.exe
                              C:\temp\CreateProcess.exe C:\Temp\axsmkicaus.exe ups_run
                              3⤵
                                PID:3384
                                • C:\Temp\axsmkicaus.exe
                                  C:\Temp\axsmkicaus.exe ups_run
                                  4⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:1216
                                  • C:\temp\CreateProcess.exe
                                    C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                    5⤵
                                      PID:3984
                                      • C:\windows\system32\ipconfig.exe
                                        C:\windows\system32\ipconfig.exe /release
                                        6⤵
                                        • Gathers network information
                                        PID:3352
                                • C:\temp\CreateProcess.exe
                                  C:\temp\CreateProcess.exe C:\Temp\i_axsmkicaus.exe ups_ins
                                  3⤵
                                    PID:6120
                                    • C:\Temp\i_axsmkicaus.exe
                                      C:\Temp\i_axsmkicaus.exe ups_ins
                                      4⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:6108
                                  • C:\temp\CreateProcess.exe
                                    C:\temp\CreateProcess.exe C:\Temp\zxrpmkhczu.exe ups_run
                                    3⤵
                                      PID:4140
                                      • C:\Temp\zxrpmkhczu.exe
                                        C:\Temp\zxrpmkhczu.exe ups_run
                                        4⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:1860
                                        • C:\temp\CreateProcess.exe
                                          C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                          5⤵
                                            PID:5452
                                            • C:\windows\system32\ipconfig.exe
                                              C:\windows\system32\ipconfig.exe /release
                                              6⤵
                                              • Gathers network information
                                              PID:832
                                      • C:\temp\CreateProcess.exe
                                        C:\temp\CreateProcess.exe C:\Temp\i_zxrpmkhczu.exe ups_ins
                                        3⤵
                                          PID:5796
                                          • C:\Temp\i_zxrpmkhczu.exe
                                            C:\Temp\i_zxrpmkhczu.exe ups_ins
                                            4⤵
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:2408
                                        • C:\temp\CreateProcess.exe
                                          C:\temp\CreateProcess.exe C:\Temp\bzurmkeczt.exe ups_run
                                          3⤵
                                            PID:6100
                                            • C:\Temp\bzurmkeczt.exe
                                              C:\Temp\bzurmkeczt.exe ups_run
                                              4⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:3252
                                              • C:\temp\CreateProcess.exe
                                                C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                5⤵
                                                  PID:3752
                                                  • C:\windows\system32\ipconfig.exe
                                                    C:\windows\system32\ipconfig.exe /release
                                                    6⤵
                                                    • Gathers network information
                                                    PID:3356
                                            • C:\temp\CreateProcess.exe
                                              C:\temp\CreateProcess.exe C:\Temp\i_bzurmkeczt.exe ups_ins
                                              3⤵
                                                PID:4932
                                                • C:\Temp\i_bzurmkeczt.exe
                                                  C:\Temp\i_bzurmkeczt.exe ups_ins
                                                  4⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:5276
                                              • C:\temp\CreateProcess.exe
                                                C:\temp\CreateProcess.exe C:\Temp\geywrojgbz.exe ups_run
                                                3⤵
                                                  PID:3620
                                                  • C:\Temp\geywrojgbz.exe
                                                    C:\Temp\geywrojgbz.exe ups_run
                                                    4⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:5152
                                                    • C:\temp\CreateProcess.exe
                                                      C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                      5⤵
                                                        PID:3908
                                                        • C:\windows\system32\ipconfig.exe
                                                          C:\windows\system32\ipconfig.exe /release
                                                          6⤵
                                                          • Gathers network information
                                                          PID:2032
                                                  • C:\temp\CreateProcess.exe
                                                    C:\temp\CreateProcess.exe C:\Temp\i_geywrojgbz.exe ups_ins
                                                    3⤵
                                                      PID:1300
                                                      • C:\Temp\i_geywrojgbz.exe
                                                        C:\Temp\i_geywrojgbz.exe ups_ins
                                                        4⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:5008
                                                    • C:\temp\CreateProcess.exe
                                                      C:\temp\CreateProcess.exe C:\Temp\jgeywtrljd.exe ups_run
                                                      3⤵
                                                        PID:4596
                                                        • C:\Temp\jgeywtrljd.exe
                                                          C:\Temp\jgeywtrljd.exe ups_run
                                                          4⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:632
                                                          • C:\temp\CreateProcess.exe
                                                            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                            5⤵
                                                              PID:2040
                                                              • C:\windows\system32\ipconfig.exe
                                                                C:\windows\system32\ipconfig.exe /release
                                                                6⤵
                                                                • Gathers network information
                                                                PID:2648
                                                        • C:\temp\CreateProcess.exe
                                                          C:\temp\CreateProcess.exe C:\Temp\i_jgeywtrljd.exe ups_ins
                                                          3⤵
                                                            PID:5384
                                                            • C:\Temp\i_jgeywtrljd.exe
                                                              C:\Temp\i_jgeywtrljd.exe ups_ins
                                                              4⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:3976
                                                        • C:\Program Files\Internet Explorer\iexplore.exe
                                                          "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
                                                          2⤵
                                                          • Modifies Internet Explorer settings
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4488
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
                                                            3⤵
                                                            • Drops file in Windows directory
                                                            • Enumerates system info in registry
                                                            • Modifies data under HKEY_USERS
                                                            • Modifies registry class
