5beb96f80e47dcab4f0d8e37013f316d1e7c417c12b30e4e67191dd491d0e38e

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 19:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 722KB
Sample260817-x3bedadd37
SHA256 5beb96f80e47dcab4f0d8e37013f316d1e7c417c12b30e4e67191dd491d0e38e
MD5 4f0f2198d3e91874830f72fc44abd223
SHA1 6917ad52eac5e10593d9d94a356aead27202a014
SHA512 c8047b8a9d48c25d2fc73e693e7bb3a8ce50dcc771a23bf7775bd60353eaa3dd87189694754fd7554d6d62ffbebd2c1131447b414ac203e128dd5f097db4204f
SSDEEP 12288:RflfAsiVGjSGecvXAflfAsiVGjSGecvX:ZMcfcMcf
TLSH
T128F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4156	oidaytqligayvqoi.exe
4496	oidaytqligayvqoi.sys
3792	CreateProcess.exe
4920	tnlidbvtnl.exe
1808	CreateProcess.exe
2120	CreateProcess.exe
4532	i_tnlidbvtnl.exe
5460	nlfdavsnlf.sys
3840	CreateProcess.exe
4272	fdxvqkigay.exe
4716	CreateProcess.exe
4184	CreateProcess.exe
1016	i_fdxvqkigay.exe
3404	nfcxvpnhfd.sys
2720	CreateProcess.exe
5636	fzxspkicau.exe
6032	CreateProcess.exe
2312	CreateProcess.exe
1144	i_fzxspkicau.exe
5932	khfzxrpnhf.sys
4364	CreateProcess.exe
4324	khcausmkec.exe
4852	CreateProcess.exe
2932	CreateProcess.exe
3192	i_khcausmkec.exe
1516	fwusmjhfcw.sys
3504	CreateProcess.exe
5580	urmkecwuom.exe
1016	CreateProcess.exe
2256	CreateProcess.exe
1212	i_urmkecwuom.exe
4072	rpjhezwrpj.sys
4556	CreateProcess.exe
4496	mjebzwromg.exe
1264	CreateProcess.exe
5152	CreateProcess.exe
4220	i_mjebzwromg.exe
2420	wtromgdbzt.sys
4100	CreateProcess.exe
4248	zwuojgbzwr.exe
2740	CreateProcess.exe
3828	CreateProcess.exe
2192	i_zwuojgbzwr.exe
5740	ebwtolgeyw.sys
2560	CreateProcess.exe
3244	dbvtnlgdyw.exe
5788	CreateProcess.exe
1064	CreateProcess.exe
3404	i_dbvtnlgdyw.exe
3824	gdywtnlfdb.sys
2332	CreateProcess.exe
4092	tqlidaysqo.exe
3272	CreateProcess.exe
1720	CreateProcess.exe
5452	i_tqlidaysqo.exe
996	nkidxvtnlf.sys
5836	CreateProcess.exe
3776	igaysqkida.exe
5184	CreateProcess.exe
5200	CreateProcess.exe
3160	i_igaysqkida.exe
4500	dauspnifax.sys
2056	CreateProcess.exe
1392	ifdxvsqnic.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_1646113661\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_1646113661\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_988812452\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_988812452\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_988812452\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_1606341876\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_728975430\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_728975430\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2136_988812452\llm_user_input_extractor_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlidbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwuojgbzwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaysqkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifdxvsqnic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uspkhcausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_heczurpmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtrljebwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtnlgdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifdxvsqnic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	heczurpmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgeywqoige.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdyvqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gayvqnliga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvqkigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvqkigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmkecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwuojgbzwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhezwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oidaytqligayvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxspkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khcausmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmkecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtnlgdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtrljebwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvqkicays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlidbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgeywqoige.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gayvqnliga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjebzwromg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqlidaysqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqlidaysqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhezwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxspkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjebzwromg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdyvqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uspkhcausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khcausmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaysqkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvqkicays.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2692	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
720	ipconfig.exe
5516	ipconfig.exe
1508	ipconfig.exe
3340	ipconfig.exe
5548	ipconfig.exe
3948	ipconfig.exe
5460	ipconfig.exe
5924	ipconfig.exe
4120	ipconfig.exe
3272	ipconfig.exe
5260	ipconfig.exe
4356	ipconfig.exe
2356	ipconfig.exe
2192	ipconfig.exe
1864	ipconfig.exe
4904	ipconfig.exe
5888	ipconfig.exe
2252	ipconfig.exe
480	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314681477380409"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4046655672-1449839301-2197395821-1000\{A5624863-8651-4CCE-980C-2CF71C6CC26A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4156	oidaytqligayvqoi.exe
4156	oidaytqligayvqoi.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4156	oidaytqligayvqoi.exe
4156	oidaytqligayvqoi.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4156	oidaytqligayvqoi.exe
4156	oidaytqligayvqoi.exe
4156	oidaytqligayvqoi.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4156	oidaytqligayvqoi.exe
3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4156	oidaytqligayvqoi.exe
4156	oidaytqligayvqoi.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4532	i_tnlidbvtnl.exe
Token: SeDebugPrivilege	1016	i_fdxvqkigay.exe
Token: SeDebugPrivilege	1144	i_fzxspkicau.exe
Token: SeDebugPrivilege	3192	i_khcausmkec.exe
Token: SeDebugPrivilege	1212	i_urmkecwuom.exe
Token: SeDebugPrivilege	4220	i_mjebzwromg.exe
Token: SeDebugPrivilege	2192	i_zwuojgbzwr.exe
Token: SeDebugPrivilege	3404	i_dbvtnlgdyw.exe
Token: SeDebugPrivilege	5452	i_tqlidaysqo.exe
Token: SeDebugPrivilege	3160	i_igaysqkida.exe
Token: SeDebugPrivilege	772	i_ifdxvsqnic.exe
Token: SeDebugPrivilege	3692	i_uspkhcausm.exe
Token: SeDebugPrivilege	5268	i_heczurpmhe.exe
Token: SeDebugPrivilege	2000	i_rpjhezwrpj.exe
Token: SeDebugPrivilege	5828	i_wtrljebwuo.exe
Token: SeDebugPrivilege	476	i_mgeywqoige.exe
Token: SeDebugPrivilege	1696	i_fdyvqoigay.exe
Token: SeDebugPrivilege	5452	i_gayvqnliga.exe
Token: SeDebugPrivilege	1516	i_dxvqkicays.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2136	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 4156	3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 3452 wrote to memory of 1184	3452	2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	91
PID 1184 wrote to memory of 2136	1184	iexplore.exe	92
PID 2136 wrote to memory of 2768	2136	msedge.exe	93
PID 2136 wrote to memory of 2708	2136	msedge.exe	94
PID 2136 wrote to memory of 2692	2136	msedge.exe	96
PID 2136 wrote to memory of 2708	2136	msedge.exe	94
PID 2136 wrote to memory of 2708	2136	msedge.exe	94
PID 2136 wrote to memory of 5136	2136	msedge.exe	97
PID 2136 wrote to memory of 5136	2136	msedge.exe	97
PID 2136 wrote to memory of 5164	2136	msedge.exe	98
PID 2136 wrote to memory of 5164	2136	msedge.exe	98
PID 2136 wrote to memory of 5164	2136	msedge.exe	98
PID 2136 wrote to memory of 4088	2136	msedge.exe	99
PID 2136 wrote to memory of 4088	2136	msedge.exe	99
PID 2136 wrote to memory of 4088	2136	msedge.exe	99
PID 2136 wrote to memory of 5076	2136	msedge.exe	100
PID 2136 wrote to memory of 5580	2136	msedge.exe	101
PID 2136 wrote to memory of 5076	2136	msedge.exe	100
PID 2136 wrote to memory of 5076	2136	msedge.exe	100
PID 2136 wrote to memory of 5580	2136	msedge.exe	101
PID 2136 wrote to memory of 5580	2136	msedge.exe	101
PID 2136 wrote to memory of 4308	2136	msedge.exe	102
PID 2136 wrote to memory of 4308	2136	msedge.exe	102
PID 2136 wrote to memory of 4308	2136	msedge.exe	102
PID 2136 wrote to memory of 1144	2136	msedge.exe	104
PID 2136 wrote to memory of 1144	2136	msedge.exe	104
PID 2136 wrote to memory of 2884	2136	msedge.exe	107
PID 2136 wrote to memory of 2884	2136	msedge.exe	107
PID 2136 wrote to memory of 2884	2136	msedge.exe	107
PID 2136 wrote to memory of 1188	2136	msedge.exe	109
PID 2136 wrote to memory of 3576	2136	msedge.exe	108
PID 2136 wrote to memory of 1188	2136	msedge.exe	109
PID 2136 wrote to memory of 3576	2136	msedge.exe	108
PID 4156 wrote to memory of 3792	4156	oidaytqligayvqoi.exe	110
PID 2136 wrote to memory of 4112	2136	msedge.exe	113
PID 4920 wrote to memory of 1808	4920	tnlidbvtnl.exe	115
PID 2136 wrote to memory of 5404	2136	msedge.exe	118
PID 2136 wrote to memory of 5404	2136	msedge.exe	118
PID 2136 wrote to memory of 4748	2136	msedge.exe	121
PID 2136 wrote to memory of 4748	2136	msedge.exe	121
PID 4156 wrote to memory of 2120	4156	oidaytqligayvqoi.exe	122
PID 4156 wrote to memory of 3840	4156	oidaytqligayvqoi.exe	126
PID 4272 wrote to memory of 4716	4272	fdxvqkigay.exe	128
PID 4156 wrote to memory of 4184	4156	oidaytqligayvqoi.exe	131
PID 4156 wrote to memory of 2720	4156	oidaytqligayvqoi.exe	135
PID 5636 wrote to memory of 6032	5636	fzxspkicau.exe	137
PID 4156 wrote to memory of 2312	4156	oidaytqligayvqoi.exe	140
PID 4156 wrote to memory of 4364	4156	oidaytqligayvqoi.exe	145
PID 4324 wrote to memory of 4852	4324	khcausmkec.exe	147
PID 4156 wrote to memory of 2932	4156	oidaytqligayvqoi.exe	150
PID 2136 wrote to memory of 5968	2136	msedge.exe	152
PID 2136 wrote to memory of 2192	2136	msedge.exe	153
PID 2136 wrote to memory of 996	2136	msedge.exe	154
PID 4156 wrote to memory of 3504	4156	oidaytqligayvqoi.exe	157
PID 5580 wrote to memory of 1016	5580	urmkecwuom.exe	159
PID 4156 wrote to memory of 2256	4156	oidaytqligayvqoi.exe	162
PID 4156 wrote to memory of 4556	4156	oidaytqligayvqoi.exe	166
PID 4496 wrote to memory of 1264	4496	mjebzwromg.exe	168
PID 4156 wrote to memory of 5152	4156	oidaytqligayvqoi.exe	171
PID 4156 wrote to memory of 4100	4156	oidaytqligayvqoi.exe	175
PID 4248 wrote to memory of 2740	4248	zwuojgbzwr.exe	177
PID 4156 wrote to memory of 3828	4156	oidaytqligayvqoi.exe	180
PID 4156 wrote to memory of 2560	4156	oidaytqligayvqoi.exe	184

