0ccaeaee585bafde296ff3398310e94f0c5d1d05e345c8b0c60c91fb39e8cee6

Analysis

max time kernel
149s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/09/2026, 21:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 722KB
Sample260909-1pr2ratsbs
SHA256 0ccaeaee585bafde296ff3398310e94f0c5d1d05e345c8b0c60c91fb39e8cee6
MD5 366ca15926d18924bd63bee888ba5f1f
SHA1 8c9c4ec339ed45c74f6480d4ddf5dd91a13f6546
SHA512 f34d06f7506be1351d60f5095497544afa0878f549e90a82efd8902db1c7011736794006bf4734e9d326b14e117eb32f2c77a4177bd1a457ede6134b39fe2a69
SSDEEP 12288:YflfAsiVGjSGecvXAflfAsiVGjSGecvX:EMcfcMcf
TLSH
T173F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2540	hfzxrpjhczusmkec.exe
3676	hfzxrpjhczusmkec.sys
2348	CreateProcess.exe
5524	hezwuspjez.exe
1428	CreateProcess.exe
5028	CreateProcess.exe
1116	i_hezwuspjez.exe
2456	tomgeywroj.sys
5424	CreateProcess.exe
1676	ztrpjhbztr.exe
2168	CreateProcess.exe
5508	CreateProcess.exe
4824	i_ztrpjhbztr.exe
4492	gbywqojgby.sys
5344	CreateProcess.exe
2400	dbwtrlgeyw.exe
3484	CreateProcess.exe
5976	CreateProcess.exe
4796	i_dbwtrlgeyw.exe
124	ywtrljgbyt.sys
4748	CreateProcess.exe
4272	wqoigaytql.exe
3356	CreateProcess.exe
2580	CreateProcess.exe
2172	i_wqoigaytql.exe
3680	qoigaywqoi.sys
2656	CreateProcess.exe
4912	oigaysqlid.exe
4188	CreateProcess.exe
4092	CreateProcess.exe
3332	i_oigaysqlid.exe
3152	icavsnlfdx.sys
5148	CreateProcess.exe
4796	ayvqnicavs.exe
4416	CreateProcess.exe
5684	CreateProcess.exe
3560	i_ayvqnicavs.exe
5644	usnkfcxvsn.sys
3868	CreateProcess.exe
2808	vsnkfcxvpn.exe
1900	CreateProcess.exe
2152	CreateProcess.exe
1412	i_vsnkfcxvpn.exe
6072	zxvpnkicau.sys
5864	CreateProcess.exe
4904	rpnhfzxrpk.exe
5712	CreateProcess.exe
1060	CreateProcess.exe
5092	i_rpnhfzxrpk.exe
5324	hfcxupjhfz.sys
4204	CreateProcess.exe
3304	cxusmkeczu.exe
4916	CreateProcess.exe
3564	CreateProcess.exe
2544	i_cxusmkeczu.exe
1988	zwuomkecwu.sys
4192	CreateProcess.exe
5376	trpjhecwuo.exe
472	CreateProcess.exe
1136	CreateProcess.exe
1116	i_trpjhecwuo.exe
4992	bwtrmjebwu.sys
4400	CreateProcess.exe
5324	ztrojgbztr.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4088_2038546879\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4088_1646358134\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4088_1676797873\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4088_1676797873\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4088_1676797873\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4088_1238870114\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4088_2038546879\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4088_1646358134\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4088_1676797873\office_endpoints_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbwtrlgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigaysqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojytrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igbytrliga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igbytrliga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvsnlfca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causqkiusn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrpjhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ayvqnicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnkfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trpjhecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywqojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezwuspjez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ayvqnicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomgeytroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxrpjhczusmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqoigaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpnhfzxrpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxusmkeczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrojgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojytrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axvtnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezwuspjez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbwtrlgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axvtnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvsnlfca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causqkiusn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxrpnhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxrpnhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnkfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpnhfzxrpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxusmkeczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trpjhecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomgeytroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrpjhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqoigaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigaysqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrojgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhezxrpjh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4532	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2340	ipconfig.exe
4432	ipconfig.exe
5084	ipconfig.exe
3148	ipconfig.exe
4820	ipconfig.exe
5172	ipconfig.exe
1716	ipconfig.exe
5032	ipconfig.exe
1796	ipconfig.exe
2372	ipconfig.exe
5792	ipconfig.exe
1096	ipconfig.exe
3460	ipconfig.exe
1636	ipconfig.exe
3460	ipconfig.exe
2288	ipconfig.exe
5132	ipconfig.exe
2196	ipconfig.exe
5104	ipconfig.exe
4628	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134334642007259588"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3611646547-550105268-947503007-1000\{FD1AC048-8808-4D01-85A1-608B9AF001D4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2540	hfzxrpjhczusmkec.exe
2540	hfzxrpjhczusmkec.exe
2540	hfzxrpjhczusmkec.exe
2540	hfzxrpjhczusmkec.exe
2540	hfzxrpjhczusmkec.exe
2540	hfzxrpjhczusmkec.exe
2540	hfzxrpjhczusmkec.exe
2540	hfzxrpjhczusmkec.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1116	i_hezwuspjez.exe
Token: SeDebugPrivilege	4824	i_ztrpjhbztr.exe
Token: SeDebugPrivilege	4796	i_dbwtrlgeyw.exe
Token: SeDebugPrivilege	2172	i_wqoigaytql.exe
Token: SeDebugPrivilege	3332	i_oigaysqlid.exe
Token: SeDebugPrivilege	3560	i_ayvqnicavs.exe
Token: SeDebugPrivilege	1412	i_vsnkfcxvpn.exe
Token: SeDebugPrivilege	5092	i_rpnhfzxrpk.exe
Token: SeDebugPrivilege	2544	i_cxusmkeczu.exe
Token: SeDebugPrivilege	1116	i_trpjhecwuo.exe
Token: SeDebugPrivilege	1532	i_ztrojgbztr.exe
Token: SeDebugPrivilege	1412	i_rojytrljdb.exe
Token: SeDebugPrivilege	4456	i_igbytrliga.exe
Token: SeDebugPrivilege	4364	i_axvtnlfdyv.exe
Token: SeDebugPrivilege	1968	i_fdxvsnlfca.exe
Token: SeDebugPrivilege	4944	i_causqkiusn.exe
Token: SeDebugPrivilege	800	i_cxrpnhfzxr.exe
Token: SeDebugPrivilege	5252	i_pjhezxrpjh.exe
Token: SeDebugPrivilege	4116	i_uomgeytroj.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4088	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2540	2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 2520 wrote to memory of 5868	2520	2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 5868 wrote to memory of 4088	5868	iexplore.exe	91
PID 4088 wrote to memory of 1404	4088	msedge.exe	92
PID 4088 wrote to memory of 4532	4088	msedge.exe	93
PID 4088 wrote to memory of 4892	4088	msedge.exe	94
PID 4088 wrote to memory of 4892	4088	msedge.exe	94
PID 4088 wrote to memory of 4892	4088	msedge.exe	94
PID 4088 wrote to memory of 2796	4088	msedge.exe	95
PID 4088 wrote to memory of 2796	4088	msedge.exe	95
PID 4088 wrote to memory of 240	4088	msedge.exe	97
PID 4088 wrote to memory of 3256	4088	msedge.exe	98
PID 4088 wrote to memory of 240	4088	msedge.exe	97
PID 4088 wrote to memory of 240	4088	msedge.exe	97
PID 4088 wrote to memory of 3256	4088	msedge.exe	98
PID 4088 wrote to memory of 3256	4088	msedge.exe	98
PID 4088 wrote to memory of 3016	4088	msedge.exe	99
PID 4088 wrote to memory of 2492	4088	msedge.exe	100
PID 4088 wrote to memory of 3016	4088	msedge.exe	99
PID 4088 wrote to memory of 3016	4088	msedge.exe	99
PID 4088 wrote to memory of 2492	4088	msedge.exe	100
PID 4088 wrote to memory of 2492	4088	msedge.exe	100
PID 4088 wrote to memory of 4320	4088	msedge.exe	104
PID 4088 wrote to memory of 4320	4088	msedge.exe	104
PID 4088 wrote to memory of 2108	4088	msedge.exe	105
PID 4088 wrote to memory of 2108	4088	msedge.exe	105
PID 4088 wrote to memory of 600	4088	msedge.exe	107
PID 2540 wrote to memory of 2348	2540	hfzxrpjhczusmkec.exe	108
PID 5524 wrote to memory of 1428	5524	hezwuspjez.exe	111
PID 4088 wrote to memory of 4692	4088	msedge.exe	114
PID 4088 wrote to memory of 4692	4088	msedge.exe	114
PID 4088 wrote to memory of 4392	4088	msedge.exe	117
PID 4088 wrote to memory of 4392	4088	msedge.exe	117
PID 4088 wrote to memory of 2900	4088	msedge.exe	118
PID 4088 wrote to memory of 2900	4088	msedge.exe	118
PID 2540 wrote to memory of 5028	2540	hfzxrpjhczusmkec.exe	119
PID 2540 wrote to memory of 5424	2540	hfzxrpjhczusmkec.exe	123
PID 1676 wrote to memory of 2168	1676	ztrpjhbztr.exe	125
