systex | 80bcb0328dc346ae01f1c8096ccb4035ba2d1b0047e2978fbbfa47483e390f44

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 19:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 456KB
Sample261002-x2ncjsgd48
SHA256 80bcb0328dc346ae01f1c8096ccb4035ba2d1b0047e2978fbbfa47483e390f44
MD5 172123b803af420eabbbb76f7708290f
SHA1 d2e5083d4d7c1f15093edd6c8830b68a5b7f8dc4
SHA512 b2b32b78e522fe6766394bee1385cf545f5529e6db777ffffdd4e22f44a6b12c0b8ca99819b5835d3159c370c326a5ba82c2eb93baf82119c92675d07cb4b40f
SSDEEP 6144:tflfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lI3:tflfAsiVGjSGecvXAflfAsi7
TLSH
T163A48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5132	czusecwuomhezxrp.exe
1452	czusecwuomhezxrp.sys
4192	CreateProcess.exe
5444	uomhezwrom.exe
3044	CreateProcess.exe
124	CreateProcess.exe
1904	i_uomhezwrom.exe
1452	zwuomgeywr.sys
2252	CreateProcess.exe
5176	omgeywtomg.exe
4908	CreateProcess.exe
2688	CreateProcess.exe
2380	i_omgeywtomg.exe
456	jdbwtrljdb.sys
5384	CreateProcess.exe
5912	jdbywqoigd.exe
4608	CreateProcess.exe
4088	CreateProcess.exe
5932	i_jdbywqoigd.exe
6060	gdywqoigby.sys
3016	CreateProcess.exe
4324	dyvtnlgdyv.exe
1300	CreateProcess.exe
5216	CreateProcess.exe
2800	i_dyvtnlgdyv.exe
4768	yvqoifaysq.sys
2032	CreateProcess.exe
1948	vsnifaysqk.exe
5656	CreateProcess.exe
5848	CreateProcess.exe
1884	i_vsnifaysqk.exe
1332	CreateProcess.exe
2000	axspkicaus.exe
3592	CreateProcess.exe
2160	CreateProcess.exe
5400	i_axspkicaus.exe
4224	kfcxvsnkfd.sys
552	CreateProcess.exe
3040	hfausnkfcx.exe
824	CreateProcess.exe
3244	CreateProcess.exe
4692	i_hfausnkfcx.exe
2912	zxuspkhczx.sys
5528	CreateProcess.exe
5688	fzxrpjhczu.exe
4496	CreateProcess.exe
4576	CreateProcess.exe
4416	i_fzxrpjhczu.exe
4108	mhfrpjhczu.sys
2624	CreateProcess.exe
4792	zurpjhczur.exe
5500	CreateProcess.exe
2860	CreateProcess.exe
5064	i_zurpjhczur.exe
1352	jecwuomgez.sys
4380	CreateProcess.exe
2696	bzwjgeywtr.exe
2820	CreateProcess.exe
5984	CreateProcess.exe
5668	i_bzwjgeywtr.exe
3292	eywqojgbzt.sys
2028	CreateProcess.exe
1328	dbwtomgbyw.exe
4560	CreateProcess.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1088_593585289\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1088_2085859425\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1088_2037100623\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1088_2037100623\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1088_593585289\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1088_593585289\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1088_1023623893\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1088_1023623893\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1088_1688072226\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1088_1688072226\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1088_2037100623\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1088_2037100623\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1088_593585289\LICENSE	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywqnlgdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlfdyvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nifaysqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbywqojgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzwjgeywtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbywqoigd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgeywtomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axspkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxrpjhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlfdyvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnifdavtnd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecxupnhfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnifaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axspkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxrpjhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecxupnhfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zusmkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbzurmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomhezwrom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomhezwrom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfausnkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbwtomgbyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywqnlgdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbzurmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzwromjebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfausnkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurpjhczur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzwjgeywtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgeywtomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbywqoigd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvtnlgdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dyvtnlgdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnifaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zusmkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzwromjebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czusecwuomhezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurpjhczur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbwtomgbyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnifdavtnd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nifaysqkic.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4668	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5340	ipconfig.exe
