systex | c3196aa2bb7840a09b54dc80c2677dd5d7d9706615501bbb5dc04bf1a7be6281

Analysis

max time kernel
149s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/10/2026, 23:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample261004-3d95asttgs
SHA256 c3196aa2bb7840a09b54dc80c2677dd5d7d9706615501bbb5dc04bf1a7be6281
MD5 e76218e5d1d3898778c958e4aba21055
SHA1 cccdae1ef96056a0a92da7faf7ea5bb983481d47
SHA512 df02afcf26e4cd8cc1745b357f7a31c5b1563974ec542be4c1f2d6ae25b369e954373032a89f13bef880e2158b15e9358e919437062d3cda4badf71c0ced419e
SSDEEP 6144:5flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:5flfAsiVGjSGecvX
TLSH
T103747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4808	yvqnifdyvqoljdbv.exe
700	yvqnifdyvqoljdbv.sys
2184	CreateProcess.exe
5484	vtnlfdaqls.exe
4708	CreateProcess.exe
200	CreateProcess.exe
2708	i_vtnlfdaqls.exe
2972	nlfdxvqnif.sys
1704	CreateProcess.exe
3120	caysnifdxv.exe
1684	CreateProcess.exe
4360	CreateProcess.exe
1952	i_caysnifdxv.exe
4704	dxvpnhfaxs.sys
1740	CreateProcess.exe
3548	ausmkfcxvp.exe
4532	CreateProcess.exe
3900	CreateProcess.exe
716	i_ausmkfcxvp.exe
4256	xrpkhcausp.sys
4476	CreateProcess.exe
796	xrpnhecaup.exe
1416	CreateProcess.exe
4388	CreateProcess.exe
1336	i_xrpnhecaup.exe
2852	czurpnhfzx.sys
2312	CreateProcess.exe
5396	mkezwrpmhe.exe
3160	CreateProcess.exe
1976	CreateProcess.exe
4920	i_mkezwrpmhe.exe
436	jecwuomjhb.sys
2284	CreateProcess.exe
5912	hbzxromgez.exe
3944	CreateProcess.exe
5024	CreateProcess.exe
2008	i_hbzxromgez.exe
5644	mgebztromg.sys
3948	CreateProcess.exe
5544	ljgeywrojh.exe
6076	CreateProcess.exe
5728	CreateProcess.exe
2560	i_ljgeywrojh.exe
2256	bvtqljdywq.sys
5268	CreateProcess.exe
2892	ywqoigeywq.exe
2040	CreateProcess.exe
3832	CreateProcess.exe
4000	i_ywqoigeywq.exe
4256	gdbytqoljd.sys
1028	CreateProcess.exe
4900	sqkidavtnl.exe
5628	CreateProcess.exe
3952	CreateProcess.exe
1440	i_sqkidavtnl.exe
5056	vsqlidyvtn.sys
4688	CreateProcess.exe
6120	qkicaysnki.exe
1436	CreateProcess.exe
3360	CreateProcess.exe
2808	i_qkicaysnki.exe
5020	kicaxvpnlf.sys
932	CreateProcess.exe
1180	khfaxvpnif.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1536_555936084\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1536_20060167\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1536_20060167\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1536_276728887\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1536_276728887\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1536_276728887\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1536_1948576119\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1536_555936084\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1536_276728887\office_endpoints_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdaqls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caysnifdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpnhecaup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpnhecaup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqoigeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khfaxvpnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhczurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbztrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkicaysnki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_caysnifdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljgeywrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljgeywrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkhcauspkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhczurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbztrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqgaytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlfdaqls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausmkfcxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkezwrpmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbzxromgez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqoigeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpjhczurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqgaytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkezwrpmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbzxromgez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausmkfcxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkicaysnki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkhcauspkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhczurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgeywtoljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqlidavtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkicaupmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqnifdyvqoljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgeywtoljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqlidavtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khfaxvpnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnkicayvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnkicayvpn.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1972	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3428	ipconfig.exe
1684	ipconfig.exe
2352	ipconfig.exe
6096	ipconfig.exe
468	ipconfig.exe
244	ipconfig.exe
5832	ipconfig.exe
