27e291e90db05741ad755dbcd2ab1e77c7e64e957eb8f032647af7019ecf693a

Analysis

max time kernel
149s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/09/2026, 14:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 722KB
Sample260909-re1fpscd72
SHA256 27e291e90db05741ad755dbcd2ab1e77c7e64e957eb8f032647af7019ecf693a
MD5 a9bfcefb70155c3e4de48b4497b28865
SHA1 ca7068720e7d77428ad4f9b98018a959738937b2
SHA512 3ea6c1abc8ce7a4c5e6100734cfe6f74b43ecbd0e09f56a10c7a0f7d31f1d336c294cadbcbaf1b4250ac58b304a50260cbc1d0cf8a03b02a2fbe494d8603d1f0
SSDEEP 12288:rflfAsiVGjSGecvXAflfAsiVGjSGecvX:jMcfcMcf
TLSH
T1CBF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3420	mhcwuomhezxrpjhb.exe
4164	mhcwuomhezxrpjhb.sys
2680	CreateProcess.exe
4792	mkeczurmhe.exe
5484	CreateProcess.exe
4408	CreateProcess.exe
2084	i_mkeczurmhe.exe
2584	mjebztomje.sys
2348	CreateProcess.exe
4760	geywuomjec.exe
1084	CreateProcess.exe
2532	CreateProcess.exe
3092	i_geywuomjec.exe
4652	ljdbwtrljg.sys
1240	CreateProcess.exe
2544	jgebwtrojg.exe
2904	CreateProcess.exe
5208	CreateProcess.exe
1148	i_jgebwtrojg.exe
2868	CreateProcess.exe
4292	igaywqoiga.exe
4316	CreateProcess.exe
3460	CreateProcess.exe
1700	i_igaywqoiga.exe
1112	oigaysqoig.sys
5064	CreateProcess.exe
4484	fdytqljdbv.exe
4104	CreateProcess.exe
3580	CreateProcess.exe
5688	i_fdytqljdbv.exe
5568	avsqkidavt.sys
3728	CreateProcess.exe
4652	xvpnifaysq.exe
1840	CreateProcess.exe
1976	CreateProcess.exe
5060	i_xvpnifaysq.exe
4272	snkicavsmk.sys
6008	CreateProcess.exe
3236	sqkicausmk.exe
1900	CreateProcess.exe
5476	CreateProcess.exe
1860	i_sqkicausmk.exe
3668	zxspkhczxv.sys
4572	CreateProcess.exe
3260	usmkhczxus.exe
2396	CreateProcess.exe
4344	CreateProcess.exe
3864	i_usmkhczxus.exe
3704	hecwupmhez.sys
5568	CreateProcess.exe
4136	fzxrpjhczx.exe
5532	CreateProcess.exe
2768	CreateProcess.exe
2028	i_fzxrpjhczx.exe
3360	wurmkecwur.sys
3012	CreateProcess.exe
2232	rpjhbztrmk.exe
4284	CreateProcess.exe
1580	CreateProcess.exe
4840	i_rpjhbztrmk.exe
2736	wqomgebztr.sys
2364	CreateProcess.exe
1788	wtolgeywtr.exe
3368	CreateProcess.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4772_1892015669\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4772_1892015669\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4772_387641189\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4772_1961099170\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4772_1961099170\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4772_1961099170\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4772_837793290\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4772_387641189\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4772_1961099170\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaywqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkhczxus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqoigaywtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kifaxspkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmheczurpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywuomjec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxrpjhczx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfzxspkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkeczurmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaywqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdytqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqljdbvtql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvpnkfax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywuomjec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnifaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlfdxvqnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlfdxvqnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhcwuomhezxrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkeczurmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdytqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtolgeywtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtolgeywtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvpnkfax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomgezwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkicausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkicausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxrpjhczx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhbztrmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhbztrmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqljdbvtql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfzxspkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnifaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqoigaywtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kifaxspkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmheczurpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomgezwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljebzojgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgebwtrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgebwtrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkhczxus.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3240	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2024	ipconfig.exe
4680	ipconfig.exe
4336	ipconfig.exe
4268	ipconfig.exe
4828	ipconfig.exe
2052	ipconfig.exe
5128	ipconfig.exe
