systex | 10274ba4700dc26d8768b47ac17b036a7ebbf158dfb98b7d8459347f7da503c2

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 22:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 365KB
Sample261002-2k1nrsvblf
SHA256 10274ba4700dc26d8768b47ac17b036a7ebbf158dfb98b7d8459347f7da503c2
MD5 f2d9745a097223be842937f72c356909
SHA1 dd32d68b7683ed805a3eb6b14657682b160c8535
SHA512 43fcd88bf68293e74f7df67cd5615c2b85a1293a71c25de215c9957346f45a251ff0670c0ee66b8483b59b89b82fb92a05e4bd558459429b15b51a153e9b39d6
SSDEEP 3072:vuxIxtcBOaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:vuxIxtdlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C2847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4892	rojhbztrmjecwuom.exe
3184	rojhbztrmjecwuom.sys
5100	CreateProcess.exe
5136	trpjhbztrl.exe
3356	CreateProcess.exe
3792	CreateProcess.exe
1552	i_trpjhbztrl.exe
1764	olgeywqojg.sys
3692	CreateProcess.exe
3024	jdbtrligbv.exe
5784	CreateProcess.exe
5604	CreateProcess.exe
4884	i_jdbtrligbv.exe
4852	aysqlidbvt.sys
5472	CreateProcess.exe
2340	yvqoigayvt.exe
1228	CreateProcess.exe
5112	CreateProcess.exe
1180	i_yvqoigayvt.exe
3312	ysqlidavsq.sys
5600	CreateProcess.exe
2012	sqnifaysqn.exe
1552	CreateProcess.exe
1112	CreateProcess.exe
3336	i_sqnifaysqn.exe
2168	ayvpnifdxv.sys
5348	CreateProcess.exe
4884	pnhfausqki.exe
4004	CreateProcess.exe
1668	CreateProcess.exe
4328	i_pnhfausqki.exe
5368	snkifzxvpn.sys
3060	CreateProcess.exe
5168	spnhfcaupn.exe
4264	CreateProcess.exe
3276	CreateProcess.exe
5920	i_spnhfcaupn.exe
5856	pmhfzxupkh.sys
5420	CreateProcess.exe
5264	pjhczusmke.exe
5508	CreateProcess.exe
124	CreateProcess.exe
1856	i_pjhczusmke.exe
2452	rmkecwuomh.sys
4988	CreateProcess.exe
5224	rpjhezwurm.exe
3164	CreateProcess.exe
5824	CreateProcess.exe
4612	i_rpjhezwurm.exe
3148	cwuomgebzt.sys
2176	CreateProcess.exe
6020	wjgbztrljh.exe
5388	CreateProcess.exe
3640	CreateProcess.exe
5856	i_wjgbztrljh.exe
2144	eywqomgeyw.sys
3340	CreateProcess.exe
2452	bztoljebwt.exe
1708	CreateProcess.exe
4660	CreateProcess.exe
1048	i_bztoljebwt.exe
4904	dywqoigayt.sys
2904	CreateProcess.exe
5404	eywqoljgby.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1712_513780847\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1712_1366137426\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1712_610736509\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1712_610736509\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1712_513780847\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1712_283720180\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1712_1366137426\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1712_513780847\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1712_513780847\office_endpoints_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trpjhbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbtrligbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfausqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spnhfcaupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkigavsnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpkhcausp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bywqolgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojhbztrmjecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbtrligbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhczusmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywqoljgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfcauspnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurmjhczur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwuomjeywu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqoigayvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqnifaysqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfausqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idavtnlfdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkigavsnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfcauspnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurmjhczur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaytqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqoigayvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqnifaysqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spnhfcaupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztoljebwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywqoljgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trpjhbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhczusmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wjgbztrljh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuomhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwuomjeywu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wjgbztrljh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpkhcausp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idavtnlfdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuomhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhezwurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhezwurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztoljebwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bywqolgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaytqljdbv.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1192	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2052	ipconfig.exe
1704	ipconfig.exe
5368	ipconfig.exe
2092	ipconfig.exe
1804	ipconfig.exe
2144	ipconfig.exe
924	ipconfig.exe
4372	ipconfig.exe
5352	ipconfig.exe
2356	ipconfig.exe
2848	ipconfig.exe
5128	ipconfig.exe
2164	ipconfig.exe
5280	ipconfig.exe
1096	ipconfig.exe
6020	ipconfig.exe
5140	ipconfig.exe
4136	ipconfig.exe
472	ipconfig.exe
1260	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2251218687-1689653882-3767565116-1000\{675E7A0E-C4DD-454A-B861-1F5452733C05}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4892	rojhbztrmjecwuom.exe
4892	rojhbztrmjecwuom.exe
4892	rojhbztrmjecwuom.exe
4892	rojhbztrmjecwuom.exe
4892	rojhbztrmjecwuom.exe
4892	rojhbztrmjecwuom.exe
4892	rojhbztrmjecwuom.exe
4892	rojhbztrmjecwuom.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1552	i_trpjhbztrl.exe
Token: SeDebugPrivilege	4884	i_jdbtrligbv.exe
Token: SeDebugPrivilege	1180	i_yvqoigayvt.exe
Token: SeDebugPrivilege	3336	i_sqnifaysqn.exe
Token: SeDebugPrivilege	4328	i_pnhfausqki.exe
Token: SeDebugPrivilege	5920	i_spnhfcaupn.exe
Token: SeDebugPrivilege	1856	i_pjhczusmke.exe
Token: SeDebugPrivilege	4612	i_rpjhezwurm.exe
Token: SeDebugPrivilege	5856	i_wjgbztrljh.exe
Token: SeDebugPrivilege	1048	i_bztoljebwt.exe
Token: SeDebugPrivilege	4368	i_eywqoljgby.exe
Token: SeDebugPrivilege	5512	i_idavtnlfdy.exe
Token: SeDebugPrivilege	1188	i_qkigavsnlf.exe
Token: SeDebugPrivilege	996	i_nlfcauspnh.exe
Token: SeDebugPrivilege	4880	i_xrpkhcausp.exe
Token: SeDebugPrivilege	4232	i_zurmjhczur.exe
Token: SeDebugPrivilege	4276	i_ecwuomhezx.exe
Token: SeDebugPrivilege	2144	i_bwuomjeywu.exe
Token: SeDebugPrivilege	4412	i_bywqolgeyw.exe
Token: SeDebugPrivilege	5996	i_gaytqljdbv.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1712	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 4892	4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	89
PID 4924 wrote to memory of 5780	4924	2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	90
PID 5780 wrote to memory of 1712	5780	iexplore.exe	91
PID 1712 wrote to memory of 1100	1712	msedge.exe	92
PID 1712 wrote to memory of 1192	1712	msedge.exe	93
PID 1712 wrote to memory of 2640	1712	msedge.exe	94
PID 1712 wrote to memory of 2640	1712	msedge.exe	94
PID 1712 wrote to memory of 5124	1712	msedge.exe	95
PID 1712 wrote to memory of 5124	1712	msedge.exe	95
PID 1712 wrote to memory of 5124	1712	msedge.exe	95
PID 1712 wrote to memory of 456	1712	msedge.exe	97
PID 1712 wrote to memory of 456	1712	msedge.exe	97
PID 1712 wrote to memory of 4876	1712	msedge.exe	98
PID 1712 wrote to memory of 456	1712	msedge.exe	97
PID 1712 wrote to memory of 4876	1712	msedge.exe	98
PID 1712 wrote to memory of 4876	1712	msedge.exe	98
PID 1712 wrote to memory of 3924	1712	msedge.exe	99
PID 1712 wrote to memory of 3924	1712	msedge.exe	99
PID 1712 wrote to memory of 3924	1712	msedge.exe	99
PID 1712 wrote to memory of 560	1712	msedge.exe	100
PID 1712 wrote to memory of 560	1712	msedge.exe	100
PID 1712 wrote to memory of 560	1712	msedge.exe	100
PID 1712 wrote to memory of 4588	1712	msedge.exe	101
PID 1712 wrote to memory of 4588	1712	msedge.exe	101
PID 1712 wrote to memory of 5744	1712	msedge.exe	105
PID 1712 wrote to memory of 2912	1712	msedge.exe	106
PID 1712 wrote to memory of 5744	1712	msedge.exe	105
PID 1712 wrote to memory of 2912	1712	msedge.exe	106
PID 4892 wrote to memory of 5100	4892	rojhbztrmjecwuom.exe	107
PID 1712 wrote to memory of 3804	1712	msedge.exe	110
PID 5136 wrote to memory of 3356	5136	trpjhbztrl.exe	112
PID 1712 wrote to memory of 3988	1712	msedge.exe	117
PID 1712 wrote to memory of 3988	1712	msedge.exe	117
PID 1712 wrote to memory of 4640	1712	msedge.exe	118
PID 1712 wrote to memory of 4640	1712	msedge.exe	118
PID 4892 wrote to memory of 3792	4892	rojhbztrmjecwuom.exe	119
PID 4892 wrote to memory of 3692	4892	rojhbztrmjecwuom.exe	123
PID 3024 wrote to memory of 5784	3024	jdbtrligbv.exe	125
