systex | e81001559fe9f58ddc1231e598eea3098a035f6f01e29f12e4c65a3dc19904dd

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 17:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample261001-wd21cstdrd
SHA256 e81001559fe9f58ddc1231e598eea3098a035f6f01e29f12e4c65a3dc19904dd
MD5 1e38068d97badfaed4b8f4bf5470da07
SHA1 b3e53a0470fc9c63ec29f79ed316bbed3cdcb6ee
SHA512 c81980c7048835d4e99edd2eef659df470c106fe12bdfcf90800127f4a8f73ff5066b21e99baf20ab6ea7cf223342badfc19e0a24f89992310f6e261def4c63c
SSDEEP 3072:4jyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:myLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E7847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5780	mkecwuomhezxrpjh.exe
2896	mkecwuomhezxrpjh.sys
1112	CreateProcess.exe
4824	mbztrpjhew.exe
5368	CreateProcess.exe
5696	CreateProcess.exe
4988	i_mbztrpjhew.exe
3764	rmjhbzwroj.sys
3004	CreateProcess.exe
4848	ljebztrpjg.exe
5652	CreateProcess.exe
4248	CreateProcess.exe
6060	i_ljebztrpjg.exe
3760	wtoljgbztr.sys
6064	CreateProcess.exe
1916	ywqojgbztr.exe
5348	CreateProcess.exe
5184	CreateProcess.exe
5252	i_ywqojgbztr.exe
5812	olgdbvtnlg.sys
3568	CreateProcess.exe
3404	qoigaysqli.exe
2592	CreateProcess.exe
556	CreateProcess.exe
592	i_qoigaysqli.exe
2484	nlfdyvqoig.sys
2832	CreateProcess.exe
6092	aysqlidavt.exe
2288	CreateProcess.exe
4448	CreateProcess.exe
3024	i_aysqlidavt.exe
4628	avsqkicavs.sys
6068	CreateProcess.exe
2464	axsqkicavs.exe
2604	CreateProcess.exe
4764	CreateProcess.exe
5896	i_axsqkicavs.exe
1792	xspnhfaxsp.sys
696	CreateProcess.exe
5852	usnkicausn.exe
2820	CreateProcess.exe
4748	CreateProcess.exe
1856	i_usnkicausn.exe
3888	pjhfzxrpnk.sys
2316	CreateProcess.exe
4944	pmkecausmk.exe
3736	CreateProcess.exe
4844	CreateProcess.exe
3328	i_pmkecausmk.exe
4812	czusmkecwu.sys
472	CreateProcess.exe
3660	pjhezwrpjh.exe
2368	CreateProcess.exe
5896	CreateProcess.exe
5416	i_pjhezwrpjh.exe
2520	pjhbzwrpjh.sys
4124	CreateProcess.exe
2692	jebztrpmje.exe
2736	CreateProcess.exe
3348	CreateProcess.exe
4352	i_jebztrpmje.exe
4188	omgeywrojg.sys
3260	CreateProcess.exe
708	omgbywqljd.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_1451699972\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_1451699972\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_254777740\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_1270363922\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_2115786204\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_2115786204\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_1451699972\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_1451699972\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_1316599192\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_1316599192\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_1270363922\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_2115786204\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_2115786204\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvqnlfdavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxupnkfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigaysqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmkecausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgbywqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causnkfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxupnkfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqnlgdys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljebztrpjg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usnkicausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usnkicausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigaytqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvqnlfdavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urpmkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuomhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mbztrpjhew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqojgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axsqkicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmkecausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhezwrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebztrpmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causnkfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecwuomhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljebztrpjg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqojgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axsqkicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgeywtrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgeywtrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoljgbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqlidavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqlidavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebztrpmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgbywqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqnlgdys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urpmkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuomhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigaytqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mbztrpjhew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigaysqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhezwrpjh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5460	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5860	ipconfig.exe
3256	ipconfig.exe
5632	ipconfig.exe
2880	ipconfig.exe
3348	ipconfig.exe
1824	ipconfig.exe
1316	ipconfig.exe
4784	ipconfig.exe
4724	ipconfig.exe
2972	ipconfig.exe
4864	ipconfig.exe
3252	ipconfig.exe
5268	ipconfig.exe
5580	ipconfig.exe
5828	ipconfig.exe
2212	ipconfig.exe
4116	ipconfig.exe
1972	ipconfig.exe
592	ipconfig.exe
3960	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1704430598-3087477806-3297458608-1000\{4EB74786-E785-4011-B63C-B59E61A91845}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5780	mkecwuomhezxrpjh.exe
5780	mkecwuomhezxrpjh.exe
5780	mkecwuomhezxrpjh.exe
5780	mkecwuomhezxrpjh.exe
5780	mkecwuomhezxrpjh.exe
5780	mkecwuomhezxrpjh.exe
5780	mkecwuomhezxrpjh.exe
5780	mkecwuomhezxrpjh.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4988	i_mbztrpjhew.exe
Token: SeDebugPrivilege	6060	i_ljebztrpjg.exe
Token: SeDebugPrivilege	5252	i_ywqojgbztr.exe
Token: SeDebugPrivilege	592	i_qoigaysqli.exe
Token: SeDebugPrivilege	3024	i_aysqlidavt.exe
Token: SeDebugPrivilege	5896	i_axsqkicavs.exe
Token: SeDebugPrivilege	1856	i_usnkicausn.exe
Token: SeDebugPrivilege	3328	i_pmkecausmk.exe
Token: SeDebugPrivilege	5416	i_pjhezwrpjh.exe
Token: SeDebugPrivilege	4352	i_jebztrpmje.exe
Token: SeDebugPrivilege	4852	i_omgbywqljd.exe
Token: SeDebugPrivilege	2868	i_oigaytqljd.exe
Token: SeDebugPrivilege	2964	i_aysqnlgdys.exe
Token: SeDebugPrivilege	1976	i_xvqnlfdavs.exe
Token: SeDebugPrivilege	5580	i_causnkfcxv.exe
Token: SeDebugPrivilege	3868	i_cxupnkfcxv.exe
Token: SeDebugPrivilege	5140	i_urpmkecwup.exe
Token: SeDebugPrivilege	2284	i_ecwuomhezx.exe
Token: SeDebugPrivilege	3204	i_jgeywtrlje.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5236	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 5780	4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 4780 wrote to memory of 5176	4780	2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 5176 wrote to memory of 5236	5176	iexplore.exe	91
PID 5236 wrote to memory of 1756	5236	msedge.exe	92
PID 5236 wrote to memory of 5460	5236	msedge.exe	93
PID 5236 wrote to memory of 352	5236	msedge.exe	94
PID 5236 wrote to memory of 352	5236	msedge.exe	94
PID 5236 wrote to memory of 352	5236	msedge.exe	94
PID 5236 wrote to memory of 124	5236	msedge.exe	95
PID 5236 wrote to memory of 124	5236	msedge.exe	95
PID 5236 wrote to memory of 6024	5236	msedge.exe	97
PID 5236 wrote to memory of 6024	5236	msedge.exe	97
PID 5236 wrote to memory of 6024	5236	msedge.exe	97
PID 5236 wrote to memory of 2576	5236	msedge.exe	98
PID 5236 wrote to memory of 2576	5236	msedge.exe	98
PID 5236 wrote to memory of 2576	5236	msedge.exe	98
PID 5236 wrote to memory of 688	5236	msedge.exe	99
PID 5236 wrote to memory of 688	5236	msedge.exe	99
PID 5236 wrote to memory of 688	5236	msedge.exe	99
PID 5236 wrote to memory of 4876	5236	msedge.exe	100
PID 5236 wrote to memory of 4876	5236	msedge.exe	100
PID 5236 wrote to memory of 4876	5236	msedge.exe	100
PID 5236 wrote to memory of 1148	5236	msedge.exe	102
PID 5236 wrote to memory of 1148	5236	msedge.exe	102
PID 5236 wrote to memory of 3008	5236	msedge.exe	105
PID 5236 wrote to memory of 3008	5236	msedge.exe	105
PID 5236 wrote to memory of 1612	5236	msedge.exe	106
PID 5236 wrote to memory of 1612	5236	msedge.exe	106
PID 5236 wrote to memory of 6120	5236	msedge.exe	108
PID 5780 wrote to memory of 1112	5780	mkecwuomhezxrpjh.exe	111
PID 4824 wrote to memory of 5368	4824	mbztrpjhew.exe	114
PID 5236 wrote to memory of 2032	5236	msedge.exe	117
PID 5236 wrote to memory of 2032	5236	msedge.exe	117
PID 5236 wrote to memory of 5436	5236	msedge.exe	118
PID 5236 wrote to memory of 5436	5236	msedge.exe	118
PID 5780 wrote to memory of 5696	5780	mkecwuomhezxrpjh.exe	119
PID 5780 wrote to memory of 3004	5780	mkecwuomhezxrpjh.exe	123
PID 4848 wrote to memory of 5652	4848	ljebztrpjg.exe	125