                                                            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                            • Suspicious use of FindShellTrayWindow
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:4000
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff9fbd2c188,0x7ff9fbd2c194,0x7ff9fbd2c1a0
                                                              4⤵
                                                                PID:4808
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2072,i,10833115929788848583,4614935296999830891,524288 --field-trial-handle=2880,i,8102948262645858600,14825610217244174172,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:11
                                                                4⤵
                                                                • System Time Discovery
                                                                PID:2712
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1960,i,3275544883297502038,3130293566825150119,262144 --field-trial-handle=2880,i,8102948262645858600,14825610217244174172,262144 --variations-seed-version --mojo-platform-channel-handle=2876 /prefetch:2
                                                                4⤵
                                                                  PID:724
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2640,i,7234567147501997824,13413159439526629850,524288 --field-trial-handle=2880,i,8102948262645858600,14825610217244174172,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:13
                                                                  4⤵
                                                                    PID:3444
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3632,i,10186194375607172433,18367390934029245669,2097152 --field-trial-handle=2880,i,8102948262645858600,14825610217244174172,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
                                                                    4⤵
                                                                      PID:6036
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3636,i,5124294887468390247,13946997618567432181,2097152 --field-trial-handle=2880,i,8102948262645858600,14825610217244174172,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
                                                                      4⤵
                                                                        PID:4848
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4380,i,1706656824356082794,5092905930881980421,2097152 --field-trial-handle=2880,i,8102948262645858600,14825610217244174172,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:1
                                                                        4⤵
                                                                          PID:4408
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4408,i,1726445619010873470,1419960145433351132,2097152 --field-trial-handle=2880,i,8102948262645858600,14825610217244174172,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:9
                                                                          4⤵
                                                                            PID:1708
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,4486150542447937718,15792339663064394761,524288 --field-trial-handle=2880,i,8102948262645858600,14825610217244174172,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:14
                                                                            4⤵
                                                                              PID:1296
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,684231182666078061,18158666880034708072,524288 --field-trial-handle=2880,i,8102948262645858600,14825610217244174172,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:14
                                                                              4⤵
                                                                                PID:3572
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,9273983602624049014,2819560138859597793,524288 --field-trial-handle=2880,i,8102948262645858600,14825610217244174172,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:14
                                                                                4⤵
                                                                                  PID:4764
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,4422855610376419268,1400783339764136215,524288 --field-trial-handle=2880,i,8102948262645858600,14825610217244174172,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:14
                                                                                  4⤵
                                                                                    PID:5072
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,4422855610376419268,1400783339764136215,524288 --field-trial-handle=2880,i,8102948262645858600,14825610217244174172,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:14
                                                                                    4⤵
                                                                                      PID:4964
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,4335170016265670417,965945699429013338,524288 --field-trial-handle=2880,i,8102948262645858600,14825610217244174172,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
                                                                                      4⤵
                                                                                        PID:4240
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,15929181349832999995,4608680171068248317,524288 --field-trial-handle=2880,i,8102948262645858600,14825610217244174172,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:14
                                                                                        4⤵
                                                                                          PID:5256
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,3866736014525809922,13202149602349209328,524288 --field-trial-handle=2880,i,8102948262645858600,14825610217244174172,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:14
                                                                                          4⤵
                                                                                            PID:2228
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,6307259129543922593,737624973529938214,524288 --field-trial-handle=2880,i,8102948262645858600,14825610217244174172,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:14
                                                                                            4⤵
                                                                                              PID:5820
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1304,i,17640033273602947565,11843496273115126562,524288 --field-trial-handle=2880,i,8102948262645858600,14825610217244174172,262144 --variations-seed-version --mojo-platform-channel-handle=1300 /prefetch:14
                                                                                              4⤵
                                                                                                PID:3796
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1308,i,2033014592210591568,1048405770334984368,524288 --field-trial-handle=2880,i,8102948262645858600,14825610217244174172,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
                                                                                                4⤵
                                                                                                  PID:4868
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1312,i,13897119829175826793,11319144256164333862,524288 --field-trial-handle=2880,i,8102948262645858600,14825610217244174172,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:14
                                                                                                  4⤵
                                                                                                    PID:5364
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,14023275712772653504,13650836501733623923,524288 --field-trial-handle=2880,i,8102948262645858600,14825610217244174172,262144 --variations-seed-version --mojo-platform-channel-handle=1304 /prefetch:14
                                                                                                    4⤵
                                                                                                      PID:4628
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,13807622869085810574,170265732693448308,524288 --field-trial-handle=2880,i,8102948262645858600,14825610217244174172,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:14
                                                                                                      4⤵
                                                                                                        PID:4272
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6704,i,2695836571603258157,16024076144291050823,262144 --field-trial-handle=2880,i,8102948262645858600,14825610217244174172,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:10