4068	ipconfig.exe
1528	ipconfig.exe
1204	ipconfig.exe
3624	ipconfig.exe
2700	ipconfig.exe
2860	ipconfig.exe
3628	ipconfig.exe
2852	ipconfig.exe
2540	ipconfig.exe
2860	ipconfig.exe
1084	ipconfig.exe
1160	ipconfig.exe
796	ipconfig.exe
5636	ipconfig.exe
3308	ipconfig.exe
3372	ipconfig.exe
3248	ipconfig.exe
1716	ipconfig.exe
2568	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2304238888-3968896904-642854331-1000\{9EE7EF02-ED50-425E-810E-77B05E05AE8F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5132	czusecwuomhezxrp.exe
5132	czusecwuomhezxrp.exe
5132	czusecwuomhezxrp.exe
5132	czusecwuomhezxrp.exe
5132	czusecwuomhezxrp.exe
5132	czusecwuomhezxrp.exe
5132	czusecwuomhezxrp.exe
5132	czusecwuomhezxrp.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	1904	i_uomhezwrom.exe
Token: SeDebugPrivilege	2380	i_omgeywtomg.exe
Token: SeDebugPrivilege	5932	i_jdbywqoigd.exe
Token: SeDebugPrivilege	2800	i_dyvtnlgdyv.exe
Token: SeDebugPrivilege	5400	i_axspkicaus.exe
Token: SeDebugPrivilege	4692	i_hfausnkfcx.exe
Token: SeDebugPrivilege	4416	i_fzxrpjhczu.exe
Token: SeDebugPrivilege	5064	i_zurpjhczur.exe
Token: SeDebugPrivilege	5668	i_bzwjgeywtr.exe
Token: SeDebugPrivilege	2612	i_dbwtomgbyw.exe
Token: SeDebugPrivilege	2360	i_eywqnlgdyw.exe
Token: SeDebugPrivilege	5776	i_tnlfdyvqni.exe
Token: SeDebugPrivilege	2564	i_qnifdavtnd.exe
Token: SeDebugPrivilege	4896	i_nifaysqkic.exe
Token: SeDebugPrivilege	2356	i_ecxupnhfcx.exe
Token: SeDebugPrivilege	4720	i_zusmkecwup.exe
Token: SeDebugPrivilege	4732	i_hbzurmkecw.exe
Token: SeDebugPrivilege	1652	i_bzwromjebw.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1088	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3224 wrote to memory of 5132	3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 3224 wrote to memory of 4832	3224	2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 4832 wrote to memory of 1088	4832	iexplore.exe	91
PID 1088 wrote to memory of 4176	1088	msedge.exe	92
PID 1088 wrote to memory of 4372	1088	msedge.exe	93
PID 1088 wrote to memory of 4668	1088	msedge.exe	94
PID 1088 wrote to memory of 4372	1088	msedge.exe	93
PID 1088 wrote to memory of 4372	1088	msedge.exe	93
PID 1088 wrote to memory of 4688	1088	msedge.exe	95
PID 1088 wrote to memory of 4688	1088	msedge.exe	95
PID 1088 wrote to memory of 4528	1088	msedge.exe	97
PID 1088 wrote to memory of 4492	1088	msedge.exe	98
PID 1088 wrote to memory of 4528	1088	msedge.exe	97
PID 1088 wrote to memory of 4528	1088	msedge.exe	97
PID 1088 wrote to memory of 4492	1088	msedge.exe	98
PID 1088 wrote to memory of 4492	1088	msedge.exe	98
PID 1088 wrote to memory of 2640	1088	msedge.exe	99
PID 1088 wrote to memory of 4360	1088	msedge.exe	100
PID 1088 wrote to memory of 2640	1088	msedge.exe	99
PID 1088 wrote to memory of 2640	1088	msedge.exe	99
PID 1088 wrote to memory of 4360	1088	msedge.exe	100
PID 1088 wrote to memory of 4360	1088	msedge.exe	100
PID 1088 wrote to memory of 2500	1088	msedge.exe	101
PID 1088 wrote to memory of 2500	1088	msedge.exe	101
PID 1088 wrote to memory of 2780	1088	msedge.exe	105
PID 1088 wrote to memory of 2780	1088	msedge.exe	105
PID 1088 wrote to memory of 4516	1088	msedge.exe	106
PID 1088 wrote to memory of 4516	1088	msedge.exe	106
PID 1088 wrote to memory of 5832	1088	msedge.exe	108
PID 5132 wrote to memory of 4192	5132	czusecwuomhezxrp.exe	109
PID 1088 wrote to memory of 4224	1088	msedge.exe	111
PID 1088 wrote to memory of 4224	1088	msedge.exe	111
PID 5444 wrote to memory of 3044	5444	uomhezwrom.exe	113
PID 1088 wrote to memory of 5512	1088	msedge.exe	116
PID 1088 wrote to memory of 5512	1088	msedge.exe	116
PID 5132 wrote to memory of 124	5132	czusecwuomhezxrp.exe	119
PID 5132 wrote to memory of 2252	5132	czusecwuomhezxrp.exe	123
PID 5176 wrote to memory of 4908	5176	omgeywtomg.exe	125
PID 5132 wrote to memory of 2688	5132	czusecwuomhezxrp.exe	128
PID 5132 wrote to memory of 5384	5132	czusecwuomhezxrp.exe	132
PID 5912 wrote to memory of 4608	5912	jdbywqoigd.exe	134
PID 5132 wrote to memory of 4088	5132	czusecwuomhezxrp.exe	137
PID 5132 wrote to memory of 3016	5132	czusecwuomhezxrp.exe	142
PID 4324 wrote to memory of 1300	4324	dyvtnlgdyv.exe	144
PID 5132 wrote to memory of 5216	5132	czusecwuomhezxrp.exe	147
PID 1088 wrote to memory of 1400	1088	msedge.exe	149
PID 1088 wrote to memory of 904	1088	msedge.exe	150
PID 1088 wrote to memory of 4412	1088	msedge.exe	151
PID 5132 wrote to memory of 2032	5132	czusecwuomhezxrp.exe	154
PID 1948 wrote to memory of 5656	1948	vsnifaysqk.exe	156
PID 5132 wrote to memory of 5848	5132	czusecwuomhezxrp.exe	159
PID 5132 wrote to memory of 1332	5132	czusecwuomhezxrp.exe	161
PID 2000 wrote to memory of 3592	2000	axspkicaus.exe	163
PID 5132 wrote to memory of 2160	5132	czusecwuomhezxrp.exe	166
PID 5132 wrote to memory of 552	5132	czusecwuomhezxrp.exe	170
PID 3040 wrote to memory of 824	3040	hfausnkfcx.exe	172
PID 5132 wrote to memory of 3244	5132	czusecwuomhezxrp.exe	175
PID 5132 wrote to memory of 5528	5132	czusecwuomhezxrp.exe	179
PID 5688 wrote to memory of 4496	5688	fzxrpjhczu.exe	181
PID 5132 wrote to memory of 4576	5132	czusecwuomhezxrp.exe	184
PID 1088 wrote to memory of 2144	1088	msedge.exe	186
PID 1088 wrote to memory of 2144	1088	msedge.exe	186
PID 5132 wrote to memory of 2624	5132	czusecwuomhezxrp.exe	192
PID 4792 wrote to memory of 5500	4792	zurpjhczur.exe	194