C:\Users\Admin\AppData\Local\Temp\2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_4f0f2198d3e91874830f72fc44abd223_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Temp\oidaytqligayvqoi.exe
  C:\Temp\oidaytqligayvqoi.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4156
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tnlidbvtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3792
  - - C:\Temp\tnlidbvtnl.exe
      C:\Temp\tnlidbvtnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4920
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1808
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tnlidbvtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2120
  - - C:\Temp\i_tnlidbvtnl.exe
      C:\Temp\i_tnlidbvtnl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4532
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdxvqkigay.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3840
  - - C:\Temp\fdxvqkigay.exe
      C:\Temp\fdxvqkigay.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4272
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4716
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2192
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdxvqkigay.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4184
  - - C:\Temp\i_fdxvqkigay.exe
      C:\Temp\i_fdxvqkigay.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1016
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fzxspkicau.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2720
  - - C:\Temp\fzxspkicau.exe
      C:\Temp\fzxspkicau.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5636
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6032
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3340
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fzxspkicau.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2312
  - - C:\Temp\i_fzxspkicau.exe
      C:\Temp\i_fzxspkicau.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1144
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\khcausmkec.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4364
  - - C:\Temp\khcausmkec.exe
      C:\Temp\khcausmkec.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4324
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4852
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5548
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_khcausmkec.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2932
  - - C:\Temp\i_khcausmkec.exe
      C:\Temp\i_khcausmkec.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3192
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urmkecwuom.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3504
  - - C:\Temp\urmkecwuom.exe
      C:\Temp\urmkecwuom.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5580
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1016
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urmkecwuom.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2256
  - - C:\Temp\i_urmkecwuom.exe
      C:\Temp\i_urmkecwuom.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1212
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mjebzwromg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4556
  - - C:\Temp\mjebzwromg.exe
      C:\Temp\mjebzwromg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4496
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1264
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mjebzwromg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5152
  - - C:\Temp\i_mjebzwromg.exe
      C:\Temp\i_mjebzwromg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4220
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwuojgbzwr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4100
  - - C:\Temp\zwuojgbzwr.exe
      C:\Temp\zwuojgbzwr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4248
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2740
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:720
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwuojgbzwr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3828
  - - C:\Temp\i_zwuojgbzwr.exe
      C:\Temp\i_zwuojgbzwr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2192
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbvtnlgdyw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2560
  - - C:\Temp\dbvtnlgdyw.exe
      C:\Temp\dbvtnlgdyw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3244
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5788
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3948
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbvtnlgdyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1064
  - - C:\Temp\i_dbvtnlgdyw.exe
      C:\Temp\i_dbvtnlgdyw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3404
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqlidaysqo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2332
  - - C:\Temp\tqlidaysqo.exe
      C:\Temp\tqlidaysqo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4092
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3272
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqlidaysqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1720
  - - C:\Temp\i_tqlidaysqo.exe
      C:\Temp\i_tqlidaysqo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5452
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igaysqkida.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5836
  - - C:\Temp\igaysqkida.exe
      C:\Temp\igaysqkida.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3776
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5184
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4904
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igaysqkida.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5200
  - - C:\Temp\i_igaysqkida.exe
      C:\Temp\i_igaysqkida.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3160
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ifdxvsqnic.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2056
  - - C:\Temp\ifdxvsqnic.exe
      C:\Temp\ifdxvsqnic.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1392
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:960
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ifdxvsqnic.exe ups_ins
    3⤵
    PID:4228
  - - C:\Temp\i_ifdxvsqnic.exe
      C:\Temp\i_ifdxvsqnic.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:772
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uspkhcausm.exe ups_run
    3⤵
    PID:3548
  - - C:\Temp\uspkhcausm.exe
      C:\Temp\uspkhcausm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3240
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2300
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5888
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uspkhcausm.exe ups_ins
    3⤵
    PID:4124
  - - C:\Temp\i_uspkhcausm.exe
      C:\Temp\i_uspkhcausm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3692
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\heczurpmhe.exe ups_run
    3⤵
    PID:2216
  - - C:\Temp\heczurpmhe.exe
      C:\Temp\heczurpmhe.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2032
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4072
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2356
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_heczurpmhe.exe ups_ins
    3⤵
    PID:2244
  - - C:\Temp\i_heczurpmhe.exe
      C:\Temp\i_heczurpmhe.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5268
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpjhezwrpj.exe ups_run
    3⤵
    PID:1984
  - - C:\Temp\rpjhezwrpj.exe
      C:\Temp\rpjhezwrpj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1692
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3528
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1508
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpjhezwrpj.exe ups_ins
    3⤵
    PID:4344
  - - C:\Temp\i_rpjhezwrpj.exe
      C:\Temp\i_rpjhezwrpj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2000
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtrljebwuo.exe ups_run
    3⤵
    PID:1700
  - - C:\Temp\wtrljebwuo.exe
      C:\Temp\wtrljebwuo.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2760
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6044
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5924
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtrljebwuo.exe ups_ins
    3⤵
    PID:5508
  - - C:\Temp\i_wtrljebwuo.exe
      C:\Temp\i_wtrljebwuo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mgeywqoige.exe ups_run
    3⤵
    PID:4604
  - - C:\Temp\mgeywqoige.exe
      C:\Temp\mgeywqoige.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1352
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5920
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5516
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mgeywqoige.exe ups_ins
    3⤵
    PID:5052
  - - C:\Temp\i_mgeywqoige.exe
      C:\Temp\i_mgeywqoige.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:476
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdyvqoigay.exe ups_run
    3⤵
    PID:1088
  - - C:\Temp\fdyvqoigay.exe
      C:\Temp\fdyvqoigay.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4952
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5512
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdyvqoigay.exe ups_ins
    3⤵
    PID:5376
  - - C:\Temp\i_fdyvqoigay.exe
      C:\Temp\i_fdyvqoigay.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gayvqnliga.exe ups_run
    3⤵
    PID:2260
  - - C:\Temp\gayvqnliga.exe
      C:\Temp\gayvqnliga.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4544
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4236
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:480
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gayvqnliga.exe ups_ins
    3⤵
    PID:5048
  - - C:\Temp\i_gayvqnliga.exe
      C:\Temp\i_gayvqnliga.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5452
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dxvqkicays.exe ups_run
    3⤵
    PID:4896
  - - C:\Temp\dxvqkicays.exe
      C:\Temp\dxvqkicays.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5516
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4572
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4356
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dxvqkicays.exe ups_ins
    3⤵
    PID:2456
  - - C:\Temp\i_dxvqkicays.exe
      C:\Temp\i_dxvqkicays.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1516
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff98a3ac188,0x7ff98a3ac194,0x7ff98a3ac1a0
      4⤵
      PID:2768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,14579582354769006583,8637368121606406694,262144 --field-trial-handle=2344,i,15900031627747692362,11357240204276667410,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
      4⤵
      PID:2708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,6980146245372549958,3471724993696019612,524288 --field-trial-handle=2344,i,15900031627747692362,11357240204276667410,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:11
      4⤵
      System Time Discovery
      PID:2692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,13406963600933674117,14223519720144195082,524288 --field-trial-handle=2344,i,15900031627747692362,11357240204276667410,262144 --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:13
      4⤵
      PID:5136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,5452732991288285359,17973043219421689306,2097152 --field-trial-handle=2344,i,15900031627747692362,11357240204276667410,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
      4⤵
      PID:5164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,6811470143370963612,26771430243239136,2097152 --field-trial-handle=2344,i,15900031627747692362,11357240204276667410,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
      4⤵
      PID:4088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,5654550366736917615,13678715762755607490,2097152 --field-trial-handle=2344,i,15900031627747692362,11357240204276667410,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:1
      4⤵
      PID:5076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,5266737760089189985,3595086184879337039,2097152 --field-trial-handle=2344,i,15900031627747692362,11357240204276667410,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:9
      4⤵
      PID:5580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3720,i,1265963497922497605,12393706640842230664,2097152 --field-trial-handle=2344,i,15900031627747692362,11357240204276667410,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
      4⤵
      PID:4308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3564,i,9058346258452031543,3630178001178894632,524288 --field-trial-handle=2344,i,15900031627747692362,11357240204276667410,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:14
      4⤵
      PID:1144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5580,i,13221851115215072709,298935864522107493,2097152 --field-trial-handle=2344,i,15900031627747692362,11357240204276667410,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:1
      4⤵
      PID:2884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3544,i,8241012490779801983,7155980924933544074,524288 --field-trial-handle=2344,i,15900031627747692362,11357240204276667410,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:14
      4⤵
      PID:3576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,4545893759171325981,13259966805515591642,524288 --field-trial-handle=2344,i,15900031627747692362,11357240204276667410,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:14
      4⤵
      PID:1188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,2870382839937219579,793402125666884524,524288 --field-trial-handle=2344,i,15900031627747692362,11357240204276667410,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
      4⤵
      PID:4724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,2870382839937219579,793402125666884524,524288 --field-trial-handle=2344,i,15900031627747692362,11357240204276667410,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
      4⤵
      PID:4112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,14968965503592558308,8282609838670827355,524288 --field-trial-handle=2344,i,15900031627747692362,11357240204276667410,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
      4⤵
      PID:5404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,7794835702979104552,1978914665973957949,524288 --field-trial-handle=2344,i,15900031627747692362,11357240204276667410,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
      4⤵
      PID:4748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,8399677129873141987,9780686267909414307,524288 --field-trial-handle=2344,i,15900031627747692362,11357240204276667410,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:14
      4⤵
      PID:5968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,15595893772468733483,1707403325786430148,524288 --field-trial-handle=2344,i,15900031627747692362,11357240204276667410,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:14
      4⤵
      PID:2192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,7750756835173257389,11391622562866430374,524288 --field-trial-handle=2344,i,15900031627747692362,11357240204276667410,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
      4⤵
      PID:996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4076,i,7977149274729930603,7510635127526894638,524288 --field-trial-handle=2344,i,15900031627747692362,11357240204276667410,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
      4⤵
      PID:2152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,17579311441645201260,4659413296289997012,524288 --field-trial-handle=2344,i,15900031627747692362,11357240204276667410,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:14
      4⤵
      PID:1188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=948,i,11472163004141944063,13094204698322198666,524288 --field-trial-handle=2344,i,15900031627747692362,11357240204276667410,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
      4⤵
      PID:4388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,3049216362251763557,13939462810725634932,524288 --field-trial-handle=2344,i,15900031627747692362,11357240204276667410,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:14
      4⤵
      PID:2148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6560,i,12117458465946091428,16949817844120656479,262144 --field-trial-handle=2344,i,15900031627747692362,11357240204276667410,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:10
      4⤵
      PID:4112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,3921920207133413476,6255289850764114372,524288 --field-trial-handle=2344,i,15900031627747692362,11357240204276667410,262144 --variations-seed-version --mojo-platform-channel-handle=1200 /prefetch:14
      4⤵
      PID:5968