1556	ipconfig.exe
1388	ipconfig.exe
4384	ipconfig.exe
1360	ipconfig.exe
2876	ipconfig.exe
5232	ipconfig.exe
2464	ipconfig.exe
1284	ipconfig.exe
4864	ipconfig.exe
764	ipconfig.exe
1484	ipconfig.exe
5876	ipconfig.exe
4764	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2714045687-1127350534-2056456672-1000\{8696A77D-5394-4D5F-A6F1-00017B9FD488}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4808	yvqnifdyvqoljdbv.exe
4808	yvqnifdyvqoljdbv.exe
4808	yvqnifdyvqoljdbv.exe
4808	yvqnifdyvqoljdbv.exe
4808	yvqnifdyvqoljdbv.exe
4808	yvqnifdyvqoljdbv.exe
4808	yvqnifdyvqoljdbv.exe
4808	yvqnifdyvqoljdbv.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2708	i_vtnlfdaqls.exe
Token: SeDebugPrivilege	1952	i_caysnifdxv.exe
Token: SeDebugPrivilege	716	i_ausmkfcxvp.exe
Token: SeDebugPrivilege	1336	i_xrpnhecaup.exe
Token: SeDebugPrivilege	4920	i_mkezwrpmhe.exe
Token: SeDebugPrivilege	2008	i_hbzxromgez.exe
Token: SeDebugPrivilege	2560	i_ljgeywrojh.exe
Token: SeDebugPrivilege	4000	i_ywqoigeywq.exe
Token: SeDebugPrivilege	1440	i_sqkidavtnl.exe
Token: SeDebugPrivilege	2808	i_qkicaysnki.exe
Token: SeDebugPrivilege	2252	i_khfaxvpnif.exe
Token: SeDebugPrivilege	920	i_pkhcauspkh.exe
Token: SeDebugPrivilege	5932	i_pjhczurmke.exe
Token: SeDebugPrivilege	4188	i_xrpjhczurm.exe
Token: SeDebugPrivilege	5260	i_hbztrpjhbz.exe
Token: SeDebugPrivilege	5176	i_jgeywtoljd.exe
Token: SeDebugPrivilege	5288	i_ywqgaytqlj.exe
Token: SeDebugPrivilege	244	i_ysqlidavtn.exe
Token: SeDebugPrivilege	4344	i_tnkicayvpn.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1536	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 4808	4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 4664 wrote to memory of 5408	4664	2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	91
PID 5408 wrote to memory of 1536	5408	iexplore.exe	92
PID 1536 wrote to memory of 1900	1536	msedge.exe	93
PID 1536 wrote to memory of 1848	1536	msedge.exe	94
PID 1536 wrote to memory of 1972	1536	msedge.exe	95
PID 1536 wrote to memory of 1848	1536	msedge.exe	94
PID 1536 wrote to memory of 1848	1536	msedge.exe	94
PID 1536 wrote to memory of 3184	1536	msedge.exe	96
PID 1536 wrote to memory of 3184	1536	msedge.exe	96
PID 1536 wrote to memory of 1556	1536	msedge.exe	98
PID 1536 wrote to memory of 1556	1536	msedge.exe	98
PID 1536 wrote to memory of 1556	1536	msedge.exe	98
PID 1536 wrote to memory of 3276	1536	msedge.exe	99
PID 1536 wrote to memory of 3276	1536	msedge.exe	99
PID 1536 wrote to memory of 3276	1536	msedge.exe	99
PID 1536 wrote to memory of 1912	1536	msedge.exe	101
PID 1536 wrote to memory of 1912	1536	msedge.exe	101
PID 1536 wrote to memory of 1912	1536	msedge.exe	101
PID 1536 wrote to memory of 3960	1536	msedge.exe	100
PID 1536 wrote to memory of 3960	1536	msedge.exe	100
PID 1536 wrote to memory of 3960	1536	msedge.exe	100
PID 1536 wrote to memory of 5536	1536	msedge.exe	103
PID 1536 wrote to memory of 5536	1536	msedge.exe	103
PID 1536 wrote to memory of 4328	1536	msedge.exe	106
PID 1536 wrote to memory of 4328	1536	msedge.exe	106
PID 1536 wrote to memory of 4000	1536	msedge.exe	107
PID 1536 wrote to memory of 4000	1536	msedge.exe	107
PID 1536 wrote to memory of 6120	1536	msedge.exe	110
PID 4808 wrote to memory of 2184	4808	yvqnifdyvqoljdbv.exe	111
PID 5484 wrote to memory of 4708	5484	vtnlfdaqls.exe	114
PID 1536 wrote to memory of 4652	1536	msedge.exe	115
PID 1536 wrote to memory of 4652	1536	msedge.exe	115
PID 1536 wrote to memory of 3900	1536	msedge.exe	120
PID 1536 wrote to memory of 3900	1536	msedge.exe	120
PID 4808 wrote to memory of 200	4808	yvqnifdyvqoljdbv.exe	121
PID 4808 wrote to memory of 1704	4808	yvqnifdyvqoljdbv.exe	125
PID 3120 wrote to memory of 1684	3120	caysnifdxv.exe	127
PID 4808 wrote to memory of 4360	4808	yvqnifdyvqoljdbv.exe	130
PID 4808 wrote to memory of 1740	4808	yvqnifdyvqoljdbv.exe	134
PID 3548 wrote to memory of 4532	3548	ausmkfcxvp.exe	136
PID 4808 wrote to memory of 3900	4808	yvqnifdyvqoljdbv.exe	139
PID 4808 wrote to memory of 4476	4808	yvqnifdyvqoljdbv.exe	143
PID 796 wrote to memory of 1416	796	xrpnhecaup.exe	145
PID 4808 wrote to memory of 4388	4808	yvqnifdyvqoljdbv.exe	149
PID 1536 wrote to memory of 1140	1536	msedge.exe	151
PID 1536 wrote to memory of 4816	1536	msedge.exe	152
PID 1536 wrote to memory of 2256	1536	msedge.exe	153
PID 4808 wrote to memory of 2312	4808	yvqnifdyvqoljdbv.exe	156
PID 5396 wrote to memory of 3160	5396	mkezwrpmhe.exe	158
PID 4808 wrote to memory of 1976	4808	yvqnifdyvqoljdbv.exe	161
PID 4808 wrote to memory of 2284	4808	yvqnifdyvqoljdbv.exe	165
PID 5912 wrote to memory of 3944	5912	hbzxromgez.exe	167
PID 4808 wrote to memory of 5024	4808	yvqnifdyvqoljdbv.exe	170
PID 4808 wrote to memory of 3948	4808	yvqnifdyvqoljdbv.exe	174
PID 5544 wrote to memory of 6076	5544	ljgeywrojh.exe	176
PID 4808 wrote to memory of 5728	4808	yvqnifdyvqoljdbv.exe	179
PID 4808 wrote to memory of 5268	4808	yvqnifdyvqoljdbv.exe	183
PID 2892 wrote to memory of 2040	2892	ywqoigeywq.exe	185
PID 4808 wrote to memory of 3832	4808	yvqnifdyvqoljdbv.exe	188
PID 1536 wrote to memory of 1984	1536	msedge.exe	190
PID 1536 wrote to memory of 1984	1536	msedge.exe	190
PID 4808 wrote to memory of 1028	4808	yvqnifdyvqoljdbv.exe	195
PID 4900 wrote to memory of 5628	4900	sqkidavtnl.exe	197