                                                                                                        4⤵
                                                                                                          PID:2592
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1296,i,358250496397784779,8563664117198057241,524288 --field-trial-handle=2880,i,8102948262645858600,14825610217244174172,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
                                                                                                          4⤵
                                                                                                            PID:2292
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                      1⤵
                                                                                                        PID:5020
                                                                                                      • C:\Temp\uojgezwrojgezwuo.sys
                                                                                                        C:\Temp\uojgezwrojgezwuo.sys
                                                                                                        1⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:1752
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                        1⤵
                                                                                                          PID:3176
                                                                                                        • C:\Temp\wqojgbztrl.sys
                                                                                                          C:\Temp\wqojgbztrl.sys
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:4636
                                                                                                        • C:\Temp\qoigaytqli.sys
                                                                                                          C:\Temp\qoigaytqli.sys
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:1364
                                                                                                        • C:\Temp\fdyvqoigay.sys
                                                                                                          C:\Temp\fdyvqoigay.sys
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:2780
                                                                                                        • C:\Temp\sqkicavsqn.sys
                                                                                                          C:\Temp\sqkicavsqn.sys
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:4552
                                                                                                        • C:\Temp\cxvpnkfdxv.sys
                                                                                                          C:\Temp\cxvpnkfdxv.sys
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:4288
                                                                                                        • C:\Temp\xrpnhfzxrp.sys
                                                                                                          C:\Temp\xrpnhfzxrp.sys
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:1280
                                                                                                        • C:\Temp\pkeczusmkh.sys
                                                                                                          C:\Temp\pkeczusmkh.sys
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:2828
                                                                                                        • C:\Temp\jhbzurmjhb.sys
                                                                                                          C:\Temp\jhbzurmjhb.sys
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:2656
                                                                                                        • C:\Temp\trojebwurl.sys
                                                                                                          C:\Temp\trojebwurl.sys
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:1524
                                                                                                        • C:\Temp\jgbytqljdb.sys
                                                                                                          C:\Temp\jgbytqljdb.sys
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:3772
                                                                                                        • C:\Temp\igbytqljdb.sys
                                                                                                          C:\Temp\igbytqljdb.sys
                                                                                                          1⤵
                                                                                                            PID:4632
                                                                                                          • C:\Temp\qnifaysqki.sys
                                                                                                            C:\Temp\qnifaysqki.sys
                                                                                                            1⤵
                                                                                                              PID:4200
                                                                                                            • C:\Temp\faysqkhfca.sys
                                                                                                              C:\Temp\faysqkhfca.sys
                                                                                                              1⤵
                                                                                                                PID:4184
                                                                                                              • C:\Temp\causpkfcxv.sys
                                                                                                                C:\Temp\causpkfcxv.sys
                                                                                                                1⤵
                                                                                                                  PID:2596
                                                                                                                • C:\Temp\nhfzxupmke.sys
                                                                                                                  C:\Temp\nhfzxupmke.sys
                                                                                                                  1⤵
                                                                                                                    PID:200
                                                                                                                  • C:\Temp\hbzurmkecw.sys
                                                                                                                    C:\Temp\hbzurmkecw.sys
                                                                                                                    1⤵
                                                                                                                      PID:1488
                                                                                                                    • C:\Temp\hezwrpjhbz.sys
                                                                                                                      C:\Temp\hezwrpjhbz.sys
                                                                                                                      1⤵
                                                                                                                        PID:3936
                                                                                                                      • C:\Temp\dbztqolgdb.sys
                                                                                                                        C:\Temp\dbztqolgdb.sys
                                                                                                                        1⤵
                                                                                                                          PID:900
                                                                                                                        • C:\Temp\tnlgdywqoi.sys
                                                                                                                          C:\Temp\tnlgdywqoi.sys
                                                                                                                          1⤵
                                                                                                                            PID:4128