PID 5780 wrote to memory of 4248	5780	mkecwuomhezxrpjh.exe	128
PID 5780 wrote to memory of 6064	5780	mkecwuomhezxrpjh.exe	132
PID 1916 wrote to memory of 5348	1916	ywqojgbztr.exe	134
PID 5780 wrote to memory of 5184	5780	mkecwuomhezxrpjh.exe	137
PID 5780 wrote to memory of 3568	5780	mkecwuomhezxrpjh.exe	142
PID 3404 wrote to memory of 2592	3404	qoigaysqli.exe	144
PID 5780 wrote to memory of 556	5780	mkecwuomhezxrpjh.exe	147
PID 5236 wrote to memory of 1720	5236	msedge.exe	149
PID 5236 wrote to memory of 3288	5236	msedge.exe	150
PID 5236 wrote to memory of 4296	5236	msedge.exe	151
PID 5780 wrote to memory of 2832	5780	mkecwuomhezxrpjh.exe	154
PID 6092 wrote to memory of 2288	6092	aysqlidavt.exe	156
PID 5780 wrote to memory of 4448	5780	mkecwuomhezxrpjh.exe	159
PID 5780 wrote to memory of 6068	5780	mkecwuomhezxrpjh.exe	163
PID 2464 wrote to memory of 2604	2464	axsqkicavs.exe	165
PID 5780 wrote to memory of 4764	5780	mkecwuomhezxrpjh.exe	168
PID 5780 wrote to memory of 696	5780	mkecwuomhezxrpjh.exe	172
PID 5852 wrote to memory of 2820	5852	usnkicausn.exe	174
PID 5780 wrote to memory of 4748	5780	mkecwuomhezxrpjh.exe	177
PID 5780 wrote to memory of 2316	5780	mkecwuomhezxrpjh.exe	181
PID 4944 wrote to memory of 3736	4944	pmkecausmk.exe	183
PID 5780 wrote to memory of 4844	5780	mkecwuomhezxrpjh.exe	186
PID 5236 wrote to memory of 3144	5236	msedge.exe	188
PID 5236 wrote to memory of 3144	5236	msedge.exe	188
PID 5780 wrote to memory of 472	5780	mkecwuomhezxrpjh.exe	194
PID 3660 wrote to memory of 2368	3660	pjhezwrpjh.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_1e38068d97badfaed4b8f4bf5470da07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Temp\mkecwuomhezxrpjh.exe
  C:\Temp\mkecwuomhezxrpjh.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5780
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mbztrpjhew.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1112
  - - C:\Temp\mbztrpjhew.exe
      C:\Temp\mbztrpjhew.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4824
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5368
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2212
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mbztrpjhew.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5696
  - - C:\Temp\i_mbztrpjhew.exe
      C:\Temp\i_mbztrpjhew.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4988
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljebztrpjg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3004
  - - C:\Temp\ljebztrpjg.exe
      C:\Temp\ljebztrpjg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4848
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5652
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5632
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljebztrpjg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4248
  - - C:\Temp\i_ljebztrpjg.exe
      C:\Temp\i_ljebztrpjg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywqojgbztr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6064
  - - C:\Temp\ywqojgbztr.exe
      C:\Temp\ywqojgbztr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1916
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5348
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2880
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywqojgbztr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5184
  - - C:\Temp\i_ywqojgbztr.exe
      C:\Temp\i_ywqojgbztr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoigaysqli.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3568
  - - C:\Temp\qoigaysqli.exe
      C:\Temp\qoigaysqli.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3404
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2592
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5860
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoigaysqli.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:556
  - - C:\Temp\i_qoigaysqli.exe
      C:\Temp\i_qoigaysqli.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:592
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aysqlidavt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2832
  - - C:\Temp\aysqlidavt.exe
      C:\Temp\aysqlidavt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6092
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2288
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4724
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aysqlidavt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4448
  - - C:\Temp\i_aysqlidavt.exe
      C:\Temp\i_aysqlidavt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3024
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\axsqkicavs.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6068
  - - C:\Temp\axsqkicavs.exe
      C:\Temp\axsqkicavs.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2464
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2604
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2972
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_axsqkicavs.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4764
  - - C:\Temp\i_axsqkicavs.exe
      C:\Temp\i_axsqkicavs.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usnkicausn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:696
  - - C:\Temp\usnkicausn.exe
      C:\Temp\usnkicausn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5852
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2820
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usnkicausn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4748
  - - C:\Temp\i_usnkicausn.exe
      C:\Temp\i_usnkicausn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmkecausmk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2316
  - - C:\Temp\pmkecausmk.exe
      C:\Temp\pmkecausmk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4944
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3736
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3348
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmkecausmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4844
  - - C:\Temp\i_pmkecausmk.exe
      C:\Temp\i_pmkecausmk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3328
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhezwrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:472
  - - C:\Temp\pjhezwrpjh.exe
      C:\Temp\pjhezwrpjh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3660
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2368
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1824
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjhezwrpjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5896
  - - C:\Temp\i_pjhezwrpjh.exe
      C:\Temp\i_pjhezwrpjh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jebztrpmje.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4124
  - - C:\Temp\jebztrpmje.exe
      C:\Temp\jebztrpmje.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2692
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2736
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jebztrpmje.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3348
  - - C:\Temp\i_jebztrpmje.exe
      C:\Temp\i_jebztrpmje.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omgbywqljd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3260
  - - C:\Temp\omgbywqljd.exe
      C:\Temp\omgbywqljd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:708
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3940
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4116
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omgbywqljd.exe ups_ins
    3⤵
    PID:2452
  - - C:\Temp\i_omgbywqljd.exe
      C:\Temp\i_omgbywqljd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4852
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oigaytqljd.exe ups_run
    3⤵
    PID:4404
  - - C:\Temp\oigaytqljd.exe
      C:\Temp\oigaytqljd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4796
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1884
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1316
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oigaytqljd.exe ups_ins
    3⤵
    PID:2136
  - - C:\Temp\i_oigaytqljd.exe
      C:\Temp\i_oigaytqljd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2868
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aysqnlgdys.exe ups_run
    3⤵
    PID:4300
  - - C:\Temp\aysqnlgdys.exe
      C:\Temp\aysqnlgdys.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2672
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4952
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5268
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aysqnlgdys.exe ups_ins
    3⤵
    PID:540
  - - C:\Temp\i_aysqnlgdys.exe
      C:\Temp\i_aysqnlgdys.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2964
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvqnlfdavs.exe ups_run
    3⤵
    PID:3184
  - - C:\Temp\xvqnlfdavs.exe
      C:\Temp\xvqnlfdavs.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4620
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4524
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4784
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvqnlfdavs.exe ups_ins
    3⤵
    PID:3044