1708	ipconfig.exe
3520	ipconfig.exe
5128	ipconfig.exe
5216	ipconfig.exe
4240	ipconfig.exe
3564	ipconfig.exe
1040	ipconfig.exe
5988	ipconfig.exe
4188	ipconfig.exe
5748	ipconfig.exe
5352	ipconfig.exe
1656	ipconfig.exe
2108	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134334364402174009"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3989226554-2204910950-1522900112-1000\{CD7EA78F-E29A-4A10-99DA-491481FE42A2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3420	mhcwuomhezxrpjhb.exe
3420	mhcwuomhezxrpjhb.exe
4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3420	mhcwuomhezxrpjhb.exe
3420	mhcwuomhezxrpjhb.exe
3420	mhcwuomhezxrpjhb.exe
3420	mhcwuomhezxrpjhb.exe
3420	mhcwuomhezxrpjhb.exe
3420	mhcwuomhezxrpjhb.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	2084	i_mkeczurmhe.exe
Token: SeDebugPrivilege	3092	i_geywuomjec.exe
Token: SeDebugPrivilege	1700	i_igaywqoiga.exe
Token: SeDebugPrivilege	5688	i_fdytqljdbv.exe
Token: SeDebugPrivilege	5060	i_xvpnifaysq.exe
Token: SeDebugPrivilege	1860	i_sqkicausmk.exe
Token: SeDebugPrivilege	3864	i_usmkhczxus.exe
Token: SeDebugPrivilege	2028	i_fzxrpjhczx.exe
Token: SeDebugPrivilege	4840	i_rpjhbztrmk.exe
Token: SeDebugPrivilege	1892	i_wtolgeywtr.exe
Token: SeDebugPrivilege	1108	i_tqoigaywtr.exe
Token: SeDebugPrivilege	1444	i_wqljdbvtql.exe
Token: SeDebugPrivilege	5352	i_tnlfdxvqnl.exe
Token: SeDebugPrivilege	4492	i_fdxvpnkfax.exe
Token: SeDebugPrivilege	5308	i_kifaxspkic.exe
Token: SeDebugPrivilege	5648	i_nhfzxspkhc.exe
Token: SeDebugPrivilege	5000	i_pmheczurpj.exe
Token: SeDebugPrivilege	2264	i_wuomgezwro.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4772	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 3420	4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 4688 wrote to memory of 5096	4688	2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 5096 wrote to memory of 4772	5096	iexplore.exe	91
PID 4772 wrote to memory of 4436	4772	msedge.exe	92
PID 4772 wrote to memory of 5592	4772	msedge.exe	93
PID 4772 wrote to memory of 3240	4772	msedge.exe	94
PID 4772 wrote to memory of 5592	4772	msedge.exe	93
PID 4772 wrote to memory of 5592	4772	msedge.exe	93
PID 4772 wrote to memory of 3436	4772	msedge.exe	95
PID 4772 wrote to memory of 3436	4772	msedge.exe	95
PID 4772 wrote to memory of 4408	4772	msedge.exe	119
PID 4772 wrote to memory of 4408	4772	msedge.exe	119
PID 4772 wrote to memory of 4408	4772	msedge.exe	119
PID 4772 wrote to memory of 628	4772	msedge.exe	98
PID 4772 wrote to memory of 628	4772	msedge.exe	98
PID 4772 wrote to memory of 628	4772	msedge.exe	98
PID 4772 wrote to memory of 3796	4772	msedge.exe	99
PID 4772 wrote to memory of 3796	4772	msedge.exe	99
PID 4772 wrote to memory of 3796	4772	msedge.exe	99
PID 4772 wrote to memory of 6108	4772	msedge.exe	100
PID 4772 wrote to memory of 6108	4772	msedge.exe	100
PID 4772 wrote to memory of 6108	4772	msedge.exe	100
PID 4772 wrote to memory of 6016	4772	msedge.exe	101
PID 4772 wrote to memory of 6016	4772	msedge.exe	101
PID 4772 wrote to memory of 4156	4772	msedge.exe	105
PID 4772 wrote to memory of 4156	4772	msedge.exe	105
PID 4772 wrote to memory of 4928	4772	msedge.exe	106
PID 4772 wrote to memory of 4928	4772	msedge.exe	106
PID 4772 wrote to memory of 5020	4772	msedge.exe	108
PID 3420 wrote to memory of 2680	3420	mhcwuomhezxrpjhb.exe	110
PID 4792 wrote to memory of 5484	4792	mkeczurmhe.exe	114
PID 4772 wrote to memory of 5276	4772	msedge.exe	116
PID 4772 wrote to memory of 5276	4772	msedge.exe	116
PID 4772 wrote to memory of 4616	4772	msedge.exe	118
PID 4772 wrote to memory of 4616	4772	msedge.exe	118
PID 3420 wrote to memory of 4408	3420	mhcwuomhezxrpjhb.exe	119
PID 3420 wrote to memory of 2348	3420	mhcwuomhezxrpjhb.exe	123
PID 4760 wrote to memory of 1084	4760	geywuomjec.exe	125
PID 3420 wrote to memory of 2532	3420	mhcwuomhezxrpjhb.exe	128
PID 3420 wrote to memory of 1240	3420	mhcwuomhezxrpjhb.exe	132
PID 2544 wrote to memory of 2904	2544	jgebwtrojg.exe	134
PID 3420 wrote to memory of 5208	3420	mhcwuomhezxrpjhb.exe	137
PID 3420 wrote to memory of 2868	3420	mhcwuomhezxrpjhb.exe	140
PID 4292 wrote to memory of 4316	4292	igaywqoiga.exe	142
PID 3420 wrote to memory of 3460	3420	mhcwuomhezxrpjhb.exe	145
PID 4772 wrote to memory of 5728	4772	msedge.exe	147
PID 4772 wrote to memory of 1892	4772	msedge.exe	148
PID 4772 wrote to memory of 6088	4772	msedge.exe	149
PID 3420 wrote to memory of 5064	3420	mhcwuomhezxrpjhb.exe	152
PID 4484 wrote to memory of 4104	4484	fdytqljdbv.exe	154
PID 3420 wrote to memory of 3580	3420	mhcwuomhezxrpjhb.exe	157
PID 3420 wrote to memory of 3728	3420	mhcwuomhezxrpjhb.exe	161
PID 4652 wrote to memory of 1840	4652	xvpnifaysq.exe	163
PID 3420 wrote to memory of 1976	3420	mhcwuomhezxrpjhb.exe	166
PID 3420 wrote to memory of 6008	3420	mhcwuomhezxrpjhb.exe	170
PID 3236 wrote to memory of 1900	3236	sqkicausmk.exe	172
PID 3420 wrote to memory of 5476	3420	mhcwuomhezxrpjhb.exe	175
PID 3420 wrote to memory of 4572	3420	mhcwuomhezxrpjhb.exe	179
PID 3260 wrote to memory of 2396	3260	usmkhczxus.exe	181
PID 3420 wrote to memory of 4344	3420	mhcwuomhezxrpjhb.exe	184
PID 4772 wrote to memory of 1856	4772	msedge.exe	186
PID 4772 wrote to memory of 1856	4772	msedge.exe	186
PID 3420 wrote to memory of 5568	3420	mhcwuomhezxrpjhb.exe	192
PID 4136 wrote to memory of 5532	4136	fzxrpjhczx.exe	194

