systex | a469ffade6aa7cae50410a790dadf6ceb650d2abcf00752e09385817537c1750

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample261003-wer7jsvt3l
SHA256 a469ffade6aa7cae50410a790dadf6ceb650d2abcf00752e09385817537c1750
MD5 090e0440d1dc2ec3f44c1038e572e054
SHA1 93699f5a7139fd8b23bdb9f7610cb1ea051dfecb
SHA512 f6c0d9ca772a10e8046ae2b01dcb5d5b977d6dae40cbce983d2cb722580a6094630fbd31bd0dd73e1261c1265889f3dd74d2a3c3293643b5e300075e61f45118
SSDEEP 3072:ftFXfaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypR:ftJ/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1FE847B00BAA4F0F6C995043800DFAF36A67EB4281726CBC3F764CE5D99517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5716	tqljdbvtnljdbvtq.exe
2968	tqljdbvtnljdbvtq.sys
5904	CreateProcess.exe
2428	aysqlgdbto.exe
5812	CreateProcess.exe
5396	CreateProcess.exe
2280	i_aysqlgdbto.exe
1660	aysqlidavt.sys
2544	CreateProcess.exe
4768	qlfdxvtnif.exe
5700	CreateProcess.exe
5612	CreateProcess.exe
4812	i_qlfdxvtnif.exe
4936	nifaxvqnif.sys
5580	CreateProcess.exe
1428	nifayvpnlf.exe
6064	CreateProcess.exe
2844	CreateProcess.exe
4912	i_nifayvpnlf.exe
3556	snkicausmk.sys
296	CreateProcess.exe
6100	snkicausmk.exe
5288	CreateProcess.exe
1660	CreateProcess.exe
3992	i_snkicausmk.exe
2552	usmkecxupn.sys
5300	CreateProcess.exe
1900	mkhcausmke.exe
4964	CreateProcess.exe
2184	CreateProcess.exe
4940	i_mkhcausmke.exe
5452	pmhfzxupmh.sys
3884	CreateProcess.exe
4112	hbzwromkec.exe
1588	CreateProcess.exe
5364	CreateProcess.exe
3728	i_hbzwromkec.exe
2760	pjgebwuomh.sys
1344	CreateProcess.exe
5092	pjhbztrmje.exe
3980	CreateProcess.exe
4392	CreateProcess.exe
2436	i_pjhbztrmje.exe
2776	wtomgeywrl.sys
1256	CreateProcess.exe
4192	wqomgebwtr.exe
2612	CreateProcess.exe
1272	CreateProcess.exe
1116	i_wqomgebwtr.exe
5140	igbytroigb.sys
3380	CreateProcess.exe
1232	bytqligbyt.exe
2052	CreateProcess.exe
2460	CreateProcess.exe
4912	i_bytqligbyt.exe
2848	gdyvqnlgdb.sys
5004	CreateProcess.exe
4396	vqnigaysql.exe
4284	CreateProcess.exe
2216	CreateProcess.exe
3244	i_vqnigaysql.exe
2308	avtnlfdxvq.sys
2660	CreateProcess.exe
3812	xvtqkidxvq.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1728404088\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_677895794\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1892504698\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1148078772\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1148078772\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1148078772\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1175851729\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1175851729\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_677895794\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1892504698\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1148078772\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1175851729\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1175851729\_metadata\verified_contents.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qlfdxvtnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nifayvpnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhbztrmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqomgebwtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spnhfaxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljgbywqoje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaytqlida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkicausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbzwromkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bytqligbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfzxspkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqlgdbto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qlfdxvtnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkhcausmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbzwromkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqnigaysql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaytqlida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdxvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkicausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhbztrmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqnigaysql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spnhfaxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfzxspkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqljdbvtnljdbvtq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczuspjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljebwtrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljgbywqoje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nifayvpnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvtqkidxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hczuspjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlfdxvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytqligbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdavsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqlgdbto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkhcausmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqomgebwtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvtqkidxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljebwtrl.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6032	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4524	ipconfig.exe
