9e09e7d42fd10c2c4142970f70d532c12805d27a51783c301e733e1faad5c934

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 722KB
Sample260820-pp6pcsxbla
SHA256 9e09e7d42fd10c2c4142970f70d532c12805d27a51783c301e733e1faad5c934
MD5 6f7ed1c21cb6ce0f925bdbf81ac4a7dd
SHA1 6062f8b2f4c3d4f0c7c5dfaf4e0500b02aae0484
SHA512 888807c8617f07317dc41f20835c9d2b789a8d878a9872b025605b7734a48419bd4162d905477e65d61b280b7e5fefe890323eda172e566e407669c34c0c72be
SSDEEP 12288:SflfAsiVGjSGecvXAflfAsiVGjSGecvX:eMcfcMcf
TLSH
T129F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4896	fcxusnkfcxusmkif.exe
2660	fcxusnkfcxusmkif.sys
1564	CreateProcess.exe
1284	pkhcaxspnh.exe
3488	CreateProcess.exe
3152	CreateProcess.exe
2924	i_pkhcaxspnh.exe
5480	jhczurmkhc.sys
2296	CreateProcess.exe
5012	wusmkecxur.exe
2016	CreateProcess.exe
5124	CreateProcess.exe
3536	i_wusmkecxur.exe
4348	ewurpjhfzx.sys
1216	CreateProcess.exe
4804	rmjecwuomg.exe
2928	CreateProcess.exe
2904	CreateProcess.exe
6100	i_rmjecwuomg.exe
4120	umjebwuomg.sys
5016	CreateProcess.exe
3276	wrpjgbztrm.exe
5232	CreateProcess.exe
4908	CreateProcess.exe
2832	i_wrpjgbztrm.exe
4212	ojgbztrljd.sys
4784	CreateProcess.exe
5424	igebwtrljd.exe
1560	CreateProcess.exe
2964	CreateProcess.exe
1060	i_igebwtrljd.exe
3320	qoigaytqlj.sys
4500	CreateProcess.exe
5916	olgdbvtnlg.exe
1980	CreateProcess.exe
5752	CreateProcess.exe
2948	i_olgdbvtnlg.exe
3176	jdavsqlavt.sys
3828	CreateProcess.exe
4216	avsqnlfdxv.exe
5420	CreateProcess.exe
4204	CreateProcess.exe
3612	i_avsqnlfdxv.exe
4828	faxsqkifax.sys
5940	CreateProcess.exe
4148	faysnkican.exe
2932	CreateProcess.exe
4212	CreateProcess.exe
2084	i_faysnkican.exe
4724	ausmkicaxv.sys
1576	CreateProcess.exe
4172	usmkicaxvp.exe
4600	CreateProcess.exe
5412	CreateProcess.exe
6052	i_usmkicaxvp.exe
4772	khfcxupmke.sys
6136	CreateProcess.exe
1020	khczxrmkec.exe
4700	CreateProcess.exe
2456	CreateProcess.exe
4620	i_khczxrmkec.exe
2756	keczxrpmhe.sys
6084	CreateProcess.exe
5552	zxrpmgeczx.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4088_233754359\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4088_1602835715\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4088_1602835715\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4088_55095447\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4088_418858201\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4088_418858201\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4088_55095447\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4088_55095447\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4088_55095447\office_endpoints_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgdbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avsqnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkicaxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpmgeczx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	romgebwtrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkhcaxspnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjecwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faysnkican.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpmgeczx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_romgebwtrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdyvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkifaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfaxspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faysnkican.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khczxrmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdyvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkifaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urpjhbzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urpjhbzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtolgdywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hcauspkhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgdbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khczxrmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfaxspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrpjgbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igebwtrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avsqnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwuomhezwj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtolgdywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wusmkecxur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrpjgbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwuomhezwj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkhcaxspnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjecwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkicaxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hcauspkhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcxusnkfcxusmkif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wusmkecxur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igebwtrljd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5556	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5964	ipconfig.exe
3612	ipconfig.exe
6044	ipconfig.exe
4160	ipconfig.exe
4432	ipconfig.exe
5484	ipconfig.exe
4944	ipconfig.exe
1476	ipconfig.exe
4840	ipconfig.exe
776	ipconfig.exe
3448	ipconfig.exe
3612	ipconfig.exe
4404	ipconfig.exe
4876	ipconfig.exe
1076	ipconfig.exe
1440	ipconfig.exe
4268	ipconfig.exe
3156	ipconfig.exe
5600	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317026880345173"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{E5297000-C684-4547-A001-EAEFF199220E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4896	fcxusnkfcxusmkif.exe
4896	fcxusnkfcxusmkif.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4896	fcxusnkfcxusmkif.exe
4896	fcxusnkfcxusmkif.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4896	fcxusnkfcxusmkif.exe
4896	fcxusnkfcxusmkif.exe
4896	fcxusnkfcxusmkif.exe
4896	fcxusnkfcxusmkif.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
836	Process not Found
836	Process not Found
836	Process not Found
836	Process not Found
836	Process not Found
836	Process not Found
836	Process not Found
836	Process not Found
836	Process not Found
836	Process not Found
836	Process not Found
836	Process not Found
836	Process not Found
836	Process not Found
836	Process not Found
836	Process not Found
836	Process not Found
836	Process not Found
836	Process not Found
836	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2924	i_pkhcaxspnh.exe
Token: SeDebugPrivilege	3536	i_wusmkecxur.exe
Token: SeDebugPrivilege	6100	i_rmjecwuomg.exe
Token: SeDebugPrivilege	2832	i_wrpjgbztrm.exe
Token: SeDebugPrivilege	1060	i_igebwtrljd.exe
Token: SeDebugPrivilege	2948	i_olgdbvtnlg.exe
Token: SeDebugPrivilege	3612	i_avsqnlfdxv.exe
Token: SeDebugPrivilege	2084	i_faysnkican.exe
Token: SeDebugPrivilege	6052	i_usmkicaxvp.exe
Token: SeDebugPrivilege	4620	i_khczxrmkec.exe
Token: SeDebugPrivilege	4604	i_zxrpmgeczx.exe
Token: SeDebugPrivilege	5796	i_cwuomhezwj.exe
Token: SeDebugPrivilege	6064	i_romgebwtrl.exe
Token: SeDebugPrivilege	4240	i_vtolgdywqo.exe
Token: SeDebugPrivilege	4904	i_lfdyvqoiga.exe
Token: SeDebugPrivilege	960	i_sqkifaysqk.exe
Token: SeDebugPrivilege	5800	i_pnhfaxspki.exe
Token: SeDebugPrivilege	3412	i_hcauspkhcz.exe
Token: SeDebugPrivilege	1744	i_urpjhbzurm.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4088	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 4896	1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 1812 wrote to memory of 5092	1812	2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 5092 wrote to memory of 4088	5092	iexplore.exe	91
PID 4088 wrote to memory of 3248	4088	msedge.exe	92
PID 4088 wrote to memory of 2512	4088	msedge.exe	94
PID 4088 wrote to memory of 5556	4088	msedge.exe	93
PID 4088 wrote to memory of 2512	4088	msedge.exe	94
PID 4088 wrote to memory of 2512	4088	msedge.exe	94
PID 4088 wrote to memory of 6112	4088	msedge.exe	95
PID 4088 wrote to memory of 6112	4088	msedge.exe	95
PID 4088 wrote to memory of 3544	4088	msedge.exe	96
PID 4088 wrote to memory of 3544	4088	msedge.exe	96
PID 4088 wrote to memory of 3544	4088	msedge.exe	96
PID 4088 wrote to memory of 1384	4088	msedge.exe	97
PID 4088 wrote to memory of 1384	4088	msedge.exe	97
PID 4088 wrote to memory of 1384	4088	msedge.exe	97
PID 4088 wrote to memory of 5888	4088	msedge.exe	100
PID 4088 wrote to memory of 4424	4088	msedge.exe	99
PID 4088 wrote to memory of 5888	4088	msedge.exe	100
PID 4088 wrote to memory of 5888	4088	msedge.exe	100
PID 4088 wrote to memory of 4424	4088	msedge.exe	99
PID 4088 wrote to memory of 4424	4088	msedge.exe	99
PID 4088 wrote to memory of 5032	4088	msedge.exe	101
PID 4088 wrote to memory of 5032	4088	msedge.exe	101
PID 4896 wrote to memory of 1564	4896	fcxusnkfcxusmkif.exe	105
PID 4088 wrote to memory of 864	4088	msedge.exe	108
PID 4088 wrote to memory of 864	4088	msedge.exe	108
PID 4088 wrote to memory of 6104	4088	msedge.exe	109
PID 4088 wrote to memory of 6104	4088	msedge.exe	109
PID 1284 wrote to memory of 3488	1284	pkhcaxspnh.exe	110
PID 4088 wrote to memory of 5460	4088	msedge.exe	114
PID 4088 wrote to memory of 5796	4088	msedge.exe	115
PID 4088 wrote to memory of 5796	4088	msedge.exe	115