                                                                                                                          Network

                                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                                Replay Monitor

                                                                                                                                Loading Replay Monitor...

                                                                                                                                Downloads

                                                                                                                                cxvpnkfdxv.sys
                                                                                                                                • Path C:\Temp\cxvpnkfdxv.sys
                                                                                                                                • Size 293KB
                                                                                                                                • SHA256 7513e09c130878d94d86e2e0d34b8a220a599166f606b2c1c762f8a8a588242d
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                fdyvqoigay.sys
                                                                                                                                • Path C:\Temp\fdyvqoigay.sys
                                                                                                                                • Size 293KB
                                                                                                                                • SHA256 2bbef3c785e3aa32b4d52159612ccf282e5bde9ba01eeec18db6226cb9181369
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                i_olgdyvqoig.exe
                                                                                                                                • Path C:\Temp\i_olgdyvqoig.exe
                                                                                                                                • Size 722KB
                                                                                                                                • SHA256 2774bfd419a3adaecd23bc308e505ea99905b5f19725a8dc6d5cf86513ffda61
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                i_oljdywqoig.exe
                                                                                                                                • Path C:\Temp\i_oljdywqoig.exe
                                                                                                                                • Size 722KB
                                                                                                                                • SHA256 d5e78467acf6f66c0ebc8cc1348b481395b77a99e647886cbb038dd5832c67a3
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                i_pnlfdxvqni.exe
                                                                                                                                • Path C:\Temp\i_pnlfdxvqni.exe
                                                                                                                                • Size 722KB
                                                                                                                                • SHA256 8ffa7604e788deacd502f27c5f2615a92a6026b194f74f510ba9f2e3d2f720cf
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                i_xvqnifdbvs.exe
                                                                                                                                • Path C:\Temp\i_xvqnifdbvs.exe
                                                                                                                                • Size 722KB
                                                                                                                                • SHA256 8f7998349863267f2111c81991c08ea44823995a48d7373f04c424d06d576cfa
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                i_ywuomjecwr.exe
                                                                                                                                • Path C:\Temp\i_ywuomjecwr.exe
                                                                                                                                • Size 722KB
                                                                                                                                • SHA256 5384fdd2b3ba04a6ccf06668710116611d384aec36b5aafc72bebe84253b71d8
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                olgdyvqoig.exe
                                                                                                                                • Path C:\Temp\olgdyvqoig.exe
                                                                                                                                • Size 722KB
                                                                                                                                • SHA256 893cc7480931e045106f5e8f0d86130a54535bacd7dfee3efea73daa09c8bd30
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                oljdywqoig.exe
                                                                                                                                • Path C:\Temp\oljdywqoig.exe
                                                                                                                                • Size 722KB
                                                                                                                                • SHA256 b7e094691f5da56152a96c79ebf5462646b5d364cd9e1124a63a686a8dab5d31
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                pnlfdxvqni.exe
                                                                                                                                • Path C:\Temp\pnlfdxvqni.exe
                                                                                                                                • Size 722KB
                                                                                                                                • SHA256 83c6acafe39e3964744d29f0bdd782313acb82d03f17292e8fd82fb7f57746af
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                qoigaytqli.sys
                                                                                                                                • Path C:\Temp\qoigaytqli.sys
                                                                                                                                • Size 293KB