PID 4892 wrote to memory of 5604	4892	rojhbztrmjecwuom.exe	128
PID 4892 wrote to memory of 5472	4892	rojhbztrmjecwuom.exe	132
PID 2340 wrote to memory of 1228	2340	yvqoigayvt.exe	134
PID 4892 wrote to memory of 5112	4892	rojhbztrmjecwuom.exe	137
PID 4892 wrote to memory of 5600	4892	rojhbztrmjecwuom.exe	141
PID 2012 wrote to memory of 1552	2012	sqnifaysqn.exe	143
PID 4892 wrote to memory of 1112	4892	rojhbztrmjecwuom.exe	147
PID 1712 wrote to memory of 4504	1712	msedge.exe	149
PID 1712 wrote to memory of 3340	1712	msedge.exe	150
PID 1712 wrote to memory of 4548	1712	msedge.exe	151
PID 4892 wrote to memory of 5348	4892	rojhbztrmjecwuom.exe	154
PID 4884 wrote to memory of 4004	4884	pnhfausqki.exe	156
PID 4892 wrote to memory of 1668	4892	rojhbztrmjecwuom.exe	159
PID 4892 wrote to memory of 3060	4892	rojhbztrmjecwuom.exe	163
PID 5168 wrote to memory of 4264	5168	spnhfcaupn.exe	165
PID 4892 wrote to memory of 3276	4892	rojhbztrmjecwuom.exe	168
PID 4892 wrote to memory of 5420	4892	rojhbztrmjecwuom.exe	172
PID 5264 wrote to memory of 5508	5264	pjhczusmke.exe	174
PID 4892 wrote to memory of 124	4892	rojhbztrmjecwuom.exe	177
PID 4892 wrote to memory of 4988	4892	rojhbztrmjecwuom.exe	181
PID 5224 wrote to memory of 3164	5224	rpjhezwurm.exe	183
PID 4892 wrote to memory of 5824	4892	rojhbztrmjecwuom.exe	186
PID 1712 wrote to memory of 3804	1712	msedge.exe	188
PID 1712 wrote to memory of 3804	1712	msedge.exe	188
PID 4892 wrote to memory of 2176	4892	rojhbztrmjecwuom.exe	194
PID 6020 wrote to memory of 5388	6020	wjgbztrljh.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-02_f2d9745a097223be842937f72c356909_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Temp\rojhbztrmjecwuom.exe
  C:\Temp\rojhbztrmjecwuom.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trpjhbztrl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5100
  - - C:\Temp\trpjhbztrl.exe
      C:\Temp\trpjhbztrl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5136
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3356
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trpjhbztrl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3792
  - - C:\Temp\i_trpjhbztrl.exe
      C:\Temp\i_trpjhbztrl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1552
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jdbtrligbv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3692
  - - C:\Temp\jdbtrligbv.exe
      C:\Temp\jdbtrligbv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3024
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5784
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jdbtrligbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5604
  - - C:\Temp\i_jdbtrligbv.exe
      C:\Temp\i_jdbtrligbv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4884
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvqoigayvt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5472
  - - C:\Temp\yvqoigayvt.exe
      C:\Temp\yvqoigayvt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2340
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1228
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvqoigayvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5112
  - - C:\Temp\i_yvqoigayvt.exe
      C:\Temp\i_yvqoigayvt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1180
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqnifaysqn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5600
  - - C:\Temp\sqnifaysqn.exe
      C:\Temp\sqnifaysqn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2012
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1552
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2144
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqnifaysqn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1112
  - - C:\Temp\i_sqnifaysqn.exe
      C:\Temp\i_sqnifaysqn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3336
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnhfausqki.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5348
  - - C:\Temp\pnhfausqki.exe
      C:\Temp\pnhfausqki.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4884
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4004
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2052
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnhfausqki.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1668
  - - C:\Temp\i_pnhfausqki.exe
      C:\Temp\i_pnhfausqki.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4328
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spnhfcaupn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3060
  - - C:\Temp\spnhfcaupn.exe
      C:\Temp\spnhfcaupn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5168
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4264
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6020
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spnhfcaupn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3276
  - - C:\Temp\i_spnhfcaupn.exe
      C:\Temp\i_spnhfcaupn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5920
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhczusmke.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5420
  - - C:\Temp\pjhczusmke.exe
      C:\Temp\pjhczusmke.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5264
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5508
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2356
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjhczusmke.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:124
  - - C:\Temp\i_pjhczusmke.exe
      C:\Temp\i_pjhczusmke.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpjhezwurm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4988
  - - C:\Temp\rpjhezwurm.exe
      C:\Temp\rpjhezwurm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5224
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3164
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5140
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpjhezwurm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5824
  - - C:\Temp\i_rpjhezwurm.exe
      C:\Temp\i_rpjhezwurm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4612
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wjgbztrljh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2176
  - - C:\Temp\wjgbztrljh.exe
      C:\Temp\wjgbztrljh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6020
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5388
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2848
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wjgbztrljh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3640
  - - C:\Temp\i_wjgbztrljh.exe
      C:\Temp\i_wjgbztrljh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bztoljebwt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3340
  - - C:\Temp\bztoljebwt.exe
      C:\Temp\bztoljebwt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2452
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1708
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5128
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bztoljebwt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4660
  - - C:\Temp\i_bztoljebwt.exe
      C:\Temp\i_bztoljebwt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1048
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eywqoljgby.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2904
  - - C:\Temp\eywqoljgby.exe
      C:\Temp\eywqoljgby.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5404
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4696
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4136
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eywqoljgby.exe ups_ins
    3⤵
    PID:200
  - - C:\Temp\i_eywqoljgby.exe
      C:\Temp\i_eywqoljgby.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4368
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\idavtnlfdy.exe ups_run
    3⤵
    PID:3364
  - - C:\Temp\idavtnlfdy.exe
      C:\Temp\idavtnlfdy.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2824
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2436
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:924
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_idavtnlfdy.exe ups_ins
    3⤵
    PID:6092
  - - C:\Temp\i_idavtnlfdy.exe
      C:\Temp\i_idavtnlfdy.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qkigavsnlf.exe ups_run
    3⤵
    PID:2028
  - - C:\Temp\qkigavsnlf.exe
      C:\Temp\qkigavsnlf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2912
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2704
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:472
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qkigavsnlf.exe ups_ins
    3⤵
    PID:4364
  - - C:\Temp\i_qkigavsnlf.exe
      C:\Temp\i_qkigavsnlf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1188
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlfcauspnh.exe ups_run
    3⤵
    PID:4928
  - - C:\Temp\nlfcauspnh.exe
      C:\Temp\nlfcauspnh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3368
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2980
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlfcauspnh.exe ups_ins
    3⤵