PID 4088 wrote to memory of 5232	4088	msedge.exe	116
PID 4088 wrote to memory of 5232	4088	msedge.exe	116
PID 4896 wrote to memory of 3152	4896	fcxusnkfcxusmkif.exe	119
PID 4896 wrote to memory of 2296	4896	fcxusnkfcxusmkif.exe	123
PID 5012 wrote to memory of 2016	5012	wusmkecxur.exe	125
PID 4896 wrote to memory of 5124	4896	fcxusnkfcxusmkif.exe	128
PID 4896 wrote to memory of 1216	4896	fcxusnkfcxusmkif.exe	132
PID 4804 wrote to memory of 2928	4804	rmjecwuomg.exe	134
PID 4896 wrote to memory of 2904	4896	fcxusnkfcxusmkif.exe	137
PID 4896 wrote to memory of 5016	4896	fcxusnkfcxusmkif.exe	142
PID 3276 wrote to memory of 5232	3276	wrpjgbztrm.exe	144
PID 4896 wrote to memory of 4908	4896	fcxusnkfcxusmkif.exe	147
PID 4088 wrote to memory of 5080	4088	msedge.exe	149
PID 4088 wrote to memory of 3468	4088	msedge.exe	150
PID 4088 wrote to memory of 4376	4088	msedge.exe	151
PID 4896 wrote to memory of 4784	4896	fcxusnkfcxusmkif.exe	154
PID 5424 wrote to memory of 1560	5424	igebwtrljd.exe	156
PID 4896 wrote to memory of 2964	4896	fcxusnkfcxusmkif.exe	159
PID 4896 wrote to memory of 4500	4896	fcxusnkfcxusmkif.exe	163
PID 5916 wrote to memory of 1980	5916	olgdbvtnlg.exe	165
PID 4896 wrote to memory of 5752	4896	fcxusnkfcxusmkif.exe	168
PID 4896 wrote to memory of 3828	4896	fcxusnkfcxusmkif.exe	172
PID 4216 wrote to memory of 5420	4216	avsqnlfdxv.exe	174
PID 4896 wrote to memory of 4204	4896	fcxusnkfcxusmkif.exe	177
PID 4896 wrote to memory of 5940	4896	fcxusnkfcxusmkif.exe	181
PID 4148 wrote to memory of 2932	4148	faysnkican.exe	183
PID 4896 wrote to memory of 4212	4896	fcxusnkfcxusmkif.exe	186
PID 4088 wrote to memory of 2036	4088	msedge.exe	188
PID 4088 wrote to memory of 2036	4088	msedge.exe	188
PID 4896 wrote to memory of 1576	4896	fcxusnkfcxusmkif.exe	194
PID 4172 wrote to memory of 4600	4172	usmkicaxvp.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_6f7ed1c21cb6ce0f925bdbf81ac4a7dd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Temp\fcxusnkfcxusmkif.exe
  C:\Temp\fcxusnkfcxusmkif.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pkhcaxspnh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1564
  - - C:\Temp\pkhcaxspnh.exe
      C:\Temp\pkhcaxspnh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1284
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3488
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1076
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pkhcaxspnh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3152
  - - C:\Temp\i_pkhcaxspnh.exe
      C:\Temp\i_pkhcaxspnh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2924
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wusmkecxur.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2296
  - - C:\Temp\wusmkecxur.exe
      C:\Temp\wusmkecxur.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5012
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2016
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5600
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wusmkecxur.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5124
  - - C:\Temp\i_wusmkecxur.exe
      C:\Temp\i_wusmkecxur.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3536
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rmjecwuomg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1216
  - - C:\Temp\rmjecwuomg.exe
      C:\Temp\rmjecwuomg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4804
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2928
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5964
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rmjecwuomg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2904
  - - C:\Temp\i_rmjecwuomg.exe
      C:\Temp\i_rmjecwuomg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6100
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wrpjgbztrm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5016
  - - C:\Temp\wrpjgbztrm.exe
      C:\Temp\wrpjgbztrm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3276
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5232
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3612
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wrpjgbztrm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4908
  - - C:\Temp\i_wrpjgbztrm.exe
      C:\Temp\i_wrpjgbztrm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2832
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igebwtrljd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4784
  - - C:\Temp\igebwtrljd.exe
      C:\Temp\igebwtrljd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5424
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1560
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5484
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igebwtrljd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2964
  - - C:\Temp\i_igebwtrljd.exe
      C:\Temp\i_igebwtrljd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\olgdbvtnlg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4500
  - - C:\Temp\olgdbvtnlg.exe
      C:\Temp\olgdbvtnlg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5916
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1980
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:776
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_olgdbvtnlg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5752
  - - C:\Temp\i_olgdbvtnlg.exe
      C:\Temp\i_olgdbvtnlg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2948
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\avsqnlfdxv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3828
  - - C:\Temp\avsqnlfdxv.exe
      C:\Temp\avsqnlfdxv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4216
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5420
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_avsqnlfdxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4204
  - - C:\Temp\i_avsqnlfdxv.exe
      C:\Temp\i_avsqnlfdxv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3612
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\faysnkican.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5940
  - - C:\Temp\faysnkican.exe
      C:\Temp\faysnkican.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4148
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2932
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1440
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_faysnkican.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4212
  - - C:\Temp\i_faysnkican.exe
      C:\Temp\i_faysnkican.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2084
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usmkicaxvp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1576
  - - C:\Temp\usmkicaxvp.exe
      C:\Temp\usmkicaxvp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4172
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4600
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6044
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usmkicaxvp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5412
  - - C:\Temp\i_usmkicaxvp.exe
      C:\Temp\i_usmkicaxvp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6052
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\khczxrmkec.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6136
  - - C:\Temp\khczxrmkec.exe
      C:\Temp\khczxrmkec.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1020
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4700
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3612
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_khczxrmkec.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2456
  - - C:\Temp\i_khczxrmkec.exe
      C:\Temp\i_khczxrmkec.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4620
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxrpmgeczx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6084
  - - C:\Temp\zxrpmgeczx.exe
      C:\Temp\zxrpmgeczx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5552
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2320
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxrpmgeczx.exe ups_ins
    3⤵
    PID:2300
  - - C:\Temp\i_zxrpmgeczx.exe
      C:\Temp\i_zxrpmgeczx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4604
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cwuomhezwj.exe ups_run
    3⤵
    PID:3852
  - - C:\Temp\cwuomhezwj.exe
      C:\Temp\cwuomhezwj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1316
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1312
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4404
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cwuomhezwj.exe ups_ins
    3⤵
    PID:4772
  - - C:\Temp\i_cwuomhezwj.exe
      C:\Temp\i_cwuomhezwj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\romgebwtrl.exe ups_run
    3⤵
    PID:3396
  - - C:\Temp\romgebwtrl.exe
      C:\Temp\romgebwtrl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5028
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4832
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4268
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_romgebwtrl.exe ups_ins