                                                                                                                                • SHA256 2097d5bd21a9524cfc34c6627d11ba8d989c36815a1daf9c0cbf08d772ba26ee
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                sqkicavsqn.sys
                                                                                                                                • Path C:\Temp\sqkicavsqn.sys
                                                                                                                                • Size 293KB
                                                                                                                                • SHA256 d52788833d507ea98aa015f8aabdd4e018d8c34a176d543278f73830e5dcb139
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                uojgezwrojgezwuo.exe
                                                                                                                                • Path C:\Temp\uojgezwrojgezwuo.exe
                                                                                                                                • Size 722KB
                                                                                                                                • SHA256 d18227cd08815745e991ead89d933b4b4b9f2334ab94db2f5044aa4e1d777161
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                uojgezwrojgezwuo.sys
                                                                                                                                • Path C:\Temp\uojgezwrojgezwuo.sys
                                                                                                                                • Size 293KB
                                                                                                                                • SHA256 78c543c76a71fa2a87b9a32350efad81e5112f1d11ec54f3f16a4e90b9b0a693
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                wqojgbztrl.sys
                                                                                                                                • Path C:\Temp\wqojgbztrl.sys
                                                                                                                                • Size 293KB
                                                                                                                                • SHA256 f4bb473986e36f3a4539653cca36278c3c88823325a760d6728758a608cf7af4
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                xspkhfdxvs.exe
                                                                                                                                • Path C:\Temp\xspkhfdxvs.exe
                                                                                                                                • Size 722KB
                                                                                                                                • SHA256 90d51d318ef79e4eceb086aef37cb9472bb0e4a3b589d318b90559b5a8ab953c
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                xvqnifdbvs.exe
                                                                                                                                • Path C:\Temp\xvqnifdbvs.exe
                                                                                                                                • Size 722KB
                                                                                                                                • SHA256 198f881933e208f656f8141548e170736e29da0276f447a5d74bf7f0f589e605
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                ywuomjecwr.exe
                                                                                                                                • Path C:\Temp\ywuomjecwr.exe
                                                                                                                                • Size 722KB
                                                                                                                                • SHA256 11ed2f5a976a41fe1aacd02afd911f502e8e1c62c509361d86448ca7662c152b
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                settings.dat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                • Size 280B
                                                                                                                                • SHA256 67b546fed422708faf33930b82ff4826bc323bc64f67af30b02bb9e565fa27ee
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                BookmarkMergedSurfaceOrdering
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                                • Size 6B
                                                                                                                                • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                Submit Download

                                                                                                                                the-real-index
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                • Size 1KB
                                                                                                                                • SHA256 f88325bf07f1ad1396320622d1678ceb742e563ba24421150880b2397404fd54
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                SiteList-Enterprise.json
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                                • Size 2B
                                                                                                                                • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                Submit Download

                                                                                                                                Edge Profile.ico
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                                • Size 70KB
                                                                                                                                • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                Network Persistent State
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                • Size 2KB
                                                                                                                                • SHA256 4a8f8fbd4c67387fa347826c73d2dcd6cb4f2683a3856a8ef9250a8eb9d3ae99
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                SCT Auditing Pending Reports
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                • Size 2B
                                                                                                                                • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                Submit Download