    PID:5532
  - - C:\Temp\i_nlfcauspnh.exe
      C:\Temp\i_nlfcauspnh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:996
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpkhcausp.exe ups_run
    3⤵
    PID:3620
  - - C:\Temp\xrpkhcausp.exe
      C:\Temp\xrpkhcausp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4716
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4964
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2164
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpkhcausp.exe ups_ins
    3⤵
    PID:5544
  - - C:\Temp\i_xrpkhcausp.exe
      C:\Temp\i_xrpkhcausp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4880
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zurmjhczur.exe ups_run
    3⤵
    PID:5464
  - - C:\Temp\zurmjhczur.exe
      C:\Temp\zurmjhczur.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5660
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:52
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5280
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zurmjhczur.exe ups_ins
    3⤵
    PID:4556
  - - C:\Temp\i_zurmjhczur.exe
      C:\Temp\i_zurmjhczur.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4232
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwuomhezx.exe ups_run
    3⤵
    PID:2480
  - - C:\Temp\ecwuomhezx.exe
      C:\Temp\ecwuomhezx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2784
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1756
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5368
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwuomhezx.exe ups_ins
    3⤵
    PID:1780
  - - C:\Temp\i_ecwuomhezx.exe
      C:\Temp\i_ecwuomhezx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4276
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bwuomjeywu.exe ups_run
    3⤵
    PID:5672
  - - C:\Temp\bwuomjeywu.exe
      C:\Temp\bwuomjeywu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2656
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4228
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bwuomjeywu.exe ups_ins
    3⤵
    PID:5856
  - - C:\Temp\i_bwuomjeywu.exe
      C:\Temp\i_bwuomjeywu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2144
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bywqolgeyw.exe ups_run
    3⤵
    PID:3176
  - - C:\Temp\bywqolgeyw.exe
      C:\Temp\bywqolgeyw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5484
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2448
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1096
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bywqolgeyw.exe ups_ins
    3⤵
    PID:1716
  - - C:\Temp\i_bywqolgeyw.exe
      C:\Temp\i_bywqolgeyw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4412
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gaytqljdbv.exe ups_run
    3⤵
    PID:108
  - - C:\Temp\gaytqljdbv.exe
      C:\Temp\gaytqljdbv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3148
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2628
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4372
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gaytqljdbv.exe ups_ins
    3⤵
    PID:2888
  - - C:\Temp\i_gaytqljdbv.exe
      C:\Temp\i_gaytqljdbv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5996
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x108,0x300,0x7ff8e594c188,0x7ff8e594c194,0x7ff8e594c1a0
      4⤵
      PID:1100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,16781017807250354495,8355920061111667372,524288 --field-trial-handle=2300,i,13890832056902834728,5904904074507913858,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:11
      4⤵
      System Time Discovery
      PID:1192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2404,i,6854820708484675336,15920743003089157372,524288 --field-trial-handle=2300,i,13890832056902834728,5904904074507913858,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:13
      4⤵
      PID:2640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,3514530489373746537,11860595478519445360,262144 --field-trial-handle=2300,i,13890832056902834728,5904904074507913858,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
      4⤵
      PID:5124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,13233401950925623233,9436877342743285111,2097152 --field-trial-handle=2300,i,13890832056902834728,5904904074507913858,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
      4⤵
      PID:456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,5083959301458202694,11711771475924155802,2097152 --field-trial-handle=2300,i,13890832056902834728,5904904074507913858,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
      4⤵
      PID:4876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,1509807609228663055,899411341498633323,2097152 --field-trial-handle=2300,i,13890832056902834728,5904904074507913858,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
      4⤵
      PID:3924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,16290104510780345848,16845142354314281875,2097152 --field-trial-handle=2300,i,13890832056902834728,5904904074507913858,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:9
      4⤵
      PID:560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,14629719900526433002,12617332327502632218,524288 --field-trial-handle=2300,i,13890832056902834728,5904904074507913858,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
      4⤵
      PID:4588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,1579318557954406277,6233756761291493814,524288 --field-trial-handle=2300,i,13890832056902834728,5904904074507913858,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
      4⤵
      PID:5744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,12537085766270419838,16810440317008173687,524288 --field-trial-handle=2300,i,13890832056902834728,5904904074507913858,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:14
      4⤵
      PID:2912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,12751085907061226197,7617718360148975464,524288 --field-trial-handle=2300,i,13890832056902834728,5904904074507913858,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
      4⤵
      PID:3340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,12751085907061226197,7617718360148975464,524288 --field-trial-handle=2300,i,13890832056902834728,5904904074507913858,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
      4⤵
      PID:3804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,7227548127759397778,3476826622058082029,524288 --field-trial-handle=2300,i,13890832056902834728,5904904074507913858,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
      4⤵
      PID:3988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6608,i,9993160976083985421,10197130728027528263,524288 --field-trial-handle=2300,i,13890832056902834728,5904904074507913858,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:14
      4⤵
      PID:4640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4852,i,4663015744953155972,2486020926585600187,524288 --field-trial-handle=2300,i,13890832056902834728,5904904074507913858,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:14
      4⤵
      PID:4504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,14700227322781936866,4790190396444530345,524288 --field-trial-handle=2300,i,13890832056902834728,5904904074507913858,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:14
      4⤵
      PID:3340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,18310597143187313564,18292823154088173338,524288 --field-trial-handle=2300,i,13890832056902834728,5904904074507913858,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:14
      4⤵
      PID:4548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,16679032935887917638,2319143655020609675,524288 --field-trial-handle=2300,i,13890832056902834728,5904904074507913858,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
      4⤵
      PID:3804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,17150976381389373452,8580465057594598768,524288 --field-trial-handle=2300,i,13890832056902834728,5904904074507913858,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:14
      4⤵
      PID:1300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,13161745386465250904,5419563683982820433,524288 --field-trial-handle=2300,i,13890832056902834728,5904904074507913858,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:14
      4⤵
      PID:4676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,8925710612572699824,16065211324896297181,524288 --field-trial-handle=2300,i,13890832056902834728,5904904074507913858,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
      4⤵
      PID:4220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6456,i,5275740890227377102,17368693897105468424,262144 --field-trial-handle=2300,i,13890832056902834728,5904904074507913858,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:10
      4⤵
      PID:5948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,8609521452186791857,424916008687183247,524288 --field-trial-handle=2300,i,13890832056902834728,5904904074507913858,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:14
      4⤵
      PID:5584