C:\Users\Admin\AppData\Local\Temp\2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-09_a9bfcefb70155c3e4de48b4497b28865_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Temp\mhcwuomhezxrpjhb.exe
  C:\Temp\mhcwuomhezxrpjhb.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3420
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkeczurmhe.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2680
  - - C:\Temp\mkeczurmhe.exe
      C:\Temp\mkeczurmhe.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4792
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5484
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4336
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkeczurmhe.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4408
  - - C:\Temp\i_mkeczurmhe.exe
      C:\Temp\i_mkeczurmhe.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2084
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\geywuomjec.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2348
  - - C:\Temp\geywuomjec.exe
      C:\Temp\geywuomjec.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4760
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1084
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5988
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_geywuomjec.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2532
  - - C:\Temp\i_geywuomjec.exe
      C:\Temp\i_geywuomjec.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgebwtrojg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1240
  - - C:\Temp\jgebwtrojg.exe
      C:\Temp\jgebwtrojg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2544
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2904
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4188
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgebwtrojg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5208
  - - C:\Temp\i_jgebwtrojg.exe
      C:\Temp\i_jgebwtrojg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igaywqoiga.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2868
  - - C:\Temp\igaywqoiga.exe
      C:\Temp\igaywqoiga.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4292
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4316
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5748
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igaywqoiga.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3460
  - - C:\Temp\i_igaywqoiga.exe
      C:\Temp\i_igaywqoiga.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1700
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdytqljdbv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5064
  - - C:\Temp\fdytqljdbv.exe
      C:\Temp\fdytqljdbv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4484
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4104
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdytqljdbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3580
  - - C:\Temp\i_fdytqljdbv.exe
      C:\Temp\i_fdytqljdbv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5688
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvpnifaysq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3728
  - - C:\Temp\xvpnifaysq.exe
      C:\Temp\xvpnifaysq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4652
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1840
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3520
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvpnifaysq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1976
  - - C:\Temp\i_xvpnifaysq.exe
      C:\Temp\i_xvpnifaysq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqkicausmk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6008
  - - C:\Temp\sqkicausmk.exe
      C:\Temp\sqkicausmk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3236
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1900
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1656
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqkicausmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5476
  - - C:\Temp\i_sqkicausmk.exe
      C:\Temp\i_sqkicausmk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1860
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usmkhczxus.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4572
  - - C:\Temp\usmkhczxus.exe
      C:\Temp\usmkhczxus.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3260
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2396
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5128
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usmkhczxus.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4344
  - - C:\Temp\i_usmkhczxus.exe
      C:\Temp\i_usmkhczxus.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fzxrpjhczx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5568
  - - C:\Temp\fzxrpjhczx.exe
      C:\Temp\fzxrpjhczx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4136
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5532
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4268
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fzxrpjhczx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2768
  - - C:\Temp\i_fzxrpjhczx.exe
      C:\Temp\i_fzxrpjhczx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2028
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpjhbztrmk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3012
  - - C:\Temp\rpjhbztrmk.exe
      C:\Temp\rpjhbztrmk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2232
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4284
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5216
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpjhbztrmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1580
  - - C:\Temp\i_rpjhbztrmk.exe
      C:\Temp\i_rpjhbztrmk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtolgeywtr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2364
  - - C:\Temp\wtolgeywtr.exe
      C:\Temp\wtolgeywtr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1788
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3368
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtolgeywtr.exe ups_ins
    3⤵
    PID:1500
  - - C:\Temp\i_wtolgeywtr.exe
      C:\Temp\i_wtolgeywtr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1892
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqoigaywtr.exe ups_run
    3⤵
    PID:6112
  - - C:\Temp\tqoigaywtr.exe
      C:\Temp\tqoigaywtr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3376
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5524
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqoigaywtr.exe ups_ins
    3⤵
    PID:5388
  - - C:\Temp\i_tqoigaywtr.exe
      C:\Temp\i_tqoigaywtr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1108
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wqljdbvtql.exe ups_run
    3⤵
    PID:1588
  - - C:\Temp\wqljdbvtql.exe
      C:\Temp\wqljdbvtql.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1232
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:204
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2108
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wqljdbvtql.exe ups_ins
    3⤵
    PID:4536
  - - C:\Temp\i_wqljdbvtql.exe
      C:\Temp\i_wqljdbvtql.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1444
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tnlfdxvqnl.exe ups_run
    3⤵
    PID:4380
  - - C:\Temp\tnlfdxvqnl.exe
      C:\Temp\tnlfdxvqnl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1540
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3608
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2024
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tnlfdxvqnl.exe ups_ins
    3⤵
    PID:2952
  - - C:\Temp\i_tnlfdxvqnl.exe
      C:\Temp\i_tnlfdxvqnl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdxvpnkfax.exe ups_run
    3⤵
    PID:3432
  - - C:\Temp\fdxvpnkfax.exe
      C:\Temp\fdxvpnkfax.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3320
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:984
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2052
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdxvpnkfax.exe ups_ins
    3⤵
    PID:2884
  - - C:\Temp\i_fdxvpnkfax.exe
      C:\Temp\i_fdxvpnkfax.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4492
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kifaxspkic.exe ups_run
    3⤵
    PID:700
  - - C:\Temp\kifaxspkic.exe
      C:\Temp\kifaxspkic.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1096
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5160
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4680
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kifaxspkic.exe ups_ins
    3⤵
    PID:1888
  - - C:\Temp\i_kifaxspkic.exe
      C:\Temp\i_kifaxspkic.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5308
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nhfzxspkhc.exe ups_run
    3⤵
    PID:3808
  - - C:\Temp\nhfzxspkhc.exe
      C:\Temp\nhfzxspkhc.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5472
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4624
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5128
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nhfzxspkhc.exe ups_ins
    3⤵
    PID:1964
  - - C:\Temp\i_nhfzxspkhc.exe
      C:\Temp\i_nhfzxspkhc.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5648
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmheczurpj.exe ups_run
    3⤵
    PID:956
  - - C:\Temp\pmheczurpj.exe
      C:\Temp\pmheczurpj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4916
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4600
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmheczurpj.exe ups_ins
    3⤵
    PID:5352
  - - C:\Temp\i_pmheczurpj.exe
      C:\Temp\i_pmheczurpj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5000
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wuomgezwro.exe ups_run
    3⤵
    PID:608
  - - C:\Temp\wuomgezwro.exe
      C:\Temp\wuomgezwro.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4512
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3392
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1040
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wuomgezwro.exe ups_ins
    3⤵
    PID:5828
  - - C:\Temp\i_wuomgezwro.exe
      C:\Temp\i_wuomgezwro.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2264
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljebzojgey.exe ups_run
    3⤵
    PID:1584
  - - C:\Temp\ljebzojgey.exe
      C:\Temp\ljebzojgey.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4192
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6060
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1708
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7fffa175c188,0x7fffa175c194,0x7fffa175c1a0
      4⤵
      PID:4436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,7482385181783531140,6184952963955246481,262144 --field-trial-handle=2872,i,11995423945855419110,12902026274925512811,262144 --variations-seed-version --mojo-platform-channel-handle=2868 /prefetch:2
      4⤵
      PID:5592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,1467612295211450768,5654100571796294048,524288 --field-trial-handle=2872,i,11995423945855419110,12902026274925512811,262144 --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:11
      4⤵
      System Time Discovery
      PID:3240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2324,i,1431603153709398946,15577645165134721524,524288 --field-trial-handle=2872,i,11995423945855419110,12902026274925512811,262144 --variations-seed-version --mojo-platform-channel-handle=2952 /prefetch:13
      4⤵
      PID:3436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,6309273499971996597,15606607466746912464,2097152 --field-trial-handle=2872,i,11995423945855419110,12902026274925512811,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
      4⤵
      PID:4408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3580,i,11404320229030542135,15917919022817490879,2097152 --field-trial-handle=2872,i,11995423945855419110,12902026274925512811,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
      4⤵
      PID:628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,17152007072904367056,15481415999798325669,2097152 --field-trial-handle=2872,i,11995423945855419110,12902026274925512811,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:9
      4⤵
      PID:3796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,15413096621291246329,4894823595225118126,2097152 --field-trial-handle=2872,i,11995423945855419110,12902026274925512811,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:1
      4⤵
      PID:6108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,636473225642483705,8132556247598137208,524288 --field-trial-handle=2872,i,11995423945855419110,12902026274925512811,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:14
      4⤵
      PID:6016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,4025356976729298053,17604342202499328669,524288 --field-trial-handle=2872,i,11995423945855419110,12902026274925512811,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
      4⤵
      PID:4156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,12451308785994531496,8590570070776269574,524288 --field-trial-handle=2872,i,11995423945855419110,12902026274925512811,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
      4⤵
      PID:4928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,15691477880622973395,13677905640027171066,524288 --field-trial-handle=2872,i,11995423945855419110,12902026274925512811,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
      4⤵
      PID:1556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,15691477880622973395,13677905640027171066,524288 --field-trial-handle=2872,i,11995423945855419110,12902026274925512811,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
      4⤵
      PID:5020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,12399121409969668722,5417207540376442150,524288 --field-trial-handle=2872,i,11995423945855419110,12902026274925512811,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
      4⤵
      PID:5276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,12361412743111099117,10074116488473174337,524288 --field-trial-handle=2872,i,11995423945855419110,12902026274925512811,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:14
      4⤵
      PID:4616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,1875413923860649502,12693319358831432439,524288 --field-trial-handle=2872,i,11995423945855419110,12902026274925512811,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:14
      4⤵
      PID:5728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,15593094970874302949,2877978507273215294,524288 --field-trial-handle=2872,i,11995423945855419110,12902026274925512811,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
      4⤵
      PID:1892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4612,i,5965250727811807866,11950318359304318589,524288 --field-trial-handle=2872,i,11995423945855419110,12902026274925512811,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:14
      4⤵
      PID:6088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,16780038935452363177,12574001206937176254,524288 --field-trial-handle=2872,i,11995423945855419110,12902026274925512811,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:14
      4⤵
      PID:1856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4108,i,14264509078627133327,14076685074241927229,524288 --field-trial-handle=2872,i,11995423945855419110,12902026274925512811,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
      4⤵
      PID:5528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,12862014948356953743,1302391083167715431,524288 --field-trial-handle=2872,i,11995423945855419110,12902026274925512811,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:14
      4⤵
      PID:5920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,167863601824724532,15512029284899542688,524288 --field-trial-handle=2872,i,11995423945855419110,12902026274925512811,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:14
      4⤵
      PID:2072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3144,i,5235895028097194719,15467877638137102288,262144 --field-trial-handle=2872,i,11995423945855419110,12902026274925512811,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:10
      4⤵
      PID:4872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3448,i,18359556891339837231,4441177282451245710,524288 --field-trial-handle=2872,i,11995423945855419110,12902026274925512811,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
      4⤵
      PID:3692