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1332

C:\Temp\oidaytqligayvqoi.sys
C:\Temp\oidaytqligayvqoi.sys
1⤵
- Executes dropped EXE
PID:4496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:364

C:\Temp\nlfdavsnlf.sys
C:\Temp\nlfdavsnlf.sys
1⤵
- Executes dropped EXE
PID:5460

C:\Temp\nfcxvpnhfd.sys
C:\Temp\nfcxvpnhfd.sys
1⤵
- Executes dropped EXE
PID:3404

C:\Temp\khfzxrpnhf.sys
C:\Temp\khfzxrpnhf.sys
1⤵
- Executes dropped EXE
PID:5932

C:\Temp\fwusmjhfcw.sys
C:\Temp\fwusmjhfcw.sys
1⤵
- Executes dropped EXE
PID:1516

C:\Temp\rpjhezwrpj.sys
C:\Temp\rpjhezwrpj.sys
1⤵
- Executes dropped EXE
PID:4072

C:\Temp\wtromgdbzt.sys
C:\Temp\wtromgdbzt.sys
1⤵
- Executes dropped EXE
PID:2420

C:\Temp\ebwtolgeyw.sys
C:\Temp\ebwtolgeyw.sys
1⤵
- Executes dropped EXE
PID:5740

C:\Temp\gdywtnlfdb.sys
C:\Temp\gdywtnlfdb.sys
1⤵
- Executes dropped EXE
PID:3824

C:\Temp\nkidxvtnlf.sys
C:\Temp\nkidxvtnlf.sys
1⤵
- Executes dropped EXE
PID:996

C:\Temp\dauspnifax.sys
C:\Temp\dauspnifax.sys
1⤵
- Executes dropped EXE
PID:4500

C:\Temp\xupnhfcxup.sys
C:\Temp\xupnhfcxup.sys
1⤵
PID:5496

C:\Temp\xupnhfzxsp.sys
C:\Temp\xupnhfzxsp.sys
1⤵
PID:1960

C:\Temp\pmhebzxrom.sys
C:\Temp\pmhebzxrom.sys
1⤵
PID:1828

C:\Temp\wuomgebwuo.sys
C:\Temp\wuomgebwuo.sys
1⤵
PID:4544

C:\Temp\ljdbvtqoig.sys
C:\Temp\ljdbvtqoig.sys
1⤵
PID:5968

C:\Temp\vtnljdbvto.sys
C:\Temp\vtnljdbvto.sys
1⤵
PID:6064

C:\Temp\dbvtqoigay.sys
C:\Temp\dbvtqoigay.sys
1⤵
PID:3184

C:\Temp\cayvqnifax.sys
C:\Temp\cayvqnifax.sys
1⤵
PID:5864

C:\Temp\vsmkicausp.sys
C:\Temp\vsmkicausp.sys
1⤵
PID:3464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fdxvqkigay.exe