C:\Users\Admin\AppData\Local\Temp\2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_172123b803af420eabbbb76f7708290f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3224
- C:\Temp\czusecwuomhezxrp.exe
  C:\Temp\czusecwuomhezxrp.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5132
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uomhezwrom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4192
  - - C:\Temp\uomhezwrom.exe
      C:\Temp\uomhezwrom.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5444
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3044
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2860
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uomhezwrom.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:124
  - - C:\Temp\i_uomhezwrom.exe
      C:\Temp\i_uomhezwrom.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1904
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omgeywtomg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2252
  - - C:\Temp\omgeywtomg.exe
      C:\Temp\omgeywtomg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5176
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4908
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5340
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omgeywtomg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2688
  - - C:\Temp\i_omgeywtomg.exe
      C:\Temp\i_omgeywtomg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jdbywqoigd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5384
  - - C:\Temp\jdbywqoigd.exe
      C:\Temp\jdbywqoigd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5912
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4608
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2700
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jdbywqoigd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4088
  - - C:\Temp\i_jdbywqoigd.exe
      C:\Temp\i_jdbywqoigd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5932
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dyvtnlgdyv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3016
  - - C:\Temp\dyvtnlgdyv.exe
      C:\Temp\dyvtnlgdyv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4324
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1300
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4068
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dyvtnlgdyv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5216
  - - C:\Temp\i_dyvtnlgdyv.exe
      C:\Temp\i_dyvtnlgdyv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2800
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vsnifaysqk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2032
  - - C:\Temp\vsnifaysqk.exe
      C:\Temp\vsnifaysqk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1948
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5656
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1084
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vsnifaysqk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5848
  - - C:\Temp\i_vsnifaysqk.exe
      C:\Temp\i_vsnifaysqk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1884
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\axspkicaus.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1332
  - - C:\Temp\axspkicaus.exe
      C:\Temp\axspkicaus.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2000
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3592
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2860
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_axspkicaus.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2160
  - - C:\Temp\i_axspkicaus.exe
      C:\Temp\i_axspkicaus.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5400
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfausnkfcx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:552
  - - C:\Temp\hfausnkfcx.exe
      C:\Temp\hfausnkfcx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3040
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:824
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3248
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfausnkfcx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3244
  - - C:\Temp\i_hfausnkfcx.exe
      C:\Temp\i_hfausnkfcx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4692
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fzxrpjhczu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5528
  - - C:\Temp\fzxrpjhczu.exe
      C:\Temp\fzxrpjhczu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5688
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4496
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1528
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fzxrpjhczu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4576
  - - C:\Temp\i_fzxrpjhczu.exe
      C:\Temp\i_fzxrpjhczu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zurpjhczur.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2624
  - - C:\Temp\zurpjhczur.exe
      C:\Temp\zurpjhczur.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4792
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5500
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1160
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zurpjhczur.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2860
  - - C:\Temp\i_zurpjhczur.exe
      C:\Temp\i_zurpjhczur.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bzwjgeywtr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4380
  - - C:\Temp\bzwjgeywtr.exe
      C:\Temp\bzwjgeywtr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2696
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2820
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3628
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bzwjgeywtr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5984
  - - C:\Temp\i_bzwjgeywtr.exe
      C:\Temp\i_bzwjgeywtr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbwtomgbyw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2028
  - - C:\Temp\dbwtomgbyw.exe
      C:\Temp\dbwtomgbyw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1328
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4560
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2852
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbwtomgbyw.exe ups_ins
    3⤵
    PID:2148
  - - C:\Temp\i_dbwtomgbyw.exe
      C:\Temp\i_dbwtomgbyw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2612
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eywqnlgdyw.exe ups_run
    3⤵
    PID:4436
  - - C:\Temp\eywqnlgdyw.exe
      C:\Temp\eywqnlgdyw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5044
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5952
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eywqnlgdyw.exe ups_ins
    3⤵
    PID:4224
  - - C:\Temp\i_eywqnlgdyw.exe
      C:\Temp\i_eywqnlgdyw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2360
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tnlfdyvqni.exe ups_run
    3⤵
    PID:5736
  - - C:\Temp\tnlfdyvqni.exe
      C:\Temp\tnlfdyvqni.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4068
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4200
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tnlfdyvqni.exe ups_ins
    3⤵
    PID:1528
  - - C:\Temp\i_tnlfdyvqni.exe
      C:\Temp\i_tnlfdyvqni.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5776
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnifdavtnd.exe ups_run
    3⤵
    PID:1052
  - - C:\Temp\qnifdavtnd.exe
      C:\Temp\qnifdavtnd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2640
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5076
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1204
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnifdavtnd.exe ups_ins
    3⤵
    PID:4580
  - - C:\Temp\i_qnifdavtnd.exe
      C:\Temp\i_qnifdavtnd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nifaysqkic.exe ups_run
    3⤵
    PID:5852
  - - C:\Temp\nifaysqkic.exe
      C:\Temp\nifaysqkic.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2616
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5972
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3624
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nifaysqkic.exe ups_ins
    3⤵
    PID:2604
  - - C:\Temp\i_nifaysqkic.exe
      C:\Temp\i_nifaysqkic.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecxupnhfcx.exe ups_run
    3⤵
    PID:5668
  - - C:\Temp\ecxupnhfcx.exe
      C:\Temp\ecxupnhfcx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2864
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2692
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5636
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecxupnhfcx.exe ups_ins
    3⤵
    PID:4452
  - - C:\Temp\i_ecxupnhfcx.exe
      C:\Temp\i_ecxupnhfcx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2356
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zusmkecwup.exe ups_run
    3⤵
    PID:2188
  - - C:\Temp\zusmkecwup.exe
      C:\Temp\zusmkecwup.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4804
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4744
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3308
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zusmkecwup.exe ups_ins
    3⤵
    PID:3828
  - - C:\Temp\i_zusmkecwup.exe
      C:\Temp\i_zusmkecwup.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4720
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hbzurmkecw.exe ups_run
    3⤵
    PID:5884
  - - C:\Temp\hbzurmkecw.exe
      C:\Temp\hbzurmkecw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5164
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3876
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hbzurmkecw.exe ups_ins
    3⤵
    PID:4128
  - - C:\Temp\i_hbzurmkecw.exe
      C:\Temp\i_hbzurmkecw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4732
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bzwromjebw.exe ups_run
    3⤵
    PID:4348
  - - C:\Temp\bzwromjebw.exe
      C:\Temp\bzwromjebw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3732
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1588
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2568
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bzwromjebw.exe ups_ins
    3⤵
    PID:932
  - - C:\Temp\i_bzwromjebw.exe
      C:\Temp\i_bzwromjebw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1652
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gbywqojgby.exe ups_run
    3⤵
    PID:2956
  - - C:\Temp\gbywqojgby.exe
      C:\Temp\gbywqojgby.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1400
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4220
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3372
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x394,0x7ffb3351c188,0x7ffb3351c194,0x7ffb3351c1a0
      4⤵
      PID:4176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,3027296429877793915,10769328657724565884,262144 --field-trial-handle=2288,i,7510984528354792637,17243145172801130428,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
      4⤵
      PID:4372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,1323566775995049523,1143337983478007675,524288 --field-trial-handle=2288,i,7510984528354792637,17243145172801130428,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:11
      4⤵
      System Time Discovery
      PID:4668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,8554734991618915708,15682605095124290231,524288 --field-trial-handle=2288,i,7510984528354792637,17243145172801130428,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:13
      4⤵
      PID:4688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3620,i,3190946986287633480,4369375357833226669,2097152 --field-trial-handle=2288,i,7510984528354792637,17243145172801130428,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
      4⤵
      PID:4528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3640,i,4469160366971546201,13667387421221494051,2097152 --field-trial-handle=2288,i,7510984528354792637,17243145172801130428,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
      4⤵
      PID:4492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,12186749320546413145,6305911489483808041,2097152 --field-trial-handle=2288,i,7510984528354792637,17243145172801130428,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:9
      4⤵
      PID:2640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4308,i,6503027924962573435,5123987802969259029,2097152 --field-trial-handle=2288,i,7510984528354792637,17243145172801130428,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
      4⤵
      PID:4360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,17858703265133645622,11427682622618180291,524288 --field-trial-handle=2288,i,7510984528354792637,17243145172801130428,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:14
      4⤵
      PID:2500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,6608453617565986096,3729411368304758598,524288 --field-trial-handle=2288,i,7510984528354792637,17243145172801130428,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
      4⤵
      PID:2780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,13862944731079413239,15305041829239631703,524288 --field-trial-handle=2288,i,7510984528354792637,17243145172801130428,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
      4⤵
      PID:4516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,14836354924043779852,1499632101431023890,524288 --field-trial-handle=2288,i,7510984528354792637,17243145172801130428,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
      4⤵
      PID:2252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,14836354924043779852,1499632101431023890,524288 --field-trial-handle=2288,i,7510984528354792637,17243145172801130428,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
      4⤵
      PID:5832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,3724028886260542359,8207771411072122364,524288 --field-trial-handle=2288,i,7510984528354792637,17243145172801130428,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
      4⤵
      PID:4224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,4198557971148637187,16109349698104705637,524288 --field-trial-handle=2288,i,7510984528354792637,17243145172801130428,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:14
      4⤵
      PID:5512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,10899795440067416187,3334943450684698756,524288 --field-trial-handle=2288,i,7510984528354792637,17243145172801130428,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:14
      4⤵
      PID:1400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,650757451322748250,6035722245518880209,524288 --field-trial-handle=2288,i,7510984528354792637,17243145172801130428,262144 --variations-seed-version --mojo-platform-channel-handle=1660 /prefetch:14
      4⤵
      PID:904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4932,i,14970336702584408040,11070266909356706994,524288 --field-trial-handle=2288,i,7510984528354792637,17243145172801130428,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:14
      4⤵
      PID:4412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,16705133470183588190,981043505152040326,524288 --field-trial-handle=2288,i,7510984528354792637,17243145172801130428,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
      4⤵
      PID:2144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,6214078154082771310,10189027970470170661,524288 --field-trial-handle=2288,i,7510984528354792637,17243145172801130428,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
      4⤵
      PID:5392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,13286512610857843534,5105363249957250055,524288 --field-trial-handle=2288,i,7510984528354792637,17243145172801130428,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:14
      4⤵
      PID:5596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,6835595525760861308,5768507428118603447,524288 --field-trial-handle=2288,i,7510984528354792637,17243145172801130428,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:14
      4⤵
      PID:5892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6564,i,2139269071312823284,13860321386100074507,262144 --field-trial-handle=2288,i,7510984528354792637,17243145172801130428,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:10
      4⤵
      PID:3360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,10551124232992955006,8094415131564732693,524288 --field-trial-handle=2288,i,7510984528354792637,17243145172801130428,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:14
      4⤵
      PID:1028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,12909754979707760295,16196893678534280429,524288 --field-trial-handle=2288,i,7510984528354792637,17243145172801130428,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:14
      4⤵
      PID:3036