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4780

C:\Temp\rojhbztrmjecwuom.sys
C:\Temp\rojhbztrmjecwuom.sys
1⤵
- Executes dropped EXE
PID:3184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4772

C:\Temp\olgeywqojg.sys
C:\Temp\olgeywqojg.sys
1⤵
- Executes dropped EXE
PID:1764

C:\Temp\aysqlidbvt.sys
C:\Temp\aysqlidbvt.sys
1⤵
- Executes dropped EXE
PID:4852

C:\Temp\ysqlidavsq.sys
C:\Temp\ysqlidavsq.sys
1⤵
- Executes dropped EXE
PID:3312

C:\Temp\ayvpnifdxv.sys
C:\Temp\ayvpnifdxv.sys
1⤵
- Executes dropped EXE
PID:2168

C:\Temp\snkifzxvpn.sys
C:\Temp\snkifzxvpn.sys
1⤵
- Executes dropped EXE
PID:5368

C:\Temp\pmhfzxupkh.sys
C:\Temp\pmhfzxupkh.sys
1⤵
- Executes dropped EXE
PID:5856

C:\Temp\rmkecwuomh.sys
C:\Temp\rmkecwuomh.sys
1⤵
- Executes dropped EXE
PID:2452

C:\Temp\cwuomgebzt.sys
C:\Temp\cwuomgebzt.sys
1⤵
- Executes dropped EXE
PID:3148

C:\Temp\eywqomgeyw.sys
C:\Temp\eywqomgeyw.sys
1⤵
- Executes dropped EXE
PID:2144

C:\Temp\dywqoigayt.sys
C:\Temp\dywqoigayt.sys
1⤵
- Executes dropped EXE
PID:4904

C:\Temp\nljdaywqoi.sys
C:\Temp\nljdaywqoi.sys
1⤵
PID:4276

C:\Temp\sqnidavtnl.sys
C:\Temp\sqnidavtnl.sys
1⤵
PID:4820

C:\Temp\kicaxvpnki.sys
C:\Temp\kicaxvpnki.sys
1⤵
PID:2956

C:\Temp\ausmkecxus.sys
C:\Temp\ausmkecxus.sys
1⤵
PID:4972

C:\Temp\hfzxupkhcz.sys
C:\Temp\hfzxupkhcz.sys
1⤵
PID:4296

C:\Temp\eczurpjhez.sys
C:\Temp\eczurpjhez.sys
1⤵
PID:248

C:\Temp\ebztrmjecw.sys
C:\Temp\ebztrmjecw.sys
1⤵
PID:3868

C:\Temp\ebwtomgdbv.sys
C:\Temp\ebwtomgdbv.sys
1⤵
PID:3412

C:\Temp\oigdbytrlj.sys
C:\Temp\oigdbytrlj.sys
1⤵
PID:4488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aysqlidbvt.sys

Path C:\Temp\aysqlidbvt.sys
Size 293KB
SHA256 33c6a2cecd6593420baa94a74346d69e20c3affc971794e672d8c845e70c1c94
MD5 c2670c815798c5b95d6a501268ea8f98
SHA1 84dcf326ee12b3dbf061806c7252eeafe0ec82d3
SHA512 1b213a9fbe0bc16a927b9411ccdd92b2f4a6a14168e5f11bc9adfe473a697fa7fa33eb9fda730062d354c09edf7e60c0bd533ea6f071f1946a8174282276c404
SSDEEP 3072:stKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:sIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D1545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ayvpnifdxv.sys

Path C:\Temp\ayvpnifdxv.sys
Size 293KB
SHA256 13f61d0c4b8fc9ca0fb26235730ffceb67e1e83e5c6e587cf20f359f6225c012
MD5 c22c741e8e9a8ce51c291f26e4672969
SHA1 0a04ec66db852b3bccd0067ecc3f685f2fbf8d76
SHA512 3aae902dddc4b0276a4b7f0326f986e8b671321e7552e9e1a2273679e0c6276ff462ebc6f6df6b40b4b1a497026ae8f1119ebc3df54c871cc9d89e35d4ca3289
SSDEEP 3072:ftKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:fIJjiJcbI03GBc3ucY5DCSj
TLSH
T17F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jdbtrligbv.exe