Path C:\Temp\fdxvqkigay.exe
Size 722KB
SHA256 3934a7e9c96c63b05957038cf4ac5577f6f525c5e722c0864b3ab62ee7012ca9
MD5 cd794346e3fe41bca79fee34fb17b3d0
SHA1 cbf91bd88e44cb0c187d7b7d1e7256ba9956cc3c
SHA512 765e6be9349b3cee1ab6f4c74e1430c8b38c2f7b1fd2ef42f473e71b5f04424984f5e29655c1a8235e5f09b67b101b35631e710cff2bbb817cc820844a34bed9
SSDEEP 12288:iflfAsiVGjSGecvXAflfAsiVGjSGecvX:OMcfcMcf
TLSH
T1ACF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fwusmjhfcw.sys

Path C:\Temp\fwusmjhfcw.sys
Size 293KB
SHA256 d30bcd2a4b533d6438f27d2c5e49788f87f24185c7f8897598d999cd6fa53abc
MD5 4b5f4c1ee4358813c1472ac057931bb4
SHA1 3fca5503b09b2fe1815260adebe411ad1614acde
SHA512 f3688ca64779de169802af05edade14b7c617d8eeec3a13c28ff2693a7b61251532bfc9f7e6449acc18e27b34748e6ca1013e4ac8801c5e9234542b7f47db15b
SSDEEP 3072:5tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:5IJjiJcbI03GBc3ucY5DCSj
TLSH
T17D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxspkicau.exe

Path C:\Temp\fzxspkicau.exe
Size 722KB
SHA256 e888242f4423e9abfe74bca2ebe9cdad86cb1e0b8c9faa4b5ee504a3d554d977
MD5 14f6380ce32b6f2c70e75121fa02bc87
SHA1 ebc1d82712e4889a536749c32e086d113fbe40cf
SHA512 6a4d6cf25d3cde36560a4ca0604489812c4877a53d2007ed6eb2eee86d50d157e15265310d204c8dea4a434099c28a6151ead231652a6deb761922ce3e06b499
SSDEEP 12288:iflfAsiVGjSGecvXAflfAsiVGjSGecvX:OMcfcMcf
TLSH
T104F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fdxvqkigay.exe

Path C:\Temp\i_fdxvqkigay.exe
Size 722KB
SHA256 1e5cb98bcc45fa7de02ba61994e19a165c68a1c6033ef1df2e62433b86a44b7b
MD5 52fa959ccb64ba9925541a3597a12872
SHA1 af9f9cd7669c99ec655c558b8bfa17fe6a354372
SHA512 58d6cbebb856dc56604a40786fc1873d1a5177918c0204d42e8a728ddaca9e6f81b876df48edf368e32c65811a11a221466741d9f128e274d58efb0fe4a55064
SSDEEP 12288:EflfAsiVGjSGecvXAflfAsiVGjSGecvX:gMcfcMcf
TLSH
T195F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fzxspkicau.exe

Path C:\Temp\i_fzxspkicau.exe
Size 722KB
SHA256 41466de6535ce25ef3490dfb6f66f0232f5bbb0cddaf0315273a85781b3abb96
MD5 fbaa32cb5fdeb17f3f42a60cb28b980d
SHA1 250c56ececea383383fabc79f948f1a77948b91f
SHA512 a11851a25f8a3fbb89be0171d383ff14d8fadf7f5cf0653a6391d37fc2c04ef929eefee1bc50aace5c95cea4e7755c60fca24c2799c385a8bf173ea2167b253d
SSDEEP 12288:mflfAsiVGjSGecvXAflfAsiVGjSGecvX:yMcfcMcf
TLSH
T13AF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_khcausmkec.exe

Path C:\Temp\i_khcausmkec.exe
Size 722KB
SHA256 d9bb74335bb3dec04e29e44f57c8d920cd73de7c2384912be3a3b34d0b064cdc
MD5 7f6763c4f72b60fa19e4f46d2f10db10
SHA1 aaa041611602cd65e6ffa0e14f9e60265eace059
SHA512 4c65bc59d8d9758e2109e37d05ea5ba850366f17d69693e716306f7386e9fb469f1e9697d1bb1208d40d5bfde9222ad08d415f60450cf1a11dbf1eac14b569c9
SSDEEP 12288:8flfAsiVGjSGecvXAflfAsiVGjSGecvX:oMcfcMcf
TLSH
T1A2F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tnlidbvtnl.exe

Path C:\Temp\i_tnlidbvtnl.exe
Size 722KB
SHA256 2d3926cc377f3b1c45897f0fa8c80f4e3188910a39f54f4b302140b508fd5bc8
MD5 222873dd7d053add3f1fe00158856114
SHA1 fc27ef72a8e8438e5f4a0095953b998f55d6d5bb
SHA512 50a6ba22d9075c185671df643948417b185640f0de216822fa3283f32b62937fd581574696f19b9eede4e98a5ae2b70bebb09e80ab13c22e2b8583790a259891
SSDEEP 12288:pflfAsiVGjSGecvXAflfAsiVGjSGecvX:hMcfcMcf
TLSH
T119F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_urmkecwuom.exe

Path C:\Temp\i_urmkecwuom.exe
Size 722KB
SHA256 9417a0b3229a24ce6ac57385aad6a9fff0d1fe2c6629e4d16f84badc4d58f2e5
MD5 6537f7eb381248e0f2402614d8d70be9
SHA1 ba7bcee980594be5d4ff07681c8cdae6dc188a51
SHA512 bb3b1b7619822e2159bdb97618c0eac6c15e744317495795c1c61108a1425d47ab632b3e599dbe07fc480e292bf37775f7374b250b5fdbaafa6fa9b80ad85916
SSDEEP 12288:pflfAsiVGjSGecvXAflfAsiVGjSGecvX:hMcfcMcf
TLSH
T137F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khcausmkec.exe

Path C:\Temp\khcausmkec.exe
Size 722KB
SHA256 55bc21938958faaa4dbf6fdca883aa3673082330aa0e48e7a2b3dd396265c457
MD5 4354c5128889ebe6a1c35bb59f0a1eb9
SHA1 5b595011b2cc7beb6a6fa4e83cc12a372e86fe30
SHA512 c7a00598e7fed701762f67878791033d937bb0d78af5848aeb3e47d787042c184f5ffbfff165c4482e39db819dddfd1280a539a95effba6555b9e29457d80ac6
SSDEEP 12288:DflfAsiVGjSGecvXAflfAsiVGjSGecvX:LMcfcMcf
TLSH
T1ACF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khfzxrpnhf.sys