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1212

C:\Temp\mhcwuomhezxrpjhb.sys
C:\Temp\mhcwuomhezxrpjhb.sys
1⤵
- Executes dropped EXE
PID:4164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4492

C:\Temp\mjebztomje.sys
C:\Temp\mjebztomje.sys
1⤵
- Executes dropped EXE
PID:2584

C:\Temp\ljdbwtrljg.sys
C:\Temp\ljdbwtrljg.sys
1⤵
- Executes dropped EXE
PID:4652

C:\Temp\oigaysqoig.sys
C:\Temp\oigaysqoig.sys
1⤵
- Executes dropped EXE
PID:1112

C:\Temp\avsqkidavt.sys
C:\Temp\avsqkidavt.sys
1⤵
- Executes dropped EXE
PID:5568

C:\Temp\snkicavsmk.sys
C:\Temp\snkicavsmk.sys
1⤵
- Executes dropped EXE
PID:4272

C:\Temp\zxspkhczxv.sys
C:\Temp\zxspkhczxv.sys
1⤵
- Executes dropped EXE
PID:3668

C:\Temp\hecwupmhez.sys
C:\Temp\hecwupmhez.sys
1⤵
- Executes dropped EXE
PID:3704

C:\Temp\wurmkecwur.sys
C:\Temp\wurmkecwur.sys
1⤵
- Executes dropped EXE
PID:3360

C:\Temp\wqomgebztr.sys
C:\Temp\wqomgebztr.sys
1⤵
- Executes dropped EXE
PID:2736

C:\Temp\bywrojhbzt.sys
C:\Temp\bywrojhbzt.sys
1⤵
PID:5352

C:\Temp\vtqljdbywq.sys
C:\Temp\vtqljdbywq.sys
1⤵
PID:4768

C:\Temp\yvqoidbysq.sys
C:\Temp\yvqoidbysq.sys
1⤵
PID:1576

C:\Temp\nifavsnlfd.sys
C:\Temp\nifavsnlfd.sys
1⤵
PID:5692

C:\Temp\sqnifaxspk.sys
C:\Temp\sqnifaxspk.sys
1⤵
PID:4768

C:\Temp\spkhcausmk.sys
C:\Temp\spkhcausmk.sys
1⤵
PID:2120

C:\Temp\mjhfzxromk.sys
C:\Temp\mjhfzxromk.sys
1⤵
PID:4860

C:\Temp\ztrmjeywro.sys
C:\Temp\ztrmjeywro.sys
1⤵
PID:3204

C:\Temp\jdbztromge.sys
C:\Temp\jdbztromge.sys
1⤵
PID:3744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

avsqkidavt.sys

Path C:\Temp\avsqkidavt.sys
Size 293KB
SHA256 9c6147510b31b824b1f8d03af848f1a1dd459358959ef3985a4263dd2aac98db
MD5 9fb8c57cb18860de0f1916c02275a700
SHA1 7f0a99430cb4a89f27cc2e53c129a8c4783e1d2a
SHA512 f5634f76ea6ac88a7968a93b8a1a5e91739284e7714a00b35786d0ba4e226aaf573223ba3269ad5d59dd07037dbe743fe64c46f7aba86f79d192064108c849d4
SSDEEP 3072:KtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:KIJjiJcbI03GBc3ucY5DCSj
TLSH
T105545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdytqljdbv.exe