  - - C:\Temp\i_xvqnlfdavs.exe
      C:\Temp\i_xvqnlfdavs.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1976
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\causnkfcxv.exe ups_run
    3⤵
    PID:4500
  - - C:\Temp\causnkfcxv.exe
      C:\Temp\causnkfcxv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1536
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4668
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_causnkfcxv.exe ups_ins
    3⤵
    PID:2548
  - - C:\Temp\i_causnkfcxv.exe
      C:\Temp\i_causnkfcxv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5580
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cxupnkfcxv.exe ups_run
    3⤵
    PID:4188
  - - C:\Temp\cxupnkfcxv.exe
      C:\Temp\cxupnkfcxv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4528
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1068
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1972
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cxupnkfcxv.exe ups_ins
    3⤵
    PID:4232
  - - C:\Temp\i_cxupnkfcxv.exe
      C:\Temp\i_cxupnkfcxv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3868
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urpmkecwup.exe ups_run
    3⤵
    PID:1032
  - - C:\Temp\urpmkecwup.exe
      C:\Temp\urpmkecwup.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5404
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2712
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:592
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urpmkecwup.exe ups_ins
    3⤵
    PID:2304
  - - C:\Temp\i_urpmkecwup.exe
      C:\Temp\i_urpmkecwup.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5140
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwuomhezx.exe ups_run
    3⤵
    PID:1976
  - - C:\Temp\ecwuomhezx.exe
      C:\Temp\ecwuomhezx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1500
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5572
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3960
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwuomhezx.exe ups_ins
    3⤵
    PID:5556
  - - C:\Temp\i_ecwuomhezx.exe
      C:\Temp\i_ecwuomhezx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2284
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgeywtrlje.exe ups_run
    3⤵
    PID:4264
  - - C:\Temp\jgeywtrlje.exe
      C:\Temp\jgeywtrlje.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1984
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3540
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5580
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgeywtrlje.exe ups_ins
    3⤵
    PID:1492
  - - C:\Temp\i_jgeywtrlje.exe
      C:\Temp\i_jgeywtrlje.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3204
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoljgbztrl.exe ups_run
    3⤵
    PID:4200
  - - C:\Temp\qoljgbztrl.exe
      C:\Temp\qoljgbztrl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4676
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1268
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5828
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffaaf40c188,0x7ffaaf40c194,0x7ffaaf40c1a0
      4⤵
      PID:1756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,6031057092005420793,11565930961320542221,524288 --field-trial-handle=2324,i,3010554489012737560,17887673416703721652,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:11
      4⤵
      System Time Discovery
      PID:5460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,12775214466895635618,8120100104686376942,262144 --field-trial-handle=2324,i,3010554489012737560,17887673416703721652,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
      4⤵
      PID:352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2416,i,18372602489127962343,18279947321563400338,524288 --field-trial-handle=2324,i,3010554489012737560,17887673416703721652,262144 --variations-seed-version --mojo-platform-channel-handle=2856 /prefetch:13
      4⤵
      PID:124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3632,i,16296625581074754255,9214033924831257923,2097152 --field-trial-handle=2324,i,3010554489012737560,17887673416703721652,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
      4⤵
      PID:6024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3644,i,11288667906685831897,7311227695042963429,2097152 --field-trial-handle=2324,i,3010554489012737560,17887673416703721652,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:1
      4⤵
      PID:2576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4308,i,10203061882019545759,14216365661610121326,2097152 --field-trial-handle=2324,i,3010554489012737560,17887673416703721652,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:1
      4⤵
      PID:688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,253056924974511168,5450244291496047130,2097152 --field-trial-handle=2324,i,3010554489012737560,17887673416703721652,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:9
      4⤵
      PID:4876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3788,i,17090424576624678434,2532441864329306786,524288 --field-trial-handle=2324,i,3010554489012737560,17887673416703721652,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:14
      4⤵
      PID:1148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,17785882866435061383,8837655485723199249,524288 --field-trial-handle=2324,i,3010554489012737560,17887673416703721652,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
      4⤵
      PID:3008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,15967554034953265894,673176505704927156,524288 --field-trial-handle=2324,i,3010554489012737560,17887673416703721652,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
      4⤵
      PID:1612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,914307560297002340,4672097960281706713,524288 --field-trial-handle=2324,i,3010554489012737560,17887673416703721652,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
      4⤵
      PID:5968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,914307560297002340,4672097960281706713,524288 --field-trial-handle=2324,i,3010554489012737560,17887673416703721652,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
      4⤵
      PID:6120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,1923058631829545448,5286949174441619514,524288 --field-trial-handle=2324,i,3010554489012737560,17887673416703721652,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
      4⤵
      PID:2032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,4072620875507020631,6919998718069983720,524288 --field-trial-handle=2324,i,3010554489012737560,17887673416703721652,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:14
      4⤵
      PID:5436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,4611570010384336127,17453583909349672687,524288 --field-trial-handle=2324,i,3010554489012737560,17887673416703721652,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:14
      4⤵
      PID:1720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,16591356902509427560,13459942181247095372,524288 --field-trial-handle=2324,i,3010554489012737560,17887673416703721652,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:14
      4⤵
      PID:3288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,4768780658296455422,1710682406026938303,524288 --field-trial-handle=2324,i,3010554489012737560,17887673416703721652,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:14
      4⤵
      PID:4296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,10445274906217070911,6762140534171280308,524288 --field-trial-handle=2324,i,3010554489012737560,17887673416703721652,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
      4⤵
      PID:3144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,3818827140487276623,13962579990844442848,524288 --field-trial-handle=2324,i,3010554489012737560,17887673416703721652,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
      4⤵
      PID:5812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,436090235062389458,12484093065053625089,524288 --field-trial-handle=2324,i,3010554489012737560,17887673416703721652,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
      4⤵
      PID:2140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,9998195414262175305,5822384410913862000,524288 --field-trial-handle=2324,i,3010554489012737560,17887673416703721652,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
      4⤵
      PID:4180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5144,i,697566651993814239,2410627613074668496,262144 --field-trial-handle=2324,i,3010554489012737560,17887673416703721652,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:10
      4⤵
      PID:1616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3828,i,632110780110407086,6186770581396415041,524288 --field-trial-handle=2324,i,3010554489012737560,17887673416703721652,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14
      4⤵
      PID:2412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,7118368505605813238,8070778971418731223,524288 --field-trial-handle=2324,i,3010554489012737560,17887673416703721652,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:14
      4⤵
      PID:2248