                                                                                                                                Sdch Dictionaries
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                                • Size 40B
                                                                                                                                • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                Submit Download

                                                                                                                                Preferences
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                • Size 11KB
                                                                                                                                • SHA256 f7e86dd318db161f25f71610addcddb9f5d1a023a4cdd85d87e429ea79cbf6de
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                Preferences
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                • Size 12KB
                                                                                                                                • SHA256 e84da16e3b589e32d8bdb886fe62b246a0dedfad62e789c60970412a5a54d497
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                Preferences
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                • Size 12KB
                                                                                                                                • SHA256 2515b2b01424ffe224cbfac6d6865209995c41842ef0c684252b4413109d5074
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                Secure Preferences
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                • Size 29KB
                                                                                                                                • SHA256 c420927a139923d5306b2f7b86ef06de04c1277dcbd94111223e0164374a64eb
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                sync_diagnostic.log
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                                • Size 4KB
                                                                                                                                • SHA256 c83734701bce731379d6b83257aa64dbf57fbfb1175d9b4bd5de1eb99a39b07b
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                ee6ae083-5ee0-4949-8a7d-d4e6915da614.tmp
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ee6ae083-5ee0-4949-8a7d-d4e6915da614.tmp
                                                                                                                                • Size 22KB
                                                                                                                                • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                Local State
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                • Size 30KB
                                                                                                                                • SHA256 741cd3656cd71b5448cb0aa6b5280fc94548953b205ffb214f74c03f8da37b5c
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                Local State
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                • Size 39KB
                                                                                                                                • SHA256 c9b06f89614d4aba040471049559511abef8bf0266e5d100b01bd5be09b3478c
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                Local State
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                • Size 30KB
                                                                                                                                • SHA256 49402f298751003e9d9dbee3e3ee42475939780f2db88bbbe3cb35587f651e50
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                Local State
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                • Size 34KB
                                                                                                                                • SHA256 8c83af9c60d9a30f02d7f08d79a99a34febab5d86ecf502222959792ea6d0edd
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                Local State
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                • Size 36KB
                                                                                                                                • SHA256 4a6c4d49a902ea08bd7a211bd617738c4621132a060cfb48dc01a8249e3c2177
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                Local State
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                • Size 35KB
                                                                                                                                • SHA256 b2408c6e76c3abc59ced6facb99b06d47535b7224d18940c39034e911df87cd2
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                metadata.json
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                • Size 132B
                                                                                                                                • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                                                                                • Size 153KB
                                                                                                                                • SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                bb3fc614-ebaf-4b74-9b8f-af05dc1de9cb.tmp
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bb3fc614-ebaf-4b74-9b8f-af05dc1de9cb.tmp
                                                                                                                                • Size 13B
                                                                                                                                • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                Submit Download

                                                                                                                                metadata.json~RFe596a78.TMP
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe596a78.TMP
                                                                                                                                • Size 132B
                                                                                                                                • SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                0734ff93-70d6-4148-bdd1-f473622be57c.tmp
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\0734ff93-70d6-4148-bdd1-f473622be57c.tmp
                                                                                                                                • Size 1B
                                                                                                                                • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                Submit Download

                                                                                                                                content_new.js
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4000_189463945\CRX_INSTALL\content_new.js
                                                                                                                                • Size 10KB
                                                                                                                                • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                CreateProcess.exe
                                                                                                                                • Path C:\temp\CreateProcess.exe
                                                                                                                                • Size 3KB
                                                                                                                                • SHA256 ffea7d32b0fda80750f923ff413bb9fdbd6b1a7bd76c19677d8003ba26f58e0a
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                memory/200-641-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1280-536-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1364-462-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1488-652-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1524-574-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1752-55-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2596-637-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2656-581-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2780-488-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2828-540-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3772-584-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3936-650-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4128-665-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4184-617-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4200-609-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4288-529-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4552-500-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4632-596-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4636-463-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download