PID 2540 wrote to memory of 5508	2540	hfzxrpjhczusmkec.exe	128
PID 2540 wrote to memory of 5344	2540	hfzxrpjhczusmkec.exe	132
PID 2400 wrote to memory of 3484	2400	dbwtrlgeyw.exe	134
PID 2540 wrote to memory of 5976	2540	hfzxrpjhczusmkec.exe	137
PID 2540 wrote to memory of 4748	2540	hfzxrpjhczusmkec.exe	142
PID 4272 wrote to memory of 3356	4272	wqoigaytql.exe	144
PID 2540 wrote to memory of 2580	2540	hfzxrpjhczusmkec.exe	147
PID 4088 wrote to memory of 2416	4088	msedge.exe	149
PID 4088 wrote to memory of 6104	4088	msedge.exe	150
PID 4088 wrote to memory of 1264	4088	msedge.exe	151
PID 2540 wrote to memory of 2656	2540	hfzxrpjhczusmkec.exe	154
PID 4912 wrote to memory of 4188	4912	oigaysqlid.exe	156
PID 2540 wrote to memory of 4092	2540	hfzxrpjhczusmkec.exe	159
PID 2540 wrote to memory of 5148	2540	hfzxrpjhczusmkec.exe	163
PID 4796 wrote to memory of 4416	4796	ayvqnicavs.exe	165
PID 2540 wrote to memory of 5684	2540	hfzxrpjhczusmkec.exe	168
PID 2540 wrote to memory of 3868	2540	hfzxrpjhczusmkec.exe	172
PID 2808 wrote to memory of 1900	2808	vsnkfcxvpn.exe	174
PID 2540 wrote to memory of 2152	2540	hfzxrpjhczusmkec.exe	177
PID 2540 wrote to memory of 5864	2540	hfzxrpjhczusmkec.exe	181
PID 4904 wrote to memory of 5712	4904	rpnhfzxrpk.exe	183
PID 2540 wrote to memory of 1060	2540	hfzxrpjhczusmkec.exe	186
PID 4088 wrote to memory of 416	4088	msedge.exe	188
PID 4088 wrote to memory of 416	4088	msedge.exe	188
PID 2540 wrote to memory of 4204	2540	hfzxrpjhczusmkec.exe	194
PID 3304 wrote to memory of 4916	3304	cxusmkeczu.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-09_366ca15926d18924bd63bee888ba5f1f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Temp\hfzxrpjhczusmkec.exe
  C:\Temp\hfzxrpjhczusmkec.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hezwuspjez.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2348
  - - C:\Temp\hezwuspjez.exe
      C:\Temp\hezwuspjez.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5524
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1428
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5132
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hezwuspjez.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5028
  - - C:\Temp\i_hezwuspjez.exe
      C:\Temp\i_hezwuspjez.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1116
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ztrpjhbztr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5424
  - - C:\Temp\ztrpjhbztr.exe
      C:\Temp\ztrpjhbztr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1676
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2168
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ztrpjhbztr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5508
  - - C:\Temp\i_ztrpjhbztr.exe
      C:\Temp\i_ztrpjhbztr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4824
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbwtrlgeyw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5344
  - - C:\Temp\dbwtrlgeyw.exe
      C:\Temp\dbwtrlgeyw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2400
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3484
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5104
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbwtrlgeyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5976
  - - C:\Temp\i_dbwtrlgeyw.exe
      C:\Temp\i_dbwtrlgeyw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wqoigaytql.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4748
  - - C:\Temp\wqoigaytql.exe
      C:\Temp\wqoigaytql.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4272
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3356
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4628
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wqoigaytql.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2580
  - - C:\Temp\i_wqoigaytql.exe
      C:\Temp\i_wqoigaytql.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2172
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oigaysqlid.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2656
  - - C:\Temp\oigaysqlid.exe
      C:\Temp\oigaysqlid.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4912
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4188
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1096
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oigaysqlid.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4092
  - - C:\Temp\i_oigaysqlid.exe
      C:\Temp\i_oigaysqlid.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ayvqnicavs.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5148
  - - C:\Temp\ayvqnicavs.exe
      C:\Temp\ayvqnicavs.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4796
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4416
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2340
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ayvqnicavs.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5684
  - - C:\Temp\i_ayvqnicavs.exe
      C:\Temp\i_ayvqnicavs.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vsnkfcxvpn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3868
  - - C:\Temp\vsnkfcxvpn.exe
      C:\Temp\vsnkfcxvpn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2808
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1900
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vsnkfcxvpn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2152
  - - C:\Temp\i_vsnkfcxvpn.exe
      C:\Temp\i_vsnkfcxvpn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1412
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpnhfzxrpk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5864
  - - C:\Temp\rpnhfzxrpk.exe
      C:\Temp\rpnhfzxrpk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4904
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5712
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2372
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpnhfzxrpk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1060
  - - C:\Temp\i_rpnhfzxrpk.exe
      C:\Temp\i_rpnhfzxrpk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cxusmkeczu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4204
  - - C:\Temp\cxusmkeczu.exe
      C:\Temp\cxusmkeczu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3304
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4916
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1636
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cxusmkeczu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3564
  - - C:\Temp\i_cxusmkeczu.exe
      C:\Temp\i_cxusmkeczu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trpjhecwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4192
  - - C:\Temp\trpjhecwuo.exe
      C:\Temp\trpjhecwuo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5376
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:472
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trpjhecwuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1136
  - - C:\Temp\i_trpjhecwuo.exe
      C:\Temp\i_trpjhecwuo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1116
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ztrojgbztr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4400
  - - C:\Temp\ztrojgbztr.exe
      C:\Temp\ztrojgbztr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5324
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4560
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4820
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ztrojgbztr.exe ups_ins
    3⤵
    PID:2660
  - - C:\Temp\i_ztrojgbztr.exe
      C:\Temp\i_ztrojgbztr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1532
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rojytrljdb.exe ups_run
    3⤵
    PID:4676
  - - C:\Temp\rojytrljdb.exe
      C:\Temp\rojytrljdb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2544
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2644
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rojytrljdb.exe ups_ins
    3⤵
    PID:1664
  - - C:\Temp\i_rojytrljdb.exe
      C:\Temp\i_rojytrljdb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1412
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igbytrliga.exe ups_run
    3⤵
    PID:2984
  - - C:\Temp\igbytrliga.exe
      C:\Temp\igbytrliga.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1264
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4572
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5172
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igbytrliga.exe ups_ins
    3⤵
    PID:4644
  - - C:\Temp\i_igbytrliga.exe
      C:\Temp\i_igbytrliga.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4456
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\axvtnlfdyv.exe ups_run
    3⤵
    PID:1564
  - - C:\Temp\axvtnlfdyv.exe
      C:\Temp\axvtnlfdyv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2508
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:124
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5792