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3568

C:\Temp\mkecwuomhezxrpjh.sys
C:\Temp\mkecwuomhezxrpjh.sys
1⤵
- Executes dropped EXE
PID:2896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4248

C:\Temp\rmjhbzwroj.sys
C:\Temp\rmjhbzwroj.sys
1⤵
- Executes dropped EXE
PID:3764

C:\Temp\wtoljgbztr.sys
C:\Temp\wtoljgbztr.sys
1⤵
- Executes dropped EXE
PID:3760

C:\Temp\olgdbvtnlg.sys
C:\Temp\olgdbvtnlg.sys
1⤵
- Executes dropped EXE
PID:5812

C:\Temp\nlfdyvqoig.sys
C:\Temp\nlfdyvqoig.sys
1⤵
- Executes dropped EXE
PID:2484

C:\Temp\avsqkicavs.sys
C:\Temp\avsqkicavs.sys
1⤵
- Executes dropped EXE
PID:4628

C:\Temp\xspnhfaxsp.sys
C:\Temp\xspnhfaxsp.sys
1⤵
- Executes dropped EXE
PID:1792

C:\Temp\pjhfzxrpnk.sys
C:\Temp\pjhfzxrpnk.sys
1⤵
- Executes dropped EXE
PID:3888

C:\Temp\czusmkecwu.sys
C:\Temp\czusmkecwu.sys
1⤵
- Executes dropped EXE
PID:4812

C:\Temp\pjhbzwrpjh.sys
C:\Temp\pjhbzwrpjh.sys
1⤵
- Executes dropped EXE
PID:2520

C:\Temp\omgeywrojg.sys
C:\Temp\omgeywrojg.sys
1⤵
- Executes dropped EXE
PID:4188

C:\Temp\rljdbvtqoi.sys
C:\Temp\rljdbvtqoi.sys
1⤵
PID:1508

C:\Temp\tnlgdywqoi.sys
C:\Temp\tnlgdywqoi.sys
1⤵
PID:5580

C:\Temp\davsnlidav.sys
C:\Temp\davsnlidav.sys
1⤵
PID:3504

C:\Temp\axvsnkfdxv.sys
C:\Temp\axvsnkfdxv.sys
1⤵
PID:1716

C:\Temp\czxspkhcau.sys
C:\Temp\czxspkhcau.sys
1⤵
PID:948

C:\Temp\hczxrpkhcz.sys
C:\Temp\hczxrpkhcz.sys
1⤵
PID:1096

C:\Temp\hczusmkecw.sys
C:\Temp\hczusmkecw.sys
1⤵
PID:2972

C:\Temp\jhbztrljge.sys
C:\Temp\jhbztrljge.sys
1⤵
PID:5180

C:\Temp\wqoigebwto.sys
C:\Temp\wqoigebwto.sys
1⤵
PID:3140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

avsqkicavs.sys

Path C:\Temp\avsqkicavs.sys
Size 293KB
SHA256 f11df18571759edf6e89821430d71443850c0b8a6ca59e51d9f8049c2f4d3c2d
MD5 15370976d8b996cba2c5736131dbd6d1
SHA1 43fe5ea5b18a2e5dcddab651429ab5d56d874e9f
SHA512 7d663a633e385d192a85f7e1de8db111cb5183b58908660a7f50e63edad9959e81f8701059d835837f6228ffebc2db5fad97fe4de95656c74199edca909b25d2
SSDEEP 3072:FtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:FIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E7545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

axsqkicavs.exe

Path C:\Temp\axsqkicavs.exe
Size 376KB
SHA256 1a0f72a9dbff031a9f1fc5a74263ab787d439b21d99ed9e51397154d1d4570d0
MD5 34462535ee63d54c41998b8d9c81dcec
SHA1 39d0c2b420fc495507c8703ff798ad41b4e1087e
SHA512 fc6e17b3a805af1585ab7ed2304b29b077a9c360b5cf5f1d0c1921d465f4c15c0e46200e901358ef9a3e5c5097241fdbb540d696ae8fac7ba2e0304d292c96ba
SSDEEP 3072:cjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:SyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T130847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aysqlidavt.exe