2568	ipconfig.exe
4296	ipconfig.exe
516	ipconfig.exe
1260	ipconfig.exe
2076	ipconfig.exe
3024	ipconfig.exe
1452	ipconfig.exe
2644	ipconfig.exe
4260	ipconfig.exe
6040	ipconfig.exe
4832	ipconfig.exe
3520	ipconfig.exe
4912	ipconfig.exe
4260	ipconfig.exe
5472	ipconfig.exe
6092	ipconfig.exe
1760	ipconfig.exe
5664	ipconfig.exe
3520	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-461973139-3212354679-1508698038-1000\{DD1743E2-F151-453A-A828-C018DF8BB476}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
5716	tqljdbvtnljdbvtq.exe
5716	tqljdbvtnljdbvtq.exe
5716	tqljdbvtnljdbvtq.exe
5716	tqljdbvtnljdbvtq.exe
5716	tqljdbvtnljdbvtq.exe
5716	tqljdbvtnljdbvtq.exe
5716	tqljdbvtnljdbvtq.exe
5716	tqljdbvtnljdbvtq.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2280	i_aysqlgdbto.exe
Token: SeDebugPrivilege	4812	i_qlfdxvtnif.exe
Token: SeDebugPrivilege	4912	i_nifayvpnlf.exe
Token: SeDebugPrivilege	3992	i_snkicausmk.exe
Token: SeDebugPrivilege	4940	i_mkhcausmke.exe
Token: SeDebugPrivilege	3728	i_hbzwromkec.exe
Token: SeDebugPrivilege	2436	i_pjhbztrmje.exe
Token: SeDebugPrivilege	1116	i_wqomgebwtr.exe
Token: SeDebugPrivilege	4912	i_bytqligbyt.exe
Token: SeDebugPrivilege	3244	i_vqnigaysql.exe
Token: SeDebugPrivilege	4896	i_xvtqkidxvq.exe
Token: SeDebugPrivilege	4308	i_spnhfaxspk.exe
Token: SeDebugPrivilege	4452	i_nhfzxspkic.exe
Token: SeDebugPrivilege	5424	i_hczuspjhbz.exe
Token: SeDebugPrivilege	5952	i_pmhezxrpjh.exe
Token: SeDebugPrivilege	1240	i_trljebwtrl.exe
Token: SeDebugPrivilege	3576	i_ljgbywqoje.exe
Token: SeDebugPrivilege	6044	i_igaytqlida.exe
Token: SeDebugPrivilege	1408	i_vtnlfdxvqn.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4608	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5976 wrote to memory of 5716	5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe	89
PID 5976 wrote to memory of 6036	5976	2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe	90
PID 6036 wrote to memory of 4608	6036	iexplore.exe	91
PID 4608 wrote to memory of 3320	4608	msedge.exe	92
PID 4608 wrote to memory of 6032	4608	msedge.exe	93
PID 4608 wrote to memory of 2044	4608	msedge.exe	94
PID 4608 wrote to memory of 2044	4608	msedge.exe	94
PID 4608 wrote to memory of 2044	4608	msedge.exe	94
PID 4608 wrote to memory of 2912	4608	msedge.exe	95
PID 4608 wrote to memory of 2912	4608	msedge.exe	95
PID 4608 wrote to memory of 4648	4608	msedge.exe	97
PID 4608 wrote to memory of 2756	4608	msedge.exe	98
PID 4608 wrote to memory of 4648	4608	msedge.exe	97
PID 4608 wrote to memory of 4648	4608	msedge.exe	97
PID 4608 wrote to memory of 2756	4608	msedge.exe	98
PID 4608 wrote to memory of 2756	4608	msedge.exe	98
PID 4608 wrote to memory of 4412	4608	msedge.exe	99
PID 4608 wrote to memory of 4412	4608	msedge.exe	99
PID 4608 wrote to memory of 4412	4608	msedge.exe	99
PID 4608 wrote to memory of 2100	4608	msedge.exe	100
PID 4608 wrote to memory of 2100	4608	msedge.exe	100
PID 4608 wrote to memory of 2100	4608	msedge.exe	100
PID 4608 wrote to memory of 1912	4608	msedge.exe	101
PID 4608 wrote to memory of 1912	4608	msedge.exe	101
PID 4608 wrote to memory of 3424	4608	msedge.exe	105
PID 4608 wrote to memory of 3424	4608	msedge.exe	105
PID 4608 wrote to memory of 2888	4608	msedge.exe	106
PID 4608 wrote to memory of 2888	4608	msedge.exe	106
PID 4608 wrote to memory of 5800	4608	msedge.exe	108
PID 5716 wrote to memory of 5904	5716	tqljdbvtnljdbvtq.exe	109
PID 2428 wrote to memory of 5812	2428	aysqlgdbto.exe	112
PID 4608 wrote to memory of 5364	4608	msedge.exe	115
PID 4608 wrote to memory of 5364	4608	msedge.exe	115
PID 4608 wrote to memory of 3452	4608	msedge.exe	118
PID 4608 wrote to memory of 3452	4608	msedge.exe	118
PID 5716 wrote to memory of 5396	5716	tqljdbvtnljdbvtq.exe	120
PID 5716 wrote to memory of 2544	5716	tqljdbvtnljdbvtq.exe	124
PID 4768 wrote to memory of 5700	4768	qlfdxvtnif.exe	126
PID 5716 wrote to memory of 5612	5716	tqljdbvtnljdbvtq.exe	129
PID 5716 wrote to memory of 5580	5716	tqljdbvtnljdbvtq.exe	133
PID 1428 wrote to memory of 6064	1428	nifayvpnlf.exe	135
PID 5716 wrote to memory of 2844	5716	tqljdbvtnljdbvtq.exe	138
PID 5716 wrote to memory of 296	5716	tqljdbvtnljdbvtq.exe	142
PID 6100 wrote to memory of 5288	6100	snkicausmk.exe	144
PID 5716 wrote to memory of 1660	5716	tqljdbvtnljdbvtq.exe	148
PID 4608 wrote to memory of 3204	4608	msedge.exe	150
PID 4608 wrote to memory of 4536	4608	msedge.exe	151
PID 4608 wrote to memory of 2216	4608	msedge.exe	152
PID 5716 wrote to memory of 5300	5716	tqljdbvtnljdbvtq.exe	155
PID 1900 wrote to memory of 4964	1900	mkhcausmke.exe	157
PID 5716 wrote to memory of 2184	5716	tqljdbvtnljdbvtq.exe	160
PID 5716 wrote to memory of 3884	5716	tqljdbvtnljdbvtq.exe	164
PID 4112 wrote to memory of 1588	4112	hbzwromkec.exe	166
PID 5716 wrote to memory of 5364	5716	tqljdbvtnljdbvtq.exe	169
PID 5716 wrote to memory of 1344	5716	tqljdbvtnljdbvtq.exe	173
PID 5092 wrote to memory of 3980	5092	pjhbztrmje.exe	175
PID 5716 wrote to memory of 4392	5716	tqljdbvtnljdbvtq.exe	178
PID 5716 wrote to memory of 1256	5716	tqljdbvtnljdbvtq.exe	182
PID 4192 wrote to memory of 2612	4192	wqomgebwtr.exe	184
PID 5716 wrote to memory of 1272	5716	tqljdbvtnljdbvtq.exe	187
PID 4608 wrote to memory of 4540	4608	msedge.exe	189
PID 4608 wrote to memory of 4540	4608	msedge.exe	189
PID 5716 wrote to memory of 3380	5716	tqljdbvtnljdbvtq.exe	195
PID 1232 wrote to memory of 2052	1232	bytqligbyt.exe	197