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_axvtnlfdyv.exe ups_ins
    3⤵
    PID:2944
  - - C:\Temp\i_axvtnlfdyv.exe
      C:\Temp\i_axvtnlfdyv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4364
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdxvsnlfca.exe ups_run
    3⤵
    PID:1816
  - - C:\Temp\fdxvsnlfca.exe
      C:\Temp\fdxvsnlfca.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4996
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2376
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdxvsnlfca.exe ups_ins
    3⤵
    PID:5512
  - - C:\Temp\i_fdxvsnlfca.exe
      C:\Temp\i_fdxvsnlfca.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1968
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\causqkiusn.exe ups_run
    3⤵
    PID:1144
  - - C:\Temp\causqkiusn.exe
      C:\Temp\causqkiusn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3316
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:912
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5032
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_causqkiusn.exe ups_ins
    3⤵
    PID:904
  - - C:\Temp\i_causqkiusn.exe
      C:\Temp\i_causqkiusn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cxrpnhfzxr.exe ups_run
    3⤵
    PID:5648
  - - C:\Temp\cxrpnhfzxr.exe
      C:\Temp\cxrpnhfzxr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2760
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2804
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2288
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cxrpnhfzxr.exe ups_ins
    3⤵
    PID:5432
  - - C:\Temp\i_cxrpnhfzxr.exe
      C:\Temp\i_cxrpnhfzxr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:800
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhezxrpjh.exe ups_run
    3⤵
    PID:5200
  - - C:\Temp\pjhezxrpjh.exe
      C:\Temp\pjhezxrpjh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5588
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:796
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4432
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjhezxrpjh.exe ups_ins
    3⤵
    PID:2888
  - - C:\Temp\i_pjhezxrpjh.exe
      C:\Temp\i_pjhezxrpjh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uomgeytroj.exe ups_run
    3⤵
    PID:476
  - - C:\Temp\uomgeytroj.exe
      C:\Temp\uomgeytroj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2352
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5116
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5084
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uomgeytroj.exe ups_ins
    3⤵
    PID:2084
  - - C:\Temp\i_uomgeytroj.exe
      C:\Temp\i_uomgeytroj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4116
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eywqojgbzt.exe ups_run
    3⤵
    PID:5032
  - - C:\Temp\eywqojgbzt.exe
      C:\Temp\eywqojgbzt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2216
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2296
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1796
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff8c863c188,0x7ff8c863c194,0x7ff8c863c1a0
      4⤵
      PID:1404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,12198620347740449008,12384606673664843740,524288 --field-trial-handle=2140,i,6820537513845125356,16146573861483728715,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:11
      4⤵
      System Time Discovery
      PID:4532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1576,i,7746574799961360722,13908681114648986690,262144 --field-trial-handle=2140,i,6820537513845125356,16146573861483728715,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:2
      4⤵
      PID:4892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2632,i,3383446570195248244,12805540394551567580,524288 --field-trial-handle=2140,i,6820537513845125356,16146573861483728715,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:13
      4⤵
      PID:2796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,7965972142412222640,11090464726737573855,2097152 --field-trial-handle=2140,i,6820537513845125356,16146573861483728715,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
      4⤵
      PID:240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3540,i,9936261809818530798,2543067272159494122,2097152 --field-trial-handle=2140,i,6820537513845125356,16146573861483728715,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      PID:3256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4356,i,5977741401047023971,15485183969935382385,2097152 --field-trial-handle=2140,i,6820537513845125356,16146573861483728715,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:1
      4⤵
      PID:3016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4368,i,571031784883286261,17354978705820207816,2097152 --field-trial-handle=2140,i,6820537513845125356,16146573861483728715,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:9
      4⤵
      PID:2492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,13179424263033466328,13158226192427842038,524288 --field-trial-handle=2140,i,6820537513845125356,16146573861483728715,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
      4⤵
      PID:4320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3688,i,1861892957781723580,14467872555748747772,524288 --field-trial-handle=2140,i,6820537513845125356,16146573861483728715,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
      4⤵
      PID:2108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,4085466202858816156,12337791991291946118,524288 --field-trial-handle=2140,i,6820537513845125356,16146573861483728715,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:14
      4⤵
      PID:1264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,4085466202858816156,12337791991291946118,524288 --field-trial-handle=2140,i,6820537513845125356,16146573861483728715,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:14
      4⤵
      PID:600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,2547438347112414934,11004745140543728070,524288 --field-trial-handle=2140,i,6820537513845125356,16146573861483728715,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
      4⤵
      PID:4692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6700,i,9460816406990842633,5661057339751816641,524288 --field-trial-handle=2140,i,6820537513845125356,16146573861483728715,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:14
      4⤵
      PID:4392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,6413540471043895548,7027433259301847599,524288 --field-trial-handle=2140,i,6820537513845125356,16146573861483728715,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
      4⤵
      PID:2900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,17806972278501658199,1835261716748221961,524288 --field-trial-handle=2140,i,6820537513845125356,16146573861483728715,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:14
      4⤵
      PID:2416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,14688115226802355122,10457189428071294079,524288 --field-trial-handle=2140,i,6820537513845125356,16146573861483728715,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
      4⤵
      PID:6104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,2553957829192828501,10953257661810595640,524288 --field-trial-handle=2140,i,6820537513845125356,16146573861483728715,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:14
      4⤵
      PID:1264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,18395989891986062008,10454448487540879738,524288 --field-trial-handle=2140,i,6820537513845125356,16146573861483728715,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:14
      4⤵
      PID:416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,17627045163317998160,116254175186512046,524288 --field-trial-handle=2140,i,6820537513845125356,16146573861483728715,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:14
      4⤵
      PID:2208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6828,i,10901451194105720526,4612273618585064259,524288 --field-trial-handle=2140,i,6820537513845125356,16146573861483728715,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:14
      4⤵
      PID:4716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,17596384695389317138,18017042836261232218,524288 --field-trial-handle=2140,i,6820537513845125356,16146573861483728715,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:14
      4⤵
      PID:592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6444,i,17600671155921879242,15472812143396919179,262144 --field-trial-handle=2140,i,6820537513845125356,16146573861483728715,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:10
      4⤵
      PID:5792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,6033075074515016836,10543304530958238434,524288 --field-trial-handle=2140,i,6820537513845125356,16146573861483728715,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
      4⤵
      PID:3004