C:\Users\Admin\AppData\Local\Temp\2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-04_e76218e5d1d3898778c958e4aba21055_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Temp\yvqnifdyvqoljdbv.exe
  C:\Temp\yvqnifdyvqoljdbv.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnlfdaqls.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2184
  - - C:\Temp\vtnlfdaqls.exe
      C:\Temp\vtnlfdaqls.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5484
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4708
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1684
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnlfdaqls.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:200
  - - C:\Temp\i_vtnlfdaqls.exe
      C:\Temp\i_vtnlfdaqls.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\caysnifdxv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1704
  - - C:\Temp\caysnifdxv.exe
      C:\Temp\caysnifdxv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3120
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1684
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5232
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_caysnifdxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4360
  - - C:\Temp\i_caysnifdxv.exe
      C:\Temp\i_caysnifdxv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1952
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ausmkfcxvp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1740
  - - C:\Temp\ausmkfcxvp.exe
      C:\Temp\ausmkfcxvp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3548
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4532
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2464
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ausmkfcxvp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3900
  - - C:\Temp\i_ausmkfcxvp.exe
      C:\Temp\i_ausmkfcxvp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpnhecaup.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4476
  - - C:\Temp\xrpnhecaup.exe
      C:\Temp\xrpnhecaup.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:796
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1416
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1284
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpnhecaup.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4388
  - - C:\Temp\i_xrpnhecaup.exe
      C:\Temp\i_xrpnhecaup.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1336
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkezwrpmhe.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2312
  - - C:\Temp\mkezwrpmhe.exe
      C:\Temp\mkezwrpmhe.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5396
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3160
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:764
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkezwrpmhe.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1976
  - - C:\Temp\i_mkezwrpmhe.exe
      C:\Temp\i_mkezwrpmhe.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4920
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hbzxromgez.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2284
  - - C:\Temp\hbzxromgez.exe
      C:\Temp\hbzxromgez.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5912
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3944
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1556
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hbzxromgez.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5024
  - - C:\Temp\i_hbzxromgez.exe
      C:\Temp\i_hbzxromgez.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2008
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljgeywrojh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3948
  - - C:\Temp\ljgeywrojh.exe
      C:\Temp\ljgeywrojh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5544
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6076
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1484
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljgeywrojh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5728
  - - C:\Temp\i_ljgeywrojh.exe
      C:\Temp\i_ljgeywrojh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywqoigeywq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5268
  - - C:\Temp\ywqoigeywq.exe
      C:\Temp\ywqoigeywq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2892
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2040
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1388
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywqoigeywq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3832
  - - C:\Temp\i_ywqoigeywq.exe
      C:\Temp\i_ywqoigeywq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4000
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqkidavtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1028
  - - C:\Temp\sqkidavtnl.exe
      C:\Temp\sqkidavtnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4900
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5628
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqkidavtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3952
  - - C:\Temp\i_sqkidavtnl.exe
      C:\Temp\i_sqkidavtnl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1440
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qkicaysnki.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4688
  - - C:\Temp\qkicaysnki.exe
      C:\Temp\qkicaysnki.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6120
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1436
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qkicaysnki.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3360
  - - C:\Temp\i_qkicaysnki.exe
      C:\Temp\i_qkicaysnki.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\khfaxvpnif.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:932
  - - C:\Temp\khfaxvpnif.exe
      C:\Temp\khfaxvpnif.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1180
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4256
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6096
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_khfaxvpnif.exe ups_ins
    3⤵
    PID:2596
  - - C:\Temp\i_khfaxvpnif.exe
      C:\Temp\i_khfaxvpnif.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pkhcauspkh.exe ups_run
    3⤵
    PID:5696
  - - C:\Temp\pkhcauspkh.exe
      C:\Temp\pkhcauspkh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3528
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5232
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:468
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pkhcauspkh.exe ups_ins
    3⤵
    PID:4604
  - - C:\Temp\i_pkhcauspkh.exe
      C:\Temp\i_pkhcauspkh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:920
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhczurmke.exe ups_run
    3⤵
    PID:4836
  - - C:\Temp\pjhczurmke.exe
      C:\Temp\pjhczurmke.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5972
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3736
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjhczurmke.exe ups_ins
    3⤵
    PID:2164
  - - C:\Temp\i_pjhczurmke.exe
      C:\Temp\i_pjhczurmke.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5932
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpjhczurm.exe ups_run
    3⤵
    PID:5760
  - - C:\Temp\xrpjhczurm.exe
      C:\Temp\xrpjhczurm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4008
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5368
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5876
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpjhczurm.exe ups_ins
    3⤵
    PID:876
  - - C:\Temp\i_xrpjhczurm.exe
      C:\Temp\i_xrpjhczurm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4188
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hbztrpjhbz.exe ups_run
    3⤵
    PID:5404
  - - C:\Temp\hbztrpjhbz.exe
      C:\Temp\hbztrpjhbz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4652
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2864
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:244
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hbztrpjhbz.exe ups_ins
    3⤵
    PID:4192
  - - C:\Temp\i_hbztrpjhbz.exe
      C:\Temp\i_hbztrpjhbz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgeywtoljd.exe ups_run
    3⤵
    PID:1328
  - - C:\Temp\jgeywtoljd.exe
      C:\Temp\jgeywtoljd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1048
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2496
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1360
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgeywtoljd.exe ups_ins
    3⤵
    PID:2976
  - - C:\Temp\i_jgeywtoljd.exe
      C:\Temp\i_jgeywtoljd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5176
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywqgaytqlj.exe ups_run
    3⤵
    PID:4692
  - - C:\Temp\ywqgaytqlj.exe
      C:\Temp\ywqgaytqlj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1696
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:720
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4764
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywqgaytqlj.exe ups_ins
    3⤵
    PID:5284
  - - C:\Temp\i_ywqgaytqlj.exe
      C:\Temp\i_ywqgaytqlj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5288
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ysqlidavtn.exe ups_run
    3⤵
    PID:3152
  - - C:\Temp\ysqlidavtn.exe
      C:\Temp\ysqlidavtn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1252
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4744
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2876
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ysqlidavtn.exe ups_ins
    3⤵
    PID:2552
  - - C:\Temp\i_ysqlidavtn.exe
      C:\Temp\i_ysqlidavtn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:244
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tnkicayvpn.exe ups_run
    3⤵
    PID:4452
  - - C:\Temp\tnkicayvpn.exe
      C:\Temp\tnkicayvpn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5720
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5596
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5832
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tnkicayvpn.exe ups_ins
    3⤵
    PID:2432
  - - C:\Temp\i_tnkicayvpn.exe
      C:\Temp\i_tnkicayvpn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4344
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spkicaupmk.exe ups_run
    3⤵
    PID:3052
  - - C:\Temp\spkicaupmk.exe
      C:\Temp\spkicaupmk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4944
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1668
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3428
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x394,0x7ffc47b6c188,0x7ffc47b6c194,0x7ffc47b6c1a0
      4⤵
      PID:1900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,12626769948284910484,12046205871916887304,262144 --field-trial-handle=2280,i,10129475870503115078,15436310366154537545,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
      4⤵
      PID:1848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,12282496409247082091,5376512418009395589,524288 --field-trial-handle=2280,i,10129475870503115078,15436310366154537545,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:11
      4⤵
      System Time Discovery
      PID:1972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,5544147594660198174,15572330022100001461,524288 --field-trial-handle=2280,i,10129475870503115078,15436310366154537545,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:13
      4⤵
      PID:3184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,13608658988621399948,9290366846423394141,2097152 --field-trial-handle=2280,i,10129475870503115078,15436310366154537545,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
      4⤵
      PID:1556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3536,i,16099425735891162807,11366196720918432572,2097152 --field-trial-handle=2280,i,10129475870503115078,15436310366154537545,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
      4⤵
      PID:3276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,15929296743845221711,12589244850206816658,2097152 --field-trial-handle=2280,i,10129475870503115078,15436310366154537545,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
      4⤵
      PID:3960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,7378813093019760623,4109984070607089922,2097152 --field-trial-handle=2280,i,10129475870503115078,15436310366154537545,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:9
      4⤵
      PID:1912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3688,i,7889159417515917488,13096450502521800558,524288 --field-trial-handle=2280,i,10129475870503115078,15436310366154537545,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:14
      4⤵
      PID:5536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,10797468355998452293,13786156047667839189,524288 --field-trial-handle=2280,i,10129475870503115078,15436310366154537545,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
      4⤵
      PID:4328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,10031620433318546713,14708485020006355578,524288 --field-trial-handle=2280,i,10129475870503115078,15436310366154537545,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
      4⤵
      PID:4000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,16026716849312940032,17654270800734438465,524288 --field-trial-handle=2280,i,10129475870503115078,15436310366154537545,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:14
      4⤵
      PID:1160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,16026716849312940032,17654270800734438465,524288 --field-trial-handle=2280,i,10129475870503115078,15436310366154537545,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:14
      4⤵
      PID:6120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,18302858364822727479,15954744545276345225,524288 --field-trial-handle=2280,i,10129475870503115078,15436310366154537545,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
      4⤵
      PID:4652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,5082820222273827521,3489887789406093943,524288 --field-trial-handle=2280,i,10129475870503115078,15436310366154537545,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:14
      4⤵
      PID:3900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,10393091583739541987,3849564819216363798,524288 --field-trial-handle=2280,i,10129475870503115078,15436310366154537545,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:14
      4⤵
      PID:1140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4372,i,929923038790034940,14733720667177919073,524288 --field-trial-handle=2280,i,10129475870503115078,15436310366154537545,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:14
      4⤵
      PID:4816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,12101846594650491088,11810625197990794722,524288 --field-trial-handle=2280,i,10129475870503115078,15436310366154537545,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:14
      4⤵
      PID:2256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,577445890509349069,5081306992611742596,524288 --field-trial-handle=2280,i,10129475870503115078,15436310366154537545,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:14
      4⤵
      PID:1984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,10295417036837748833,9575006940178249985,524288 --field-trial-handle=2280,i,10129475870503115078,15436310366154537545,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:14
      4⤵
      PID:1096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,8113448648565578364,5016290477896346822,524288 --field-trial-handle=2280,i,10129475870503115078,15436310366154537545,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:14
      4⤵
      PID:3232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,18081414030508397626,15336252376201664216,524288 --field-trial-handle=2280,i,10129475870503115078,15436310366154537545,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:14
      4⤵
      PID:5184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6492,i,13802731417124321319,5510870538223170617,262144 --field-trial-handle=2280,i,10129475870503115078,15436310366154537545,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:10
      4⤵
      PID:3052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,17490402022508988587,2359947147483381056,524288 --field-trial-handle=2280,i,10129475870503115078,15436310366154537545,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:14
      4⤵
      PID:3996