C:\Users\Admin\AppData\Local\Temp\2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-02_090e0440d1dc2ec3f44c1038e572e054_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5976
- C:\Temp\tqljdbvtnljdbvtq.exe
  C:\Temp\tqljdbvtnljdbvtq.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aysqlgdbto.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5904
  - - C:\Temp\aysqlgdbto.exe
      C:\Temp\aysqlgdbto.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2428
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5812
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aysqlgdbto.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5396
  - - C:\Temp\i_aysqlgdbto.exe
      C:\Temp\i_aysqlgdbto.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2280
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qlfdxvtnif.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2544
  - - C:\Temp\qlfdxvtnif.exe
      C:\Temp\qlfdxvtnif.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4768
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5700
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1452
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qlfdxvtnif.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5612
  - - C:\Temp\i_qlfdxvtnif.exe
      C:\Temp\i_qlfdxvtnif.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nifayvpnlf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5580
  - - C:\Temp\nifayvpnlf.exe
      C:\Temp\nifayvpnlf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1428
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6064
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nifayvpnlf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2844
  - - C:\Temp\i_nifayvpnlf.exe
      C:\Temp\i_nifayvpnlf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4912
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\snkicausmk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:296
  - - C:\Temp\snkicausmk.exe
      C:\Temp\snkicausmk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6100
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5288
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5472
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_snkicausmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1660
  - - C:\Temp\i_snkicausmk.exe
      C:\Temp\i_snkicausmk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3992
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkhcausmke.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5300
  - - C:\Temp\mkhcausmke.exe
      C:\Temp\mkhcausmke.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1900
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4964
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkhcausmke.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2184
  - - C:\Temp\i_mkhcausmke.exe
      C:\Temp\i_mkhcausmke.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4940
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hbzwromkec.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3884
  - - C:\Temp\hbzwromkec.exe
      C:\Temp\hbzwromkec.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4112
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1588
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1760
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hbzwromkec.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5364
  - - C:\Temp\i_hbzwromkec.exe
      C:\Temp\i_hbzwromkec.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3728
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhbztrmje.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1344
  - - C:\Temp\pjhbztrmje.exe
      C:\Temp\pjhbztrmje.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5092
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3980
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2644
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjhbztrmje.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4392
  - - C:\Temp\i_pjhbztrmje.exe
      C:\Temp\i_pjhbztrmje.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2436
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wqomgebwtr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1256
  - - C:\Temp\wqomgebwtr.exe
      C:\Temp\wqomgebwtr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4192
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2612
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2568
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wqomgebwtr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1272
  - - C:\Temp\i_wqomgebwtr.exe
      C:\Temp\i_wqomgebwtr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1116
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bytqligbyt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3380
  - - C:\Temp\bytqligbyt.exe
      C:\Temp\bytqligbyt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1232
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2052
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bytqligbyt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2460
  - - C:\Temp\i_bytqligbyt.exe
      C:\Temp\i_bytqligbyt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4912
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vqnigaysql.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5004
  - - C:\Temp\vqnigaysql.exe
      C:\Temp\vqnigaysql.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4396
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4284
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6040
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vqnigaysql.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2216
  - - C:\Temp\i_vqnigaysql.exe
      C:\Temp\i_vqnigaysql.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3244
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvtqkidxvq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2660
  - - C:\Temp\xvtqkidxvq.exe
      C:\Temp\xvtqkidxvq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3812
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2888
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4832
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvtqkidxvq.exe ups_ins
    3⤵
    PID:6140
  - - C:\Temp\i_xvtqkidxvq.exe
      C:\Temp\i_xvtqkidxvq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spnhfaxspk.exe ups_run
    3⤵
    PID:4448
  - - C:\Temp\spnhfaxspk.exe
      C:\Temp\spnhfaxspk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1912
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2120
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3520
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spnhfaxspk.exe ups_ins
    3⤵
    PID:3128
  - - C:\Temp\i_spnhfaxspk.exe
      C:\Temp\i_spnhfaxspk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4308
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nhfzxspkic.exe ups_run
    3⤵
    PID:612
  - - C:\Temp\nhfzxspkic.exe
      C:\Temp\nhfzxspkic.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4736
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3752
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2076
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nhfzxspkic.exe ups_ins
    3⤵
    PID:5332
  - - C:\Temp\i_nhfzxspkic.exe
      C:\Temp\i_nhfzxspkic.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4452
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hczuspjhbz.exe ups_run
    3⤵
    PID:3984
  - - C:\Temp\hczuspjhbz.exe
      C:\Temp\hczuspjhbz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4996
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3468
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hczuspjhbz.exe ups_ins
    3⤵
    PID:5852
  - - C:\Temp\i_hczuspjhbz.exe
      C:\Temp\i_hczuspjhbz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5424
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmhezxrpjh.exe ups_run
    3⤵
    PID:4212
  - - C:\Temp\pmhezxrpjh.exe
      C:\Temp\pmhezxrpjh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5708
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5452
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4296
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmhezxrpjh.exe ups_ins
    3⤵
    PID:3664
  - - C:\Temp\i_pmhezxrpjh.exe
      C:\Temp\i_pmhezxrpjh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5952
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trljebwtrl.exe ups_run
    3⤵
    PID:1760
  - - C:\Temp\trljebwtrl.exe
      C:\Temp\trljebwtrl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3556
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2848
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3520
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trljebwtrl.exe ups_ins
    3⤵
    PID:3488
  - - C:\Temp\i_trljebwtrl.exe
      C:\Temp\i_trljebwtrl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljgbywqoje.exe ups_run
    3⤵
    PID:5432
  - - C:\Temp\ljgbywqoje.exe
      C:\Temp\ljgbywqoje.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6076
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4360
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:516
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljgbywqoje.exe ups_ins
    3⤵
    PID:5636
  - - C:\Temp\i_ljgbywqoje.exe
      C:\Temp\i_ljgbywqoje.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3576
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igaytqlida.exe ups_run
    3⤵
    PID:5764
  - - C:\Temp\igaytqlida.exe
      C:\Temp\igaytqlida.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3220
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5140
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igaytqlida.exe ups_ins
    3⤵
    PID:2448
  - - C:\Temp\i_igaytqlida.exe
      C:\Temp\i_igaytqlida.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6044
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnlfdxvqn.exe ups_run
    3⤵
    PID:3840
  - - C:\Temp\vtnlfdxvqn.exe
      C:\Temp\vtnlfdxvqn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3540
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1312
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4912
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnlfdxvqn.exe ups_ins
    3⤵
    PID:2760
  - - C:\Temp\i_vtnlfdxvqn.exe
      C:\Temp\i_vtnlfdxvqn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1408
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlfdavsqki.exe ups_run
    3⤵
    PID:4208
  - - C:\Temp\nlfdavsqki.exe
      C:\Temp\nlfdavsqki.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3876
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1568
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3024
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:6036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffaef9ac188,0x7ffaef9ac194,0x7ffaef9ac1a0
      4⤵
      PID:3320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,6508664233396011650,5283014438017139888,524288 --field-trial-handle=2292,i,4088493131753788792,1602072464239387786,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:11
      4⤵
      System Time Discovery
      PID:6032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,16324625349882006480,5176149486546433537,262144 --field-trial-handle=2292,i,4088493131753788792,1602072464239387786,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
      4⤵
      PID:2044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2544,i,8465960151632618768,13264900430138439911,524288 --field-trial-handle=2292,i,4088493131753788792,1602072464239387786,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:13
      4⤵
      PID:2912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,17573967747799019880,1519205794770349732,2097152 --field-trial-handle=2292,i,4088493131753788792,1602072464239387786,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
      4⤵
      PID:4648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,10804462807414497780,17977218754872897456,2097152 --field-trial-handle=2292,i,4088493131753788792,1602072464239387786,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
      4⤵
      PID:2756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,1141909195325181464,15488727395534569511,2097152 --field-trial-handle=2292,i,4088493131753788792,1602072464239387786,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
      4⤵
      PID:4412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,10676730072448540203,5448554495262094135,2097152 --field-trial-handle=2292,i,4088493131753788792,1602072464239387786,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:9
      4⤵
      PID:2100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,15951664513139543928,3370365874794280295,524288 --field-trial-handle=2292,i,4088493131753788792,1602072464239387786,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
      4⤵
      PID:1912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,8708709372283947887,4240080554254377415,524288 --field-trial-handle=2292,i,4088493131753788792,1602072464239387786,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:14
      4⤵
      PID:3424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,9290296535575863674,6526732423314588273,524288 --field-trial-handle=2292,i,4088493131753788792,1602072464239387786,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:14
      4⤵
      PID:2888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,13238585810717550119,2570159046219422557,524288 --field-trial-handle=2292,i,4088493131753788792,1602072464239387786,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14
      4⤵
      PID:4588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,13238585810717550119,2570159046219422557,524288 --field-trial-handle=2292,i,4088493131753788792,1602072464239387786,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14
      4⤵
      PID:5800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,13896187649943335116,14652870917174979791,524288 --field-trial-handle=2292,i,4088493131753788792,1602072464239387786,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
      4⤵
      PID:5364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,6880985890312170407,7051109245466785217,524288 --field-trial-handle=2292,i,4088493131753788792,1602072464239387786,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
      4⤵
      PID:3452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4268,i,8576825222654639185,2698243894996482419,524288 --field-trial-handle=2292,i,4088493131753788792,1602072464239387786,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:14
      4⤵
      PID:3204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,9102497179558380000,17472665930498136367,524288 --field-trial-handle=2292,i,4088493131753788792,1602072464239387786,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:14
      4⤵
      PID:4536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,17526350216198205724,17971615271985074979,524288 --field-trial-handle=2292,i,4088493131753788792,1602072464239387786,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
      4⤵
      PID:2216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3592,i,10151190869462707391,5895655812400689888,524288 --field-trial-handle=2292,i,4088493131753788792,1602072464239387786,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:14
      4⤵
      PID:4540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3780,i,3003278310413938182,9614756263735186477,524288 --field-trial-handle=2292,i,4088493131753788792,1602072464239387786,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
      4⤵
      PID:5732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,17904270923110032726,18780881789044610,524288 --field-trial-handle=2292,i,4088493131753788792,1602072464239387786,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
      4⤵
      PID:3664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,4586621038724564216,7532207305588738915,524288 --field-trial-handle=2292,i,4088493131753788792,1602072464239387786,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:14
      4⤵
      PID:4344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5276,i,13652799164573031003,8384834986835974237,262144 --field-trial-handle=2292,i,4088493131753788792,1602072464239387786,262144 --variations-seed-version --mojo-platform-channel-handle=948 /prefetch:10
      4⤵
      PID:968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,11754892273197557052,14892176184505036403,524288 --field-trial-handle=2292,i,4088493131753788792,1602072464239387786,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:14
      4⤵
      PID:5208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,8008498727535087402,9745069524393509970,524288 --field-trial-handle=2292,i,4088493131753788792,1602072464239387786,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
      4⤵
      PID:1964