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2284

C:\Temp\hfzxrpjhczusmkec.sys
C:\Temp\hfzxrpjhczusmkec.sys
1⤵
- Executes dropped EXE
PID:3676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1552

C:\Temp\tomgeywroj.sys
C:\Temp\tomgeywroj.sys
1⤵
- Executes dropped EXE
PID:2456

C:\Temp\gbywqojgby.sys
C:\Temp\gbywqojgby.sys
1⤵
- Executes dropped EXE
PID:4492

C:\Temp\ywtrljgbyt.sys
C:\Temp\ywtrljgbyt.sys
1⤵
- Executes dropped EXE
PID:124

C:\Temp\qoigaywqoi.sys
C:\Temp\qoigaywqoi.sys
1⤵
- Executes dropped EXE
PID:3680

C:\Temp\icavsnlfdx.sys
C:\Temp\icavsnlfdx.sys
1⤵
- Executes dropped EXE
PID:3152

C:\Temp\usnkfcxvsn.sys
C:\Temp\usnkfcxvsn.sys
1⤵
- Executes dropped EXE
PID:5644

C:\Temp\zxvpnkicau.sys
C:\Temp\zxvpnkicau.sys
1⤵
- Executes dropped EXE
PID:6072

C:\Temp\hfcxupjhfz.sys
C:\Temp\hfcxupjhfz.sys
1⤵
- Executes dropped EXE
PID:5324

C:\Temp\zwuomkecwu.sys
C:\Temp\zwuomkecwu.sys
1⤵
- Executes dropped EXE
PID:1988

C:\Temp\bwtrmjebwu.sys
C:\Temp\bwtrmjebwu.sys
1⤵
- Executes dropped EXE
PID:4992

C:\Temp\rljebwtrlj.sys
C:\Temp\rljebwtrlj.sys
1⤵
PID:5980

C:\Temp\jdbywqoljd.sys
C:\Temp\jdbywqoljd.sys
1⤵
PID:5068

C:\Temp\gaysnlfdbv.sys
C:\Temp\gaysnlfdbv.sys
1⤵
PID:2404

C:\Temp\tnkidavtnd.sys
C:\Temp\tnkidavtnd.sys
1⤵
PID:796

C:\Temp\faxvsqkica.sys
C:\Temp\faxvsqkica.sys
1⤵
PID:2084

C:\Temp\zxupmkfcau.sys
C:\Temp\zxupmkfcau.sys
1⤵
PID:1616

C:\Temp\pmhezxusmk.sys
C:\Temp\pmhezxusmk.sys
1⤵
PID:3136

C:\Temp\cwuomkecwu.sys
C:\Temp\cwuomkecwu.sys
1⤵
PID:4840

C:\Temp\ebwuomjhby.sys
C:\Temp\ebwuomjhby.sys
1⤵
PID:4240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ayvqnicavs.exe