Path C:\Temp\fdytqljdbv.exe
Size 722KB
SHA256 3faaca35fb9a9e84786311e44d146b6c49927fe45184f868ba4e736c4b2b85d8
MD5 75d022a1284972e493352c67ee220567
SHA1 8cfe29cfeb2f5aaeb0cdd115d9817d1ca58ce4f9
SHA512 57b5095f561a7a8b8da33f605419e3551d7db9591bb6596de0ec9ef00be506523fdd31a2872de2ddb8597ee7d477ab9eb610c5f8305d900ad38bd7021f3f21de
SSDEEP 12288:4flfAsiVGjSGecvXAflfAsiVGjSGecvX:kMcfcMcf
TLSH
T1EEF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywuomjec.exe

Path C:\Temp\geywuomjec.exe
Size 722KB
SHA256 f193db6107aa041069522906c57c21b5e525286625a545f857867e98603c7649
MD5 d4908530925576baec8503d9bdba80b3
SHA1 189ccf6e8266146a21908040abfb544ca83b528e
SHA512 37bed86aaeb082c46b56b729053584b8cf97fb9ae5fddfbbd7973b55bdcd7bcfccc1ec83efac99e1f444e899572ae463df887b3445c9e27fdc837441774f72ce
SSDEEP 12288:3flfAsiVGjSGecvXAflfAsiVGjSGecvX:PMcfcMcf
TLSH
T1B3F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fdytqljdbv.exe

Path C:\Temp\i_fdytqljdbv.exe
Size 722KB
SHA256 4d6102f0fcd9072b217e8209f52b8c474db357f653742fd5b39c96ace4e82695
MD5 7239acedc3f884b6267e59001af4a76b
SHA1 44172218a84fdc390bfddb9af145676a334a8bf8
SHA512 5632f1aeac7bd89b87b3f067f89780ca03395b0c2558d50242d5ff37bba6429daa9fdb66e3ea9305529ea737ac2684768ccffb740fb592a3c5db6b70c295dac4
SSDEEP 12288:NflfAsiVGjSGecvXAflfAsiVGjSGecvX:lMcfcMcf
TLSH
T131F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_geywuomjec.exe

Path C:\Temp\i_geywuomjec.exe
Size 722KB
SHA256 9b7a6adf1e5a5381b02f1f21356102dd04bb9008a01eddd8982ed5ee81096764
MD5 5a9528562876af3be3a8950358dcb8a3
SHA1 fd403d6a9b88cfa0393e526ddc912fa1a5306f76
SHA512 6c076f1b18cde28c3768aea5f3a47855c82f8ec2420db6b08c29f3f918fd604f8acab256c1135b6149612fc3df3ac34bc0aa894a79cbb20f7098e3207c3f5f4c
SSDEEP 12288:RflfAsiVGjSGecvXAflfAsiVGjSGecvX:ZMcfcMcf
TLSH
T150F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igaywqoiga.exe

Path C:\Temp\i_igaywqoiga.exe
Size 722KB
SHA256 c543e93a493e37f4d7231998be0d3ee99503c1172a8141cf7a167197212be687
MD5 69b0c5967e8535f574e77dc438ce1287
SHA1 aae843dc76c79ca74dda5e0b83d565c55b50444e
SHA512 92ca7c8322ddce98f929b4be70c1f643c5b4a0c0f75d004ed693e41cc8be9dc261acb90c45c3c4f30a5361d43af00de1d7ea2dbe20b665a487ec847185851b73
SSDEEP 12288:BflfAsiVGjSGecvXAflfAsiVGjSGecvX:pMcfcMcf
TLSH
T1D0F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jgebwtrojg.exe

Path C:\Temp\i_jgebwtrojg.exe
Size 722KB
SHA256 b148c9f46d6a75493b2e458954dbd9a7b877b43451c4844987ef6d3265aba7bf
MD5 210fd4cc24f0817aebb4b7c06797f311
SHA1 7b5c7505f7b6142349ab94fe3b0ffb183d0b3350
SHA512 eeef82550de8f802c5a256286318e7811e1a44a0085bbd19e2f5e012f474da8f9aec9d01c073a4b1fdd756cded4c7d98f9b552ba89143c27517052e17fdb29fb
SSDEEP 12288:uflfAsiVGjSGecvXAflfAsiVGjSGecvX:KMcfcMcf
TLSH
T13AF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mkeczurmhe.exe

Path C:\Temp\i_mkeczurmhe.exe
Size 722KB
SHA256 b96b596245b49491e10a5b6448642ad71f8af2b8cfb01bbfb8893e3e9c0c5881
MD5 ad62d1ce30df80d397cbe0f896fedc70
SHA1 4bb23feddc13beca031a215efa26aa7aa4592779
SHA512 d48def66652a881a232dee9036dc8bef7ebe9a02557e76164f174750572fc6e7156f3129666159596ace3e8f2b108a6d13aded77038ab563bc3a25cc27caeb4d
SSDEEP 12288:iflfAsiVGjSGecvXAflfAsiVGjSGecvX:OMcfcMcf
TLSH
T16BF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xvpnifaysq.exe

Path C:\Temp\i_xvpnifaysq.exe
Size 722KB
SHA256 0960257b720f7c9d8d37f074c0eb705156d04df4ac96106396f3f0e4b001c6a7
MD5 094a74b910d30efeac34b1d1ceb11979
SHA1 7146453fcbaec6649e0a86f6803bf5961ef8a42c
SHA512 a139c1d9376365051fd2b4c1a9b41d896d05ed91a3b91a1d78d8626dbd1cae8771f2328f6b91cc3b425ca9e61df0a369b0353342cfc2df1660f976872683221c
SSDEEP 12288:lflfAsiVGjSGecvXAflfAsiVGjSGecvX:tMcfcMcf
TLSH
T170F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igaywqoiga.exe

Path C:\Temp\igaywqoiga.exe
Size 722KB
SHA256 a0082daa7bee955c501a78bc40d6d9e9b48dfa95c4bf952a40928fb54e9cec7b
MD5 057b79a2ffb8e5f0ec0f661c873ab7ac
SHA1 0c4cfa35af68f6c21184a6a6086c810b7b8a9479
SHA512 b3d46e441bfb64ea0dc27e7b8caf489ab77ed734a1d02c80073cdfb62a464728280c91533b148a54e6e0e26a531645a2e33ea25e688c705cc77e278ca51915d7
SSDEEP 12288:qflfAsiVGjSGecvXAflfAsiVGjSGecvX:mMcfcMcf
TLSH
T1A5F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgebwtrojg.exe