Path C:\Temp\khfzxrpnhf.sys
Size 293KB
SHA256 9c7e8cf357ce486c502be2a5ea55c8078ea949428979b362763da6629459cea0
MD5 05c384bec770b193436d99ba8e3fe307
SHA1 9a24b616e8afebbd6969878b8a1768a007c509a2
SHA512 68ff40460bab6e32771f5baaab31cd0ec8e59e3c1677fb766fe025078e66f3a6a14223181422851e1436396e263d8f732684418d5d8cd82a0b0ae7101b341ec6
SSDEEP 3072:AtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:AIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C3545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjebzwromg.exe

Path C:\Temp\mjebzwromg.exe
Size 722KB
SHA256 3b8b0b40a72ab15a98fdf1c9e5487b7c6ac8324a13e958fb9951b60c0fb942e7
MD5 9d5c8e95e98cc4b4bc4037d6a761f336
SHA1 ef5c48bfe4c025cdde33ea3d42d19621a16c33ec
SHA512 9459cac795fad0832ec9860a9696d7be0c34fde82ba0994448c40966650f9797e75d5b998c15383e55eff788da12c9483bcc5117cac9bcaf84e99a3dfdb72e83
SSDEEP 12288:HflfAsiVGjSGecvXAflfAsiVGjSGecvX:/McfcMcf
TLSH
T151F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nfcxvpnhfd.sys

Path C:\Temp\nfcxvpnhfd.sys
Size 293KB
SHA256 65bcca0b34ee842344c4e8cbdb3fc754dee264efc1aa6b42f1b69acdc35c56f7
MD5 0603cb43b20e134f2052c6416278b00a
SHA1 636eb5dec8a3ba85133c3f25d4cc3d0b7f461e7d
SHA512 9f3498eb3e826dbac95197542a40e326f9db5c67b4ce290365c039adaf88e00c0e2603d5c12e5ba399be5260a17ffe6825c43e9eec04348bd86689d4d7fbfb6c
SSDEEP 3072:utKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:uIJjiJcbI03GBc3ucY5DCSj
TLSH
T105545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlfdavsnlf.sys

Path C:\Temp\nlfdavsnlf.sys
Size 293KB
SHA256 569e38e0711280fb14546b381e1828acaf21fe4723657618a6a9ed428d023c83
MD5 395d48b87300a14df44c9bc0a016d38d
SHA1 672287085372a45ce2dda418b1e1b95e8ee53eaf
SHA512 c077c66d5c52eed2d1a70801e6085faeb853e4d58153e5bd910cc5657c7bdedb0bda9a04fcc63c9e98146ea4981070dc9d49d6d69199f6003724d41c0ca9e13a
SSDEEP 3072:WtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:WIJjiJcbI03GBc3ucY5DCSj
TLSH
T1B5545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oidaytqligayvqoi.exe

Path C:\Temp\oidaytqligayvqoi.exe
Size 722KB
SHA256 87a0fe22ed6cb7de0b4937264d9f5150d24baf3ed44c3c362012d0fe5e2a238b
MD5 a8db4f8ad53cda3accad917501c11ed3
SHA1 2b231cf6d83f61a8010e13ad41e533ef0cd40ed1
SHA512 0c85eef035cf3fe2d8281fa04653d4552d8a5913a8cbd9fc91fa9e4923ec9a63ec00038e648917ad8c98c6c82401e8ddd08054862cefdbd6d7259438ed01363e
SSDEEP 12288:IflfAsiVGjSGecvXAflfAsiVGjSGecvX:UMcfcMcf
TLSH
T15AF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oidaytqligayvqoi.sys

Path C:\Temp\oidaytqligayvqoi.sys
Size 293KB
SHA256 1276174856be610d4289c9f54ae05f36869da53eddf043ca3a7cac0647e8d575
MD5 482e2f53084cb1a9aa030a10ca0ca081
SHA1 e42906a4fc643087b23c237f702745b58193d7b4
SHA512 10bf5a3f47ab7175b8de8c8a402dc6af7a06b77f534985a962f5879e63a0d429e6831b2bb8ebf80c229a4b1a2d566838841af5a372a77cb1dd4e1602fa58230b
SSDEEP 3072:EtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:EIJjiJcbI03GBc3ucY5DCSj
TLSH
T165545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpjhezwrpj.sys

Path C:\Temp\rpjhezwrpj.sys
Size 293KB
SHA256 511a3866fb6885d3b1aab5abb08012ad30c4a149e9ae08ffcb9c6c355a95e620
MD5 4797859de72220b1e9d6129eb936fddc
SHA1 c5359b79973ac844f9f75bf15a34ded54b611487
SHA512 8cbc97b0d9245cd4e8004159199585de32d723d87224077e0ebbaaaa059a866e95cf1c74adfa3da9dd2f7a699db68c2c5b515220ece138a3568130427b8be161
SSDEEP 3072:rtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:rIJjiJcbI03GBc3ucY5DCSj
TLSH
T15B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlidbvtnl.exe

Path C:\Temp\tnlidbvtnl.exe
Size 722KB
SHA256 9965d457dfe4618db85118e4f409c9cec156ca14f1f9ced364344b9c6cfc76f3
MD5 e7567aa0e761f5c128ae7fb07c729d12
SHA1 acecc4722d7aac0911492714a025b4006272ff29
SHA512 7964c4b19933547cf3583629747df10d4f612fae3eb93c36856e82718255093fc67862fd4d457af79087a86319fc6bcac879263c4200fcba44581f12edc42377
SSDEEP 12288:bflfAsiVGjSGecvXAflfAsiVGjSGecvX:zMcfcMcf
TLSH
T1BCF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urmkecwuom.exe