Path C:\Temp\ayvqnicavs.exe
Size 722KB
SHA256 ce134a858fbef5ec23bea20af24ce500befdc997a6dbba3037bf1d81bebfbec0
MD5 274a971416e0201d7882f29f67cdd174
SHA1 47df06fe963f8e10a30c31cc72745202293457d4
SHA512 79d78bba159bd4b01512fc0cc9e9fd1bc124d3530551be6543c5d2eb2dbfc3c869694cc29fc74dde45fa4357a56df9769ca4c25c5afba2b4355af01e61463604
SSDEEP 12288:ZflfAsiVGjSGecvXAflfAsiVGjSGecvX:xMcfcMcf
TLSH
T1EDF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbwtrlgeyw.exe

Path C:\Temp\dbwtrlgeyw.exe
Size 722KB
SHA256 3fba44e6c737add2f1dd02d24e410c26226b5ea35b87f536e2aafef1d72cab8e
MD5 fbbd32a491ef979c2d42e39c87b4b4fd
SHA1 7fe62ec372a648a316eac8715c1ae503cd2a1f9a
SHA512 72e03d6ed93742a64a8f077c3edad0ab2565a8e2ee8e595237ebd6b132340eaea76b6d82063bff77e117c7af7756e86bdc87e95bee23837c165757f4dd33bef5
SSDEEP 12288:1flfAsiVGjSGecvXAflfAsiVGjSGecvX:dMcfcMcf
TLSH
T13FF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbywqojgby.sys

Path C:\Temp\gbywqojgby.sys
Size 293KB
SHA256 b9eda4ad0233638488d73a931702c72b75935abf6849a336504fa697e660819f
MD5 804a920d49892afacf4b16e9fd142516
SHA1 b658ccc78211db549ddcfc6a65e2d669b22c1d3f
SHA512 6eff99750d5e982d6ae615d94b1c1557046a44f09e71c9e8482bbe0054f029de1623ee94d6cbe9232dddb5c8be02d98fcd5b48c9ec2226f45781ffb596b4ff43
SSDEEP 3072:MtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:MIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E6545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hezwuspjez.exe

Path C:\Temp\hezwuspjez.exe
Size 722KB
SHA256 af98674120bf79554d797d714e9c2a613abdf0aa81ebc26af72a420eac427720
MD5 115bd7b9b2643de8f6fa11a5f5930d66
SHA1 f6918b3bcf20102a1a35fd94c82533d1cba849e2
SHA512 14690706d54537ba34d4b08289e28b82b4b439136c3e5a3b09f1793a436fff43cb6a15b91f6caf443293ac25aeceea1decd19e61850b0f482f50a7b7a26c279a
SSDEEP 12288:cflfAsiVGjSGecvXAflfAsiVGjSGecvX:IMcfcMcf
TLSH
T1E8F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfzxrpjhczusmkec.exe

Path C:\Temp\hfzxrpjhczusmkec.exe
Size 722KB
SHA256 cb8a4be3e758abed28ac90342e8859583e52f318b7c2d21ca5f35612a46e2e58
MD5 76dc7655204b84868039c4f989937405
SHA1 72ac1998776ef72b916c5ff0b52dbacc257c8ad4
SHA512 e33ae9791fd9ce770bbd79b8815bb069e7c0130fae0ba9a10a2268dad81f988e41d2a8067d715959725edf09da20f183e311c050d2177abb28cb8609a523195a
SSDEEP 12288:VflfAsiVGjSGecvXAflfAsiVGjSGecvX:9McfcMcf
TLSH
T105F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfzxrpjhczusmkec.sys

Path C:\Temp\hfzxrpjhczusmkec.sys
Size 293KB
SHA256 556cf8629ecff6171f96081ed21d32c6f443308fecbf76a6902a6c7c07db26c4
MD5 5c094b43adb01063e6e0bda4505c68db
SHA1 0e4936b8502be71b5256030239be28cf4d63e101
SHA512 117d6ae1192ded8a25580886c4c0f3a4beb3a2764071ff0dd0f17cec56c784021bb634b826feff0b0e207024aa172595b2e458eededcd91b8bf7fe2496192d0e
SSDEEP 3072:ttKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:tIJjiJcbI03GBc3ucY5DCSj
TLSH
T139545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbwtrlgeyw.exe

Path C:\Temp\i_dbwtrlgeyw.exe
Size 722KB
SHA256 551ad07c03d11eb8087891177817189b9e9c2df00d4b05b5024d43319e2ccb58
MD5 0cfa451148f56387cdf28e7153782b09
SHA1 1cb0567f73f77c1c711581817ec9044ab19aa4b6
SHA512 f39da163b97a6e02a29d7d4a2be3d2b313e004f4bcc56ce96af6042368428506c9cb035e61e0fb6f7e73d97f8ea71164f804657acad26419db4936a34b0f8f3e
SSDEEP 12288:9flfAsiVGjSGecvXAflfAsiVGjSGecvX:1McfcMcf
TLSH
T12EF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hezwuspjez.exe

Path C:\Temp\i_hezwuspjez.exe
Size 722KB
SHA256 8c5f35bbd70cb0d85729d782b53a19fb5c347711e99661cbd29df500458d4e56
MD5 77e1af960f149e9ee595f649f174c2f1
SHA1 99dbf78e39b3cee628c810bf5f3eaffb4b2551a4
SHA512 657c0d0c762d70353ff2cc6708818c45e7c68c1ee22bacf35e8a806aadb654d35baf0318f2c775b36b403cc9e02e94eae25f01364ff81feb9d63ebcded9a812e
SSDEEP 12288:iflfAsiVGjSGecvXAflfAsiVGjSGecvX:OMcfcMcf
TLSH
T13DF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_oigaysqlid.exe

Path C:\Temp\i_oigaysqlid.exe
Size 722KB
SHA256 1c16253ea92e05039cf2b42f43752bfc3a3957c140221c8317bbe1f75c9d87cd
MD5 36d29b4970ebc0023b0fe907776aa210
SHA1 b4ed3893f046468062a30edabe65bff63698f7be
SHA512 4974214811ba82c50ba5b0e927a98e8ff2b9c04df54de86b6f27323c2398aef04688788d7b60c1cb6a3f44de0f870fe3c24d921b130dab5090ea3da2f87920b1
SSDEEP 12288:3flfAsiVGjSGecvXAflfAsiVGjSGecvX:PMcfcMcf
TLSH
T10BF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wqoigaytql.exe