Path C:\Temp\jgebwtrojg.exe
Size 722KB
SHA256 69d907ce4ca95dfd4c540fd1f3628b9855df8e7533e4df4ebef65e18a369c1d7
MD5 ca0be96f93672de924bba04d45231d1f
SHA1 aace7119f35eb66e67579002dd67ab45876a9dac
SHA512 7d0b1299952d64445da30b9037ee9250742cfdd1db95f2c1c809054ee430420db02bb882aa1080482418bc4ecb97be487293a3c08ae5241a01870b0a62c6a97e
SSDEEP 12288:vflfAsiVGjSGecvXAflfAsiVGjSGecvX:3McfcMcf
TLSH
T1E9F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbwtrljg.sys

Path C:\Temp\ljdbwtrljg.sys
Size 293KB
SHA256 3e139b1e51177025f711afdbf6c4ee54ada13f0eaa8bcdfdec7af5c961a4de8b
MD5 a680ada0ed813fd82ea8184944d7a2d5
SHA1 eaa42a0b9f5c1597bf8e59df0b79a73d7591904e
SHA512 7705096657e11ced350baae630e019ce6fb5bf0c55785bcf9e0488c29c9c8b483efac358af7a932f106847685aa06fe6828ede243ef40cbc9531a41ffe519564
SSDEEP 3072:EtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:EIJjiJcbI03GBc3ucY5DCSj
TLSH
T15A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhcwuomhezxrpjhb.exe

Path C:\Temp\mhcwuomhezxrpjhb.exe
Size 722KB
SHA256 b5203f24a56971b876339e3b09c991f139a99a75c25cd5281a52cd043b901d73
MD5 268320c4e39e91010ed7f25464787c4a
SHA1 3c11d7af1cb483a31d2fc0650686224ff0dd3e11
SHA512 7a9e5a461973be1dccb9c798c05d5d19ef319a2a75933b1ae5b6482a4b0e8fba3e37eef23fc003ad13312e1572e2ec38b6d89deff89854eff22d1039cd2a0d8a
SSDEEP 12288:/flfAsiVGjSGecvXAflfAsiVGjSGecvX:nMcfcMcf
TLSH
T15FF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhcwuomhezxrpjhb.sys

Path C:\Temp\mhcwuomhezxrpjhb.sys
Size 293KB
SHA256 ab7675d21b161cc3b92d4443f51c17d8219c9be5e3da40e873b679f221baaaa9
MD5 398c05c388b50076e91f84139d59e1f2
SHA1 bb19af03378de0e9a0e30dc303ede0eefbad090e
SHA512 cfba07b90e09ddaf27c7fd4e52368d5703d8476bdd9f78e990037e52375cfa1d211a97733533e5db4ca02d10cf70fe206a311c9a74742588c9a3e9a5aca1758f
SSDEEP 3072:5tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:5IJjiJcbI03GBc3ucY5DCSj
TLSH
T16D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjebztomje.sys

Path C:\Temp\mjebztomje.sys
Size 293KB
SHA256 be73086c2a431de94a2081ee06de22f15aecf438c419a1529af72ca6a47d50a4
MD5 ab279d1b0cf62faa6b34cffd72cd0de9
SHA1 10c037d623eec23ebd877e6d3794e00d1258d645
SHA512 111cf3b85d0016a49630c5289de11823c2c52c636d7d68b0118c4c8bfae086898fc29aca36d42c85558cf87adcc83582c86f36c32238ef05ff17d15f08aeb638
SSDEEP 3072:rtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:rIJjiJcbI03GBc3ucY5DCSj
TLSH
T1FE545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkeczurmhe.exe

Path C:\Temp\mkeczurmhe.exe
Size 722KB
SHA256 168b656f08f7c445a5cf51e05ac01ca3245ffbfb75a7bd59c5d86342e06de382
MD5 659cf1cd733eb3603d977937e3813f56
SHA1 101a5ef863bf64fd28d62a462e44dc7ffcab30c2
SHA512 b448c618d166af1fe354cb18ad74fdef3f068249ca202c2d49bd055171126f41f29919f374150b0d3e74d89aefd9ad7f5f778aa7ff967f545defd8bf56ddbc4e
SSDEEP 12288:iflfAsiVGjSGecvXAflfAsiVGjSGecvX:OMcfcMcf
TLSH
T122F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigaysqoig.sys

Path C:\Temp\oigaysqoig.sys
Size 293KB
SHA256 4279181aee6b0eed78e1c86711064fd3cc27164d30c078f4daf86b7b13256a4c
MD5 7f1b9b3b04ff57af08419ddd6722e23f
SHA1 ad6ad69e87b91c72cdbea5aa4d08cc3794ba823e
SHA512 507cb0cce66811c8088ddf81ff0c01e60c5cc8a83847ce063824e518d416b8f3b1061d580cb32c6b519f0888525d1b0e32b6341a9edaa4c50a54d966451aad4c
SSDEEP 3072:/tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:/IJjiJcbI03GBc3ucY5DCSj
TLSH
T197545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvpnifaysq.exe

Path C:\Temp\xvpnifaysq.exe
Size 722KB
SHA256 817f327d541e5f964b349628961367c0d4e77fa4b1f4963b74b2c24d163c32c4
MD5 a5cf275f7dc659e315cf0ed8a4b518c7
SHA1 7e9f23f67fedfe5744838ef1bf207ae3228eee9c
SHA512 d78b1bad7a02a4997d7e2280a94bdfa2215f62b905ebb4e85114a067ec23420007fbb224c531fbe3b3be861950a872c0d6eed1b3e76389d4e8083f7a21c34ebf
SSDEEP 12288:jflfAsiVGjSGecvXAflfAsiVGjSGecvX:rMcfcMcf
TLSH
T121F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 a6673ce49b12fdcbb7d76835e1b016504a29767f7212d8e801c405cb7104ab24
MD5 ca6c08209c2d38cddd20d85d8c5dc47a
SHA1 cec1cabd103f18062e7cb4e4d6f0d8b419a6c0bd
SHA512 21049ac949a133b2d3655a743fa48fb77fd023763be431c403808d8b8cc86ade7133ad2fd2407bc2f19378bde77d294fb858d77ccfdd369434389ccbd4e515c6
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7V:fwUQC5VwBIiElEd2K57P7V
TLSH
T17AB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
MD5 e1ae04b3e73ad5ac4854b3b71e22d4d3
SHA1 221461b4f2d9e84e2f881b5a79edfef3705178db
SHA512 58529610d3f5dd7778bff3b81dd8abd9d79702eff78583d0294f3999089de0bbf84f0abad703269c0988835522b1d8d48e9f3c65472a409c5868fc3547c3fb1b
TLSH
T138D02B206A54494CCDC0B03464A3EA18E2004135140013C44001F07988901830B970CB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
MD5 8af1f60999c332d8cf9a392cd968a81c
SHA1 93834a1f070ff24041a0deb17d95d868998c98ba
SHA512 95d5c6b0fed3c3dce459178eafa2e9fa13b06caf50a5b294d66ecf16bf91357eccebec57e01d50e054232862c252fc80f7300e865318ec24078f9288a88c63d4
TLSH
T17BD02B206A444A4CCDC0B03064A2EA18E2104135680013C44001B06988901830B970DF
MD5 SHA1 SHA512 TLSH