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1252

C:\Temp\yvqnifdyvqoljdbv.sys
C:\Temp\yvqnifdyvqoljdbv.sys
1⤵
- Executes dropped EXE
PID:700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5396

C:\Temp\nlfdxvqnif.sys
C:\Temp\nlfdxvqnif.sys
1⤵
- Executes dropped EXE
PID:2972

C:\Temp\dxvpnhfaxs.sys
C:\Temp\dxvpnhfaxs.sys
1⤵
- Executes dropped EXE
PID:4704

C:\Temp\xrpkhcausp.sys
C:\Temp\xrpkhcausp.sys
1⤵
- Executes dropped EXE
PID:4256

C:\Temp\czurpnhfzx.sys
C:\Temp\czurpnhfzx.sys
1⤵
- Executes dropped EXE
PID:2852

C:\Temp\jecwuomjhb.sys
C:\Temp\jecwuomjhb.sys
1⤵
- Executes dropped EXE
PID:436

C:\Temp\mgebztromg.sys
C:\Temp\mgebztromg.sys
1⤵
- Executes dropped EXE
PID:5644

C:\Temp\bvtqljdywq.sys
C:\Temp\bvtqljdywq.sys
1⤵
- Executes dropped EXE
PID:2256

C:\Temp\gdbytqoljd.sys
C:\Temp\gdbytqoljd.sys
1⤵
- Executes dropped EXE
PID:4256

C:\Temp\vsqlidyvtn.sys
C:\Temp\vsqlidyvtn.sys
1⤵
- Executes dropped EXE
PID:5056

C:\Temp\kicaxvpnlf.sys
C:\Temp\kicaxvpnlf.sys
1⤵
- Executes dropped EXE
PID:5020

C:\Temp\pkhcausmke.sys
C:\Temp\pkhcausmke.sys
1⤵
PID:1440

C:\Temp\uspkhczxus.sys
C:\Temp\uspkhczxus.sys
1⤵
PID:1876

C:\Temp\urmjhbzurm.sys
C:\Temp\urmjhbzurm.sys
1⤵
PID:3880

C:\Temp\ebzwrpjhbz.sys
C:\Temp\ebzwrpjhbz.sys
1⤵
PID:5060

C:\Temp\ljdbwtolge.sys
C:\Temp\ljdbwtolge.sys
1⤵
PID:1560

C:\Temp\wqolgdywqo.sys
C:\Temp\wqolgdywqo.sys
1⤵
PID:2980

C:\Temp\dyvqoigays.sys
C:\Temp\dyvqoigays.sys
1⤵
PID:4188

C:\Temp\sqkifaxvpn.sys
C:\Temp\sqkifaxvpn.sys
1⤵
PID:1440

C:\Temp\faxsqkicav.sys
C:\Temp\faxsqkicav.sys
1⤵
PID:4712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ausmkfcxvp.exe

Path C:\Temp\ausmkfcxvp.exe
Size 361KB
SHA256 b9b7aacb1018b1d2d215a97b0b5893f09a956f186db73c913cb3178437d8cc2a
MD5 38720e748a2d24eb7d8d9cf2ed0d0369
SHA1 2eee3de7e8dab3922f381815b1e60429e817ae83
SHA512 9876aa814d8ebaca55a0f267fd3b8ef6a451ae13a515e77255954e8b5241fcb71769597945937182a7959089b6e0c03e973c2aebb3e7b7792a7803f29b81bad9
SSDEEP 6144:mflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:mflfAsiVGjSGecvX
TLSH
T1C8747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

caysnifdxv.exe

Path C:\Temp\caysnifdxv.exe
Size 361KB
SHA256 9bdd08d5265be6ec7f575639da6c5f23142750a0bc23cbfa4dfab74a2cf8b0e9
MD5 2467e340dcffbf81acf730b5e8a8f2df
SHA1 bcdc58c5cc9494324c706c38cbc02337e5196883
SHA512 ac59883e1973df42094d5e56f986b5c0a6ae513b3c0e93f1878eba4734434728560fc853bf494249ccecdc836b8eb28ee9c814866f43f7e65195dba7a948c898
SSDEEP 6144:qflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:qflfAsiVGjSGecvX
TLSH
T1E9747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

czurpnhfzx.sys

Path C:\Temp\czurpnhfzx.sys
Size 293KB
SHA256 4b92dbaa02ba68d5394b908ea8e82a02f453cd3e216101c9a9faf3570204badf
MD5 a21dd32046f3e7b203965abcd8d68db9
SHA1 cb99d40bb0014b10f33e718a82880e4ff7ad890a
SHA512 83a122dab417a501bd00114d2c14c9c34c927a2d3129e9941cacc1f0a48f72babdcff79f76c8ac159ce7b26dbe935f47a404e842f13d5a9677571333470ae3b2
SSDEEP 3072:OtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:OIJjiJcbI03GBc3ucY5DCSj
TLSH
T12F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxvpnhfaxs.sys