Path C:\Temp\aysqlidavt.exe
Size 376KB
SHA256 95a920dfa98344d902221a41c1602f0ade47010b6607f01d68264f6cf0a529a2
MD5 92836e5806681c2fb85fe9065c51608f
SHA1 9e894f51f176519684d47e25074b5fd8604de107
SHA512 4539ba35586f90bde120ad3c79178b378fd4a466bca4d020d36f26bb29ed0cdf262d917910bb1a527b382841f4dca3a72ad5b7cdcdfcc2465288ed81ebf30042
SSDEEP 3072:ijyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:cyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1EE847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_aysqlidavt.exe

Path C:\Temp\i_aysqlidavt.exe
Size 376KB
SHA256 ef38159723fa9ec93c0f7fdc711f977948baca572bf6e2d23f4dd19173bc14b5
MD5 895bce0f6ec4a3eac8586fc1b68637ca
SHA1 64648c96a5c512776ec2b25030caceebfd2649fd
SHA512 376a557899c792cda3371cd4e24724259d1f39dd804256c7147e51c97c0d9a628324aacee60852345233681d6bd7138141a840c175511678ab4fcca1e7cc4443
SSDEEP 3072:ujyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:gyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T11D847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ljebztrpjg.exe

Path C:\Temp\i_ljebztrpjg.exe
Size 376KB
SHA256 05b69c6d561593ab1b0361666c378135faf40883f2303a089d547597d9abe717
MD5 101a5cb4b26ed2a56fa0812e8bd5ea52
SHA1 bfdeb35a31b1b6d64a337e56824c96321f17169d
SHA512 6038e5361a648d5ef73f1a06eff07c43ac27bad897f49b87bb5ad9aa47399f6113120af8f32c0c0517ee8826b44682e33b1222eaead9748cd9efbeee83c73475
SSDEEP 3072:FjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:dyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T163847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mbztrpjhew.exe

Path C:\Temp\i_mbztrpjhew.exe
Size 376KB
SHA256 886b3dad94d6e56be49a18da1470fead7af7d2a5099462def9c373ed49e651ec
MD5 16b7c1051df768ef8fb500e9379e4ce1
SHA1 e4e8df3011bf827d0bc7b0119aaee78c605c0d28
SHA512 200ed10ee132c07d87ac9339a02c28cce45ede282306bcc06f7b1cd04cebb3cc37b38857462051b4ebb00b9c5995dc7367602be37a51bb4c4eefe5b295ff06ba
SSDEEP 3072:MjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:iyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T132847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qoigaysqli.exe

Path C:\Temp\i_qoigaysqli.exe
Size 376KB
SHA256 bb5dfdd58bc5b33e3a1dfbc9c32e04f0f5fbdefa41f7098e6216f694b92504f5
MD5 a219c6e27517e4f9d046f902dce76949
SHA1 34271c2f6400ba9effc732ece85198e35dd2037d
SHA512 de56e61f338fedf7b3d093718a49a5cb515f14f00d56925b33824739b5e52ef08bd7cbce112bf54a1fd1b51e49e3a9ea9e6aabf9d1554641f897ca2daf838d08
SSDEEP 3072:ljyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:9yLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T14E847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ywqojgbztr.exe

Path C:\Temp\i_ywqojgbztr.exe
Size 376KB
SHA256 c1fe3014057f9cb4c532e8257f1a93b6f5bb265b43f76ac95c0bae148d399b9c
MD5 b3f308fd9289cedc9f1bf1529db62dd7
SHA1 2f6b13a2e2da495c3724bf37e35605817358cd27
SHA512 b143c0557543885462130fcef6dee2a13d9fc67644d0732862fc999d6afe2bc2a8ca579e0fcb2bbbd5e7407157ab02bea91276f17a48e5215e5a009af8265069
SSDEEP 3072:JjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:pyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1DD847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljebztrpjg.exe

Path C:\Temp\ljebztrpjg.exe
Size 376KB
SHA256 e34ded98fd5adf9865ea24addbcead4a5bc47d1c50de6568a56559d17d63d791
MD5 8a8833920ad042c7bab2f5b16c616a12
SHA1 24831946dff9bfd808d2b21b7e7a0056e66fd55a
SHA512 04af8550184ed69de06005c7e78e12b81c2f8f7db78374dc220f76e01ad044880279da11287fc018a27d9d9c46712d75c3e3922aebe99a8e36943f5bd155136c
SSDEEP 3072:wjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:eyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T159847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mbztrpjhew.exe

Path C:\Temp\mbztrpjhew.exe
Size 376KB
SHA256 807cc53561b744b48a3cf5a2bb238af00b145999e8ff4d5b69f5c8de30e36a92
MD5 3a4988be31fa3b3cbc8bd2c5e7ff56f5
SHA1 b0db40d6afd12e6bea275e7299a02abf586db23b
SHA512 6a368905e0a422345cf6b156ff7a18842126a13e523255d963fbacc364078a3b3f864ee1b8ae9c63a84566d31f3700a3aa796f9f4920ff92b07252d2f5cf0a64
SSDEEP 3072:mjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:4yLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T10E847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkecwuomhezxrpjh.exe

Path C:\Temp\mkecwuomhezxrpjh.exe
Size 376KB
SHA256 e12d3bb475349b7390f246a7cb0cc14509cfc52911169f6d1bc9b6892053de57
MD5 cfb3fe3156540baaec0ec896f99f2d81
SHA1 3d7bdd8440aab6b9dbf1b64f406d6e4757c7ea23
SHA512 b2273f7a84ffe581728315b260e135c0402a888ee4ea164a4266fcb820a49e1b004e9dc1ffd0888f8dc841c8c3a57f7309058652455077a2891ab05f26058769
SSDEEP 3072:5jyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:5yLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T15C847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkecwuomhezxrpjh.sys

Path C:\Temp\mkecwuomhezxrpjh.sys
Size 293KB
SHA256 8ca733aac5b6cc939a090a45de847d67d7114fbb3527d896152fcebe635737ad
MD5 6c13898375efdf15da57e88ef53b96d4
SHA1 95259967a02e32dc235d533873e7808df215f1fb
SHA512 4752a488f6f08d32488fb81f0eb7b0583342440ba9a6f027f14fd00bff951fa4c7381d0e56da1b423d671dee8bf290ec2dedb430fea2b8161528c0277a87c6ec
SSDEEP 3072:8tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:8IJjiJcbI03GBc3ucY5DCSj
TLSH
T16B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlfdyvqoig.sys

Path C:\Temp\nlfdyvqoig.sys
Size 293KB
SHA256 77c40ee25b8224805a07712cfdac989214771b35d1c2d37fef7f30b8b301c039
MD5 add577c9ce179b3a52090fbf71230474
SHA1 cd8307f2fc2b3ac20943a9dbebfee8661a130bb1
SHA512 387b078228b01d906cef09dee53486aa94fcbcbb0e2874a17b433df563b8314677e8be27a3af57057bdd1fb5b794d13903084cd5b1b77c1effba2f27bd8419ac
SSDEEP 3072:6tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:6IJjiJcbI03GBc3ucY5DCSj
TLSH
T1BD545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olgdbvtnlg.sys