Submit Download

182816d7-a0e0-4896-b9f7-61be24436c25.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\182816d7-a0e0-4896-b9f7-61be24436c25.tmp
Size 14KB
SHA256 3008d016c347e937de9a3e406c7d59d5dbd27bb7d6cfbeb66e0ce7c1cfedc815
MD5 a42350e784951d1e045663cee220d749
SHA1 30fab43ccbc8d681e09e2678908d13b9b8728480
SHA512 e766adcfe12bb28ce1e690c215e3f0109094ad65026c420c80bbebb3b49be5dd9a27252e0863b830e84aff333538e52efbf779b37994c6a428cd2e9a05f2d9b2
SSDEEP 192:sxRHRSyM/jK1Ml8wCx/fIspYZSPUM4VzoD8p9t/g6+WNCyZ/Y3t2QMG0IgDwVJ:sxRHc8x/fIspmSMLH/5t/u4S
TLSH
T1D062E915A5349A7BCCDBD30DFA957F93D6F85663A1901E44AAFC8A1C00E66EC231381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 c6fc46011eb9e70546646bbbe3d367dae47aea730f0fca933d07ea94721164e5
MD5 1e9e71cba0d8c17779065250c26ece7e
SHA1 873a23e7cc25342daacd5ea8c3e344aeb3525f30
SHA512 16366ca446629dce57617627bd315522a7ab47685190db8fbbe4d2831c35b52c936223ea0882b188d1e68a51f41a85942f47b30b68c93aa4d79f79daa6179915
TLSH
T1B841E92A83240DF3F7A16DBEA0F1575936F4D06909872F6058409EB45AA3FC637D0353
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5973bf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5973bf.TMP
Size 2KB
SHA256 9f882d628e9f2791cd1ae5929d600acd50ca369bb881ae1dcfd87e179291fb04
MD5 67e8164862d988fb345f351c7a7984c9
SHA1 e86343c1a83dcda971fced883f16f5af286f7dfe
SHA512 62fb21ec4cd4168f75366f81246a51bcf8181c2481ff0455703e24288184a61f16bbc830a269a4ae4d7c9daf1a68cd06d6c81a16bafea79ad932617363de56ea
TLSH
T13E41E92A83240DF3F3A16CBEA0F1575936F4D0A908872FA058409EB05AA3FC637D0393
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 96d07f67dad8ae386c8d75d9253b5c84e43d43f6e58b631e32c56997452a0053
MD5 0af8cecf7b660c757fdf7fedf91a637a
SHA1 2d868c357b9cc4e9319b7bc320d874e04b3c02b1
SHA512 31997958d48f67318c707d1c382615547e3b5b9193a1725efd895a262dfa33cbf9f1baf9223c74ff56a592acde7331f9b9ec9fc193daa70e27fe6437f50d0af3
TLSH
T16B41BEF783F4956E8A0196F0AA146E2FCE2C0511432C7C5AC5E4AE2B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 79cded9343fa27327ac3f9e28d2b36db27f7afe081245f347e24ab24a2c02ee2
MD5 ce8fd5be4913517a3bfe0a07f4963544
SHA1 0f060fb25841bf02003508eaac72476797c7b625
SHA512 91223bcf97b5592c56a1c7ce966fc00d95810c1c6d449b7e29873439acbf87d759a19212eaa0ee22126075be0debca353c13e2d8f7c5d9c9f9cf12c2a88e65fe
SSDEEP 192:sxRsRSyM/jK1Ml8wCx/fIsbYZSPUM4VzoD8p9t/g6+WNCyZ/Y3t2QMG0IgVVJ:sxRsc8x/fIsbmSMLH/5t/u41
TLSH
T1E662EA15A5349A77CCDBD30DFA957F93D6F85663A1901E44AAFC8A1C00E66ED230381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 4f480f336bf4b08d79319f8fab301943bb21494128283f69c1426f44ea45faa3
MD5 bef0b08ee376e2385d6d0e7c4a793b09
SHA1 ccf68d5a341a5a7494eeeb290dc44fd8276a99e0
SHA512 a51918a922ba6cde6270767ddd8538fef2776f78d0d2f990f06027883cb5b171f25559a5a179d0c14f43eedf593ca9dddd0ddbe0ff0d47fcdd1017f19607a36f
SSDEEP 192:sxRHRSyM/jK1Ml8UQhCx/fIsxYZSPUM4VzoD8prt/g6+WNCyZ/Y3eGMG0IgDCVJ:sxRHcq4x/fIsxmSMLB/5t/bU
TLSH
T14562E815A5349A77CCDBD30DBA95BF93D6F85673A1901E44AAFC8A1C00E6ADD230381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 d862274dc07a4d44e23991392809e9cd88042f3a74a5a77a153adce5ed1531d7
MD5 f8e2d4609f2daeb78cee651fd9e3e29d
SHA1 cf31e5e0a69a88cb66902a477201349cf7adfaa7
SHA512 3cf390d2f5989c5efb019d615b0b29db95771fb3f5b6de202e932976b359e82dfe7feb5efff90c754bf5249a61bed887d6630f46817e928e2944a4886d92f6fb
SSDEEP 768:GiqbLo7pLuL7hkWg0CfDs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsFoMW6qrojxi9:GiqbLUE7hkWg0CfDsu1jaXFoF6Bjo9
TLSH
T1D5E2FC3B680CCB7E4F804A9CEC2ABEDB6DA801CF5698C95447EA841C03C67FB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a7f8b25f3e35007664f402ccce5bb9a80a254ec26e43eafbb8538a74720a27ad
MD5 5352550435d5b31eb8244465c66f85e0
SHA1 83a707de8710881c2ca0a2163e860146e6edb93d
SHA512 032ea17632a5f5841f5eb945a0a235a8b89dcd7491b0cc61849d8a3b9f297187d8afdce718e861282cde211cc3453ed6611926ccb6a3248f46e1bf89dc1433e5
SSDEEP 96:KR1i7PF/DnWrw+gXnK4mgpnct1o7zsH/f/I/t/p/f/d/9/xW/J/m/sg/R/xK4/4C:C1i7PF/DWrwfX9mgpct1o7zsH/f/I/tt
TLSH
T10D91D316353A0240383EA90CD1F9DC6ED6C178637019F56B3BA915A66F6BE038CFD8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c240fd64-ab70-467c-adbc-87f176acc7af.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c240fd64-ab70-467c-adbc-87f176acc7af.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 ae8279f18efc75a48ab0399d6cdeba4a85ab64c90566cd6f6b2aba6dfc41afda
MD5 91e1a5c04d79aaf0b82f54c9c567db4d
SHA1 5e3d3ff656223fd0de04535e95f3da3f95c33c70
SHA512 fa73ec51aa1f8db518c516e4a0d5b015bbd237a1666e30d3766eb63612df6491d38768b32db78dc4bdf9671f6f6cd021f07e3c9c562a88aa8f19b7f6eec2881b
SSDEEP 384:nNZcIe38NvQ0PFFmycHGfd+UJfRXOVyS5XY3Y3fp+Hk9vShCiDBTayppFJlmqJrY:Ve3mezc+wfZOFOQfrvShCQRycTRU7
TLSH
T122F2BE71ECB42A738DE6C389764A7B43BEE55223D5C94A44DDDD5B0D00836AE2707C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 3b55f339e8df716bbd02dd4685c4468137ccb6cb5bcbdfe7f56305390582c35e
MD5 8897f8110ff23e8ad813c672702ca6ef
SHA1 1554916365d1eece0972ad07ce05dfc376d40436
SHA512 9d49f8fd7b18b6604968d13f6d770dbffd0f2cc44880f172f67b28859c4951476d1adfa4b96ea95a131af8138cd543052e77a2b44948562ffb97d49504fea011
SSDEEP 768:1rv+4UNbd436Rc+wfZOFOQfovShCQsy2bwWV:1bsbO3GwftQfovSd0wO
TLSH
T1F803CF31E8686673DEE386887646BF537FB89263D4C50684DADD0B0D018769E230BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0940633a1309518d708a34b245537c76fbb0729076b02fb4c7f578100a539bb3
MD5 73a5b0ebe9a65ee5612a8bbbce9f4694
SHA1 c752cc58eda7241fef96da3b49a0066eb5a8a98a
SHA512 a0da140875f745e3e8da0c251438d00e1151b416fd2e99475ece706d0cd1539f92faf57ad6a20b44605b2ce112c5c631c341e0d030eb4a57bdf18085c5902371
SSDEEP 768:rrv+4UNbdR3ohzc+wfZOFOQfDvShCQRyEmE:rbsbz3obwftQfDvS2EmE
TLSH
T12203AF71FC746A73DEF28748B6467B537FA46223D4C90684D9D94B0D01876EE270BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 dd10fbc2ca60c6d7a4bd9d05b10d53bc7b15e37bc49bea12c13acff6eef34808
MD5 5ec3b032c4e88ee9fd7f7a4fc709c3ce
SHA1 fa410248184f247ee5268c705f6f49a4ffb9add4
SHA512 4a2c180d2830583c31499b8904a3b781aafe3c0fa05b3f79c4b329f29b89a63a45779a0d09dd021e3e0df1ee61fbc9a7cff6338482aee1788ea403a932ab09cd
SSDEEP 768:sFQK3uwgiZzgtfZOFOQfsvShCQRycTRU7:fK3TGftQfsvS2cTRU7
TLSH
T15C1317F198E39A76D9EE8787673D6E02ADBDD253B5884484BBC84D0CCC821BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 c262b373740c5f4e97c3474da5f3561a8ea0c075cf4e7e071fb590d99c79dab5
MD5 a3ee6149c5deaff41e93356803f21e3c
SHA1 ca017607a581e0304482492d6c2ff3bf91d57af2
SHA512 e559d054995ab79b793d1e5fcf34936b844260fca6dbc256801b84e2deeb55b62fc00e7cf618f47a301e558f6bd981fcfc43d86097a5d2d0c80bcfb025a3baf6
SSDEEP 384:n/sZcIe38Nvv0PFFmycHGfd+UJfRXOVyS5XY3Y3fp+Hk9vShCiDBTayppFJlmqJ8:ie3pezc+wfZOFOQfrvShCQRycTRU7
TLSH
T148F2BE71ECB42A738DE6C389760A7B43BEE59223D5C94A44DDDD5B0D00836AE2707C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