    3⤵
    PID:5080
  - - C:\Temp\i_romgebwtrl.exe
      C:\Temp\i_romgebwtrl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtolgdywqo.exe ups_run
    3⤵
    PID:2244
  - - C:\Temp\vtolgdywqo.exe
      C:\Temp\vtolgdywqo.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3480
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2580
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1476
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtolgdywqo.exe ups_ins
    3⤵
    PID:3424
  - - C:\Temp\i_vtolgdywqo.exe
      C:\Temp\i_vtolgdywqo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lfdyvqoiga.exe ups_run
    3⤵
    PID:5888
  - - C:\Temp\lfdyvqoiga.exe
      C:\Temp\lfdyvqoiga.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5340
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6140
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lfdyvqoiga.exe ups_ins
    3⤵
    PID:4780
  - - C:\Temp\i_lfdyvqoiga.exe
      C:\Temp\i_lfdyvqoiga.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4904
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqkifaysqk.exe ups_run
    3⤵
    PID:1944
  - - C:\Temp\sqkifaysqk.exe
      C:\Temp\sqkifaysqk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4076
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2352
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4160
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqkifaysqk.exe ups_ins
    3⤵
    PID:2392
  - - C:\Temp\i_sqkifaysqk.exe
      C:\Temp\i_sqkifaysqk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:960
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnhfaxspki.exe ups_run
    3⤵
    PID:5216
  - - C:\Temp\pnhfaxspki.exe
      C:\Temp\pnhfaxspki.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4240
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1076
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3156
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnhfaxspki.exe ups_ins
    3⤵
    PID:1592
  - - C:\Temp\i_pnhfaxspki.exe
      C:\Temp\i_pnhfaxspki.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5800
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hcauspkhcz.exe ups_run
    3⤵
    PID:4840
  - - C:\Temp\hcauspkhcz.exe
      C:\Temp\hcauspkhcz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3144
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6120
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4432
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hcauspkhcz.exe ups_ins
    3⤵
    PID:4348
  - - C:\Temp\i_hcauspkhcz.exe
      C:\Temp\i_hcauspkhcz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3412
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urpjhbzurm.exe ups_run
    3⤵
    PID:6008
  - - C:\Temp\urpjhbzurm.exe
      C:\Temp\urpjhbzurm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4568
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1596
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4876
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urpjhbzurm.exe ups_ins
    3⤵
    PID:5636
  - - C:\Temp\i_urpjhbzurm.exe
      C:\Temp\i_urpjhbzurm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1744
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x31c,0x7ffd8c0fc188,0x7ffd8c0fc194,0x7ffd8c0fc1a0
      4⤵
      PID:3248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,5155890759316227009,7457024346493865259,524288 --field-trial-handle=2324,i,9658944530656446762,4170948233174700469,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:11
      4⤵
      System Time Discovery
      PID:5556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,1672100976050322389,449009770868709087,262144 --field-trial-handle=2324,i,9658944530656446762,4170948233174700469,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
      4⤵
      PID:2512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2520,i,2752230977691561442,17661093488829903454,524288 --field-trial-handle=2324,i,9658944530656446762,4170948233174700469,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:13
      4⤵
      PID:6112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,1961145776162955348,11797191842976693170,2097152 --field-trial-handle=2324,i,9658944530656446762,4170948233174700469,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
      4⤵
      PID:3544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,13141183463731553478,8901164701068378645,2097152 --field-trial-handle=2324,i,9658944530656446762,4170948233174700469,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
      4⤵
      PID:1384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4340,i,6341706073992936330,593998757120756973,2097152 --field-trial-handle=2324,i,9658944530656446762,4170948233174700469,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:1
      4⤵
      PID:4424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4344,i,2901921983643601116,4364001000722891371,2097152 --field-trial-handle=2324,i,9658944530656446762,4170948233174700469,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:9
      4⤵
      PID:5888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,13599396984157862496,1449163720977978455,524288 --field-trial-handle=2324,i,9658944530656446762,4170948233174700469,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
      4⤵
      PID:5032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,14090553897354878712,966823537451334387,524288 --field-trial-handle=2324,i,9658944530656446762,4170948233174700469,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
      4⤵
      PID:864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,4208111484251734905,1539237477488420958,524288 --field-trial-handle=2324,i,9658944530656446762,4170948233174700469,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:14
      4⤵
      PID:6104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,10749019808166199384,5799251838512152494,524288 --field-trial-handle=2324,i,9658944530656446762,4170948233174700469,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
      4⤵
      PID:1332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,10749019808166199384,5799251838512152494,524288 --field-trial-handle=2324,i,9658944530656446762,4170948233174700469,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
      4⤵
      PID:5460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,10967059954484452520,14555061794291941642,524288 --field-trial-handle=2324,i,9658944530656446762,4170948233174700469,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
      4⤵
      PID:5796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,18119526002258410052,16724008096028716363,524288 --field-trial-handle=2324,i,9658944530656446762,4170948233174700469,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
      4⤵
      PID:5232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=172,i,9651169970591613185,3138493827767239341,524288 --field-trial-handle=2324,i,9658944530656446762,4170948233174700469,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:14
      4⤵
      PID:5080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,5138837591035822475,6919744049057847490,524288 --field-trial-handle=2324,i,9658944530656446762,4170948233174700469,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:14
      4⤵
      PID:3468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,17216000078348730802,6726121292605782644,524288 --field-trial-handle=2324,i,9658944530656446762,4170948233174700469,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
      4⤵
      PID:4376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3264,i,18271329417013500362,12269458121259729823,524288 --field-trial-handle=2324,i,9658944530656446762,4170948233174700469,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:14
      4⤵
      PID:2036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,13999947185686406228,1672601823171170741,524288 --field-trial-handle=2324,i,9658944530656446762,4170948233174700469,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
      4⤵
      PID:3796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=944,i,446701629484561400,5265545432711872217,524288 --field-trial-handle=2324,i,9658944530656446762,4170948233174700469,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:14
      4⤵
      PID:2968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,15037740533279053322,14601282397975174727,524288 --field-trial-handle=2324,i,9658944530656446762,4170948233174700469,262144 --variations-seed-version --mojo-platform-channel-handle=948 /prefetch:14
      4⤵
      PID:5756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6388,i,15928203134875983101,10820127206055992351,262144 --field-trial-handle=2324,i,9658944530656446762,4170948233174700469,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:10
      4⤵
      PID:4428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,2154817844525584082,7376354791177728920,524288 --field-trial-handle=2324,i,9658944530656446762,4170948233174700469,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
      4⤵
      PID:4768