Path C:\Temp\olgdbvtnlg.sys
Size 293KB
SHA256 dba7126550c9504cc554b7018aed7898c897cc037d9f1183c7bcf0f48005d06f
MD5 0e9642c3db4aa48e8e9939c72a07323b
SHA1 2bda33776abb9fd524f32a41f50310fc8dadc31e
SHA512 49804883169aa3a1d068c4bd6b684fc9bc03333a6aa09cc1f2b926481187a8008c8e59e0a2bf1c32dfbdbf1af0349ddfd6a11170aa7bac4c2172415b8df52de3
SSDEEP 3072:3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:3IJjiJcbI03GBc3ucY5DCSj
TLSH
T19A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoigaysqli.exe

Path C:\Temp\qoigaysqli.exe
Size 376KB
SHA256 caf22a462760001751e023d2de523b26d96a541ce01bb30019c20513fb1da445
MD5 4c0e13a03ca25aebbf14e7a9f70585df
SHA1 1969e6c3ef0583e0660529d0b1db8f0655aa78b8
SHA512 31cd97335d5f9e63d29c93e8813ece5a99172a762d3814004afad05509ac03114ba53c84397d1b9d78585b51f37b4f52cfac9b4ea063f7c01f44fff1c68e457a
SSDEEP 3072:CjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:8yLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E3847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmjhbzwroj.sys

Path C:\Temp\rmjhbzwroj.sys
Size 293KB
SHA256 ce7b170db74ee850e899623ae0fc68833ef84eb8641eb4c55c439d70dc3e44ae
MD5 85ee2faa4ab78e2115e5f2f676050b75
SHA1 b38ccb910bc058818075825f8f999a03a6bf74dd
SHA512 169027fdbdf1f6164a38595093e786989c025bfb081d1253fc02ea77202ce91d87d7fb49377b3d7d4c276f3d1837f8f24325a81df0fdbdac974cba4caebb2e91
SSDEEP 3072:gtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:gIJjiJcbI03GBc3ucY5DCSj
TLSH
T17F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtoljgbztr.sys

Path C:\Temp\wtoljgbztr.sys
Size 293KB
SHA256 5fd12909503037532965b7a7b7b792f6b0cac128b38fb0aa48c2b8fcd3cbe473
MD5 4d67e2b41adab96f3a776104585ff99b
SHA1 ca003070ca6cfb20b20f7637d1945525e6e14757
SHA512 736a420aa8b29227ac85980b023f7c9b244ac47100c21e4088f8ecb54177823ed192d1fcf828b3efe809c2182da05894e77d36cf0dd775e5f867999f859aab82
SSDEEP 3072:0tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:0IJjiJcbI03GBc3ucY5DCSj
TLSH
T14F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqojgbztr.exe

Path C:\Temp\ywqojgbztr.exe
Size 376KB
SHA256 39d2387c292dfcc77b9da8419666e9af90a30fcd1a53d91890163eb601670bdf
MD5 a350be5ff951676dd63cde361f234a21
SHA1 f3402dbbbb9d134b6791cda3dd74e202244b244e
SHA512 6bf5686b3233996f5e4d222ebb5b93575887135bf0a0c75d409031d0e305c0d92049e255215f7800bfc9fd22d8fb1c1c0c6de73ec7491a84e89812964528c78f
SSDEEP 3072:DjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:nyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1BB847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1d14ccf7-253a-4e56-8153-9797b638eb03.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1d14ccf7-253a-4e56-8153-9797b638eb03.tmp
Size 34KB
SHA256 4c37ad07372103c1d71cbe8f614235b9df0b599376f56866ade0add15d11b812
MD5 1a766680886cc1e109549755b7aa965c
SHA1 7a65a911e7a8e5b73b0d96c725c813dd53aeeb47
SHA512 1e8040d29e20c350237a70f5b83d3226896b8497c443ce704d656109295746e996f116fbfc39e60831af42ed05dcf5e05e1e6ac403c88109c029fe2ca6eb075f
SSDEEP 768:PO3TBMMwieOXktfFjgnUPO4Qp7cPAiSm2eo4w4cciGrTFlN2s0d:PO3TGjPjgwQpYoimeoR4ccFFT2s0d
TLSH
T1F4F2BFB1D9E99EA3ACF7E28176497742BFF0206398C54F84DAE95B0C01476AE071BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

85d0bda5-5950-40d8-bf59-e966b08c4031.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\85d0bda5-5950-40d8-bf59-e966b08c4031.tmp
Size 42KB
SHA256 da7c8836f39423ffa8262031edbc3c1a63f06d535b2540b13d0605911b561c13
MD5 569a3a55a3b5efd78d59600d0f3baaa8
SHA1 0a673de3027c93bf67d87bb8724fe0ba99579ff7
SHA512 caa88805ce2c29f402f79336a0e076659ea1fe6e4e0d51739da1695d57faf76cfd1ca53ccf1306c0a2dd097cf7f981c761e78a1f183dd44fa20d0bdb268c73e8
SSDEEP 768:HFQc3hwg9BKMfuOXktfQvYnUPO4Qp7cPAiSm2eo4w4cciGrTFlN2s0d:ac3dMSvYwQpYoimeoR4ccFFT2s0d
TLSH
T1A51328F188D79A76E8AE5783677C6E41AEBCD063B4844984F7D51E0CCC461BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 68f353a62995fc87917d7d1eef768abe00ffab02e1d3e469100f99b6987f6488
MD5 5ba62d3fe2ddefdf87e8dd139f3e421b
SHA1 1986deda7bda2ac5b490eacb9fe2784fb6d01648
SHA512 4e6a767b24298d2e01c8dbefa41509e1bc67cf2c2f34fd0bf866fc1017e1d15a470a5a95feb8ee1cccf4b8ccf5fa9054bcbb93919c00de89eeffec199b68baf9
TLSH
T19CD02BB5DFFCCC62D54820B802518E116085B41519490040DA03FC04DD110814D03555
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 648887a89dac8888df245d8758dcd78e85ae79931c9464f19b0967fcd69c3d2f
MD5 b053e18c94ac6f6c60a9e0a281e1687b
SHA1 17ed2d8ae6844c2878132336a2fea7d044381f8b
SHA512 abf3d05979a55f573445c0c7a95529a5899c0d9f55f350b3eb35132d8502e23e6c764ffc98e92f4374754aa22e9292fd03f8e6e8113c0e919f428e797e339bfa
TLSH
T151D02BB9DFECCD62D54820B402508E116095B4156D490040D903BC04DD110814D03569
MD5 SHA1 SHA512 TLSH