Path C:\Temp\dxvpnhfaxs.sys
Size 293KB
SHA256 9b93c8964f3c600e4fe4cba0a343cb4908dd5e1ec7094b224ddb40931cccddf3
MD5 23d280b987d70f6a455265b9934eab8f
SHA1 12903946acbc9b25c7ed680515ad88589323f697
SHA512 32d91167921e96a483172d439698fdbc094fb42144259690268902a1d9de179c06d365df3c27c76569b04cf7f66fdb889546c20aade60cf33e6f728fbd2aa519
SSDEEP 3072:QtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:QIJjiJcbI03GBc3ucY5DCSj
TLSH
T188545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbzxromgez.exe

Path C:\Temp\hbzxromgez.exe
Size 361KB
SHA256 db3328231a50bc282525f0bc7705689c41a431c7d23299df4847c3f76aa18ea5
MD5 58d00c218bf66cbb8dff8585ddd75004
SHA1 1e66a48842ee6b08cee2c161df509f8b25fadb94
SHA512 cabd552a5a5988ced74004fec8e0aaa02665f95e763c8d2898bf169c2a2a1155ef8077a0235c9364ce795a289bac676d613bd4fab98b61400bc337c0b3995525
SSDEEP 6144:AflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:AflfAsiVGjSGecvX
TLSH
T1AC747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ausmkfcxvp.exe

Path C:\Temp\i_ausmkfcxvp.exe
Size 361KB
SHA256 eab9252c045b169cccb9d2ab69c07a623473525e8128efdb04cf363e09e86bc0
MD5 da4d9a31a8be3333b3512b303c36d24d
SHA1 ca0ee67619e29a16a91551a38d88ca0143ddf37e
SHA512 839bee777e7f0c798147d1c7ebdf04f0c4ab20c112af42fc5aaddeeba6b2e4069309b142033e306927d57de5ae64f6d792b68e02c55f9bade62637fc2e53bcf3
SSDEEP 6144:DflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:DflfAsiVGjSGecvX
TLSH
T16D747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_caysnifdxv.exe

Path C:\Temp\i_caysnifdxv.exe
Size 361KB
SHA256 8f8da19cd8d9882122c251182b2201861d3fc41dfdab68ecbcbb0f384e21afd6
MD5 5fc01a3d1adc60f778286884a98d2ad2
SHA1 bc1331de754955579ff0d654c237fa94b6a05096
SHA512 21a1b3c95c4a1054d461455a9f34b4a0b10c6ec3ea279084c2f6e74989b64f53a20c21692f1c8b653e83b2f99d8b4d436f8baae54ce058b09da6df174db9e623
SSDEEP 6144:HflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:HflfAsiVGjSGecvX
TLSH
T1D5747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mkezwrpmhe.exe

Path C:\Temp\i_mkezwrpmhe.exe
Size 361KB
SHA256 a9c6c366665d933b0fd14714e78bc91211a6401211af108bb9ea2d75e0b37555
MD5 9e3a0eec83825f9d0f903f9c42fbe9e3
SHA1 da44abfbffc3be7e2e60c73636179cdb70c14e75
SHA512 1a93a202a2bb037cf197d1b7849923c8e4ee458220aa7bfff903d164997d09cc328085b7add6772006140ea48e145a2ad0fc2311fdfb2a7ba2bcc1ae658e6b37
SSDEEP 6144:gflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:gflfAsiVGjSGecvX
TLSH
T1B1747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtnlfdaqls.exe

Path C:\Temp\i_vtnlfdaqls.exe
Size 361KB
SHA256 9fd20881a0177f2857625aec950bedb42e7879cc05684f905296882b890a5ff8
MD5 c573e5b336b379dc72f325ddc3adcbff
SHA1 721e91bbafb574f36b687ceb7ad053ae1747135a
SHA512 85493ce3cd5fab10f80923ceab25af1fe06f4b00f771d1c5cd5fc3386ea03fc1b03801f3b92c56b567361e6aa494ccb6af902b7f6d9026bd10cb647b35d5ecf6
SSDEEP 6144:qflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:qflfAsiVGjSGecvX
TLSH
T1EF747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xrpnhecaup.exe

Path C:\Temp\i_xrpnhecaup.exe
Size 361KB
SHA256 ac7b273f2fe3707fe8fc342a382c6b5aca41dd0e68daf631bc5029970061e72c
MD5 507d5bbe45d7cafb96b101b90786572b
SHA1 e47a557a86ca84a8ae30111954ecd5160261fcca
SHA512 9d240ccebec31130c78c6bda0c29240b81b8b77fd83bc790d80aee8425dd09af86536ab7cb8e62759aa791dc439ffdaa1b7f0f97c18019bbf9eb0f3e69a97d89
SSDEEP 6144:7flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:7flfAsiVGjSGecvX
TLSH
T1BB747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jecwuomjhb.sys

Path C:\Temp\jecwuomjhb.sys
Size 293KB
SHA256 08b3cdbcc8ff6ea005d913256d49db6bfcdf2b3c672b2cdf30264ca15167af39
MD5 d7d3603fdd3c38ea13d1b79484b4ddb0
SHA1 ad61b19154acca341cfc439ebdf34b916f205a4f
SHA512 285a59cf1cbcf73722578df1d68d6b1447bda2fda05e5b9d392d954fc28967241f560bcbdafa301ecf368aaa6bf29f44cc2137882efe3f7fcce2dd3d0c164693
SSDEEP 3072:xtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:xIJjiJcbI03GBc3ucY5DCSj
TLSH
T126545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkezwrpmhe.exe

Path C:\Temp\mkezwrpmhe.exe
Size 361KB
SHA256 3114e320dd1b9b68380129e2c33d3aac3b5bf28ab047f46da72aea6f0e1b72e7
MD5 f0c0e23a3c4104c38807f31aec6afb7a
SHA1 2e5521979a6567fa2ff45c522e1ad628283d7d16
SHA512 c52371eedbbf2df1ff3721a6efbad9b320462d7d6c9191e1b94056a915410adf585ea4ed7c08b7ca6b50829a45859ee003aea7aff538a7d9b4fc50ab653ca38d
SSDEEP 6144:2flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:2flfAsiVGjSGecvX
TLSH
T171747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlfdxvqnif.sys

Path C:\Temp\nlfdxvqnif.sys
Size 293KB
SHA256 4ab79535276e9b6ca059e081a5c56d25a53fd785e0ec9f92395cbd8e154e7ea6
MD5 84622d859ae0f7c38e4179248dd7def5
SHA1 6d24cae681dae8a94bf5c09a9d083006bcd936ea
SHA512 2813bc87601646d70d432d33892cb79a2c76424c3aac80c8e51af143ade015198d96f1d07292cff58e2ce8bab5dd8e3537932d77793e8c66a7abfd26a140842d
SSDEEP 3072:ttKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:tIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C8545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlfdaqls.exe