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3180

C:\Temp\czusecwuomhezxrp.sys
C:\Temp\czusecwuomhezxrp.sys
1⤵
- Executes dropped EXE
PID:1452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2292

C:\Temp\zwuomgeywr.sys
C:\Temp\zwuomgeywr.sys
1⤵
- Executes dropped EXE
PID:1452

C:\Temp\jdbwtrljdb.sys
C:\Temp\jdbwtrljdb.sys
1⤵
- Executes dropped EXE
PID:456

C:\Temp\gdywqoigby.sys
C:\Temp\gdywqoigby.sys
1⤵
- Executes dropped EXE
PID:6060

C:\Temp\yvqoifaysq.sys
C:\Temp\yvqoifaysq.sys
1⤵
- Executes dropped EXE
PID:4768

C:\Temp\kfcxvsnkfd.sys
C:\Temp\kfcxvsnkfd.sys
1⤵
- Executes dropped EXE
PID:4224

C:\Temp\zxuspkhczx.sys
C:\Temp\zxuspkhczx.sys
1⤵
- Executes dropped EXE
PID:2912

C:\Temp\mhfrpjhczu.sys
C:\Temp\mhfrpjhczu.sys
1⤵
- Executes dropped EXE
PID:4108

C:\Temp\jecwuomgez.sys
C:\Temp\jecwuomgez.sys
1⤵
- Executes dropped EXE
PID:1352

C:\Temp\eywqojgbzt.sys
C:\Temp\eywqojgbzt.sys
1⤵
- Executes dropped EXE
PID:3292

C:\Temp\eywqoigayw.sys
C:\Temp\eywqoigayw.sys
1⤵
PID:4580

C:\Temp\gdywqnlgdy.sys
C:\Temp\gdywqnlgdy.sys
1⤵
PID:684

C:\Temp\vtnlfdxvqn.sys
C:\Temp\vtnlfdxvqn.sys
1⤵
PID:1140

C:\Temp\nhfcaysqkh.sys
C:\Temp\nhfcaysqkh.sys
1⤵
PID:5048

C:\Temp\kfcxupnhfz.sys
C:\Temp\kfcxupnhfz.sys
1⤵
PID:1652

C:\Temp\hecaxspmhe.sys
C:\Temp\hecaxspmhe.sys
1⤵
PID:5408

C:\Temp\khbzurmkec.sys
C:\Temp\khbzurmkec.sys
1⤵
PID:4888

C:\Temp\ywrojgebwu.sys
C:\Temp\ywrojgebwu.sys
1⤵
PID:5464

C:\Temp\dbztqoigey.sys
C:\Temp\dbztqoigey.sys
1⤵
PID:3292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

axspkicaus.exe

Path C:\Temp\axspkicaus.exe
Size 456KB
SHA256 462cb57c60b66447c638b98d9e85e50d6c8d1c5d5796c6051aa0cb8a8b7e7d41
MD5 2673a1e6e00d1e1282c4e44a9e050bb0
SHA1 9299ce3fdcef91388e634dbdb53e311da520a77f
SHA512 d96468b3c00c86add3de0e2bfb78782675f285d79d936ee7406f1557cc1731aaf6f44ffc27040566c425f26ce83f5a84eeb41d3bf8ce165c3013f86156ef9401
SSDEEP 6144:EflfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lI4:EflfAsiVGjSGecvXAflfAsic
TLSH
T1BAA48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

czusecwuomhezxrp.exe

Path C:\Temp\czusecwuomhezxrp.exe
Size 456KB
SHA256 7af490a31180cbb75619fc293f1df6d5f4fabb67e7755aad56a5297ca6b3ba62
MD5 a4e862a7e8b5343f93f5eec47cf1fa30
SHA1 e5617f34f598c5432223ea64f12523603b4d17c3
SHA512 4f9217c42a898a0a9b62d552e621b9a3d624cce679e91c5b819199057144648d3adcc7dfbf41d9efd455332fa987119905248fb2843acf0f529af1969273e6e1
SSDEEP 6144:FflfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lIH:FflfAsiVGjSGecvXAflfAsiD
TLSH
T1CEA48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

czusecwuomhezxrp.sys

Path C:\Temp\czusecwuomhezxrp.sys
Size 293KB
SHA256 3591f56cd42c04c094f519872344a5395e497532a8132fc2c34f890dcb4277d4
MD5 f321bc35ce800b63fdebed7776c4c508
SHA1 11b48f8548d8e419dae9d8deb8fc59bf7dcc99f8
SHA512 15b56ea97710f4f7b0eb0307f27dad12427a73446e8a5a5d78bd105396344dccf5a5deee07578c660dc95c02ea6b3dc6f2240345e8b36136eaa2e413f3125e07
SSDEEP 3072:OtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:OIJjiJcbI03GBc3ucY5DCSj
TLSH
T1CC545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dyvtnlgdyv.exe