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6064

C:\Temp\fcxusnkfcxusmkif.sys
C:\Temp\fcxusnkfcxusmkif.sys
1⤵
- Executes dropped EXE
PID:2660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4580

C:\Temp\jhczurmkhc.sys
C:\Temp\jhczurmkhc.sys
1⤵
- Executes dropped EXE
PID:5480

C:\Temp\ewurpjhfzx.sys
C:\Temp\ewurpjhfzx.sys
1⤵
- Executes dropped EXE
PID:4348

C:\Temp\umjebwuomg.sys
C:\Temp\umjebwuomg.sys
1⤵
- Executes dropped EXE
PID:4120

C:\Temp\ojgbztrljd.sys
C:\Temp\ojgbztrljd.sys
1⤵
- Executes dropped EXE
PID:4212

C:\Temp\qoigaytqlj.sys
C:\Temp\qoigaytqlj.sys
1⤵
- Executes dropped EXE
PID:3320

C:\Temp\jdavsqlavt.sys
C:\Temp\jdavsqlavt.sys
1⤵
- Executes dropped EXE
PID:3176

C:\Temp\faxsqkifax.sys
C:\Temp\faxsqkifax.sys
1⤵
- Executes dropped EXE
PID:4828

C:\Temp\ausmkicaxv.sys
C:\Temp\ausmkicaxv.sys
1⤵
- Executes dropped EXE
PID:4724

C:\Temp\khfcxupmke.sys
C:\Temp\khfcxupmke.sys
1⤵
- Executes dropped EXE
PID:4772

C:\Temp\keczxrpmhe.sys
C:\Temp\keczxrpmhe.sys
1⤵
- Executes dropped EXE
PID:2756

C:\Temp\hbzwrpjhbz.sys
C:\Temp\hbzwrpjhbz.sys
1⤵
PID:3400

C:\Temp\wuomgeywtr.sys
C:\Temp\wuomgeywtr.sys
1⤵
PID:6088

C:\Temp\vtqoigbytq.sys
C:\Temp\vtqoigbytq.sys
1⤵
PID:5652

C:\Temp\lfdavtniga.sys
C:\Temp\lfdavtniga.sys
1⤵
PID:4404

C:\Temp\igaysqkiga.sys
C:\Temp\igaysqkiga.sys
1⤵
PID:4376

C:\Temp\vsnkfdxvsn.sys
C:\Temp\vsnkfdxvsn.sys
1⤵
PID:3360

C:\Temp\nhfzxrpkhc.sys
C:\Temp\nhfzxrpkhc.sys
1⤵
PID:1224

C:\Temp\xrpmkeczur.sys
C:\Temp\xrpmkeczur.sys
1⤵
PID:4608

C:\Temp\bzurmkecwu.sys
C:\Temp\bzurmkecwu.sys
1⤵
PID:3796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ewurpjhfzx.sys