Path C:\Temp\i_jdbtrligbv.exe
Size 365KB
SHA256 165557be045756f1a2a5331dd1d63928535d7630b056ac5b093c866e2ac0b8e5
MD5 b5cb5fc6b894fc3e48802852e817b4d6
SHA1 8d583595654166683f673c7a6c58532c08e341f4
SHA512 a4fc2bc5084c47a2b97bb37b4580c8e9f6549b8238cc067b2b08ecd4811463d67b6891b7241b66d688192ae34004e9b47713b2a404cd19a59c74f125f08bcc55
SSDEEP 3072:kuxIxtcBOaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:kuxIxtdlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T197847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pnhfausqki.exe

Path C:\Temp\i_pnhfausqki.exe
Size 365KB
SHA256 d612850aec2d1df5bd5ec07ee5bb31967dc4bf195ab131e73c0ec7cb72d2b3f2
MD5 9c8190f49bc126ed39d2a93ce9fa6d11
SHA1 1826646df9c3b9bf9b25ba8596d8dc425bda22c2
SHA512 43651fcad9f9fb89e83a22d70ed8c7c4e22a9c955b3804adc1331715ac0e57f40bf022a258dab81d551ac4dbac7c49a9b9c8d0dc993e2201c1c2703d2822141c
SSDEEP 3072:2uxIxtcBOaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:2uxIxtdlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A7847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_sqnifaysqn.exe

Path C:\Temp\i_sqnifaysqn.exe
Size 365KB
SHA256 a6041773bc37659d85ffb5e9c893b5ad3a29e69e167fbe1afdf819235894071d
MD5 e01c2b77254684e7bb3bbd59c57d130b
SHA1 72f5a2a4d6480e636dcc5e0930f2b2bd2b56af95
SHA512 b17e0d072cfbd282d1112437fbcf5703971b3db9436546032187908e65796d172ed1a60d6b5cd1ea280f72772481e9474c42cc0fc7baaf6027e52f80e5669b1a
SSDEEP 3072:ZuxIxtcBOaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:ZuxIxtdlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C1847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_trpjhbztrl.exe

Path C:\Temp\i_trpjhbztrl.exe
Size 365KB
SHA256 00ff843cfa7ce3d0c5584a435550aa544d7f00681281dab29d430f8811bbe9ac
MD5 14b17dd7464649df8c7ec802372786ae
SHA1 404ac583d36d0e37ba737b54683b989b49b328e7
SHA512 e5cd895ca5750399b805d65b5c656a268ffebe197671286f1b8322dd62264b9a854a282fe843c35fe03d60bd02e45315c37a2d001994681e250ed80ccab1ce18
SSDEEP 3072:kuxIxtcBOaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:kuxIxtdlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E0847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_yvqoigayvt.exe

Path C:\Temp\i_yvqoigayvt.exe
Size 365KB
SHA256 57165837cae5fb85dd0ab9624f95d57398e3f2aecea6b182e19ab4fd6d754b68
MD5 0b9f8df3d63af7d09a3e5c43925c914e
SHA1 2a213a23f938478c253645f56d872cbec1acdc83
SHA512 7d25b020f76bd077bb2eeb41b6aef91b943e31d5ed409e4fcc7b38b63a59974b0f4c85ed02e3bc4d38bd34dad02db98aadba9319d58f9bff7f4707e276a8bf81
SSDEEP 3072:9uxIxtcBOaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:9uxIxtdlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1EC847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbtrligbv.exe

Path C:\Temp\jdbtrligbv.exe
Size 365KB
SHA256 956a579dcd008538445f502f65303685c0e1d52dde1d55fd98035a11d0e5834d
MD5 031c6c777dbff39884a61d0eea93dbbb
SHA1 d0f2aed42f00c059bd4f74adb675d94cddce199a
SHA512 f36948128cd0c0e2b80d4ae1dca40b5436a3834aac474298b897e0212aed2f41c9c26ff9d7f600e72b866f0e8fea4a89c0cf244a3ca2886b4fb98ecbd68ddcee
SSDEEP 3072:2uxIxtcBOaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:2uxIxtdlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T11D847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olgeywqojg.sys

Path C:\Temp\olgeywqojg.sys
Size 293KB
SHA256 06a929b55af9fe1f196ca83aef5b7fa57611ebed16d3651aefbf8fd98d42cdf1
MD5 0255a3ed82497ac9d20d59f705a1a3e4
SHA1 4bffa04702d14eb47c097d7d0aba195cc05fe5c8
SHA512 b578a4148fe8c82865da1ab6dae37745ce726d60f9ab4e3e8911f780b8e0cc48a93e3ba7818d4d1cc24a27b2490e8e23f2e442b4704827b86f4b21b8dbbc8389
SSDEEP 3072:/tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:/IJjiJcbI03GBc3ucY5DCSj
TLSH
T19D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnhfausqki.exe

Path C:\Temp\pnhfausqki.exe
Size 365KB
SHA256 0efcc9bb31862a7bec10749ec133a8c809cf875f9700906acbe98c933d209164
MD5 ee4442052fbbd3dfa338287415dba2b7
SHA1 e66fbeab8afb87638ee5a27b22e09ed44916269c
SHA512 f382bef2d4a7766185bf82f0bde986a42f6dc230678e33d040d65d47d1d54b7205eecfa5ad420d0c89f377c1f009b274e3d923a3b495f349344b8e78277323ee
SSDEEP 3072:MuxIxtcBOaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:MuxIxtdlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E1847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rojhbztrmjecwuom.exe

Path C:\Temp\rojhbztrmjecwuom.exe
Size 365KB
SHA256 9bdf74c3360a2ff848f0ce7c58cad15dc133e57dd40859da7b55185e1a3fc245
MD5 10a31a00b6ec2f49f6a324f3105e5421
SHA1 c3db2773c67793c1f92808a872dd25426f6e09ce
SHA512 503887b80a02194fc643c442ac34d6a10948efe672b01a1553440ecb953d7886c5c77fa7566c10a0d6fef8865a3e8bd34203fa180316e589dfdd0106b623e303
SSDEEP 3072:NuxIxtcBOaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:NuxIxtdlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T170847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rojhbztrmjecwuom.sys

Path C:\Temp\rojhbztrmjecwuom.sys
Size 293KB
SHA256 fb9a348e9a10d9ae3ab391c68a60c4e28c5582d64df0892485933f362278cd7e
MD5 fe80a12778aa2d3cc34f1061490da657
SHA1 67c3869e9664431c10c4f8f087bde6834b5767eb
SHA512 404236c36c03a276fdea383dad4bdbab5ba379555e2b7e1d7a9099ca6bb27d16f0e6ef2eaf4a0bcd6f8244c6a61e2ffddee16bc4cb41f2b0247db5beddab2da4
SSDEEP 3072:GtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:GIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C4545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snkifzxvpn.sys