Path C:\Temp\i_wqoigaytql.exe
Size 722KB
SHA256 b71c567c95b41466622324ad2c94fb65ab694f8cd4a4e63125ea4b1a0370a704
MD5 7ce7f5b2ba0331d88dece5d3eb212dc9
SHA1 fbab69f149b553d0e6ee8cef7829bf163d26441f
SHA512 7c82b3ecb07567553ff42687aa7a512ef9242d2819c4f75d25a536606a4ececf50a598e521bba760da5531c5e3bbf70c68e616bf640e401574c36ae8513c20d8
SSDEEP 12288:CflfAsiVGjSGecvXAflfAsiVGjSGecvX:uMcfcMcf
TLSH
T117F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ztrpjhbztr.exe

Path C:\Temp\i_ztrpjhbztr.exe
Size 722KB
SHA256 ab0c812ba6a8e9e60f74a6d92ae02e4e9c99cd639019f462e7bcc9366a45b0bf
MD5 cb0a405c6a59f5ec23e2d3d3c11ce41a
SHA1 aae63d6563cb378b7699dd45bb54e654b2647c4f
SHA512 970910e628761515e47a92e932e44012d1040e85a077055f17334aebb234d03318cb563fca9c5779a16a1a6fc3f917cdb28816d7f931d59197369217d55e94f5
SSDEEP 12288:sflfAsiVGjSGecvXAflfAsiVGjSGecvX:4McfcMcf
TLSH
T178F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icavsnlfdx.sys

Path C:\Temp\icavsnlfdx.sys
Size 293KB
SHA256 6bb0ed490256a6e5c50af9d7231fa69e2eae973e9060771b31a7344ddcb76b83
MD5 322db30f721f2fe6116dc02447a8c52a
SHA1 6e050e3d533346e800b307497aa7952b139e0d12
SHA512 8241fd0eb9bc836b822036e9b02623669a06b9b94fe85ffbdee7e91f68a26089f66d61df63c3d843777b4b2f5cb86f8e62aa0279cf0b5e47f45c5677769b28e8
SSDEEP 3072:ZtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:ZIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D8545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigaysqlid.exe

Path C:\Temp\oigaysqlid.exe
Size 722KB
SHA256 a47883d8f6c7473c38a37a0665a581a1137cef4cd7323e7df371dcfc554b645f
MD5 7e8725ec312b7a445b7d52735c42903d
SHA1 73e9f200ecda01d9b8321e345f7ce606aa0176f7
SHA512 a3f3748dbbf788626ec104de719f569ce76980a16af94d11603da36737f32472345f56e7a35b945985de1b14793ce52232591274fce9edde4773cae55db46347
SSDEEP 12288:IflfAsiVGjSGecvXAflfAsiVGjSGecvX:UMcfcMcf
TLSH
T107F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoigaywqoi.sys

Path C:\Temp\qoigaywqoi.sys
Size 293KB
SHA256 d116feaf8761c6f7830466420d656682bd3bd0f9b7c8a270fa24bdfbfe6dafec
MD5 254b9f083f77c48e0c32198b0e8c728b
SHA1 7b327d40f01e0af677a5a2b835693fd3ca1064ad
SHA512 5b98472fecec08d908b7c8d6b87dd7bdb8012524db147f644baff64932eb136d59d50a6fbad1f1d42e4dde24a8ab3200ab85b68558d89f1b6223225fc2f19d63
SSDEEP 3072:qtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:qIJjiJcbI03GBc3ucY5DCSj
TLSH
T110545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tomgeywroj.sys

Path C:\Temp\tomgeywroj.sys
Size 293KB
SHA256 53c1dac7ec751ea110657b1493845eb2c847341af6a7f97d8569b68188a3868c
MD5 40c7a1761ee00bb34e3e8690898d87a0
SHA1 b9cbfb30325972c4b428f1aa52aff685b870ade4
SHA512 d0318ebad6d8b0b4e50fc836a72cd1321568a01a7f1bf7df22a9b2e5437d1fc45e82f42e24b1f9408c49ad68bf104de89644b8c5f98f2cbefbc5e177a33e9d0c
SSDEEP 3072:ptKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:pIJjiJcbI03GBc3ucY5DCSj
TLSH
T137545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqoigaytql.exe

Path C:\Temp\wqoigaytql.exe
Size 722KB
SHA256 ba6e8595cf2862cdf2548ed0af7100f21d66f7885bcb3db9c2da8f19adadc3bd
MD5 60254ee651fba5bd0885c5fb723bd3fc
SHA1 952316916dfabe7e6db217ee09a68898129e2929
SHA512 77c3fb93238b139b8aed48b082314f99c0c1310803004b10644bc045b1bf49380fd704bccfef55a73c856a253b459665a731a14ff92b34435562b4167fce7a0a
SSDEEP 12288:WflfAsiVGjSGecvXAflfAsiVGjSGecvX:CMcfcMcf
TLSH
T11FF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywtrljgbyt.sys

Path C:\Temp\ywtrljgbyt.sys
Size 293KB
SHA256 c1f294e2a423c4ee171b761b9ffe5ab0dc0989ad6f1dcaf1a28eb779ee4a1c48
MD5 6a55a557180ed3f9904d767909e8dd66
SHA1 25559193f3f34a89cea7cbb521f8c9b835072e2a
SHA512 ca8b048518e0eccb85a639ccd6967af1d86317767979c3a10178823ba926193aacd0b78f51e0c1ae7c74fb23df1cc89ca5b7b8b39902ba06d2cc6a794eca358c
SSDEEP 3072:EtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:EIJjiJcbI03GBc3ucY5DCSj
TLSH
T183545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrpjhbztr.exe