Path C:\Temp\ewurpjhfzx.sys
Size 293KB
SHA256 f490877533b9328aa98077e6e9d5811b4688f8ee870cccf452d6277e0a4c1a14
MD5 ce990bc100b7830435d3872c09472568
SHA1 d876b35cf045975047bd40d82581e25536078723
SHA512 ac1c7acf5af750e86954e0084b8330b66f2072cb4babf22869e91dd7cf39c6f7ac05eeb1b76344f6b0f76609548cc346f81d193c27a82d4dee6a5465d98d130e
SSDEEP 3072:ktKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:kIJjiJcbI03GBc3ucY5DCSj
TLSH
T193545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcxusnkfcxusmkif.exe

Path C:\Temp\fcxusnkfcxusmkif.exe
Size 722KB
SHA256 8fb2fd341a78f5e8fc61d29db7d951ba701cc00694b74d5b22219e2096741e57
MD5 6eae4bd1c14131f6ffc7f01f5b8a7d7c
SHA1 61d9096d066d5b511b4ac90244a6f956d4799e17
SHA512 7ab5e9088fd577eab97805985e4e2a74db29492e682bc79e32cf0fe09e3172fe0a6145d5c7052a1abbfe2c7c644a0208479ce9f9d753eab5e10426f4cefd94bf
SSDEEP 12288:+flfAsiVGjSGecvXAflfAsiVGjSGecvX:6McfcMcf
TLSH
T1ACF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcxusnkfcxusmkif.sys

Path C:\Temp\fcxusnkfcxusmkif.sys
Size 293KB
SHA256 e1fefa01a6a1055da8550dc84e8ec7c88fd461f9f021a7044057c2d01fe05ab4
MD5 25ba8135c901048d7c580d7bfd7240fc
SHA1 1c471998a4903a32e71776dd57421f034b0814fa
SHA512 a91ef8f666a72aac07c715e9367f94d203ddeda28afb4ce8ebaee6a6e479b61d6845d46e6e1a3b910684c3f85553fbd8595ef4f67f9e653cbb531a2bb4c6a57a
SSDEEP 3072:2tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:2IJjiJcbI03GBc3ucY5DCSj
TLSH
T1EE545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igebwtrljd.exe

Path C:\Temp\i_igebwtrljd.exe
Size 722KB
SHA256 6e9bd1c32d237844c41941c319f8f22c1f53e5e097570096df284d1c58743761
MD5 d5741ed6bc204046562485937cb09d95
SHA1 44c882b381f91e3ed5ff70d0d81eaeefe60d5a1e
SHA512 1edc0f5e13b42b0fc6fe3191987fdc7dbfc07855c4286522752c7ea03a1c151993130ffaacb043116ff1b24f053719e90d7e29b7bdaa62d20beb79f31e5a49d1
SSDEEP 12288:qflfAsiVGjSGecvXAflfAsiVGjSGecvX:mMcfcMcf
TLSH
T197F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pkhcaxspnh.exe

Path C:\Temp\i_pkhcaxspnh.exe
Size 722KB
SHA256 f1565266f1476aa218f604039c61efd353ad69b07a6d54b31c8571581336e22f
MD5 9f79ac1d6e022f6ca8960f85f9b39c8b
SHA1 3527f1068f332e91ac8d8f42e6a67b88c52c08e4
SHA512 32b71c15e790cc33801790d9834a19db2193eb6d753477b67c40ba73fca31144bcbe9af09b621e13b4e12823eddc07876b6e03962042704a96a8194dce01f6cb
SSDEEP 12288:xflfAsiVGjSGecvXAflfAsiVGjSGecvX:5McfcMcf
TLSH
T1E3F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rmjecwuomg.exe

Path C:\Temp\i_rmjecwuomg.exe
Size 722KB
SHA256 74bc58766b3ac6467506a2f61504604f6586e18a5933034403dc62d33bf061c4
MD5 e407e74181f7ca978c82b8005e35dbfa
SHA1 e7c2b7ea1b4a625c10d0a37d53264b13ecee54ad
SHA512 ed4d591c2311f110c6a0e44f77b5b9dd1bbf856e14b08d67694a30d31e984fddce8fc47ec0b250e473ca5936e6be7966b6fa7add6b4d01ce9e4026ef13232e03
SSDEEP 12288:aflfAsiVGjSGecvXAflfAsiVGjSGecvX:2McfcMcf
TLSH
T127F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wrpjgbztrm.exe

Path C:\Temp\i_wrpjgbztrm.exe
Size 722KB
SHA256 80634baa5c118790800b35ff217103774704055f0769ef918f0030752a07a8fe
MD5 7e564c5149720d40338d11eaf8b56e52
SHA1 997a8dc39791951b0e6206ba6187f55c4f7deac0
SHA512 8fb3bc5e7a427225147c7b3acee68f932091100d329ef803aaf188c1ee32a1d36f5c03a300d012e83399d8b98efbc37d8fd1dabe8df0852050dcc7d3ea40c6ee
SSDEEP 12288:xflfAsiVGjSGecvXAflfAsiVGjSGecvX:5McfcMcf
TLSH
T1F9F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wusmkecxur.exe

Path C:\Temp\i_wusmkecxur.exe
Size 722KB
SHA256 0407dc861059651ca3def67f259505cc16cc1a07ed2a7ae6eb84577b2cf6ae93
MD5 f4c29a4ac086bb919937c187cc2ac252
SHA1 3018cbc98f2183d63816ce69e284bb0a8a876c76
SHA512 9c0aac4aa5e8f03d8f1c076ff68f63fb7e5bf873e2d0c28425bb63bfc78a24ca24f3e0f04b2e8734983b06300c186c9e6fdaafdd64c13507f506904a7adc4109
SSDEEP 12288:UflfAsiVGjSGecvXAflfAsiVGjSGecvX:QMcfcMcf
TLSH
T18EF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igebwtrljd.exe