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2312

C:\Temp\tqljdbvtnljdbvtq.sys
C:\Temp\tqljdbvtnljdbvtq.sys
1⤵
- Executes dropped EXE
PID:2968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4276

C:\Temp\aysqlidavt.sys
C:\Temp\aysqlidavt.sys
1⤵
- Executes dropped EXE
PID:1660

C:\Temp\nifaxvqnif.sys
C:\Temp\nifaxvqnif.sys
1⤵
- Executes dropped EXE
PID:4936

C:\Temp\snkicausmk.sys
C:\Temp\snkicausmk.sys
1⤵
- Executes dropped EXE
PID:3556

C:\Temp\usmkecxupn.sys
C:\Temp\usmkecxupn.sys
1⤵
- Executes dropped EXE
PID:2552

C:\Temp\pmhfzxupmh.sys
C:\Temp\pmhfzxupmh.sys
1⤵
- Executes dropped EXE
PID:5452

C:\Temp\pjgebwuomh.sys
C:\Temp\pjgebwuomh.sys
1⤵
- Executes dropped EXE
PID:2760

C:\Temp\wtomgeywrl.sys
C:\Temp\wtomgeywrl.sys
1⤵
- Executes dropped EXE
PID:2776

C:\Temp\igbytroigb.sys
C:\Temp\igbytroigb.sys
1⤵
- Executes dropped EXE
PID:5140

C:\Temp\gdyvqnlgdb.sys
C:\Temp\gdyvqnlgdb.sys
1⤵
- Executes dropped EXE
PID:2848

C:\Temp\avtnlfdxvq.sys
C:\Temp\avtnlfdxvq.sys
1⤵
- Executes dropped EXE
PID:2308

C:\Temp\vsnkfcaysq.sys
C:\Temp\vsnkfcaysq.sys
1⤵
PID:5856

C:\Temp\pnhfcauspk.sys
C:\Temp\pnhfcauspk.sys
1⤵
PID:2960

C:\Temp\pnhfzxrpjh.sys
C:\Temp\pnhfzxrpjh.sys
1⤵
PID:1820

C:\Temp\mkeczxrpmk.sys
C:\Temp\mkeczxrpmk.sys
1⤵
PID:5320

C:\Temp\wuomgeywro.sys
C:\Temp\wuomgeywro.sys
1⤵
PID:1068

C:\Temp\oljdbztqoi.sys
C:\Temp\oljdbztqoi.sys
1⤵
PID:2228

C:\Temp\tnlidbvtol.sys
C:\Temp\tnlidbvtol.sys
1⤵
PID:4136

C:\Temp\yvtnlgdyvq.sys
C:\Temp\yvtnlgdyvq.sys
1⤵
PID:6104

C:\Temp\qnlfcxvpnl.sys
C:\Temp\qnlfcxvpnl.sys
1⤵
PID:5772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aysqlgdbto.exe

Path C:\Temp\aysqlgdbto.exe
Size 384KB
SHA256 ea57ad379f03eb7f8f7673b8245df93c35c0fd87ec9e932055becd46e12e36b9
MD5 eab0b5fa969c759c38cbb0f40b94e2bf
SHA1 fb9281460f54cbc82da12b1564bf20b380642f34
SHA512 84306b181696449912500f55cb7f3d5d2246c14e8c7285a6d1b56f4860dfe406b15c8bc409a7f97e0c2edc2677e0783e00998ad526dd076e878b4006dbb0efc7
SSDEEP 3072:etFXfaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypR:etJ/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T17F847B00BAA4F0F6C995043800DFAF36A67EB4281726CBC3F764CE5D99517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aysqlidavt.sys

Path C:\Temp\aysqlidavt.sys
Size 293KB
SHA256 357c5bcb18ad6e471203fce3f50c52c07e37f61f56657b815ad2d584a9afd27d
MD5 a0100296f7f0719c10b1d5be07fbe2be
SHA1 439ebada96091a1c91665785a026f2aa7cdabac5
SHA512 ae6f7f8a6ef404195a1712784bb59a56ee22602cc1ffb4f82adda2071a35f8a7605fee9f4bd4502d0c0bdf1738cac1fbfa051305fbfa6a87b672a319e60aa834
SSDEEP 3072:MtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:MIJjiJcbI03GBc3ucY5DCSj
TLSH
T17D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbzwromkec.exe

Path C:\Temp\hbzwromkec.exe
Size 384KB
SHA256 2333eb31d7a50c0ca54922aa57de4c1281d37ed05d3ebf19143d7ec785f7e1c4
MD5 4dfa25a0efc1e4b5a9292b9ebc80241a
SHA1 1e49611e6b07d59f587263d7448f748ae79c2e94
SHA512 29ad02fe66f4fa24202713bbf8628720913532dcf1d0f8d86d1a470ae40885da70a3efc484fa46fdc3f0796d474f0cdd9d7db173ce5b38a71b0e1461db65b82b
SSDEEP 3072:WtFXfaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypR:WtJ/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T13D847B00BAA4F0F6C995043800DFAF36A67EB4281726CBC3F764CE5D99517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_aysqlgdbto.exe