Path C:\Temp\dyvtnlgdyv.exe
Size 456KB
SHA256 a14d569a3354e954a76d2b41577c71fa479244af6c9b132cdf5f341501cbd499
MD5 105f2a803964192feef023d8144349e9
SHA1 ddef8d2a106253a93a853e6308c125810ebe0239
SHA512 0ca8839530690897943646997fb4107c616be731aec16aa425dcbdf130ef4d42b9186ace8f8ffbda40ae8f95f520015809bbc16034136928f41f7249a2d832e9
SSDEEP 6144:7flfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lIB:7flfAsiVGjSGecvXAflfAsiF
TLSH
T112A48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdywqoigby.sys

Path C:\Temp\gdywqoigby.sys
Size 293KB
SHA256 3a0690819f017b7495d657d415d6e8b62b73d88d073ce2f62d39baa9ada91788
MD5 6295cbce075c86b97a80d607bb18a31f
SHA1 b87f2ce8622a7cebd68c5676af010134668d9624
SHA512 3e28e40636da8e67cb4e178af574096ea57191ff4abad573383b447a3617f7e89130f564b065f499b0549ea7c7925b79bcccb9d34e5fb7dc54b769bbf5c4d427
SSDEEP 3072:UtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:UIJjiJcbI03GBc3ucY5DCSj
TLSH
T1B3545B44AAA4B0F6D9D5043C00EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_axspkicaus.exe

Path C:\Temp\i_axspkicaus.exe
Size 456KB
SHA256 3f06ddb08dfc8c7e59d205acb54087c77f166977ca453249556f5e29986b0623
MD5 6bdfd330accfa3ac7aca08a3874a40af
SHA1 74c77e3919233ee8fecd699e9242dd9b84aed6fc
SHA512 2a3751e66ec95bc4c645f8a35d412e3ef5f92e79dd09ff6a8b5197c02031f3214275f096e353cf7d0474d730edacff208a483e135a6c1727ed27d82084f90c40
SSDEEP 6144:+flfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lIm:+flfAsiVGjSGecvXAflfAsia
TLSH
T133A48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dyvtnlgdyv.exe

Path C:\Temp\i_dyvtnlgdyv.exe
Size 456KB
SHA256 c1f9f71293b7b3b1d85553e72006ac0d5579d56f579cda9a9eae747337730844
MD5 0b57cef992eff23079fa263d5aba0a7b
SHA1 fb2346cea66ec6db92864e763256e7dac742ab12
SHA512 098321bf38ac292430784c3f503da88b2640ef291941f48180dc2a324138a0d2ade3692c4b91ec66413050ce65ec321e23c508279055ac23c1afd927c0e89991
SSDEEP 6144:kflfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lIA:kflfAsiVGjSGecvXAflfAsiM
TLSH
T1A6A48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jdbywqoigd.exe

Path C:\Temp\i_jdbywqoigd.exe
Size 456KB
SHA256 3f393096966d7d7e20c1201bd7cb328a2deef833cb37baa4279e70b8fd911073
MD5 e41c506e0ccaf55a5cc702106642e598
SHA1 cfbcff1779a0a267fd5af3d09fe77e0a8c19260e
SHA512 7e6756a3a3d75e34a7a454dde52538feeed1b43330d5485255cc1ac71dff7d2d7f23138a56f08c575f3b417a036da1a9abb066a92937da2b5e3796665657c8ef
SSDEEP 6144:TflfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lIZ:TflfAsiVGjSGecvXAflfAsid
TLSH
T103A48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_omgeywtomg.exe

Path C:\Temp\i_omgeywtomg.exe
Size 456KB
SHA256 1012baf2dd9ae558d4bf656503f69a121baf94e2d5460024f2acde47dee73e34
MD5 134d54baa43ae1790a2ee13cda7ed474
SHA1 2fb15df154fb2298a9f5ba0606a775ea12f36102
SHA512 178c81a45528c6321e22d91798b9990e6b4b79299e0baaf7ff07f94bfcf2c5188bcb9c06e75e945e17e9d591056b1b8aaf9e2891c962e6ae94761c3cbed860c0
SSDEEP 6144:yflfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lIK:yflfAsiVGjSGecvXAflfAsi2
TLSH
T1B7A48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_uomhezwrom.exe

Path C:\Temp\i_uomhezwrom.exe
Size 456KB
SHA256 b19cc0704970c2f91eb743cfebb0fa06a8a03208c2ba59dcba1901e60b2d213d
MD5 dc1453dfaa5429795160741072b3a9f1
SHA1 5cead81aace6ca04b6d56ec2f34113bfa2075a27
SHA512 77e92fbd86cb0b4e07bb3475d76e7d599a54a30db241867d5d435c2e47c9d2b67f664440f8b294450144d3848a8d6b520ae50d128f1ab3c20171b7ced3c86167
SSDEEP 6144:9flfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lIH:9flfAsiVGjSGecvXAflfAsib
TLSH
T1A4A48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vsnifaysqk.exe

Path C:\Temp\i_vsnifaysqk.exe
Size 456KB
SHA256 4470b30487f04c7ec99afd0a5c5f835c95bd40965b9b95f25f0e172a799d46af
MD5 bf99ccf3dd646f4aaee5172223dcf249
SHA1 6deacacd04625b68b7309ec48870c67b91d30df4
SHA512 a023bbed3b25813eda27ccbfa3ba872a5ef16c9947f142b251f29def57a42c3be302a6da6e11b730ef879139d9c31b7bcf9e7946d55554f8c4e61ece6497c532
SSDEEP 6144:JflfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lIT:JflfAsiVGjSGecvXAflfAsiP
TLSH
T109A48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbwtrljdb.sys

Path C:\Temp\jdbwtrljdb.sys
Size 293KB
SHA256 e3fb9a4618e8b738320d230a6790c64fff6fea529e644b60590a397e748321d2
MD5 d84c51d5d7f86c49f2f8b4332746ee5e
SHA1 256932ba948f2ac86dedddfe7c705b9e3e7c4a27
SHA512 f8f1c8f42d0b8c76dce53973bfa576fecb3da232980ac6f961eff2fbbfaf480602d1b37457a1871512014d3d60fd6480ba7525da943a20ab800a85f22ebe9f39
SSDEEP 3072:8tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:8IJjiJcbI03GBc3ucY5DCSj
TLSH
T17E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbywqoigd.exe