Path C:\Temp\igebwtrljd.exe
Size 722KB
SHA256 278692aba481fa47844d721bae91839ad57998b5727bdccca0d3e21ba9d0feb1
MD5 4f4e3508a06d023679302004fd528f51
SHA1 280637ec643840bc772217c4cfc09cf211d92856
SHA512 da8b3332087a2aa5c5c3ceec75419eb48906a5a5345bd5e45de521ba87236b9bf7b7db0ed5a0ca517a1346d72c8e003e6e8e091582e2abc6fdeaf55a1bf71523
SSDEEP 12288:rflfAsiVGjSGecvXAflfAsiVGjSGecvX:jMcfcMcf
TLSH
T118F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhczurmkhc.sys

Path C:\Temp\jhczurmkhc.sys
Size 293KB
SHA256 fcf5442e20a6b21c7d6ecac331a0d248f632371ef07449eab8179f1c3640a349
MD5 1d06166622e0b934c0c332b157e842fd
SHA1 073e77fc3bf7af55ded50ae0bde25df73d378273
SHA512 2d1f0c7aca9299ce739bafc18a312edf19869936b6e5d5ea301df10259e44879cdf599a408d46d3fb2560d29e9f062d16987b4aff6df23eb4b8b8fda62e75f5e
SSDEEP 3072:vtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:vIJjiJcbI03GBc3ucY5DCSj
TLSH
T107545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ojgbztrljd.sys

Path C:\Temp\ojgbztrljd.sys
Size 293KB
SHA256 f17833071d9e542191567e87859cd595c946ebc5c63825ab7a61a6a836ab0bcb
MD5 fcafd90f09fe22f91178e9bdd901f58f
SHA1 00cc7c05d10af94c0b3b01e21003fc57402d1ff2
SHA512 f53ccaea778e53a663f4cc59410e4e1ca9886c07df3d90e7001c7b265022d9dcd338c00179bcf1b52ea723778c5a5cc3943e29a038805645b674ea0b41c26d92
SSDEEP 3072:0tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:0IJjiJcbI03GBc3ucY5DCSj
TLSH
T10F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olgdbvtnlg.exe

Path C:\Temp\olgdbvtnlg.exe
Size 722KB
SHA256 0a385a924ff5ad27622a37e00c755322279e63518eb1b70846cbe3c540aa1845
MD5 872675a82724bde77805a0a6d698e079
SHA1 27c7f265eb0193aa4a71f9af26c07e601ceeec93
SHA512 9cf1712865a8f47d34c41378272e0cd30ea249ccc40b52556f14c048cb32f448e3099251a963db9c679e320fd6be1cacf579fd6163a6a5f58f8d7ad55b497bb2
SSDEEP 12288:2flfAsiVGjSGecvXAflfAsiVGjSGecvX:iMcfcMcf
TLSH
T19FF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkhcaxspnh.exe

Path C:\Temp\pkhcaxspnh.exe
Size 722KB
SHA256 0bb6cf4ef2f188f4cc6632646a077a44abf67b9d3a392dfc5f192e588557f17a
MD5 db5dd922db1653127d0dbd1b9f06dcc0
SHA1 75a514e9b346ac48a988d8f7b6c73cf5f39c3197
SHA512 2038a3bc8ad83316fd9e7ba64ab5282d7e3e5b52a22682a35fccb18a6fac30bd559186fee8ad98e428ee019425e93486f84e696136eb87d5f28d8eb7ce4493f8
SSDEEP 12288:1flfAsiVGjSGecvXAflfAsiVGjSGecvX:dMcfcMcf
TLSH
T127F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoigaytqlj.sys

Path C:\Temp\qoigaytqlj.sys
Size 293KB
SHA256 6f8e74c1dd65bd5e5fd1e9b5288d127720f7b7364d7326bcc33b6be5f58a0f66
MD5 399722ff4b9bbfa14d914cade095efa2
SHA1 2b783164ab7fcafd22844047c3278cded708c9e3
SHA512 98926ba0e1ffbb612ab4e02b896cd5cb12c855542f756996aded377736a7b14b1390cddf7aeb6e9af8a3b59381f380e8de016dd6dbda32042c57483aedd0de9e
SSDEEP 3072:wtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:wIJjiJcbI03GBc3ucY5DCSj
TLSH
T104545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmjecwuomg.exe

Path C:\Temp\rmjecwuomg.exe
Size 722KB
SHA256 4570de921c70ed0459ebc4f6bf93214e3d267b3dc55745fd62a0f3d87fe4db02
MD5 6e95680718b6ee5adca70fa7bb974cbe
SHA1 6e47fe474e793bd7bce204f276cd55e69864c89e
SHA512 39c95654a8c953bc65c7f21f706fd3662432c9626bfe668526ca59f3a8ef9ee175038bda3b1465fb9a97aa16104280143cc9ab37ccd71328c7f7ebb41d56b0e2
SSDEEP 12288:nflfAsiVGjSGecvXAflfAsiVGjSGecvX:fMcfcMcf
TLSH
T1E2F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

umjebwuomg.sys

Path C:\Temp\umjebwuomg.sys
Size 293KB
SHA256 2bb9fc9b4a3e0e5db8d84c55b0fb48e71724e9617449b9638c95aba9833432ca
MD5 71298fd9c334f2da9b30535ab89ef2c5
SHA1 1063199e642741af94401c9c1325ddd5c5ce490b
SHA512 382c4d1baba41987e9ba7b58bda8ed8d84d462f0a622711060761a4ba94ac5f7f77a204f0848fd7557af7537242d01af2cb7222e9f299ff45b3451d876e1f426
SSDEEP 3072:5tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:5IJjiJcbI03GBc3ucY5DCSj
TLSH
T1E7545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrpjgbztrm.exe