Path C:\Temp\snkifzxvpn.sys
Size 293KB
SHA256 3548074ecae1d0a1f1311b7b40b87f526e692181dd30d4339ceaf2babb03d885
MD5 21b7e6780d11b81091f239bb55349b14
SHA1 18910aff78d7c8383cc0547c360a1662afaec551
SHA512 8479e6a0d74ad8cee6c1d5b7be4293ed62ca74f32ef36cea167abc26817236d5a965e483282f116d7588737aa8be065fdeeeb1f6e099df609a6929423057055b
SSDEEP 3072:ftKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:fIJjiJcbI03GBc3ucY5DCSj
TLSH
T18A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spnhfcaupn.exe

Path C:\Temp\spnhfcaupn.exe
Size 365KB
SHA256 72356531503326d806227bb550d71cc560dcca264f8390d1beea68737709bdc0
MD5 51a4c4d0b47922e9329883e5ecd7be67
SHA1 b69195815737138cc17e8a85cf87698fdf6793a7
SHA512 d761169c60fa84d2237d51c2530a9ab14bbd7fddf6a4844b274fcf06799e3c15d2aa08df01d1995601992f991050240a1ca749beb731ef021858bfd4e7b47e9a
SSDEEP 3072:AuxIxtcBOaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:AuxIxtdlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T173847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqnifaysqn.exe

Path C:\Temp\sqnifaysqn.exe
Size 365KB
SHA256 2d5cd1d53d8cf93d9b27588723ae0a94ad3050e5da81442effe3912c121f59ed
MD5 e861908d39e14e3b185fc6c8d76ee160
SHA1 f4e72543a8f9625e4bedc127229a8838f41e7255
SHA512 b1cc6d535c89c110bc121e786048cc632b3ffa2a3284508ac2343680d6d934f1a70b2ff8a3caad6a507bcb4afaabce196b52b5d88ebb60eed8837b104587ff84
SSDEEP 3072:JuxIxtcBOaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:JuxIxtdlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T150847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trpjhbztrl.exe

Path C:\Temp\trpjhbztrl.exe
Size 365KB
SHA256 0b7b5a536a4ceebb83e40f69b3aeff8fa550127f573ec0bb57f7f10e0c33b1f6
MD5 4fd9bdde2ad7f1307665dcc89abbd00d
SHA1 97bddd751c601fc9bcc8a541d077171b38234e62
SHA512 c12e771d40c3205df2e01bc674ed63d64c1312323e1e26f5c21c7d38da23a925dce5c9b291b956b916ed8ea0299e52ba22ff90cc22e7d3601e176d2ed8c4f18d
SSDEEP 3072:4uxIxtcBOaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:4uxIxtdlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A6847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqlidavsq.sys

Path C:\Temp\ysqlidavsq.sys
Size 293KB
SHA256 a976cde96cd9bf9ff754077f1888d99d9556c937bcd589a2082aa7902176c798
MD5 fd34ce13cc972345f8dc5445355d6db4
SHA1 c08175ee59178b1d5bdb11da2c6fa657b7b12491
SHA512 9b6b4f419ed1af4c0220232a75625db88a6642a31275ca251741d5fb3e239447b273e098ecdb32b7763ca128b9345d59cf7ed3c18f9c0d63324d773ae76fc634
SSDEEP 3072:HtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:HIJjiJcbI03GBc3ucY5DCSj
TLSH
T198545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvqoigayvt.exe

Path C:\Temp\yvqoigayvt.exe
Size 365KB
SHA256 56dbc0dfa0ed99a3368286a5f06be9672de63accf50ad0a815a0a62748b7a8fa
MD5 a7c2ccc8e114ed29d41967f0dba54f81
SHA1 eec5dbf985e581b5cc7e1109e3da1dda54ba9d52
SHA512 f68537e4aa7935491a535bdfe01f00e0bc6569eac3d583074f558b009f252a8c459cc4ab3745ce4e394beb5c075362c4e8c6ed6086e21ce0b51cab5ae9cfb8e2
SSDEEP 3072:UuxIxtcBOaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:UuxIxtdlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T15B847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

040fec3c-9e5a-412f-a601-103175ce4ca4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\040fec3c-9e5a-412f-a601-103175ce4ca4.tmp
Size 33KB
SHA256 d8616d06672adedb3c1af5918617ab8d5d4a2193e536f5b5b4faa92c814a63b9
MD5 742bd502a90bdd42ad10fe4e521760fb
SHA1 5df7200271444a72a1e55a8c59133ff90e911a2a
SHA512 702b849fe21e96f4b49fd8f97b9ad6b56e71245b9f15e3557e92136f53e5bf1819e005d58276ba025e9a28f5b2f606c731f33c580c0d7621bb7a19f449c9fb65
SSDEEP 768:knZ36b/SFajTxXnqMwQi5BgK5/CwYcZS2s47:UZ36p3xXVmBg8/d42s47
TLSH
T1B1F2BF30ECB58EB71CFE9200B2867746AFF46663D8D54A9494EE8B0D05979EE130BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0cf486f8-6d65-40af-a59a-76a6d5c2c0b0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0cf486f8-6d65-40af-a59a-76a6d5c2c0b0.tmp
Size 37KB
SHA256 280819c2c956ff95602e854824cccae03a7b4085066ba33b68678d4f4e01ea0e
MD5 ed2d7a53a8c3b746dd05e8d1597776fa
SHA1 03858018cd74212e470b42839232803b2457ef6e
SHA512 efec1aa1fa4096ec55dcd3e46509c6cf1e01c1765561c20815cd0e97da316e66d2638cbc9e5683ef66b07440d0b994a006f71758d0b73fcc26e5e65935e12036
SSDEEP 768:O/UxvxjgC+Ft3VtUSFajTFnqMwQi5BgK5/CwYclGA8Dea:DZj3+Ft3Vq3FVmBg8/dcA8Sa
TLSH
T1E703CF36ECB49DB78CFA9640768A638BEFF45153C5C4099889ED1E0E02C79EC130BC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