Submit Download

149689c3-6396-4963-9df7-28a1e0de4379.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\149689c3-6396-4963-9df7-28a1e0de4379.tmp
Size 29KB
SHA256 1600b2e14fb6610d9f0c94679449fb8667dc8680572a52949891a16d550696ee
MD5 93edd70973afa6e875b941c491371740
SHA1 6fc3878f851352d46aca1120435a4bcecf5ff7c9
SHA512 1babdd5effc55abc0a342817329369ffb2381b67fb8583553d5530061a5321c3b7c6d530c4bd072e14d65bfd4cea452f56e4df0fa140b26f4241573118fa3080
SSDEEP 768:DFakv4yG7pLuLbs5Wg1Bf9t8F1+UoAYDCx9Tuqh0VfUC9xbog/OVrlJ97gBroMuf:DFakv4ymEbs5Wg1Bf9tu1jaYlJxg6Muf
TLSH
T134D2EB3B744CCB7F4F804A9DEC197E9B6DA802CB9598C98047FD941D03C6BEA521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1f8dbd48-62d2-4881-89f8-118d3c01ebbb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1f8dbd48-62d2-4881-89f8-118d3c01ebbb.tmp
Size 12KB
SHA256 3801baf18a9560b2897ec2c929c6e9d070f36d7970cb1105027da2d9a6cdd051
MD5 42d660b294c29d4679854d384d5a7834
SHA1 3cad09d9b972e364b87b782317651da07dede617
SHA512 03250e48515306ad4af6835adba6be87cb05bd0d3009d4019e8d1453dde31a24f6620aefcf346abc95e18f0fd6021ff4a755f202ff1dfb26e8b31d450417831c
SSDEEP 192:sxRaTBRtPC95/feGMs9erZaq06DdrmzoA8p9aQ/g6+WNCa429/Ycl1XxIiT76GyT:sxR4mT/feZs0Far6t5/5P/TiiTBe
TLSH
T1B942D915AD68A97B8CC7D20DFB557F53E2F95032A0D51F88A6FC8A1C14E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

471d6662-5a63-4446-9632-c07a4a9d7f1a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\471d6662-5a63-4446-9632-c07a4a9d7f1a.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

4d31afa8-539c-49ee-8460-db7f55a0249f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4d31afa8-539c-49ee-8460-db7f55a0249f.tmp
Size 12KB
SHA256 563bfb218793a9f26da0111b60661218f801f4feedbbb95de8aa2fee32a693a6
MD5 dcacc12c7bf8a5b9c06f6123b1145868
SHA1 b7ad015d391545f5817e2acc9ea7c640c561535e
SHA512 0ae5b7efa325c6182d4a9796bbd33b738140c3114321deb8a19eba52d0bfcab6a81a3696668b904f5a06624979d066b394902cb290b4ad97393465efb53cff7f
SSDEEP 192:sxRaTBRtPC95/feGMs9AIrZaq06DdrmzoA8p9aQ/g6+WNCa429/YclnSXxIiT767:sxR4mT/feZsVFar6t5/5P/giiTBc
TLSH
T10642F915AD68A9BB8CC7D20DFB557F53E2F95032A0D51F88A6FC8A1C14E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 f179b865a9da8e85be6c6378f55e84efa4cc6df5cbd8e3bf6cfb91e1b0813a85
MD5 912307e16c79e8173d4c33631b42462f
SHA1 ebc3aa066ded3565d69b50a38ce16be499692ad0
SHA512 514a43f87e1e436e1fc0a5c6aafee24997df81a92d068fdf33c3e2075bab92543bd7943e4edb41a0d3d104cef588c0d40651e0cd493e821fd78ee30279bf51d0
TLSH
T1CC517600C37CB9A3F35A837844E51ECB3A3493A054C33E9143A6CDB6A9B63E4B1452DE
MD5 SHA1 SHA512 TLSH

Submit Download

9d3d8a22-290e-4a1d-8fc8-44bca32c616d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\9d3d8a22-290e-4a1d-8fc8-44bca32c616d.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

1b1c2d14-f4eb-4f06-8f4c-c94074aba3dd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1b1c2d14-f4eb-4f06-8f4c-c94074aba3dd.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

81c27946-96ce-4ddc-b365-c79ba672aff8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\81c27946-96ce-4ddc-b365-c79ba672aff8.tmp
Size 2KB
SHA256 04dfd6766a29e16b2d9bd162071ae20f7858185965a6e7b2b748dab5988861e2
MD5 b14dbb0ce43360686e37c22a0632f279
SHA1 f4867ec4e99012e3f275db2c75e7892895416a3a
SHA512 a39f48db81e74a50a1d8e1da8acbe2a73fb53d5891434be39c84a631e17b94514a7e5392fb6cc09f0edabd811b86c560ea7a275e30524046f89b3af42ff875f6
TLSH
T15F51AFF3C7E8866D891195F4A7187E2BCE2D0914432C3D5AC8E4EE5B93E2471D14199F
MD5 SHA1 SHA512 TLSH

Submit Download

ae1639ce-48f8-4d12-95d1-1393209da2ac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ae1639ce-48f8-4d12-95d1-1393209da2ac.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1c4fd9c498d9eb0b8773d2b672cd100f670df1e480884396c9d46edc89e34f76
MD5 39a3f4a8216af6837f49a1d3e486cc0d
SHA1 402064531d8d6c0cb37c38f85c86f58b2db15e1b
SHA512 36b08e6303cc52d51cf5dcf8be733528e419e52c7000f503f3a70fc572499214a8a6d1880b41dddb3d4f0fab1b2682ef21259d1c521f65acfac37a0a24c15c72
SSDEEP 96:KcMAKt6+aqEKHKsurswucsZRgp0b4ZKTwb+ZPm+xIsIuZCVZTh:SDPyHt
TLSH
T14791A411722B1245783D3D0C51B6E69F435234A33029EABB3FEE50A15EAAE144EFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b4596fd7-1b6d-4246-9cc2-797c5ccf45c0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b4596fd7-1b6d-4246-9cc2-797c5ccf45c0.tmp
Size 11KB
SHA256 7b20ff4d01eaa84790ba9e732da28a4c4cb27a90fe8f6b51eac7cd702c2020f2
MD5 afa9ca859299512a0ee42e47ed45d91d
SHA1 8073bbd5a5b232b7a676d39660c3fd4ed78cb51f
SHA512 6e7eafa208f34f00c327cab51786102b0a87834da8bb2d6b0ab638da7df05e7ddc2588ad4702718196c5b3e81df76c0713081fcd6d5c39acca14750dfaff4c8f
SSDEEP 192:sxRa8BRtPC95/feGMsDrZaq06DdrmzoA8p9aQ/g6+WNCa429/Ycl1XxIiT76Gykk:sxRHmT/feZsDFar6t5/5P/TiiTBo
TLSH
T15342C815AD68A97B8CC7D20DFB557F53E2F95032A0D51F88A6FC8A1C14E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b86525ec-af0a-4307-ab41-ff34664de150.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b86525ec-af0a-4307-ab41-ff34664de150.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