Path C:\Temp\jdbywqoigd.exe
Size 456KB
SHA256 c0b62af0ee568d93869a012ef5295fe59d89907709ba05a7fa98ce251769a3be
MD5 a23659208f4386c8ea1ba39a81f1971d
SHA1 dbecc05418835fbc387d494557072c42ad0ad438
SHA512 a154b5b30ce97c632fb1fd73d6e64cb43837d7b432e7341df2ca5c57e588802189d6c9476be69b21bce8ae217a09f64fac06aaed46a4c3f4cc54c8e09fe2db34
SSDEEP 6144:BflfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lIj:BflfAsiVGjSGecvXAflfAsiH
TLSH
T1F3A48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgeywtomg.exe

Path C:\Temp\omgeywtomg.exe
Size 456KB
SHA256 4e8ccf009235221fd3034c799d69e75b1e32aa045985838d6e8987b19215eafd
MD5 2076bc8419eded0777bf0fb90798624c
SHA1 017a507eac3789ef2dec5e21da9a1ed5bca975b0
SHA512 20a938825d5965a56c0dc30b58a1a64a31c5e9cb6cb4dbd1f229b5da363c220be3b10f074748219d82a0c473d45783bf9dcedee3c484a6476de24239676bc7b4
SSDEEP 6144:IflfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lIk:IflfAsiVGjSGecvXAflfAsi4
TLSH
T19BA48C14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uomhezwrom.exe

Path C:\Temp\uomhezwrom.exe
Size 456KB
SHA256 7e10d903e49190ca4e2c9201c718a8d8b8459975c1f11dce217305755e0c3b2c
MD5 4450b586bdbe503d9acdf6a0f8575062
SHA1 3d9e482ac2827f62e5848b7cd8de294127c469e3
SHA512 990ae7aa390456345285c7eb16dd85379ee3256507f63ada7829d33408b0b03fbe0166daac9e23a585eb5f98b4a177feea1889adc9f203ea4973be1c8dc7f193
SSDEEP 6144:LflfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lIp:LflfAsiVGjSGecvXAflfAsil
TLSH
T17BA48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsnifaysqk.exe

Path C:\Temp\vsnifaysqk.exe
Size 456KB
SHA256 66077849be8c076e172407de93dbf6c8d645f6a6633c32702583da564096395b
MD5 a4e66322be940a035b37bb973a9d5285
SHA1 4ffa2acf8902b43ba5e48db725513fa13e2a95f5
SHA512 b6e03c3fe8bf54081932f7476135e7518c2517e9b7a17b859e1a768156b765ee8a35f64ed55bd33174b5004fadbb8d2bb752b4febba9eca200ab5c7d30707e2f
SSDEEP 6144:5flfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lID:5flfAsiVGjSGecvXAflfAsiv
TLSH
T146A48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvqoifaysq.sys

Path C:\Temp\yvqoifaysq.sys
Size 293KB
SHA256 7292b24ba057a79a39d60e3865bdb10be12a87fa1a91c975af95e39fd875c755
MD5 2e94e4eeed7ec5f762de21bdff84f9da
SHA1 c2faa8157419fc81b790cc2694dec87f39cd4d57
SHA512 788160fccaefef4bf44bd9d2e714d306d9c488d0ab1255fd82a7240cc6e03c931a320b0793db780a2a357f7a153cfe482b1c693a53c767089f5b4ee5fd7275a7
SSDEEP 3072:btKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:bIJjiJcbI03GBc3ucY5DCSj
TLSH
T118545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwuomgeywr.sys

Path C:\Temp\zwuomgeywr.sys
Size 293KB
SHA256 5b59057d59338e0fe7b3fc60673364d0aef311035166d2a1319906d0dba71393
MD5 ce20e64fbd96ace10f616a00c7661a07
SHA1 ba2e44475119cbc4be36138f5bcdd4b7c9b493c2
SHA512 712322a55e436ab842416509b3bccf52cee8a329acd13ac43f6ed5fa3ba6b3666c246ec6c77f480b206ea18a78e16d0b864c2df2edb80857dcc9f1bbbaf193f9
SSDEEP 3072:/tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:/IJjiJcbI03GBc3ucY5DCSj
TLSH
T12E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

334f7950-4d74-48c9-abc7-212581142f3c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\334f7950-4d74-48c9-abc7-212581142f3c.tmp
Size 38KB
SHA256 4c93e4bd8ed6ca05769b0ef10171270d033e954ad0e607a72e7c2901e304b901
MD5 05bc59dbb1c4771dc10cafc7decbf538
SHA1 1962025b4af96a629d9944afc1285a60c402e55b
SHA512 07d2656294be8fc368eb82b24dc2d1c231efcba40a31ef148cce662dddfed300c2e4230fb8e6c77b423704e1f3bf49adf9ffea39989859c0122bea11eda8f455
SSDEEP 768:do/UxvxjgC+23NgfSSO56xsJMIYNa8S5oYklnAaISH8L4:nZj3+23NyeosHTWRdAvS04
TLSH
T16903C03AAC946873CCF663C4720AA357AEE55263D1C56EF88AEC1F0D16C77AE5303851
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 72a43fbaed1cd4a89462ff759b5bb2f6f6d1a7a9c08002937c809c101fc685e4
MD5 b04c9bc22d86d65999036cf784bd7a42
SHA1 74f3b96e34181e491a9fd238877d82f72fce321d
SHA512 9bbf9224f5546df81a26e79932518e2c3bea2fc0e37127e4af1f02d1a5543680b5d9370365c28b8bb5427b3bb4f27eb12737d158490216ff77859483f95a6b00
TLSH
T189D02B316CED4C23C08CA27C0057004117517400EA1040401221504808082414281399
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 84d025c8484a1ba1eae075fe4fb60ee1013d5e3c0fe4757f9d23c77a5ecf4bff
MD5 40a03f8f45ceb83458e7ff6718e8114c
SHA1 3aee2deed85e7e1b8a1a9090347606288ce5f90c
SHA512 011f7c1ff606c9271e176c099ac19361c51f6a3eb7ee8dae4e0bead781595a3fa38a006247688a203ba11818d1de1b9066033932d5d22ba79d5a19f921cf6159
TLSH
T164D02B316CDD4D23C08CA27C0056004117617400FE10404011211048080824142823AD
MD5 SHA1 SHA512 TLSH