e1e85b57-5cf6-4b02-bb48-747d60e4efd5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e1e85b57-5cf6-4b02-bb48-747d60e4efd5.tmp
Size 38KB
SHA256 88ef96572b120a0c0a8222daf3eda835cec4d2998e48757bcd03414ccf7f7927
MD5 7d6e95d4d70fd183b3efc2d7f9eb07b9
SHA1 3b57f74c894b58005c1a04ef2a40f2f4d5543adf
SHA512 c5e238085c870331043c1e4aaf7afeac9dca44c58be778df2089fe6cbef9ee9de20fee1ed89fe70503f17953ed96d353c888a8f03919f1f1fd88a2cd7671cffb
SSDEEP 768:Rrv+4UNbd43dtkc+wfZOFOvvShCQtb2bwWV:RbsbO3d0wftvvS30wO
TLSH
T1B803CF32E86859739DE782487646BBA37EB861B3D8C54784D6CD4B0D028369F370BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bd39514f-5dd3-4b86-8f78-5d627df7492c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bd39514f-5dd3-4b86-8f78-5d627df7492c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4772_254656050\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 c3bf09532f0c63f62fa7194f9ccac4f982a936dd118b8e7f2632ddf6c63e5154
MD5 886a011bbba57527f96a05f7586844bd
SHA1 33f2738efb86b2d984a4071db4ec69e26072ba76
SHA512 35d216917cf5565969d4b8b494f25ef6246115198b900fdb9e14ed2d1c2908c3566aa1f3d55fd0dc9a698a0dbd2289554e39c62542b3c5aa4e970e5d9571dcfd
TLSH
T16571008357B9D9F3C19A5BF002835248F5BB22380B2320214B555546AA30B7E24B9F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1112-276-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1576-433-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2120-445-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2584-192-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2736-368-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3204-495-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3360-339-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3668-320-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3704-327-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3744-493-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4164-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4272-316-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4652-240-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4768-440-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4768-408-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4860-465-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5352-380-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5568-289-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5692-431-0x0000000000010000-0x00000000000AB000-memory.dmp

Download