Path C:\Temp\urmkecwuom.exe
Size 722KB
SHA256 d97abdb19d79e123ed05dfc28f92f47df437c9f3cf9ed21a74c6761e104128b8
MD5 d88d284da565b04e006b0ab1e7564cf6
SHA1 684339b89528548d6664c95bfc405c216a2f1867
SHA512 1d13df9d5a9604b78e2662d1dcd26959cdd274eb459f516891d347fd63d7595ec93f0efaf75c4d9f73a67721718f0f166da38a5587cdf21c50ae9588999cce2b
SSDEEP 12288:WflfAsiVGjSGecvXAflfAsiVGjSGecvX:CMcfcMcf
TLSH
T1CAF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8f092732-82a8-441e-b237-c5ca73c24243.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8f092732-82a8-441e-b237-c5ca73c24243.tmp
Size 43KB
SHA256 b5d78a63d5285af1a081e164d508846299876130f8233e5499abb736946c3ab0
MD5 7ea8b4f904754c951dc646325d2dbba8
SHA1 2189a00228c3c7d5c54c76cf57bf13b851a33da0
SHA512 1c6b92d4a56f8f584e3f5cec62353deb61b20b375c2951930855f8d56b696b687f451f147c0ab69896fe83afbfc65e37a6f9ebc84397f1789f990131f805f5c9
SSDEEP 768:3FZ3Izhm3Zwgy7uqGwiD4K48dHeByERRFzjK3Y0iC1pSbo:/3IA3qrGwa48dHSyw/iixo
TLSH
T1561339F198D39A76D8AE9387673E6E46AEBCC153B4885950F7C85D0DCC820BFC30A805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e75f270f1371188bd7f350113eee1f4d141652add7af8e5f7af0ab47dac6d1f2
MD5 e0e7da4c84e8882b494037c575bd294c
SHA1 04d43c383ac5d232ee362aad151519414dc6db2b
SHA512 70d9ca23de3befb782d3d04a586490c626e7c63ad00fac39b0fd9adeae2c1d8413a5d2474e847fabb4f48bbf1384f1fcd10e67765d21ed94ac67795b274b3c2e
TLSH
T122D09294BB60A90CCC81B0322AE66355BA1598A1182D868900A5F07A9CA8AC246179AF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e35119268ad2455b6ec4314361db946ee09b095b28e62d25bbd7542d6be959b9
MD5 5c633da04aeb5bea485c08ea28f57d24
SHA1 1c5287022e764ef0bb6d895cd993be007ab68eba
SHA512 341697613439896bbdc5bae2e067bf2b52fd4ee959460166157f5fcf5f0647d000c9824a7394abad2ea244ee761164649972236a37dd919e413ac011474bb4b7
TLSH
T12DD09B947B50A50CCC41703229E5535579155461581D45450055F0799C646C246175BF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 37f51460ca247d704879f87538a5a6d30e0c7d19d50c8acdceee0dcd189d1b63
MD5 6db5202f0158ff9eb42bcd990184a6fb
SHA1 df4f3f6e9951f18f15fb24d2455118ae294893d0
SHA512 772bcf7981e1a70eeefd9763f0db7de6014601b86309a0da21068bfbfc5cffeb8bee6b6f5711e76654746e1354e7f1fb57105e6e84734292ae882c1bd6b1c765
TLSH
T1FC6175760BB2869AD766877918EB9FB431F4F846454BAE0184645D3C8B07F2A5CE101B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f052.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59f052.TMP
Size 3KB
SHA256 752d303cd2645d8a881c585de1d0cbe6fa5baa64b4aad5fe34476cb03dbd3812
MD5 be70f2dd18e47f039ebb36500ee28510
SHA1 504bf921765b4baea58c911cac9e8d647584b5d4
SHA512 485197e5dc50f3ce872c338404442773cd9b55d7c098a36e7be19dc63d2855f7bf379f7891042ade43bcfaab09e334bb15bd1d58ed0f1331d324be1ac6e1e3c6
TLSH
T1486185764BB2869AD7A6877A18EB9FB431F4F8464447AE0184645D3CCB07F2A5CE101B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2bed9429be298ef8c60b66473d3f83a35775075e6aaadbe3c2143c8e3370dc4e
MD5 2f38771b471fc258e5ed6c5c1e3440fc
SHA1 049f154203ace3c2f2c4e256782a2e76df774e89
SHA512 d17756dbc4f57d91af18fdeb5bfb746e63c988bd0ae32c552135a4e94dd9846a92084bdb6bbfc69e4cb22d9ac5dec81190886b5cdaf57e386ee1cbbbb2dca980
TLSH
T17F41AFF783F4856E8A0196F0AB146E2FCE2D0525432C7D5689E4AE2BA3E3471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 12e495d3ed90ed84a14b6ffb3e6d784d7e41ad6d0b234441d425519a38f72a41
MD5 48c14e5251375b62968839de05f6bebd
SHA1 60e0ffd1cdd0fba06fbf4c5ea4ca4f36fff180c9
SHA512 428f52afb952ec2310930d12570db14f9ff28c8221081960d6578f7d237c9c2a42b6ef463a9ebcb19507259843420401dbad5c0eab072cedf7ba4371f6292040
SSDEEP 192:sxR+RZyM/jK1Ml8wCK/fBsn6dfZPxZi6VzoA8p9D/g6+WNCZl/YEa9iKXGmIgV7J:sxR+j8K/fBs6dBpc64V/5u/zEP
TLSH
T10262F815AA349E77CCDBD208FA557F53D6F85573A6901E44AAFC8A0C00E6AED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 57a9eb49ea14c17ff89d5a97a24bde46580c22af2545d9178c17fdd7e166221f
MD5 b74b9c9a6f7bff10af32ab15557af073
SHA1 787590b1773b8fb93183c9681866b565daac738d