Submit Download

08a06bc9-0687-4635-a1ca-c586e130cf57.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\08a06bc9-0687-4635-a1ca-c586e130cf57.tmp
Size 11KB
SHA256 df4385178370e6b5bf8b41b264d1c8fb06825fe2c0a07a213abc3b2b4dc9af59
MD5 b011dfb505e598c6d6e08454914c62a3
SHA1 ccb2306de8959e8e58a3d5724f23d4b7b92486ac
SHA512 4a9950f8e811c3a2b08f6a5a9f166d9f38b8eb7ed479ea1f8757da69370dd65bf071acede4a57380a2b95e8a72e6a34727318f2210cbbeb388805cc51dc13cbe
SSDEEP 192:sxRmR6CB/fMs5AZhzoA8p9I/g6+WNC16/YufiUGDIgDlrJ:sxRmbB/fMs5ecO/59/iv
TLSH
T1AC42D855AD28A97B4CCBD30DBB557F13D6FD1032A0D11E48AAFC8A1C04EB6CD220341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

38da011a-5a7e-423c-a695-15a287e520b9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\38da011a-5a7e-423c-a695-15a287e520b9.tmp
Size 11KB
SHA256 1b3cdc721752c08cac24ab6d524a1f0020727187aa6132772af1405b35048a2d
MD5 8dcab43a5375ac808e1e7f1f5bd20717
SHA1 b0feefe3d69138b49ee9fdc3ed95c185c3aca3a8
SHA512 33166ec494e27abc090236aaca044d3a45a26aef8b02993ada80e2a7de4a85ffeb879b17efe01968220bee4b89d1f14d484e3e1e06830e7c6178f28f94058a6a
SSDEEP 192:sxRmR6CB/fMsTAZhzoA8p9I/g6+WNC16/YuhiUGDIgD/rJ:sxRmbB/fMsTecO/59/Qx
TLSH
T1D342D955AD68A97B8CCBE31DBB557F13D6FD5132A0D11E48AAFC8A1C04E76CD220341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7a22c6ad-73da-47bc-9bce-9f454b1695fb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7a22c6ad-73da-47bc-9bce-9f454b1695fb.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9c569918-4cd3-494e-9995-19f7e0ed21df.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9c569918-4cd3-494e-9995-19f7e0ed21df.tmp
Size 29KB
SHA256 085c47804dc33460cfd67e3c24c00c7cb75433d42c03bb07e40ce03561153420
MD5 f0ebfd7051dd1766bb51e846d1d9751f
SHA1 e8f5e567c5db4190e44c0774bcc0b39afc97f9cd
SHA512 763b220053a70e48da4fd42a9bb7e0d6d01c4c8d18a248d33e3a1426c27dd6fd11764ca75abe9cc56164ab1f2d82651afd75f6bc78bb1c09c159f5790ced9c0e
SSDEEP 768:/jnhHH7pLuLbcJWg6cfCw8F1+UoAYDCx9Tuqh0VfUC9xbog/OVzJlRkPhrosGLy:/jnhHBEbcJWg6cfCwu1jawJliPajLy
TLSH
T1ACD2D97B780CCA7F4F800ADD9C197E9B6DA802CB96D9C98047FE945C02C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 887112e46c63ff62a0de2ab3ebc837f26d214ba7153eb320f8bcd4005ba0cbb8
MD5 d85ee7c285091017656347babde248f7
SHA1 89037020e373b39ca105c4216773643e913b58a8
SHA512 d23971504c8a1b4601892807ab778c32d128611774fe2fa4f152f7721ee6a0ab26da52e51a80427a40631ae4f16ed76a25763816b8503df4e1879cb6523ad844
TLSH
T116413988526053B4F38940319AD04ECB3A34CAACE4AB2F4F3BB4D4F85F01FAD82D2844
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 3c3f1686deea5fdc8114044aa6de1b272e5a2fae577ba6a88c52716c66a78d7e
MD5 8770104abd1cfd95c73136e3d395f38d
SHA1 bbc118994aa3fb2f37515e5f1e588081717f2771
SHA512 f63f1bcb6a71d018875d5c17385f8c72f39d052ccf979a1b4829d7173914647bf6bc39516d7decaab537e946ffcba34206561db901f62a80a8d4ac9abd58461f
TLSH
T11F413B4856A052B4F74940319AD00ECB3A34C6ACE4AB2F5F3BB4D0F85F01FAD82D2844
MD5 SHA1 SHA512 TLSH

Submit Download

986b6fa1-89bc-4967-b171-ec88fb9a6061.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\986b6fa1-89bc-4967-b171-ec88fb9a6061.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

9155fc14-736f-4976-8ade-2c5d75191a88.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9155fc14-736f-4976-8ade-2c5d75191a88.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

ec09a680-67c7-4f56-aacf-ccbf992ce896.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ec09a680-67c7-4f56-aacf-ccbf992ce896.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

fa4a8e3e-23a3-4a68-9ef4-4fbd9770d34a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\fa4a8e3e-23a3-4a68-9ef4-4fbd9770d34a.tmp
Size 2KB
SHA256 dec312e0dcc245880591ad0aaed660a930afe31bec2ff9b29aea9f72ad3fc9d9
MD5 1c2785430c75eb9292512672d0e4622d
SHA1 52507368875eb174216a45ac380d49e3ef68edf6
SHA512 555f8e3f4d8e340549fe32f61dd1b12c4925b2ee10262f5690273e99db6d95dcaebb27bf3943de324470a8f5c37279eff2d09a865b3e0b6377cbed6903b2ec93
TLSH
T12351A0F3C3E8866D890156F4AB186E2BDE1D0914832C3D5AC9E49F5B93F3471D18199F
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 e0f338db1f09afdb35475387467ae528237d2ccfd1d5bdcef5fe171dfa0203e4
MD5 4201a96865d37f6f49a620f61b12748f
SHA1 d44d2173546cf6364e0ad99fb85068d0f20c342f
SHA512 753903ff2785b1ef782900c21ccd5d2850e0775faa9bfdec2c2b30dc1244cc686393a4fa3f71bd9b44d64daf411325afe974636e1d4f833b15a4c8b06822d9a6
SSDEEP 96:KSeOe/eIeceeesewe/LeIeBeWJe0e/KxeuJeSe/VemeueJe4eAeU8YFaewCCdLGc:ODm5dzNRq589l7uU3YLjUJBUh7dd6
TLSH
T12DB18324352F0392383D361850E9DA6A5A4271F6743CE6AF3BE850A54E6BE005DFCCDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c02d59c2-f828-4f54-b48a-2d76c7b11dc5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c02d59c2-f828-4f54-b48a-2d76c7b11dc5.tmp
Size 11KB
SHA256 1bb231d352073dfb6e39c670cc3911e0defb2d3d5b8a97a94d521f8f596a10e8
MD5 c5af7a0a902de4fb048085ca1a73651c
SHA1 cbe7a71d291c00557ab1831f41b056dbaa521926
SHA512 dec76ea45244c7c97915cf3eb82bdba24a90150ddd35b20a5b1a7b038a6235af8cf2e011ecb196f475a867788acb4dd3d8d29e997a822b3c7c195e0f100e6150
SSDEEP 192:sxRNR6CB/fMsXAZhzoA8p9I/g6+WNC16/YufiUGDIgVrJ:sxRNbB/fMsXecO/59/iT
TLSH
T1DA32D855AD28A97B8CCBD30DBB557F13D6FD1032A1D11E48AAFD8A1C04EB6DD220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e6db92a6-68ea-4308-8fd7-5f42a869f984.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e6db92a6-68ea-4308-8fd7-5f42a869f984.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