Path C:\Temp\vtnlfdaqls.exe
Size 361KB
SHA256 7b42c94d80e289221a65f5fecf3efbc33d10d9f41dd75d2f3fa8a4cb6b31af50
MD5 224201b619c6e8758f89a8ef6d8216d1
SHA1 27226e813ef29a83013cf5080501db3f89fd103e
SHA512 6c31cf634d1707c1cf23b70619b4a4a273c45cf07c1b6796cd099d90eda06ca263cc5f28bc5c55e2c3999e27dc0c329d097c57d22753c80c868e446372d90e15
SSDEEP 6144:xflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:xflfAsiVGjSGecvX
TLSH
T1D3747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrpkhcausp.sys

Path C:\Temp\xrpkhcausp.sys
Size 293KB
SHA256 bbbcc2f6a421f188bdac467f15b5124169f59cc5a17192c7f7e32449ff8826c4
MD5 66a04a3c2a940603a142f0f65d905c82
SHA1 57b0a213b6406408e7cf048500204e7de99c2bf3
SHA512 0a1904a7cd42843a223fd3857a674aef7826571f9140be6e0f8e53fb15e734c2850c12637b070cf305360e4a4c54a5812e3da0af68b56a6fc04b0a5f1d9c8631
SSDEEP 3072:utKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:uIJjiJcbI03GBc3ucY5DCSj
TLSH
T16F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrpnhecaup.exe

Path C:\Temp\xrpnhecaup.exe
Size 361KB
SHA256 b33b8d6766e5edc043156d7d93758eb3257fe297a97b5cbc2ffd4e25931a5540
MD5 b73df9898c87a97ca388f435c2967ce0
SHA1 ebb72b9900090a6a8ee9f1b381789a341f04c233
SHA512 a0d6151dbed55e9fdf3d831aa9f68768d5d1576a2ab622ab93b99db2e7f648985ecd3cf0a62d3f3f48bc3e209eb2c6a7b43dd67d28130812e7fee5ca7a4f9bb1
SSDEEP 6144:iflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:iflfAsiVGjSGecvX
TLSH
T123747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvqnifdyvqoljdbv.exe

Path C:\Temp\yvqnifdyvqoljdbv.exe
Size 361KB
SHA256 5cb2bd9b3b6c2909bea2497bd4363797907aa65b124aaba0c99bef4a78a8f76c
MD5 91567992db725cab2cefd53d723f70ec
SHA1 df7330659dcbcd40a2efcee9587a2c14b15f8d06
SHA512 fe931ee92dabc06fae12993b4f2ceaa2b05f17a7e56369494603a1742e77d4e63d40f9c8c2b92d70ddcbbf730ac6e5662062879df2e04668e00abe9bc4bef1ed
SSDEEP 6144:4flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:4flfAsiVGjSGecvX
TLSH
T136747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvqnifdyvqoljdbv.sys

Path C:\Temp\yvqnifdyvqoljdbv.sys
Size 293KB
SHA256 c570c8c634d5d2cb8cb60ce1973bf943b646352ff40db4a16d0192ed67e69199
MD5 4fd22f5c60277ef551aaecbeee21181b
SHA1 fa713d6d515be8b572fe794f42c7ee1fb839081e
SHA512 09b980f7101887af68270470cf2a5acf6067d320a6647d79498dba637061dd0543cbd2fd6c808319850b847be01554e17ee299ef3f36943640d523e9207b4519
SSDEEP 3072:utKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:uIJjiJcbI03GBc3ucY5DCSj
TLSH
T118545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9bb232d2-d606-48b5-8c2b-235baf8e43f4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9bb232d2-d606-48b5-8c2b-235baf8e43f4.tmp
Size 40KB
SHA256 8fe89f217ffbb6db18d559d825775b86c424e1feb8a342800355fce94b9e98ec
MD5 1576858642cf37d4433fede4ae2fdaa0
SHA1 ca3ced75f6b11f2893b9fdcda4a702518645afe5
SHA512 8db33a32bc1286c663b9e3d505dc161b4581ded0997dec53e2d97d9be14490f8e53bc34604d1e6f6d5e41017036a2e0549a020849556fe82486d4552757273c2
SSDEEP 768:i/UxvxjgC+K3AtKnJDjOa7xDc9bsMSJz/Fn/e4YGHPef:nZj3+K3zJjO6VQbs7JTs4YUmf
TLSH
T1A413D079EC905CA38DF6B7407A8B6B97AFF408A3D4C55D8889D5AE0D06C73AC2707816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d8f51289-6b15-48bc-9b91-12304b88bb05.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\d8f51289-6b15-48bc-9b91-12304b88bb05.tmp
Size 105KB
SHA256 0526a2a51e51d4fabd0b1d17ef03f5340c42a3dfcb2119ece19ca3fb7900a64d
MD5 844a3eca2c89c5806ce623a8aaa667a4
SHA1 92425b0bd5ebe6baf101dd06c4c2d65b1cabbe97
SHA512 19fb4fa602526e6121d2bbb2984c8130d972906c815cef03a10d6c046e88bc013fabfd2daed35ac6fc10b90eb453c529c4fb4c4b465fb957c45a55ec67aa247f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7u:fwUQC5VwBIiElEd2K57P7u
TLSH
T1D2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 97f58c0ff1008d9a744980b06de74b1bc42fdd2408c0871566ecacc80738c498
MD5 ffa34db42a6c31e411546fdfd8772d96
SHA1 cd3fa45407492f90d8b070cf009147d20a8b4151
SHA512 72fd2a1188869d257eaee37d23569752bb0744ad1a5cad19b6a4b2e60f4d5f74f1ccf0a0b24a6e31d4d512e939f7b384fb86433ec7496296acb712e8334d5e32
TLSH
T18BD02BF0529C9C63C4CA307804264581001634017548D2903601878849401B914423D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 355a29997d085f70c135b61fb8e48fe3b3d9b6030190662c9d930bd533b88c78
MD5 5121c8953b32388eb96bb70d0d12fd00
SHA1 e62d74f75b188deb1ec8b8dabcff7c16e7ba9ba5
SHA512 c8f0ff682c9ed7e02559e599a97078b0a2e39f928b301598e0196d5d9dd6ffac13da9bd34262b0120793cb2472ac6c7a93a178d4abcd0a5a2c6df1e9a193de10
TLSH
T13CD02BF4528C9C63C4CA30740425458100263401B948D2903501478849401B914433E7
MD5 SHA1 SHA512 TLSH