Path C:\Temp\i_aysqlgdbto.exe
Size 384KB
SHA256 87abcf7aa15e1038835166e51fbc66506a30c4eada6e1e7c687681c4f7bfc1d1
MD5 7eae7a07ba39571b31b1486d2fb2d4a0
SHA1 fdcf4bd53454b16e03ea8df8d12daccdc78288ac
SHA512 41e804d4bc7c0b684bbd554c4d5a12c38981edebd24924ef2cfa54534062c4173d7316eb12f691d5ed332ac6d21d479367e10ae7404ba76d54eeab29d76eaf90
SSDEEP 3072:FtFXfaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypR:FtJ/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T10B847B00BAA4F0F6C995043800DFAF36A67EB4281726CBC3F764CE5D99517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hbzwromkec.exe

Path C:\Temp\i_hbzwromkec.exe
Size 384KB
SHA256 442476935903f429ca56b44d0e8855c2365ee9ddeaaeaec75fa8b877c200302e
MD5 d5e7571aabb16a8119a8a342f40e7056
SHA1 119218cc2240a8ca6ddd9ad308924b7979206291
SHA512 0991fc76d34652a4749099bf70b5420a8bfb3859c479c429a737b29ec3313c32e9efddd95e0e657c8c9a0e9e6d6d8dd0ca8d7fc9deb84e86790deefc0278fce0
SSDEEP 3072:OtFXfaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypR:OtJ/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T175847B00BAA4F0F6C995043800DFAF36A67EB4281726CBC3F764CE5D99517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mkhcausmke.exe

Path C:\Temp\i_mkhcausmke.exe
Size 384KB
SHA256 e778cab10e1b4b6b69d30e569de3f8087f7dd4813af4b9963c0e236a3e86119d
MD5 d63e797728c368931fd3fa6a6545b602
SHA1 1812b1f08115fe55519251c36784fbee1a5f3e0e
SHA512 10f87e3f2810892fbaa66c8fa1e7c4f8cf4f8b9884f7c11148d87cd52540eba2106eaaebddcec31e203db9048cedd27b298441cc8c8e6511fd98bc8e100db0f5
SSDEEP 3072:0tFXfaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypR:0tJ/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T138847B00BAA4F0F6C995043800DFAF36A67EB4281726CBC3F764CE5D99517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nifayvpnlf.exe

Path C:\Temp\i_nifayvpnlf.exe
Size 384KB
SHA256 a043f9064f9eb4ade1c723f528ed7d0aa344a124eff546f5131a1173aacf5bd6
MD5 8405fe4782a31d3349f1633f888533b3
SHA1 c3a4d870255277954d9c7702339fe44ddfbda120
SHA512 1cf0cc43350ab8d8aecc61fd5d03afbc2497a7db867122cb11a4f9da5510e005547f1394c0d9b8b82d7d2eff6d8a15066a57fe092835cb2aabadeea02c77d370
SSDEEP 3072:FtFXfaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypR:FtJ/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1EE847B00BAA4F0F6C995043800DFAF36A67EB4281726CBC3F764CE5D99517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qlfdxvtnif.exe

Path C:\Temp\i_qlfdxvtnif.exe
Size 384KB
SHA256 02461374346d15e126d219d2d91d116b355cd53dd793d948b22dfa21f57c807a
MD5 54798f4268ffc0fafee45c73dd964773
SHA1 3620fdb039bd1b99d800aaf67c54b18be67bec2a
SHA512 95c241ad4c76ccaf2462f6eb4ce3e7cab35c272806c34f1536a446a6076d7e49922ce86a065fdc42349229882895afd1ea51c658f013f329b413a9ae09c9add9
SSDEEP 3072:PtFXfaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypR:PtJ/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F6847B00BAA4F0F6C995043800DFAF36A67EB4281726CBC3F764CE5D99517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_snkicausmk.exe

Path C:\Temp\i_snkicausmk.exe
Size 384KB
SHA256 8c78d967ca35dbaaa79f32932e75005d7f760a5d62b2a92519b263c02493b6cf
MD5 35b24964b15052909a6186eb84096c46
SHA1 4ae5bb3c70ed7dbb154081ea32828b6888fb0d61
SHA512 66c00a98c7a5b3b1593a311ea737f6544b49606e9aebcd326b0d214ace1a3a370177c2bda78d07a6a028687937be3c7a9c0507ca0e32d6aefa728e0e0ebe6204
SSDEEP 3072:xtFXfaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypR:xtJ/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A8847B00BAA4F0F6C995043800DFAF36A67EB4281726CBC3F764CE5D99517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkhcausmke.exe

Path C:\Temp\mkhcausmke.exe
Size 384KB
SHA256 82c43b248c3d3ea666ddb7d7665ab2358c3ddb63db610889309f9f1373231526
MD5 9e0687e27f71a747045b0dfc68a77e1e
SHA1 31cb9d3c7280ea66f19a60c9f9b224bb6d6cedfc
SHA512 c4beb3d0083ad293b139e4ccd523a670b891b5f2c35b0bc53f04336f2e7cdcdc5ead325b2f1ed4e5b966479d30d0ed11c49ddcf7628c88dbbd0c862c59d5421c
SSDEEP 3072:4tFXfaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypR:4tJ/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A2847B00BAA4F0F6C995043800DFAF36A67EB4281726CBC3F764CE5D99517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nifaxvqnif.sys

Path C:\Temp\nifaxvqnif.sys
Size 293KB
SHA256 5fcba82c50dadf9e081053b1d4b6a826715b663d540f3c4d6c1296f40fa1739c
MD5 91454a2fd7bc947d3f256f003280ce91
SHA1 f9af6b35818215d19621a81afb82906ec9bdbc5c
SHA512 ad46ed974abd47508b79e3f3fbc965a4bc81e3501d29e6935d2e18ba583d008d0df859eb1b7e26cbf72719f657ded09c6fd62f087ed18d81d6e4da1b0dd6c4bd
SSDEEP 3072:4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:4IJjiJcbI03GBc3ucY5DCSj
TLSH
T1F4545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nifayvpnlf.exe

Path C:\Temp\nifayvpnlf.exe
Size 384KB
SHA256 196bf9bcc8a23ba6dba6f62186cd096df6986152ac7bc47806a136135aaed7f9
MD5 152bb482f16c12c8b368db3b6e738d49
SHA1 df5f91da88df2de4caa2d31db6dd0493a9fdc486
SHA512 b6bbb43c0cba6afd7f05f41d5ac03e603e90e7654ffe3b14609070c38fb446f37a063ed59f3bb5dd49b09b7027a42d182ac1b950d208bc059a8f077644d52bd3
SSDEEP 3072:utFXfaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypR:utJ/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T112847B00BAA4F0F6C995043800DFAF36A67EB4281726CBC3F764CE5D99517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmhfzxupmh.sys