86a740a2-d488-4e58-8db6-c989c55fd187.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\86a740a2-d488-4e58-8db6-c989c55fd187.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a5bc3591-b13e-424c-8968-a01f2bd39b8c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a5bc3591-b13e-424c-8968-a01f2bd39b8c.tmp
Size 42KB
SHA256 a77cfa45efe74b8390c30012f0ec2f913877357878f412d91f9729a0e76d8f86
MD5 49f6d01854e63548d956d15413723be6
SHA1 6c457e19ceba0a89eba83a0fde125d4e6c38378d
SHA512 37b02ba23d7e32f2f4d231af7c2af9641362129a6033abc8db65290ced855206330714ba1ab236f5a0dae965cb7fda099c93875644ffc5d995c4d17267621efe
SSDEEP 768:9FQk3Xwgmiz/XO56xxiMIYNa8S5oYklnA+b2sn0yKD:Mk34iEoyTWRdAo2sJKD
TLSH
T15D1328F699D78976D8AE4387A33D6E429EBCD123B4889994F7D40D4CCC822BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cea81d83-376e-4a8f-b248-2a32a266b1f1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cea81d83-376e-4a8f-b248-2a32a266b1f1.tmp
Size 34KB
SHA256 94b8ec50ab33bd4bdbf0ba528cabf5206ae7489de420b54c332353cf71fa5aed
MD5 6a9df7c2044c6bbb071ba313d2f2dcbf
SHA1 b315a53273a1adcf5cb987eacf09c40d2765034c
SHA512 b044ab3bb5defbe8327afb5be0e56df01d389894dd9bdbdc1d1ec65bcb0b4c5a81956ff3102a40da79dafd98662f13ca7278f49c145aaf7ea6ceae8ef659083a
SSDEEP 768:Fdl3XNztSO56xxBMIYNa8S5oYklnA+b2sn0yKD:bl3XNNolTWRdAo2sJKD
TLSH
T1BEF2CF359DA5DDB38CEE93C5B20673926FE41233E4C85EA8D9E95B0D05837AF0703826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2ddb7fdf-115e-4999-abdc-45e12cad12dc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\2ddb7fdf-115e-4999-abdc-45e12cad12dc.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

36060453-1c79-4bb6-ac84-726fd7e3eeae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\36060453-1c79-4bb6-ac84-726fd7e3eeae.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

89dfdc24-7624-40b0-ac47-f86891145a5f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\89dfdc24-7624-40b0-ac47-f86891145a5f.tmp
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

e8514e8d-1424-4841-ab02-c6675bdbdb00.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\e8514e8d-1424-4841-ab02-c6675bdbdb00.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

76a89699-ab2c-4410-9aed-9543c895b0e0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\76a89699-ab2c-4410-9aed-9543c895b0e0.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

fa2f62b5-3037-4325-bc4c-e8f83825a58e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fa2f62b5-3037-4325-bc4c-e8f83825a58e.tmp
Size 34KB
SHA256 4d9fa476c2aeff61f82f023214493af9f5402e3d9e5331b1f42a3bb5f65b6817
MD5 b6ae40602fa31e3f638a06300993eaab
SHA1 6d9104cd3c2d47e3887fbe626604db60230af915
SHA512 f9a789eb781d4fc26ea67cf28cc53e66d9615d76faa0d1a816c3c89e54b465817b5bc4a0ea8fda41503cb93635dc281c553834ed6f536ce8a6eca1c8c34222ee
SSDEEP 768:nl3O4ztSO56xxBMIYNa8S5oYklnA+b2sn0yKD:nl3O4NolTWRdAo2sJKD
TLSH
T122F2BE359DA5DDB38CEE93C5B20673926FE41233D4C85EA8D9E95B1D05837AF0703826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1b0fc050-a83c-49ef-ad13-ad9b2d3827d2.tmp

Path C:\Users\Admin\AppData\Local\Temp\1b0fc050-a83c-49ef-ad13-ad9b2d3827d2.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

73e1dec8-0620-466f-97df-fa409ec40f23.tmp

Path C:\Users\Admin\AppData\Local\Temp\73e1dec8-0620-466f-97df-fa409ec40f23.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1088_712518161\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1088_1023623893\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1088_1688072226\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1088_2037100623\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1088_2085859425\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1088_593585289\manifest.json
Size 85B
SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
MD5 8ce95626b39ebc2401eee0b34c24fc7c
SHA1 f97a2fefe756f7a03e388e1333573b884730c2b0
SHA512 f04e4f695977918adf6e0603386b6f9c75a4a2202b0fe7215b642f3db491a1db398039cc28633b8e2541749403581622d28c1400f3f8fc66a3daab200e27266d
TLSH
T106A0121018015DE318880320213143D2D3A51C05247437001106108019B8636027A22E
MD5 SHA1 SHA512 TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 61bc5d8b063ce0cfece179f06ea5df5cd5aa1ea0123c33a30da4bfc835cd38f2
MD5 a3022c6869b45662f8a3f0ff23087238
SHA1 f106f0744464e3c775f93d85e85ab7e54e82db4f
SHA512 eec8d319eee1723091485e675132b39b64aed8bd23fd381f4b7ed89dab3afbdd2f5e7fdbeb3d618708703254ac859f608884e31b3420fc960aa4826d3f2f602e
TLSH
T17C7123835AB8D9F2C1DA5BF002835648F1FF22380B23706007559546AB30A7E24B9F44
MD5 SHA1 SHA512 TLSH

Submit Download

memory/456-244-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/456-278-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/684-418-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1140-430-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1352-350-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1452-195-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1452-65-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1652-462-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2912-325-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3292-376-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3292-511-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4108-373-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4108-341-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4224-321-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4580-404-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4768-285-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4888-487-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5048-442-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5048-464-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5408-482-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5464-507-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5464-512-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6060-272-0x0000000000010000-0x00000000000AB000-memory.dmp

Download