SHA512 d5a64158b3afb37ebe2902a5e50e6202397bdddf6463433b62a78ce718fc83fedd0f19b874909e725ab25943cc868d1c7b340046d489d8d252faabdf821f2180
SSDEEP 192:sxRhRZyM/jK1Ml8wCK/fBs46dfZPxZi6VzoA8p9D/g6+WNCZl/YEa9iKXGmIgD1N:sxRhj8K/fBs9dBpc64V/5u/zET
TLSH
T1FF62F915AA349E77CCDBD208FA557F53D7F8557296901E44AAFC8A0C00E6AED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 5c5f73b0674d940688bfcc6f6217db8392ddc1ad410faee857cfd862ecf1ebde
MD5 b57cdac7a46686b4c544ad80eaf67c41
SHA1 ad7bc2110e71c2989bb3b435e84cc712aa9a11a4
SHA512 70fa65d4225c28bcb9ac8e826ae0c7339de6d0f306bcb066cd4e0bd551949fddb5a05ff30bdbf570cf80058d0ccc4d8859a9226ee2efa6e67ea42ee7665de0b8
SSDEEP 192:sxRhRZyM/jK1Ml8UQVCK/fBs46KfZPxZi6VzoA8prD/g6+WNCZl/YEfNiKXGmIgJ:sxRhjqEK/fBs9KBpc64f/5u/cEJ
TLSH
T18B62E815A9359E77DCDBD208FA55BF63E3F8557295900E44AAFC8A0C00E6ADD2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 49a78b9c675b4f537bb7f1f3cabe123f0494f3653381b368a1f3964d545a9d3b
MD5 965d09b583f581e4d91e0d0f9d81199f
SHA1 20f2d343504e558562a269d76fd79b1580fc08e4
SHA512 94a3b7d70345b2aaa67337c437619bf32e2dcbbed3dcd846e75f82ccabbeca182946393279adb079c2cd02e3adaf6f4b206eb4c4ddc834938cde2ff4537aab7d
SSDEEP 768:0hiiPW7pLuL7jaWgH7f3Q8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaheOV8NroO65:0hiiP2E7jaWgH7f3Qu1jaxheI8mh
TLSH
T13EE2EB3B680CCB7F4F404EDCEC29BD9A6DE801CB5A988D9447EA884C03C67EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a902b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a902b.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1c5b1554071794a06c90abab4b797b1993aeb16a232e25757f9e25591d32a836
MD5 c5a623bfdcf3b47fa094290ffd44ec63
SHA1 860a1a4f992193ba83db35e2ab7d0f347c75adae
SHA512 b5e8aa34b60f0968881264e6f056731e66b6837fef5f5819ace3237e0983700faec3133a4db1c79c0ae94c6ee973bb652341287a004ff1db9894264176fddbfd
SSDEEP 768:Qrv+4UNbdf3fqG0/DxK48dHeByERRFzjK3Y8eVH1SCj:QbsbJ3SGg448dHSyw/qEH1Z
TLSH
T19503BE31A8A85E774CE792897683B657BFF4421386C41BA4C4DD6F4E868B4DC130BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2fe63e1b5e8ad9ba4bb91a100850017e6cd0c4055e270049eac4868c915e8a10
MD5 6a380b2c3ea02e5944448dbd54591a05
SHA1 5fe0babc59965aef51095b5a5ca8af1c9d180d86
SHA512 dd0ef48d2d71fbf26ffdbad70c3ec591b7ca0edaeed5ed28384fec0bf46d9a5088fbf18429b828f0e6ef471dabd655514232a9b5ccf10bbf02d817686c8c20c2
SSDEEP 768:w3IzhK3A7uqGNrDKK48dHeByERRFzjK3Y0iC1pSbo:w3IM3ArGlD48dHSyw/iixo
TLSH
T1C5F2BFB069669E778CABE249B6137797FFE00167C8D52E24C5CD6E0E41C21DD170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 56a997ee063ce8a6df63105e9bbbb96f091aa076e9655f83c025755f6e889c91
MD5 bfc39c4c736e0448aea93d09b27322c0
SHA1 9895c76eee1de59f493a6c685122afa3c1a0c6af
SHA512 91ce4bdce6e0b956adfb615eb4abd7acbf96146ec12142c9066ea526139a43bd811691427bf11cbf97185232d56ddbfb1b666b7cdb835868df7aa12859e21f15
SSDEEP 768:23IzhK3D7uqGNrDKK48dHeByERRFzjK3Y0iC1pSbo:23IM3DrGlD48dHSyw/iixo
TLSH
T1ABF2BFB06966AE778CABE249B6137797FFE00167C8D52E24C5CD6E0E41C21DD170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 8cfc648123decc45c50612766765f44edd0be66c7bc536a95782c6a703dbe610
MD5 3d83146ae43ded6a80903eda56d8bc5d
SHA1 a0e573c89495a790c79b88d5aef60ca8d6d0dbfe
SHA512 10fe395c8d67d6d619958bbd6339e2f43ad92080600994363349ac434a34326d49150fda30355353c5d5b56448331a4e92c1b8b8246c08665b2eb904de7459e2
SSDEEP 768:Urv+4UNbdf3fqGNZDRK48dHeByERRFzjK3J0ieVH1SCj:UbsbJ3SGLY48dHSyw/biEH1Z
TLSH
T18703BE70A4A99E734CEBD249B283B797BFF4016385C44B64D4C9AF4E85860DD170FD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 24abf6d15856d1771e9c136de2bda3127d7dc17eebb35279a30ed1a3720ea17f
MD5 e635b1991eda79f0b615587564eaa96b
SHA1 42f99d36f528ff7ef52064a103c6cac4b9ec6de3
SHA512 7cbf3894f81a7fe592db64d22fb4df47bdcf164c8b1beeeb17cc152f4ab9980472482018c5a5f389ca5c1d23aad2a90f360be064ab3f43bb1c466350abe6a7b5
SSDEEP 768:Vrv+4UNbdi3C7uqGirDMK48dHeByERRFzjK3Y0iVch:Vbsbg3CrGmZ48dHSyw/iiM
TLSH
T13F03BE70A569AE734CFBD289B2437B97BFF0016384C45B64D9C9AA8E41870DD170BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