82f8cd43-72c9-40cf-b819-b846e7f4e63e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\82f8cd43-72c9-40cf-b819-b846e7f4e63e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

b131e00d-cbf5-4cb4-9d4f-b69cedf09c30.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b131e00d-cbf5-4cb4-9d4f-b69cedf09c30.tmp
Size 39KB
SHA256 2fee40b6ee71045c36149ec72691ac6d6954b4a6662ae123d010c6f0bc3bc3ba
MD5 8b088744e392da0ef3eeaf38048d8de1
SHA1 4b7ddfa968ce667a0166ea95589535b2512eaa5d
SHA512 e296f4604004d0187208af470e1f6e72a183cf2404cb92266950f01d42a27a9b13901fe2d275efe6c02d79ea2e91643cad69a238e2507941b6dc6a1e4077fa8c
SSDEEP 768:3u/UxvxjgC+j3opB9IwieOXktfFjgnUPO4Qp7cPAiSm2eo4w4cciGrTFlNNBqMJ:3jZj3+j3opzvPjgwQpYoimeoR4ccFFTR
TLSH
T18A03BE75A8A9AD639CF3A241765D6793FFF0146398C11E98CAE95F0D06873AE070BC07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

42b16cbb-5166-4e7a-9a95-c07f5115e05c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\42b16cbb-5166-4e7a-9a95-c07f5115e05c.tmp
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

4cbda94f-38b9-46d5-b3f7-b5cd0e4cb353.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\4cbda94f-38b9-46d5-b3f7-b5cd0e4cb353.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

7643cd1a-b685-4d24-bb0e-ad4db4186359.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\7643cd1a-b685-4d24-bb0e-ad4db4186359.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

99930c5d-a113-40f6-b25d-71dc9fab7b81.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\99930c5d-a113-40f6-b25d-71dc9fab7b81.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

d6888dd6-8e0f-4725-9ce8-c6d7e4b7e5cf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d6888dd6-8e0f-4725-9ce8-c6d7e4b7e5cf.tmp
Size 37KB
SHA256 dbb9147ad793fb9ea68727c0788877b13f36df911a93a3192d66766cd16a3b32
MD5 c9cdc58f1198e455b743dfa250e5805c
SHA1 bc56aa18ea3c1a44b234459fbf092dd0f510c3e9
SHA512 68600aad763743c1b612aac6b3867a4f115b94b93b12234711f33eb93db70000820bddf5af0a1e62a06efc2735413c066414bd24ef05ba745076a4c81d48a314
SSDEEP 768:vw/UxvxjgC+5j3OV718fieOXktwjFnUPO4Qp7cPAiSm2eo4w4cciGrTF5zAgZbCl:vdZj3+5j3Ot1gqjFwQpYoimeoR4ccFF4
TLSH
T1B603CFB598A4AE73DCF39785361D6342FFF0406395C12EA8CAE92E0D42877AD430BC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d7a32419-1994-4f1b-88ba-5f8b0f068788.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d7a32419-1994-4f1b-88ba-5f8b0f068788.tmp
Size 34KB
SHA256 a8858578de68947df9712eb3bdac2266a6fca40b349ca43f9d73dc8a926adcb7
MD5 12fdcdac541e22c5d6b9933dcd99a7a2
SHA1 8b3c2fba271236fe2ac530cf3ee8dedf4e3a16b2
SHA512 08cfadd5ee6df871512b983f093daa0cce5476c9502f2e4bd7e7f3816d3749a58af7af19eb7f445664c71ec7d5a6d6ecd65d8035b0c0c4e7b6e68704e4734a0c
SSDEEP 768:3GO3gBMMwieOXktfFjgnUPO4Qp7cPAiSm2eo4w4cciGrTFlN2s0d:3GO3gGjPjgwQpYoimeoR4ccFFT2s0d
TLSH
T192F2BFB1D9E89EA3ACF7928176497742BFF0216398C54F84DAEA5B0C01476AE071BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f292854f-75cd-4553-9775-d720af3cad72.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f292854f-75cd-4553-9775-d720af3cad72.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

02ef6e00-25ea-45de-a77d-7affbfabf34e.tmp

Path C:\Users\Admin\AppData\Local\Temp\02ef6e00-25ea-45de-a77d-7affbfabf34e.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

27cf8cf4-6076-49ea-bd9b-3500c0fc16b4.tmp

Path C:\Users\Admin\AppData\Local\Temp\27cf8cf4-6076-49ea-bd9b-3500c0fc16b4.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5236_2020325835\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_1270363922\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_1316599192\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_1451699972\manifest.json
Size 85B
SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
MD5 8ce95626b39ebc2401eee0b34c24fc7c
SHA1 f97a2fefe756f7a03e388e1333573b884730c2b0
SHA512 f04e4f695977918adf6e0603386b6f9c75a4a2202b0fe7215b642f3db491a1db398039cc28633b8e2541749403581622d28c1400f3f8fc66a3daab200e27266d
TLSH
T106A0121018015DE318880320213143D2D3A51C05247437001106108019B8636027A22E
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_2115786204\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_254777740\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 88bbc5ac88ebbea4ad3556e9af67d27b9350bf5bb8f16841972819eca7083066
MD5 828a6909948ea530172b81fc2a04f549
SHA1 a9663fb9ab0e03c258927dc01be365d697ce90f1
SHA512 0f7bae43a41cf591013b7ebfbd2120dfe9b138f598346f0a0a941df9938d8f1b2bcac0b48259be430552d85b870abd3cb53677c7ec80223e8567c9db7464d1b7
TLSH
T1C971008356B9CAF3C19A5BF502835248F5BB22384B2330740B559546AA30A7E68B9F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/948-458-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1096-477-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1508-422-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1508-399-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1716-438-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1792-316-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2484-279-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2520-345-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2896-62-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2972-482-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3140-506-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3504-434-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3760-267-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3760-241-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3764-192-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3888-320-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4188-371-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4628-291-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4812-336-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4812-368-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5180-502-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5580-413-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5812-266-0x0000000000010000-0x00000000000AB000-memory.dmp

Download