Path C:\Temp\pmhfzxupmh.sys
Size 293KB
SHA256 f027a1cc48cf906a1d8c4e8c491a5bf295617c68280d4c185b259336450835ee
MD5 57b4dec6a096a795c85877908019bf4e
SHA1 aa281b4b3e157f18719699b516f128c547720476
SHA512 a337d8ada022faca16e6a8a29019ac9e6da138eaeaa60f3075422f71a9f417f4e5ff080561ae66ad1ea525dd5a15def211b526d21321334e378e0b14bf1ab6c2
SSDEEP 3072:PtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:PIJjiJcbI03GBc3ucY5DCSj
TLSH
T1FF545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qlfdxvtnif.exe

Path C:\Temp\qlfdxvtnif.exe
Size 384KB
SHA256 fe53d7d30b63dbbfaea2d42d78e7b7440c33f64a1ed66bf1b5bda1cb79113d88
MD5 9ae3b45e3af2b531e0e67bde431eed1f
SHA1 bc0a2b6be23a71c8e76e6fe90b833b2dd94359b9
SHA512 b5c1563d38ddd6a0492a20d1005ccb7a7ca611f23686d29fe369012d00cc501e84911a5336aa95848dcef59f9352a5d04de256893acb85d1aa5ee93997aed636
SSDEEP 3072:QtFXfaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypR:QtJ/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T159847B00BAA4F0F6C995043800DFAF36A67EB4281726CBC3F764CE5D99517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snkicausmk.exe

Path C:\Temp\snkicausmk.exe
Size 384KB
SHA256 e70c6aab4ec04715cecac7647ec38474eacbe6fa4d87a36697f71114ea486f38
MD5 96b1eab49cee0c1609fe1bdcb4084981
SHA1 2bfc348896c0d6ca7740ac2d06cd7c1be10ef90b
SHA512 ddf4a45f17b9cd44fc2fa79ced4d87a64b906761f05f781c5596510101793a4a2533c8b3a3d169e385c2e526b12b667dcf2f935d7f1b3322c20152fa2b386732
SSDEEP 3072:3tFXfaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypR:3tJ/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T135847B00BAA4F0F6C995043800DFAF36A67EB4281726CBC3F764CE5D99517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snkicausmk.sys

Path C:\Temp\snkicausmk.sys
Size 293KB
SHA256 c9daee8811ca1456c1facc13fa3dcb15067fb6042f0f98469ffd01b0defbe892
MD5 26221aad119d4f83c51e525efedcee60
SHA1 ab7d873ecac7d43cfe6a89b0f6d785f7161da32c
SHA512 645e83b4d3a4da24d932fa6e1fdee5d723df4427035d68acc2063df0ae3ee63f8a3c8c995fd792f4d9b7ec329eb0808c46a235e15c758a46cdebc39abc89d699
SSDEEP 3072:ZtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:ZIJjiJcbI03GBc3ucY5DCSj
TLSH
T152545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqljdbvtnljdbvtq.exe

Path C:\Temp\tqljdbvtnljdbvtq.exe
Size 384KB
SHA256 f68a66f43dca42193e569588bcdedbf823025de1f6b659e1a8b0f7713b22add3
MD5 2027ef270e1afa89eadb328e59338dec
SHA1 e77e1076270916b796196c2931df153f92fc0e1f
SHA512 0744d400992be72a2ebdceeaa611cfbf5ac9a06af19598b89dfcb3ba603cd0ff25d469d5a52acc0f37123c939213f6ccbbe40f7d57d62f9dd0de623333d922ae
SSDEEP 3072:YtFXfaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypR:YtJ/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T19D847B00BAA4F0F6C995043800DFAF36A67EB4281726CBC3F764CE5D99517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqljdbvtnljdbvtq.sys

Path C:\Temp\tqljdbvtnljdbvtq.sys
Size 293KB
SHA256 2d47d925744018dde6ee04f4ff9060313a7296b410f8894be172e0b53284d9b3
MD5 a3ebb4402b1a7174edc854b29d1605be
SHA1 c7f6cd819da5b2a2c25d251ec2f0f4d1a25fbaa8
SHA512 6051f998f9eb3c1fa789257f26a3488eb964212a2184d007544e201f3dd677659ee2ffbe9217945d69266e6fc493706f02453de371fc938a57c4b6d585d88e46
SSDEEP 3072:YtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:YIJjiJcbI03GBc3ucY5DCSj
TLSH
T15F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmkecxupn.sys

Path C:\Temp\usmkecxupn.sys
Size 293KB
SHA256 0b61c17a90ec9c16ce02720abdf38427cab30560e7478d91cd8d9e7b2563f11d
MD5 f5ff27512cba5a6da87d0770a5ce53b1
SHA1 4e458cc5ffd19977ce97dfca03758478b8a454ec
SHA512 afce9768bf59c65d7f5f8cc0a02f7c6f3943f0078baf004047ec634869e42af090a4fd58059bfbb418eb2c5d46d8503626f1242bf794d88cf4145507b020bfe5
SSDEEP 3072:0tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:0IJjiJcbI03GBc3ucY5DCSj
TLSH
T140545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