Path C:\Temp\wrpjgbztrm.exe
Size 722KB
SHA256 ddbba2edc6571869418e14bd6a2fdd5de1f9817da888ee70c3e752526e784ec5
MD5 2f8a31a7df1ad5dace0b67463c4dc11a
SHA1 e19ffa2621ab8e05a4007bb2bda41cbd4d21446c
SHA512 3012edb8b008e73ea93f775a67cda36f5e66c0ff1800cd4eb112814444d60f0b50c9a2ad386cd0463518ad388a1e0458b69b730ae1d0c92f80ebafc7f358dd56
SSDEEP 12288:sflfAsiVGjSGecvXAflfAsiVGjSGecvX:4McfcMcf
TLSH
T1E3F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wusmkecxur.exe

Path C:\Temp\wusmkecxur.exe
Size 722KB
SHA256 ed1eccabda2d4e38776795bcc01161a5f856a5158d2f19a482a73fb2a5b7d5e2
MD5 86798aa6432c4d2974b9353e9162ac1a
SHA1 51afaf489059624bf6cdd16e2d2d7e3fab29f0c5
SHA512 ee8ae095f0908b3ce2e4c7b6f5a91d45fde6701cd7394872de7edc9dc1b6e107195e6f970ac586429e65549f021aa6c206ff170d9fdcf61827c9d7641403b41b
SSDEEP 12288:yflfAsiVGjSGecvXAflfAsiVGjSGecvX:+McfcMcf
TLSH
T17FF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 339f6d4a69e9f219a0ff9fd06c4aec6bfc2771c28504a219e7bb8589e3e906dc
MD5 551dd18f15a1d501dcb710d19c936586
SHA1 2247816774a5670bf841ddead31300526b96fb4e
SHA512 74d964c1a1a8aa0aa4594825821853f415af42c6e70ec08ce8baecee1db287137dc0f3e74dca0716f731f339cd0cad219d5dc1756f3a16c39c52f2b5b8b84386
TLSH
T1D341E956136647C3E7A889BBF0F1D68432F6E85E4B4F6E1162416E77CA06F4400E6DD3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 74db8fd58dfe9c028f2ac3426c6b6b4a1dcc1361bf5c33198136d0999728c373
MD5 447f2331c7160e2388fdc6002bac3ebd
SHA1 d513ca037d9f3d6b3eaabff393421f67f71bcc69
SHA512 b0bde46b2d22d93469a824ee5b1b2060a8dbdaf6aaac6c68655063ea4815edfd0e15c8b2f9f57d152a22149b15340b9a1790f936d6737ca671d7954efc1c6355
TLSH
T13D41ADF783F4956E8A0196F0AA186E1FCE2D0515432C7C5A89E4AF2B93E3471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2c2eef1797294aba636080a618eb0a79e92d68eab9937664e7162be557d1fa0a
MD5 964e2a14964f0cc8b3e664fc7a9140d2
SHA1 a0e4550a2a290d512ca21e2b97090a913f4dda92
SHA512 784df4775689d0412dc360c78bac978470fac36cbe0a06987541d24806b2e1552c1def94fe1328ddf83a1281534cb0b6f0afc591b551d822494823cc0a542de5
SSDEEP 192:sxRGRdCK/fgsnlMSCZ/cSRzoD8p9V/g6+WNC68/YCbBfOxGVIgVOJ:sxRGqK/fgslRE/cS1r/5w/+6w
TLSH
T1BA42C8166928A97B8CC7D20DBF15BF53D6F91033A1946E58BAFC961C04EB6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c31d20c9fb839a660faf2e773de6ce3a227382b4447e242e62895961ddb70397
MD5 842927c51a4fa0ae328f508ea82a835b
SHA1 9e74f65a5f91b806e779e2f90bfbc8d239dd3ff1
SHA512 80238a89c5582892a0896fac18b3c6854ef5cb982976b3d498c079222b4e9d642ad750d1d07a839c2b8a098867aa01391295b2e29487a4ed5ab2cd34ae2ecd95
SSDEEP 192:sxRdRdCK/fgsTlMSCZ/cSRzoD8p9V/g6+WNC68/YCbBfOxGVIgDtOJ:sxRdqK/fgsBRE/cS1r/5w/+60
TLSH
T13542D8166928A97B8CC7D20DBF15BF53D3F91073A1946E48BAFC961C04EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a1bd726c051d8da0e8015c2d770b04a7a9a5aad7231f9e9c38b72e33183f7d10
MD5 5c345587e66b5bdbb8ae93337cd8be54
SHA1 1a342034cae36f05ba23ca46e0927e8f7d54cc9d
SHA512 60c50b0836b51b3c10038592d4b3c7d8c38eec407104bdb6b61120fe3729b859d2290acfc96cf6c0b9a68b74094c3feb0371c9c2d3b84df35a83b1996e54a39a
SSDEEP 192:sxRdRdCK/fgsTlJSCZ/cSRzoD8p9V/g6+WNC68/YC+LfOxGVIgDXOJ:sxRdqK/fgsBwE/cS1r/5w/d6W
TLSH
T13842D9166929AD7B8CC7E20DBB15BF53D3F9507391946E48BAFC861C04EB6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 d5c2a1b006edd51663750e881e052d8873d47c873b74eeeba3c201a92c0389a3
MD5 f01f9cb1c49ce244a08d74fadd8c08b4
SHA1 26f0d275e1cd6541221a8482549d3e43e95e700b
SHA512 d5fd8a81ca45b78643f00a856cfb8cf3281f3c9f3155a50836b40f3bef806412d1c63c64f33551dbb5a1da8bda131522e3c5f3da2ae59ad67a1c75c74a3cae07
SSDEEP 768:jC+v0N7pLuL7JQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVK78YZ0QqcuroZf:jC+v07E7JQWgQ+f4+u1ja378YZ0VclNf
TLSH
T1E4D2EA7B640DCB7F4F804ADDAC197A9F6DA802CB9698CD4047FA941C02C6BEA52164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9737181e832574af8a006eb1995cef01b49e7ea914114e7d4397d68a32ba6769
MD5 dc431b573e837dc002bb0feaadb7f31c
SHA1 078e5fefb200fb1d87ace29d9dcba4ac51c8de39
SHA512 6b4fa0af0903c66295c688964263eb5f3228e439bb4669205f87a77baa18279e01345a17c8d18d0dab49470343fd160a9560b2e4805c578bb5f96ce1c15d9f4e
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHWLa2Q44eWIdFgWeK4rgEec+W10m/Hd0dH:CbEBVj5JAdSp9/EgTK7j6dJOHWLa2Q4z
TLSH
T109912804343A0650B87E770C81F98C2E96C574723519E52B3FAC46A60F6AD47ADFDAC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1aee7abb-cc02-42d1-a9d6-465c95d024a6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1aee7abb-cc02-42d1-a9d6-465c95d024a6.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 d65b19641edbf6f04229057577611dfe5d522ec5f949cc77afaf0a12b3e69b7a
MD5 367946ca564c00d92a3f976863811c64
SHA1 882cbb663194317639bb5a6d48cb430b81a0c593
SHA512 3310c4acef317e70ef01947c631db0bcc6fc16970382483d540a6e9617daaab905f2f617fd44af5f98e76318ab593c9b9c1d388e30479e1d8ed381a9e9b972d1