84b745b9-33f3-4a8f-a878-8d75e5d462aa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\84b745b9-33f3-4a8f-a878-8d75e5d462aa.tmp
Size 38KB
SHA256 24bbf07f28a08b9ec48dd909edf263977689af6f67e15270e84299feaf39a85f
MD5 647baeeb6aef3edee0317e428e2049f7
SHA1 d20011b16428170f0bf2158113bae53328c4df5a
SHA512 24c2b55c2541c7a11dfa696cab4add69415e8956070baf799d0d2a0dce0a288d60c64a1047f6f7675b38d421382c4c7910e737b9abe24e2fd9d3afbaa8df2732
SSDEEP 768:kr/UxvxjgC+M3lj/SFajTxXnqMwQi5BgK5/CwYcZS/3D:ZZj3+M3lh3xXVmBg8/d4vD
TLSH
T12303C035ECB59D7748FAA204B28A3797EFF416A3D8C509A845ED4E0E06876ED130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7ecabb73-ae57-4539-a20c-01162870c663.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\7ecabb73-ae57-4539-a20c-01162870c663.tmp
Size 105KB
SHA256 25559293c954898f2da344ed5fe3faf3c076ca2a1868befb99178bedacb3d026
MD5 7921e958d547711c39f2211be9d582e9
SHA1 d327f17351a129da59733ef73c24b256addb1b88
SHA512 29c83b34cc319b93140a7156f0e4fd32fca94b626b32f9aa46eb5471603b5bab4338ee0313db91199b04ee0ff93fc3dd5d552299e129f6c1cd750f4211244525
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7E:fwUQC5VwBIiElEd2K57P7E
TLSH
T117B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a23025f4d05b749cd64019222483e40f71e2bd4380052e2b64a234eb0323dd12
MD5 f2999f57642ce17248d9900b8034961f
SHA1 5a92b97bdc3c0e5222e917e766218a9ee7568f1f
SHA512 001c4dde433f6d4b3121bd2e5736ab1443818c9c8ef22f8298c411039f23f15532e8510ef806e0f54b26c4ef31db9b77ed6c750a42b27167e98f8b691edafe8f
TLSH
T1F4D02BB1E0ED8473C050307C000681815205F8426AC555801F25D07C091014C234B108
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ae4519203ea4a71f8bb5a86dffca3b288f02f1bf4cb8d6f78e8a591b676414b1
MD5 1293a304484c7d4be275f1eb20c69a28
SHA1 b568174debe43e00bc9d8880e0c5166dc6720312
SHA512 ffd84ca0277d7fb25239662676bdc1988ee3267dfd6a7a17da4c4ab32edd7fa146f36c8d8b2c5f1b06efedf5cf636eaa55943e5f89902c62e6a914ebbc3ae1b7
TLSH
T143D02BB1E0DD8473C0503078000581815215F842BEC555801F25D07C091014C234B10C
MD5 SHA1 SHA512 TLSH

Submit Download

1ce5517e-2068-4647-9f7e-c9fedf513450.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1ce5517e-2068-4647-9f7e-c9fedf513450.tmp
Size 11KB
SHA256 a69f80fb448a7184e3aec6fc2270f02135cfe6845a4a6bb0aa01a3c5c2ad8caa
MD5 ed87b4917badc80b7cbefeb6c587f4dc
SHA1 b71919c6d7de213080e5aeba8143fa4c323f9ca2
SHA512 15076702e9d1b3f31fdc3d5fc4621dc6a2192ccf04a23deaff0adb356a6fa25f9b9d273995221663b8da4fe3fef530407254071b680d17197c6df2c22d9947c5
SSDEEP 192:sxRyRUCL/f5+s6BZJJ92GzoA8p9z/g6+WNC1C/YlacpoGLIgD/AJ:sxRyhL/f8s6PJJA7p/5F/ww
TLSH
T11142C815BE38A97B4CCBD20EFA557F53E2F95132A0D51E48A6FC8A1C14E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3a8e56f1-232b-49b1-9100-8dbe6f2b706b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3a8e56f1-232b-49b1-9100-8dbe6f2b706b.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

5897439f-ac0a-4e8a-93be-5cd75f70c512.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5897439f-ac0a-4e8a-93be-5cd75f70c512.tmp
Size 11KB
SHA256 0fcd2dadb5c61c49deb8f40a25fe2b3807943ad8ffa3d591540bf2f2b338c49f
MD5 7639eb65b94d72542cb087b89bbc65e3
SHA1 2a91c748b489b401d7ebfb70a9e1fe92c0f6cdb7
SHA512 0e28dc807c6c82de4b2f9274af3825431dc69778d23eb4204946790a3e55190e13517b60509e81dc10c4f0c7d6610f113cc674642d38d0c80d5419fc4e59ce27
SSDEEP 192:sxRhRUCL/f5+sWBZJJ92GzoA8p9z/g6+WNC1C/YlacpoGLIgVAJ:sxRhhL/f8sWPJJA7p/5F/wm
TLSH
T14842C915AE38A97B4CCBD20EFA257F53E6F95132A0D51E48A6FC891C14E66DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7d32b518-861b-45b0-aacb-72be2bfa3c64.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7d32b518-861b-45b0-aacb-72be2bfa3c64.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 3537b224751430f14f21f57dcf4f405abd46b6f98cf80082e033b2d07c1e6063
MD5 544b373d3066eacf4429964dd9875a4d
SHA1 f9ab71449cf5a4f956e2f2466b93d655f4f503d1
SHA512 a6640b20562d2dfad67315a5772ed445ca208df8d238ea52dba4987a1ade57d0384bf601ce5f7577ea48718c0bf3fcaf95c3e0362c136fd2fe560d28c6de0a8e
TLSH
T1BD514C95D6E0C469DBAF2173C6C6C68736747BF3498B1E4903D8C47A570F76AC54B044
MD5 SHA1 SHA512 TLSH

Submit Download

039cdf55-c6da-4634-b582-d3895719fe2b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\039cdf55-c6da-4634-b582-d3895719fe2b.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

07f479d8-e069-4544-aa53-3d91ab275b1b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\07f479d8-e069-4544-aa53-3d91ab275b1b.tmp
Size 2KB
SHA256 6ae4b74177199dfb2b892a0f02c1cef9b8a8a495c6203e9ba1a7eae42a4d4212
MD5 073e7c65691521c68c3ae87d0da8a105
SHA1 17499f4a9d2c1272b45976db718af8d820e86130
SHA512 6a3a0ff589c6e90b1a92cf95d6305fd409f57f6193e51e97ebd67461b084b3c2610c581db774915448797bded6c104aa290a0176812654a63a68c684c4a06037
TLSH
T1A0419EF3C7F8C67D891156F0AB186E2BCE1D0915432C3D5AC4E4AE2B93E2471D18199F
MD5 SHA1 SHA512 TLSH