27185429-c45d-4891-97d2-3ec5bd29d2d5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\27185429-c45d-4891-97d2-3ec5bd29d2d5.tmp
Size 43KB
SHA256 8be8b008f3e3d39effdce38e2b4b7c3bfffef70d198808536b8ec781084dcbaf
MD5 5b20a151860064c6c9a1dd1e709ede28
SHA1 580fcf08dbffb8ad4c7be71a4c7e11b85312f6b9
SHA512 e0edd45de26a81d662b60fb1a1e451dbc2a531a3396187dca953bee710c6b6a38988cd0f4517c9d913bf2f277e3f8dee2c5ac786d707aa7aca2a3a4899ba191e
SSDEEP 768:wFQZ3cwgtVfHe1OgJjDmGA5b65Q92RQMPbjRswVQ:jZ3XFAF65dQgRs4Q
TLSH
T1021327F298D38AB7E8AD5383677D6E419EBCC163B4888584B7D55D0CCC821BFC30A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3073fe9e-6df1-4d0f-9a8c-00aad6937204.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3073fe9e-6df1-4d0f-9a8c-00aad6937204.tmp
Size 35KB
SHA256 c87ad6798d4b2130789993e500ff402848085ff54880c37935603be6ba758553
MD5 1a5f280ecae355a36ffae194d74b5224
SHA1 5f7b4361d2ab395dc0302db31d654bbcb1f98c84
SHA512 49e3bb76e27e5bf32cf84ab7e42e18c341edc7bda0fbbf59af156e563f880b2579a59cc52648c1c5cff62cb62f33e06a5003647926831b1cd3ac764c847e84d0
SSDEEP 768:AC3uOYgm1OgJ1gDmGA5b65Q92RQMPbjRswVQ:AC321AAF65dQgRs4Q
TLSH
T1A5F2BF71DCA1DEF3ACFD52813687B3417FB8516394C98A8498E5AF1D04839DE034B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5ff88b38-735e-4525-b75e-710e6f8ab611.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5ff88b38-735e-4525-b75e-710e6f8ab611.tmp
Size 40KB
SHA256 db95d454593d1f810a5d02a75a62fb360ca0e45dd4eb7ff70066061fee685375
MD5 7710a5649551476e77947793d4658bb8
SHA1 8d6677729bb3d09b7fccb39d12bbffb9497daaf3
SHA512 d6e57ffa5ff62035f78a8cae6f7cffe22eaadd52291a2c894dca8fb032aa5df0bbb207cb89fa7672c4bffaf28e82678a072322f542e406aafdd672c6230f29f4
SSDEEP 768:+/UxvxjgC+v3u/p4Ygm1OgJ1NDmGA5b65Q92RQMPbjJnmM:zZj3+v3uL1XAF65dQgJmM
TLSH
T1F403D032ECA1EDB39CF96280365B7386BFF8456394C54A9889E55F0C05836DE034BD5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2faa1b1440ef2e1a669881f74143ac7857706d1524c89e682f713c8f3d38ab23
MD5 6a131a77b0edda45a2895a3d33a867a0
SHA1 2be1a2b3794fa396138562716cc7e4a4f17caa66
SHA512 20cb3d576349a78e3fec9e8b5e0726835f04e7dd74bb2a15edba4417611cdd35bc2d2525fdae7879e8d01d4643f26df1c05a44fb125105ad0bcee8ccd0257571
TLSH
T1F6D02B3176B99CA1D193103D00C386A014BAB0009C0501843B22C0050C401091330206
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4fc7dcf7387fe20ebfe8604da12039dc01420b7c4f9203598cac361fa8e97926
MD5 c3187641f7a33614939d03f0d43ad5e0
SHA1 82b3d0d3fa3092b29b9c8b55ce9fb9bba31c9c23
SHA512 ac0b9a042b5883e5cb0458cdeae19e251d85b3b88bb576dec24d66444085275504065eccb22c8674162977df0a0d2f69723a5923be85a9c5ea85f46af2ce9edc
TLSH
T13FD02B3176B99CA1D193103900C286A014BAB000EC0501843A2280050C40109133120A
MD5 SHA1 SHA512 TLSH

Submit Download

39aa1a06-5bf0-405e-acc6-1b081c0e2dda.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\39aa1a06-5bf0-405e-acc6-1b081c0e2dda.tmp
Size 11KB
SHA256 6568c7e5b43760ec88dd1fa4e7df3c48adc3f2e686a1d41f1d718fbec2201e67
MD5 31c7e4bf2ef58f0264505e139c86e4ca
SHA1 a8580c7022b3182d5c58660ca6e2973cac3233ff
SHA512 9f955dc94ddf0d021baa22da08b464db2bb9f044237d903a0efc6817c44c0cf1833809d90fb58d288295ed2a00c355bb0a0890dfc6527562313fac7408005e4c
SSDEEP 192:sxRoRbCy/fsbs6c2aZNwVmxzoA8p9T/g6+WNCZO/Y2xcUGvIgVowJ:sxRooy/fsbs6XM25/5X/sfeU
TLSH
T16732C915AD28A97B4CCBD209FB697F53D2F9513290D11E4CA6FC8A1C14EB6CE220340F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6480f00d-4cb9-46ae-b7ea-77938a40d67d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6480f00d-4cb9-46ae-b7ea-77938a40d67d.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 433070620ff3da0db97acf5b6004129e0c0c18cb7ccb8b226a45040fe6050bef
MD5 a230b13823b110e378e1299ad4258ac7
SHA1 de363be3e785bec98c1a00fb8d4f5400e42e0582
SHA512 69aeb0bd80563246424e0749a81b2536a621ef5b6483ba5088aaf28adaf1813ba6a9d4a15df2b0547e5810e5ef84fdf949d6a1590507ab2bbaf78f0dd7801845
TLSH
T15C51B6BC42AF0559DB54493353E0618B3B38EAFD0A673EFF1DAAC8B45B16715DE05004
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 aed8e873cf490fd01e0c4b955e4c258efa78a8f41ed9e53620a598ebde613a44
MD5 25cfc733e1c83c7daf8ad0e36351232f
SHA1 4d90e1123930aada72ab380e5ef67637c5409b25
SHA512 208d7a696a48c87514255018d2a04339d408dd16c94170b775af52af988cb4a3e666824d104d5327f5c505f6a4187b38788f11bf6dc3791c24cae8377457db63
TLSH
T14D5194BC42AF0159EB54493353E0619B3B38EAFD0A673EFF5DAAC8B46B16B15DE04004
MD5 SHA1 SHA512 TLSH

Submit Download

1eaf03aa-f366-4bac-8522-f7da8e5a2a9d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\1eaf03aa-f366-4bac-8522-f7da8e5a2a9d.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

1a70e9c1-19a5-45c5-8e6d-96719b1ba7ed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1a70e9c1-19a5-45c5-8e6d-96719b1ba7ed.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

580f2eb1-9d00-4487-9aaf-e0e614edba1b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\580f2eb1-9d00-4487-9aaf-e0e614edba1b.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

b4a8ac76-4c8a-4904-b27f-1376c82bf15a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b4a8ac76-4c8a-4904-b27f-1376c82bf15a.tmp
Size 2KB
SHA256 6f61a5509bb0196a92c26f368137cce281790aadb12f7c3ad4846eb93a6973ef
MD5 ec035d41f73078ab8f8da2168e561d58
SHA1 20601482433aae678474416507ec2cfbfec4e02f
SHA512 837b469f035459fb2187e5cad8738f0ae783e436a5817cf43d3e12851ade24941d68ff35a56aa83b1acf55f40ba9c7579c7f24305e50c1b68e5e52da54b5dbf5
TLSH
T11151BDF3C3E8862D890156F4AA186E1BDE1D0924432C3D5AC8E4DE2BA7E2471E24199F
MD5 SHA1 SHA512 TLSH