Submit Download

0adc7e98-2c65-4991-afc8-e24a3ffc3e22.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0adc7e98-2c65-4991-afc8-e24a3ffc3e22.tmp
Size 11KB
SHA256 2e518476fed425fb2bc12e27b1fe6c9f67d0319f3b09f8ec161abf8a198cba3c
MD5 65efe9d10dc6cc8856e2fae0ed294bf7
SHA1 dbab06ab9d49931642c72743bac7e6233cc625de
SHA512 3f6c62100c7afc5673ad0a9f60e7f651f8b2541aa6c9c40545fc246adc44ce1096a2ebcb7bce702662990296b96aad4a6519fab4ab652e064c1ff6f396c71422
SSDEEP 192:sxR0R8C6/fOsQtZGzoA8p9KJ/g6+WNC1d/YtwKGVIgDzwJ:sxR0V6/fOsQD7C/5S/Z0
TLSH
T12442B715AD24697B8CCBD21DFB55BB53E3F91072A0915E4CA6FCCA1C14E76DD220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

26513fea-897c-4418-9460-3032a739126d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\26513fea-897c-4418-9460-3032a739126d.tmp
Size 29KB
SHA256 9db78292cf9f8fd6ac2562fcda4501d157ff0c2a0b5eebc875b0ce4035dcfde2
MD5 ef948811effc72fcdfa82c58fab20963
SHA1 d0daa98b6f0ae2afa103d4e72ef113007b3bd4ad
SHA512 0b68ea3449f8932b98f0e091942a866c297ddc1e0c59027608d45d09f4968fba1c4c8b78656dbc43fe721f4bcfbdef852954d8853caff0de88f4c58d64760341
SSDEEP 768:dmGxoF7pLuLb1sWgmMfk68F1+UoAYDCx9Tuqh0VfUC9xbog/OVpRXUGe0romLcdz:dmGxoTEb1sWgmMfk6u1jaCRXVefT
TLSH
T172D2DA7B780CCB7F4F800ADDAD197A9F6DA802CB9698CD8447F9941C02C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

41d7afb2-58e1-4987-ae00-7e0788004ce4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\41d7afb2-58e1-4987-ae00-7e0788004ce4.tmp
Size 11KB
SHA256 a0d250749989d996c5bfaafe3ac9554bb073dd1a146afc38e00a916c10ada31a
MD5 fbcc0c615c4ded620a91f2b05ac84188
SHA1 04cbe3e906bf34030e841b84a3e83d2399954857
SHA512 f03c87a57ef50375b45fce7e8e243ff859d6f9b0ee42e923794b1839b48c156f9f8d78281fda155fc0eeacbc864c3a958b6bb67dd4f03ec0fa92db6c5888ec56
SSDEEP 192:sxRrR8C6/fOsgtZGzoA8p9KJ/g6+WNC1d/YtwKGVIgVwJ:sxRrV6/fOsgD7C/5S/Z+
TLSH
T1CC42A715AD24697B8CCBD21DBB55BB53E3F91072A0915E48A6FCC61C14E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8e540d9a-51f5-42b6-98f5-91699b8e0f98.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8e540d9a-51f5-42b6-98f5-91699b8e0f98.tmp
Size 12KB
SHA256 1fc6d7588c0484ab1303da94ddbda557fb3f695423c256161fc6f1d11fa40fc8
MD5 2f3b7fa9a4cf441f74c448ba31fbd5a6
SHA1 a3fa94963f21c52767955724b0e3a460fe5be979
SHA512 1d9af6de62ecf8a4e18e7759964cf538cab5c4c734e7bcce20509e07baa860ab56babaa412da16065ddc5970fc81c40c91d939fe860e69eb07c14df323148c45
SSDEEP 192:sxR0R8C6/fOsrJtZGzoA8p9KJ/g6+WNC1d/YtZKGVIgDRwJ:sxR0V6/fOsrJD7C/5S/SO
TLSH
T13F42B715AD24697B9CCBD21DBB557B13E3F91072A0915E4CA6FCCA1C14E76DD220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

95f60ed0-2b98-4747-a5f7-881517b457e5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\95f60ed0-2b98-4747-a5f7-881517b457e5.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 61ba852d48910ee81463757450b99348e2fb26bdc48359b085f2c39fed8f4833
MD5 eb678b427527b25f69539398eeb9a5ba
SHA1 4da79bce3a7c81881ce706e5a79b6e3b736af67c
SHA512 e8c1d039f1aea84b8fda1ade942f55cf259698a1a8f7b264e9d4710efbe9c706520bc8a69ce982ad13e7365de2ccf3824b1f5af8a243a00fa78a8cd2542e8d3c
TLSH
T16F613CC68690A13AFB780134A2C00DF3F63F86A3D5930E0E7698CDB96D46F9641D07A7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2b91b3ce0293e567fe7c763171e82059f4b11114cd57e6ed8810e8ba827b624e
MD5 c59836b73bbb2c34df0efe167ed109ee
SHA1 c812ba7752009577c06721c96f06c5ed066c7d8b
SHA512 582524adeacefcf9dca4aa7028b7fb4216fa0751446a6fb9d9fcaea29d70036a4a800d95cc08555bff9307f8f620752048385371b6943291c33cd387c071fb52
TLSH
T143613DC68690A13AFB680130A2C00DF7F63F85A3D5930E0E7698CDB96D46F9641D03A7
MD5 SHA1 SHA512 TLSH

Submit Download

9a9ae941-5704-448e-bfda-4b382aabb0c1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\9a9ae941-5704-448e-bfda-4b382aabb0c1.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

283cdfd6-da57-4dc0-98ed-cdaad7f56a6a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\283cdfd6-da57-4dc0-98ed-cdaad7f56a6a.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

9021e506-ecc7-4300-9259-08a6b6a005c6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9021e506-ecc7-4300-9259-08a6b6a005c6.tmp
Size 2KB
SHA256 140031499097ebf37319de2de5fb383a04f1c5a75fc4bdcc3ef0db6cc9d921cf
MD5 6a78285613e78943d79bdb4b255966d2
SHA1 8379cabb39e06d3e1956e850f1e1b1c7fc766e93
SHA512 9e17bd6b7a7b9cf7de82435d46612b5c9e5bfbd8b28d1c48c0908872923eae98536fb8306a89fa3c3c6d303dc1c45bb6d6a4280c8fc0eb1efd1350962f062523
TLSH
T113519FF3C6E8866DC90156F4AB146E1BCE2D0954432C3D5AC8E4EE6B93E3471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

f1a043d4-4e86-4600-8abc-0ed463e88806.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f1a043d4-4e86-4600-8abc-0ed463e88806.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 471300b4889f078498e82505b39b12258b95f1a4dc9792f2ce1531f566c75f11
MD5 3def95a1a5549a1e6c514ccd9a4ef564
SHA1 4c79b6e88812b1f3140bd74c3d6fe7d3041aa790
SHA512 798fbad1ad67a8b1a729206c8da22bf1bb114d4025cc7a448c76b3e8f8624c67f4452f16d3fc8623eb9a91b7fe82c563ed922cf2ccdd0a3c68d2b435d6a216ba
SSDEEP 48:KUOI3KbK8PyhCIfKXqcHeI/KjiYRyd9IxKucU+:KUOIKbKOSCwKXqEekKjicu9GKucx
TLSH
T192B11321707B46013ABD360895E497AE174232733039EA2B77F950669E6FE084DFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f602a648-1ec2-4780-a8f1-3dd23af84556.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f602a648-1ec2-4780-a8f1-3dd23af84556.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