c165800b-a4c0-4f66-8a48-01ab97dde2c2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c165800b-a4c0-4f66-8a48-01ab97dde2c2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2136_1099906683\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 ade46156ca8110e42e90f24982f1550bb871fcc3efbf3820da91ada3c0747729
MD5 9a8fd5f9f72d602fa5472545a1a41f83
SHA1 9eac4faef1017524afe9f3636144f73f1ff0a6d4
SHA512 4adf30812b36a7163407abba5c2c1a4a83dca3b7fa4553726c8925dba937cfbfc8d26c361b4b6e16aa5b0e6a6e2894dd09ed2c8f8519949bb49c807f032eb5ca
TLSH
T13571274356A8C5B2C1DE5FF002835644F1FB123C0763302007915587E770A3654B8F14
MD5 SHA1 SHA512 TLSH

Submit Download

memory/996-351-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/996-365-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1516-274-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1516-304-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1828-409-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1960-405-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2420-311-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3184-494-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3184-466-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3404-234-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3464-497-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3824-331-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4072-303-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4072-313-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4496-65-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4496-219-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4500-364-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4544-429-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5460-186-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5496-385-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5740-316-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5864-479-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5932-262-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5968-440-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6064-445-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6064-476-0x0000000000010000-0x00000000000AB000-memory.dmp

Download