Submit Download

163c05a8-a276-456c-b72c-2c6d06392890.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\163c05a8-a276-456c-b72c-2c6d06392890.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

b1220fbc-268c-4209-a522-bf5e2d595abe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b1220fbc-268c-4209-a522-bf5e2d595abe.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d6852739804ba3d5998ebcfe19c4f7dd70a7d145c331463498145d1ae7b96a67
MD5 1542b56d00bcef627231e55f3325467f
SHA1 8ca51b66e3df614b43e0f1e627dc66eb757668a7
SHA512 dc219be3413632cd3eb208d337ee238c13abb748b9989ba63524abacfc43ba1ed7d5f58ee24b3addc6a037515035438e6d3192ff8d4284fc0a09977fc70a493c
SSDEEP 48:K0CNQ8CgARbcrMISURK9Y1iRxaBYDUAyyLAPGKQ6uvbG9mISivK9+1Evx4/YF2IH:KgZCKaQSWHmKg4XYgK1Cqm
TLSH
T15591341036BB0210797F3A4842B5871B465232B37015EA2B7FFC51B68E2EE458DFE5D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a2b9b750-3304-40a6-8cd6-dfa83f0a09f7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a2b9b750-3304-40a6-8cd6-dfa83f0a09f7.tmp
Size 12KB
SHA256 1dcad46dc39986539c4e7c55d6a73a75d5dd5627bbe7c5904783cb9dd168619d
MD5 eae9d4ad002c401fcc264cf8930a0e61
SHA1 302afdf6e755b264934d2ec8fbed10cb18cf171c
SHA512 13509b97c3cc8b6c23ce2e78bb2e7fc44fef6952fcfdc520a59e77bf6dc20347653e338cf005694c3bb5477e87da6160cf770badcb9578bca217bbc5c43b283d
SSDEEP 192:sxRyRUCL/f5+sjBZJJ92GzoA8p9z/g6+WNC1C/YlacOoGLIgDNAJ:sxRyhL/f8sjPJJA7p/5F/Jy
TLSH
T1F842C915BE38A97B4CCBD20EBA557F53E2F95132A0D51E48A6FC8A1C14E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f54cc8a5-211c-4b4c-acff-3d020ecbeb62.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f54cc8a5-211c-4b4c-acff-3d020ecbeb62.tmp
Size 29KB
SHA256 29e3ef96287e769fe2d1ad0346ebb69142c3fa613a9973c85b93cc02a7497818
MD5 92e3b1f0ff08b3f62a8d2ee7ff28c18c
SHA1 80cc6b0658e7db8ea9b03db32d28f805212d1438
SHA512 4fc39ab7158873e906dcefa98aa4fb67fbf65ad9ad20a00bf2672b19aaca3b3d40e556d83dfc0bd86b7c1961de4806502f6048d6137a9d59226104615c348e6c
SSDEEP 768:ksRd+G7pLuLb0JWgSwffT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV9vp2+goroe2Mih:ksRd+mEb0JWgSwffTu1jaOvprgTe2DHB
TLSH
T1A0D2D97B640CCB7F4F804ADDAC197E9B6DAC02CB9698CD8047FE945C02C67EA511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6614a4a2-7a6e-4317-93df-0acf6ed18a72.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\6614a4a2-7a6e-4317-93df-0acf6ed18a72.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a1fc2155-2b85-4ba8-bca7-2e9de4d431c1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a1fc2155-2b85-4ba8-bca7-2e9de4d431c1.tmp
Size 42KB
SHA256 86b1f11f8895739f904c7c6432d7322624ecc055b16db77d5ce0c190788ab21c
MD5 4e92e0764b383f0a832f6db4e0d0060f
SHA1 c947df26643adaf0d0385ad36ce44be12d31d9fa
SHA512 027718047065b8d1d450a19fa896aa5321b4b78e4d065af6f79b7f9c5ac71ad580c824cf3c9468b06fce3ef79d4c893dab4bd7ba48267c3a14804234793a7512
SSDEEP 768:XaFQw3WwgmB/glajTxwRnqMwQi5BgK5/CwYcZS2s47:Rw35f3xwRVmBg8/d42s47
TLSH
T17D1318F598E38A7BD8AE4343A37D6E469EBCD153B4984894B7D94D0CCC864BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

99c4b949-508f-4781-9d7f-a5eab0b91af6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\99c4b949-508f-4781-9d7f-a5eab0b91af6.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

ceec08c7-977b-49c5-8a34-4d3cd0c92e84.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\ceec08c7-977b-49c5-8a34-4d3cd0c92e84.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

de8649b0-d67b-4ca8-945e-12a2a812e30f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\de8649b0-d67b-4ca8-945e-12a2a812e30f.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

df78d1fb-b044-45a7-92ea-65854b81c8e7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\df78d1fb-b044-45a7-92ea-65854b81c8e7.tmp
Size 33KB
SHA256 4617238afeda134589810996ecda9c3944f983f9958434b27ad863640a333a96
MD5 51813eab5d1278fb9bdc79b55442b70d
SHA1 41df2c482386a396639ee360bd96fe1f5e3fb2c2
SHA512 19a5c4b72cf864dd218a01e6eaecbb8cfb2da272f7b3e7a747469f65a6340bebe423d195a84352ae1139bbd301dede837dc3e0b92546788324bf18e54cf1112d
SSDEEP 768:PnZ3vb/SFajTxXnqMwQi5BgK5/CwYcZS2s47:PZ3vp3xXVmBg8/d42s47
TLSH
T16DF2BF30ECB18EB71CFE9201B2867742AFF45663D8D50A9494EE8B0D05879EE130BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

58ee8533-3166-4fa1-a31b-d5f105f5585c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\58ee8533-3166-4fa1-a31b-d5f105f5585c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

6c0df8bc-26f3-4f46-af36-69a615fd9b0a.tmp

Path C:\Users\Admin\AppData\Local\Temp\6c0df8bc-26f3-4f46-af36-69a615fd9b0a.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

8dc825c1-19c1-40f3-8028-f8fa68aa8c66.tmp

Path C:\Users\Admin\AppData\Local\Temp\8dc825c1-19c1-40f3-8028-f8fa68aa8c66.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1712_984416483\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1712_1366137426\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1712_283720180\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1712_513780847\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1712_610736509\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 516b035bd6eca04f2053a6cbc2d7a1169dbdae8317c2e52ee46e170293b383e6
MD5 14bc24881fb40629f846c023896b2e8f
SHA1 2e4d55fa038155587525d14e7921597943ba497d
SHA512 837e56e8d749eb7de66ec4b6b70b8c8a43cd5eac04eafe1bb9a95227d56a7459077b338075e945a59e1ed2a6813b694bd552579f69e574ae4f860d6092218d23
TLSH
T1CF71238357B9DAB3C1DE9FF102835604F6FB227C472330210B616586AB30B7A24B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/248-454-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1764-194-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2144-342-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2168-279-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2452-322-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2956-418-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3148-338-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3184-62-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3312-280-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3412-479-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3868-495-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4276-384-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4296-450-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4488-498-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4820-398-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4852-243-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4904-372-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4972-438-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5368-293-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5856-318-0x0000000000010000-0x00000000000AB000-memory.dmp

Download