SSDEEP 768:4FQ037wgllxy74np8+p3bd66j+4BRv86aLIWqflz+6:b03jf8+p3Z6n4y0fl+6
TLSH
T1F91329F298D78937D8AD8783A37D2E429EBCC063B5845894BBC85E0DCC461BFC706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 09112aa9daf370dda28741bd8e782fff05d32de0b819531ab2356b6d9c5abcdb
MD5 a00883fbd8ffc32cfc88b0b31e62119d
SHA1 ee0366b28a35bf4b2ddaef119af25e1b99401d57
SHA512 b41a74bcbced0a5bbca9e4b71b2e30daba0e3d73b0f455b85a1300190738929025187cbabb73881f70510fc0b49c71f68c98c656e649cbf456555e02798e9399
SSDEEP 768:Brv+4UNbdD3oGF+Np8+p3bd66j+4BRv86aLITq2bwCl1:Bbsbp3GL8+p3Z6n4yD0ww
TLSH
T14F03BE72E5A99D739CF6D644B1867B837FF811A389C10E94E8DD6B4E004A19E270BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c936eab6e3e42cc72f9832618bc3317ef5ee1133e901c0794439f223f14e3c61
MD5 fb85116a209741b5a768af1e527d3410
SHA1 20e477a35ce7cab8c349d2d4e725c77e9e438716
SHA512 627683bb0d8e309878cb32e157f369f476550c9f8c01d26ddb2cfaa2d4fa565954ac27ed51ceddccde51a94b6c8a101e9e073bc2e4a4f0498f9266e1b489b5e1
SSDEEP 768:Srv+4UNbd13olxwoF+Xp8+p3bd66j+4BRv86aLIWqc:Sbsbn3mwZ8+p3Z6n4y0c
TLSH
T12003BF72F869DD739CF6D644B18637837FB814A389C00EA4D8C95B5D458B1AE270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 07784d561b448d81a54613a6d108f1ab05666ebee9c0febfb7edb953af524610
MD5 4914ccc9d3b1eba6105e33668b2be604
SHA1 57a629b8aaa1efbf16eb78c6127e7d3b1e92b9d8
SHA512 75ea72348b39ed2fe7c4fc0e320e1636cde69dff6d5c3b164690aa65708f1068ca2696ba0338795cd34b5268f9c0b4cd479dd5f0e715831e0a69bea4ea50eb4b
SSDEEP 768:Krv+4UNbd13vlxtoF+Xp8+p3bd66j+4BRv86aLIWq2bwClP:Kbsbn3vvZ8+p3Z6n4y00w6
TLSH
T1FC13BE72F9A99D739CF6D644B1467B837FB811A389C00E94E9C95B4E014B19E270FC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 aaee8c2d4f708403f4ea4b73cd9aac720cbc037dd3cae317c40842bce5d45b4a
MD5 7106eb65663681c6321699c87de05222
SHA1 34e4966e4411b11de948f486f071d5d7c6cf64fa
SHA512 77bbbc06bc2802fc212f0719a29f8bf34f5c87ac679ab2825774c2093c3e38d61260806f8bfcf911a64d8ff91f506871722d504e9ba93ce73175206782b9b95d
SSDEEP 768:2y3hlxwoF+Xp8+p3bd66j+4BRv86aLIWqflz+6:2y3FwZ8+p3Z6n4y0fl+6
TLSH
T162F2AFB1E8A69C735CF9D344B6463783AFF410A389C45E94D8DD9B1E10472AE2B0BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 582094ac80b1de9486f7fba4035215f2ac0f7b96d0ed01f874c1a6ec19bfc2d5
MD5 459d2a9a28433f22b1551ec191719f9e
SHA1 f49251d1da7c97048c90443c73c2904640d70b59
SHA512 854772cbdee2e78dabe785965e2457eb25c24fcdae5f358d34e2880465055bea01de3d6ca9653e98f5d748a9273e173c6daec8c1502faf7431af8a01f2503ded
SSDEEP 768:Irv+4UNbdD3GczNp8+p3bd66j+4BRv86aLIim2bwCl1:Ibsbp3hL8+p3Z6n4ys0ww
TLSH
T1C403CE73F99899339CF6C644B2467B437FF851A39AC00AC0D4DD2B4E419A19E630BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

951029bd-271d-434f-9652-5078b6fd77d7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\951029bd-271d-434f-9652-5078b6fd77d7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4088_1891049968\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 7d1330df1768568f4ea581821ef780b6161b54d3df2b1e72504907ba60b06401
MD5 36d1f4cce2040b3ba89b8c7004878758
SHA1 e4f67b232df33b0d465998b377b57817f34bc45d
SHA512 2a15544fc3c634a561a66df968d11532888fd0b8c2944bbd9267bed1779251d44b698e6143fcb0d1674ba0f293c08e9fe46451fa4b09b78b8595647ef1b878a1
TLSH
T1DF71238357ADDAF3C2DA9FF002835244F1FB227C073330200B525586AB34A3A54B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1224-466-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2660-55-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2756-363-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3176-303-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3320-285-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3360-461-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3400-375-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3400-404-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3796-487-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4120-252-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4212-264-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4348-225-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4376-440-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4404-428-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4608-483-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4724-330-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4772-334-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4828-307-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5480-178-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5652-408-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5652-429-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6088-403-0x0000000000010000-0x00000000000AB000-memory.dmp

Download