43c5ae01-37f3-4d31-8343-9aa4a4be46f1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\43c5ae01-37f3-4d31-8343-9aa4a4be46f1.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

a2d88d81-2b59-4a38-834d-e6df636b09f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a2d88d81-2b59-4a38-834d-e6df636b09f9.tmp
Size 37KB
SHA256 9056b039d62b450b977494a4e6fc24229effdea9b091d02da956b3510b148c05
MD5 dc1d585d5bbbe3341cb9cade78772fd6
SHA1 d1744764cf13c6f245c8754e58b706f1023fb30f
SHA512 0bf55484a21514dd4e8e8b8501aff890611a675d2112d1bad801d3913b499d7c6514c3ac79693edaf45949867871bcf4c795a65b1a302670b4f57325eabd8cbf
SSDEEP 768:z/UxvxjgC+U399KnJDhxDc9bsMSJz/Fnn5SHXPyK/:GZj3+U3+JhVQbs7JTLSb/
TLSH
T14703D03AEC905CA3CCF763803A8AA657AFF94953C4C5299849DD6E0C07CB3AC1307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c74447b8-4b58-43a9-9a2d-9d8778984e5f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c74447b8-4b58-43a9-9a2d-9d8778984e5f.tmp
Size 42KB
SHA256 6861095bc4e0719825e605d40ef1b744423131328f487038bc6248030c128384
MD5 a06cf5771f00eec28271ac5f2d2abcea
SHA1 97a93e23c0b90ac5641e71d21654b1ae216721b8
SHA512 0aed49eb1bc1b5cf03f5a6ca926ab098488590ef33831cf7892077b3e5091331842702f22575d3c6acb420fcfe72b814fe32138998a2f0b63fba541f83042120
SSDEEP 768:eFQ238wgwu0nJDjOaDxDc9bsMSJz/Fn/e4YGHP6H:123FJjOEVQbs7JTs4YUCH
TLSH
T1C61337F688D389B7D8AE5783A77D6E469AFCC053B4889984B7C55D0CCC822BFD706811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3c557fed-452a-4509-ae7f-11e02efea755.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\3c557fed-452a-4509-ae7f-11e02efea755.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

44936c79-19a2-4230-88e1-ccefa545c2fa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\44936c79-19a2-4230-88e1-ccefa545c2fa.tmp
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

88197863-e2f4-4f68-b943-eec8424db74d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\88197863-e2f4-4f68-b943-eec8424db74d.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

b9691395-99f6-4120-86a0-06712e2c7fd9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\b9691395-99f6-4120-86a0-06712e2c7fd9.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

dd914eec-522d-4153-b93c-7da5ef6ba864.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\dd914eec-522d-4153-b93c-7da5ef6ba864.tmp
Size 34KB
SHA256 01358dd9401482e24d29087c6ff770a5ddd5b5eb042bd0344e963eeadfcc7dff
MD5 d14ac867802f0745ddfc0e4d6730b3e1
SHA1 b3a5b7f04541c57a64b960d7055dfd54a2cf1de0
SHA512 8c9881387a98176529c2e1e41f03863127fb249d2ecb2deafd14cd400b54ac75db312d4c85c935915d3b67c5b501fcefa601d8f37cef515ab74deef81f9d3a9a
SSDEEP 768:in3VtKnJDjOa7xDc9bsMSJz/Fn/e4YGHP6H:in3+JjO6VQbs7JTs4YUCH
TLSH
T1C3F2B0B5DC604DA39CEAA380BA877B576FF80553D4895A88D4D9AE0D06C33AD2707827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

edbf07d6-6818-471c-bb41-5f5156bed9ea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edbf07d6-6818-471c-bb41-5f5156bed9ea.tmp
Size 34KB
SHA256 1268372757a58131f3aeef6b38d4c1c4253a3010b8486a93498b7a9bdf8aa033
MD5 621de431ed2f865e19467a690c5a7634
SHA1 36aa8558a11ab6a19b083db79383f31753f90123
SHA512 37702f6882a36ed138a71f0415a2768a4c32cd98c85f3c6752f197225671fe72dc747cf2793a8ff66e00d2d4894a08eac80cd04df84ff3694eb1c840433b176c
SSDEEP 768:Fn3YtKnJDjOa7xDc9bsMSJz/Fn/e4YGHP6H:Fn37JjO6VQbs7JTs4YUCH
TLSH
T198F2B0B5DC604DA39CEAA380BA877B537FF80953D4894A88D4D9AF0D05C33AD2707827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

07230d2b-38c2-41f5-9997-f428c9385299.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\07230d2b-38c2-41f5-9997-f428c9385299.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

9cefadb7-fb59-43c4-9e4c-aebb10b91f95.tmp

Path C:\Users\Admin\AppData\Local\Temp\9cefadb7-fb59-43c4-9e4c-aebb10b91f95.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faed6669-da31-48a6-93e3-25c214814724.tmp

Path C:\Users\Admin\AppData\Local\Temp\faed6669-da31-48a6-93e3-25c214814724.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1536_1554731859\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1536_1948576119\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1536_20060167\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1536_276728887\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1536_555936084\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 49f80fc153aae4e8144801781fee6cae384aa6e613410bdb764013438114f3dc
MD5 621a93f28f1c0e4ee10e3e04a590ded1
SHA1 9c8f1c8311794c6c6a7c99dc8d6209b674346e29
SHA512 5f36213e24af93dd65ec763c66d993b42894fa2d5eaa610cf2d7d8ebc524a98e66b10fc8f830a4cdda862a23d0b5cdfd473a2ee243e414796b47cca111a720eb
TLSH
T14571239357B9D5B2C5DE5BF102835244F6FB23384B2370200BA65586AB30A3A54B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/436-300-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/700-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1440-400-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1440-495-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1560-450-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1876-422-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2256-328-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2852-287-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2972-198-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2980-455-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2980-478-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3880-426-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4188-476-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4256-345-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4256-275-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4704-247-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4712-499-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5020-380-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5056-350-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5060-438-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5644-330-0x0000000000010000-0x00000000000AB000-memory.dmp

Download