Path C:\Temp\ztrpjhbztr.exe
Size 722KB
SHA256 d62b840ea3f6658b3b7c756563b3202ccac519e8b2a01d445225f535a1710a80
MD5 4dc3f8d069dfe0ca9b50450934609f6c
SHA1 8c7a22f567ebf1cffca2c92d140823be7aea805c
SHA512 e90ece537192721c2a6027e18b742c3edbf4540615bb2500bfd50c5ebcc54f875bfd947009b9a2b9d0dbda5c9064a2ea136bcb614e5eb993f3ebb281c391ddb3
SSDEEP 12288:9flfAsiVGjSGecvXAflfAsiVGjSGecvX:1McfcMcf
TLSH
T175F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 22c1d58ffa7df77a7e0440ce3b2c474b1e03f30b60355bbf5dd6392fefb641fd
MD5 b9f45a900b1f64efbf90731f41c6ad44
SHA1 0c28e85e464e328fbbc07373b05113d39f83bdcc
SHA512 132313545c55ea809da0e811d6d5d324ecf5b6cfaefadb3fa4a29df5e6266dfeca7cffa4daf21754b4b37771504d3692189b5660a468784b5eaf80bf92f59ae0
TLSH
T11ED02BA033044C0CCE40203215B9A210720484204849031A8E41F02C8C6FD4387161F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee3af991fa1719733ca1e3ac746d5b605f4205e269bf244bd9ae780ceadb9bd8
MD5 a044f6413820c4c3fbd300ee9b379ebc
SHA1 94fc91536a25274f06d3a6e89322dec7fde7912e
SHA512 ced4374c54d7b4ea2b76afe4ca5d8841dfb55d8cb5db96de4ed49e64bd3850a817db5301787c268756641c94c0bf85eb4ee188f04fc891fa2e45ad48284985a5
TLSH
T13AD02BA433044D0CCE40203215B8A210720484209C49031A8D41B01C8C6FD4387171FB
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 8ab4705e23c5b946fa98e250be5242b6412d8b7b203e8119ae6d123fc95da971
MD5 d1d56b4cd6b8b425ec0f435cbdfaa32e
SHA1 d33c948d929318d744a42905461dac5044b2eb45
SHA512 2ebfc0b84a50535471d10beefd1efab2fcdaed83538e17e370971ccafba10593440ff9fc8bcfa4eb7b0202a48bc8b9b9ee0985d9239dc8017edc1b74267277b5
TLSH
T15D41E5400B2A29C9F7A850B161E10A7A3EF08C9B4B0F6F005009ED788EE1F520FF026F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 215a1a1f137fe95be43bbc6f437c8ff84b91ca494e8d41e4fea3fe12bd370b22
MD5 1cd7d2956d6554006d847862bd5b81c7
SHA1 5d8de67904f9f24b7bff73b66904979c8dd1294d
SHA512 14b8f2c49040d6441ed8a4dbcc511c653ceba2d4a9dfd0a7fc29d7dddb4fdb080a18b80dd92c5aa89feee5043d9b849a97b1d3d8649d0a535ccd5ab2c865c112
TLSH
T11441A0F783F4856E8A0196F0AA186F1FCE2C0915432C7D9AC5E4EE2793E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d6a3b78be6751ba12331b31444650028442c45da54bc4cf3b3bd2d6b2b8b2262
MD5 06a1bd06fce0364a0322a554314c564f
SHA1 93080347d691103680bdfed901ebb724b1ebe713
SHA512 3ba4dcdcf25ac083907939e3e4945e3638cb2c0a5a5c6613abc2d13c235119dbe4d1ff1f90cd30e889557bdffc033d168223582d6e8c0e48bb5e2aa16259686c
SSDEEP 192:sxRMRMCwf/f1EsYiaZBeIzoD8p93/g6+WNC9J/YGKbnwcGRIgVeJ:sxRMxwf/fisZMBeYB/56/31s
TLSH
T14342C8156D28693B9CC7D70DBA69BF53D2F95032A1D45E48FAFC8A1C04EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c590d7fc71d284faa68612d0c9bd4d1b5c0ca064121539279cf4d83891991157
MD5 681289350f49ca0b225f9cc6e6b6d690
SHA1 d3655e018e79e10dbd035857cf59a54506f108b7
SHA512 b84bca6695f2d55f74e42b914396c978dc6144a444eca9748da44379ef43c26c8b1f08e982dd55ec0084e275485b2fa449e7b5f8155324b64833786d332c4a0f
SSDEEP 192:sxRvRMCwf/f1EsJiaZBeIzoD8p93/g6+WNC9J/YGKbnwcGRIgD6eJ:sxRvxwf/fisIMBeYB/56/315
TLSH
T1B742C8156D28693B9CCBD70DBB59BF53D2F95032A1D41E48BAFC8A1C04EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 21318843c907b7390be578c33b59ddc0cde8d3de953fda4eaf1a08f9a2b6983d
MD5 f3b4c8470e0c7db797a655ca0e244265
SHA1 4bf57941d8a01ba04c37e0d8fd064fe840941960
SHA512 b493e595b2bd2c1d5e1a10e5720c98621a78b296f6d2dc65a2b3bb03b2699786b142761dd97d48602376f11088b4ab5b2fc5dfdb55cfbf5b988028a1f08529c7
SSDEEP 192:sxRvRMCwf/f1EsJgaZBeIzoD8p93/g6+WNC9J/YGLNwcGRIgDgeJ:sxRvxwf/fisCMBeYB/56/U1j
TLSH
T15242C8156D286D3BACC7E70DBB55BF53E2F95032A0951E48B6FC8A1C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 eee931d97501fd48ff049e5a3ca12911608fa8f6077dabfebededc99eed1dd2f
MD5 c8f705e5f7dc56c975adbac930b575a1
SHA1 4f917b21af1cb32b6c0303d903c716ea49accc72
SHA512 693e505dc267abceda3068dd8777050036a571b583fe8b850483be34ca46e409cc4148c97e5c77cd65d2b1948d54098458ec62d59e66266b4f04150829b1e07d
SSDEEP 768:UQYib37pLuL78NWgv7fxJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOK5pNKMroI:UQYibxE78NWgv7fxJu1jaNK5fKXI
TLSH
T19DD2DB7B740CCB7E4F804A9DAD197A9F6DA802CB9698CD8047FE941C02C6BFB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3de367abbcced56d00b634b1c25ed25929e348c793d25b38d9bd167f40ef3272
MD5 a727b5774623153a2d1ad54fbe233326
SHA1 18df67366a3f0f269c9aad24574be3cf366a2176
SHA512 8ab07c873ab7d7a51264e5a4537a204ef6a962f1597e612301e6ea6d1309c957f34efbc8f1b3ed565360aedb1f5f0a0235ff8b54443de7c02abda350a5ff3b9b
SSDEEP 96:KRm7KmgIIOW4tVgGOK47g0OcOGlkgRkQiOCYWm7LgYYK49gKYcY4rKQ1H/oNJ/9b:Cm7KmgIIJ4tWGm7g09OGlkgRkQiOCPm7
TLSH
T14E910715B27A0240387DAA0C85B9885F92C3F4663414A62F7BED52761F26F07ADFE4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2ad99f7d-5bd6-441e-8f45-37a61b568b69.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2ad99f7d-5bd6-441e-8f45-37a61b568b69.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 bdd31e585810d90515fd7c607c99d76c1fb96dccb427b6efe7e7a891169af953