Submit Download

aa365e40-2701-4e4c-9c04-4afb6b47aaec.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\aa365e40-2701-4e4c-9c04-4afb6b47aaec.tmp
Size 11KB
SHA256 e317942401d84f94344857f725939b3e4570dc97e5ae99a3eff9d8b5a2980990
MD5 d3645b46bc427a9c9f9035e73996b6d3
SHA1 41f9912cb49a59f58340e3ddda9795098d312e85
SHA512 e19eed346f9931cb9a5bc3ba6abf3710475bb76cad1d4bb26bd191b83edf17d808d6c649c74ab24cb9af8c6d8af7cf65e0926f4b02f89a09c6d332cc62293841
SSDEEP 192:sxR7RbCy/fsbsOC2aZNwVmxzoA8p9T/g6+WNCZO/Y2scUGvIgDqowJ:sxR7oy/fsbsO1M25/5X/bfTU
TLSH
T17542C915AD28AD7B4CDBD20DBB697F53D2F9513290912E4CA7FC8A1C14E76CE220344B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3e6e2fe-9d76-4433-9a97-8c4f5453f1c4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d3e6e2fe-9d76-4433-9a97-8c4f5453f1c4.tmp
Size 29KB
SHA256 f7903eeddc0db0095a61ff30ced9341772c9d63aaefda85e4e0e4ea3756f1612
MD5 2b41a2953e10b372e4ef70efdaf92b3e
SHA1 7cb0049015214f0f0d8ea5dd352f10667b51f1ae
SHA512 f5175e6216551ebc92d5ad913f6e6974ba494e94f3fdf8c162827a3735c79f94cd5b5ef62481e6346f0911c165e05fb18b51fbdf386f3d2bb594dcdb8106c03b
SSDEEP 768:L7aaYW7pLuLb6DWgptfvD8F1+UoAYDCx9Tuqh0VfUC9xbog/OVIJFdNMXroH9:L7aaY2Eb6DWgptfvDu1jaPJFrMEd
TLSH
T14ED2DB7B640CCB7F4FD00ADDAC197E9F6DA802CB9698CD4047FA945C02C6BEA511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f304443a-6e52-44bf-893b-da528f8c787b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f304443a-6e52-44bf-893b-da528f8c787b.tmp
Size 11KB
SHA256 cd8a15ceca194d8fbefbef66c1662a44f53e6222a8a3a6e3551735051569c2a7
MD5 885ecf178d6a00c709fb48f839f7b616
SHA1 3386fb3ccb920f2e0435d4b4552e5bc90cddbfa3
SHA512 7de8efee54b2166da9a815037bd41b6ddd0e373d07acddf24230a5738c5858666d19c5dc815d46f1d85d4d81a1721e0cb809b7cd7a1b84821be32b7cf9844f53
SSDEEP 192:sxR7RbCy/fsbsOc2aZNwVmxzoA8p9T/g6+WNCZO/Y2xcUGvIgDIowJ:sxR7oy/fsbsOXM25/5X/sfJU
TLSH
T1AC42CA15AD28A97B4CDBD219FB697F53D2F9513290D11E4CA6FC8A1C14E76CE220344B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

aea48ed3-625d-4b8c-b4d5-5b53d00fff72.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\aea48ed3-625d-4b8c-b4d5-5b53d00fff72.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c9289dc1-1474-4e36-97fe-f577c4f9d16d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c9289dc1-1474-4e36-97fe-f577c4f9d16d.tmp
Size 35KB
SHA256 d898aaeefb741b98451813707e5b6388f10f22288685c698c381209bc3caac32
MD5 3694f1c3c608e39ea8e29d02f2d726fd
SHA1 12dbeb80b91bc0c03617fc7e28f3b9fbf009cad8
SHA512 5978970a014146a878e97b215617d75a53a7f150bbb847f02816752d532f3e4280f0d2d5a427ac3ac31f8688e5a61c6f2e5dd582d6157b60c629205a0e135291
SSDEEP 768:WC37OYgm1OgJ1gDmGA5b65Q92RQMPbjRswVQ:WC3P1AAF65dQgRs4Q
TLSH
T1C8F2BF71DCA1DEF3ACFD5281368BB3417FB8516394C98A8498E5AF1D04839DE034B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cca3ae76-b340-4da2-9d63-e0788fe9030a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cca3ae76-b340-4da2-9d63-e0788fe9030a.tmp
Size 39KB
SHA256 8262fadfca768594f4dc04cff50b3362a6ea554ea3e631565ee5062483fd0df9
MD5 dc589d933af8de83456da7f16afccd32
SHA1 d558b68ece791f00c549ed3ee2a23e9f5276acb0
SHA512 d997725927ad698d32a84cbd433864b0051792985ce57151d8f841687663cf9e26cd9ce848fe938381ccea576f9566ec55c6bb9e3fb869d836d4e1e576ae7bcf
SSDEEP 768:U/UxvxjgC+B3q8Xtvgm1OQtDmGA5b65Q92RQMPb6NFj0O:BZj3+B3qwh3AF65dQ/NFQO
TLSH
T1CD03D036EC90AEB3DCF95280374BA356AFF84563D0C556E049E96F1D06C768D430B85B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

14fc30f8-d7e2-4aae-8d14-dbe41f2c5475.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\14fc30f8-d7e2-4aae-8d14-dbe41f2c5475.tmp
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

8a7af299-668f-4a2d-8cf2-9b49baaea983.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\8a7af299-668f-4a2d-8cf2-9b49baaea983.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

a72563f6-6250-4682-bef2-cd893b45da8b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\a72563f6-6250-4682-bef2-cd893b45da8b.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

d1490645-f44e-46c8-bd2b-db4a6818cc93.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\d1490645-f44e-46c8-bd2b-db4a6818cc93.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

4c50e895-0fcc-4977-98a4-50abfc1e1bd3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4c50e895-0fcc-4977-98a4-50abfc1e1bd3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

7e440161-51df-4757-b38f-512ef5eb1abd.tmp

Path C:\Users\Admin\AppData\Local\Temp\7e440161-51df-4757-b38f-512ef5eb1abd.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

90d8297c-53ff-4cb5-ad29-c6b84f0e26b0.tmp

Path C:\Users\Admin\AppData\Local\Temp\90d8297c-53ff-4cb5-ad29-c6b84f0e26b0.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4608_202880577\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1148078772\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1175851729\manifest.json
Size 85B
SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
MD5 8ce95626b39ebc2401eee0b34c24fc7c
SHA1 f97a2fefe756f7a03e388e1333573b884730c2b0
SHA512 f04e4f695977918adf6e0603386b6f9c75a4a2202b0fe7215b642f3db491a1db398039cc28633b8e2541749403581622d28c1400f3f8fc66a3daab200e27266d
TLSH
T106A0121018015DE318880320213143D2D3A51C05247437001106108019B8636027A22E
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1728404088\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_1892504698\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4608_677895794\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 7a97694fbe9afc6d3c28e4e7be597773945dd9cdb9888334063bf03cc6098730
MD5 76e171fe7ef77380747db9826509f47a
SHA1 13a52207d0d749da66aaec342f149d45cb8e21e9
SHA512 826eea4d2e764804bca37c083f94aff469a25481969944775aa246fc1731cd59cf4feb9390a22d90481b36443fe03055e4e5d432b474f9c0ab0f1d22cec53a23
TLSH
T13471048356B8D6B2C1DA9FF002835644F1FB1238076330601B515546A730A7554B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1068-466-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1660-196-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1820-434-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2228-485-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2308-380-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2552-320-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2552-285-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2760-325-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2776-329-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2848-350-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2960-422-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2968-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3556-273-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4136-489-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4936-245-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5140-345-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5320-446-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5452-298-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5772-513-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5856-408-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6104-509-0x0000000000010000-0x00000000000AB000-memory.dmp

Download