MD5 65fddab032c2f60f5655a23c5f71e70a
SHA1 80dc50c75b94dc67105ddfbd865b294795d835b2
SHA512 993782d09034b0de0e3656bed979599c0007157b45d44f4f6a657ded471c73ec98893b24962e40328076cd5a0b100a0a92017ac037cf249672a5edce3d7b9aae
SSDEEP 768:Krv+4UNbdH3QglYy2iEgs7Hucys6BRvi82oP4/z6himo6JcTRfw:Kbsb13PEA3imOz6Imo+cTRo
TLSH
T1C803BF31B4588D73DDBB9289B04A7B937FF4226345C95D90E5EA9F0E0587A9E130BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 f668879add853722d2fd4e2a2d8fc04c63865f692126de616d464cf977ad369f
MD5 0b7b720961b8ac3abd7afbb6fbcdd8bc
SHA1 28b8efb47ccb3ec875d1e58f10a84b3a0e251595
SHA512 09587e2687775998d2cfd14e2a9618294329d62a00823b313451636f7d1ba160a8453e4763fe72c021ece91517b851c18f4374a6b4328dde8c21ca4219016bf1
SSDEEP 768:6w3bglYy2iEgs7Hucys6BRvi82oP4/z6himo6JcTRfyP:6w3+EA3imOz6Imo+cTRqP
TLSH
T108F2AF30A8558D76DCBBD389B54A3B926EF4623345CC5D80E5EAAF0E0587B5E170BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 c825ccfb55277d3eeff585ff1611767894070f51811500e7e59e252995678f11
MD5 a471e1bb41539588911b6de64af8ec4c
SHA1 7746a1d8e63987ff0f725406833e85dfd13e12d0
SHA512 128af6c52af1ac099d1aa38dd9cafcd4915a14973707d926473ec0aace137b752b0e3f4340213714b606f99f5390e00e43f6dc256e13061588d0fbfca54e0f29
SSDEEP 768:Ow3aglYy2iEgs7Hucys6BRvi82oP4/z6himo6JcTRfyP:Ow3lEA3imOz6Imo+cTRqP
TLSH
T10EF2BF30A8558D76DCBBD389B54A3B926EF4623345CC5D80E5EAAF0E0587B5E170BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 fb25a990ac8e47554549fc7d075265b53c27287d78f1cbcca866b0bb4d46f295
MD5 cdaf2b16f428cd39c795729e54e9a785
SHA1 19e0dca46c0b0f4e27020f5d2102fbb8142272d3
SHA512 a87cbfaa4b284bbd19521525aa64d3a66bdefb91a235190fc6ca451c2db9a2bdf8dcadcca5c41f0b61c8f218ccadad574fc5d1515c0723bacf4f2bde7bb2d306
SSDEEP 768:QFQ437wgGxly6iEgc7Hucys6BRvi82oP4/z6himo6JcTRfyP:D435Eq3imOz6Imo+cTRqP
TLSH
T1EA1318F198D38936E8AE9787A73D6E429DFCD26375889880B7D55E0DCC825BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 7c1a8ad9c3f12d0f6497e0417d7177787928057452b048b5fcbbb7ade1e1fff9
MD5 f4ee34836a63542301d1331bbade0aa7
SHA1 e8c8e5263ed5b39b11044bf69b832c9fb7929c49
SHA512 570f0112463ce1d68b4ab054b76b059db1a777bb16a5afc31e9dfffb4e7655c766c60c443268c0ae12d4d3e781f5f0bdd4c7a54f573c7e3c3d6ce3995dc90bc5
SSDEEP 768:Orv+4UNbdS3NalYy2iEgp7Hucys6BRvi82oP4/z6himofJ2bwn+h:Obsbw3KE/3imOz6ImoB0w+
TLSH
T1F503BF31E4189D73EDEB9288B04A7B937FF4126344C95E90E6DA5B4E0187A5E231FC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 550fbffbd95fbeee89af2ffcca1109641a68770ef218507b7e92b18d36a77a3f
MD5 2cab342d6460a547ec1834ba0e583bfe
SHA1 7dea52336f4a03b3d4126660e259b9bef37188f6
SHA512 c71290888cc63aec1f25afb8432fa90481419c0d20f89c0f7d8aa2fe7ea395feebfa9cdd51c04f6b854c38868148554ec2c91730aebf4b40f21441d215c1432d
SSDEEP 768:xGrv+4UNbdS3Km1lYy297Hucys6BRvi82oP4/z6himo+Cv2bwn+h:xGbsbw3K83imOz6Imojv0w+
TLSH
T1C303BF31E4548D72EDE78288B14A7A933FF4522345C91AC0E6DE6B0E029B95E631BC63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4088_2142281096\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 9789f4e33d44e4b7849e58284cea1aef6d6ab8de370c247b37a2b0135b49b8cc
MD5 6c3ce25759fc1684804e3d8a6941bdf2
SHA1 47c475a80b16ca10bf51c6d8c32b615fd6d8ae06
SHA512 9f621c6436b7a0ab8edaa6b0b47c80a02d81b07385577a9d4fdce04483f4f4738df8eb8c22299977c66b0bfcb675a671acc06872d86509ca4862b305fb650398
TLSH
T1EB71008356B9D9B3C5DA5BF012839208F1BB2278073330208B565646AA30A7A54B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/124-259-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/796-424-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1616-440-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1988-331-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2084-435-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2404-404-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2456-187-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3136-461-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3152-283-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3676-61-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3680-271-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4240-482-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4492-234-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4840-465-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4992-360-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5068-385-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5324-327-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5644-308-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5980-380-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6072-312-0x0000000000010000-0x00000000000AB000-memory.dmp

Download