systex | 154ad74e38f5544aeb1cda9b29d56668ee12e97e8096947eaa9e2e9eef6c87b8

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 12:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 456KB
Sample261006-p6grkafa39
SHA256 154ad74e38f5544aeb1cda9b29d56668ee12e97e8096947eaa9e2e9eef6c87b8
MD5 63d6d100447ee8f66686c0cc19494831
SHA1 327af4d3341c7ed967023d2c17faea651cb45250
SHA512 daa02fc43c835011e08433bf409127451c500bd0c52474e9a10863bc2dc77d3b4696a492f3b26cb80310943e8f06afc0f83e966903e87636964716538049c775
SSDEEP 6144:WflfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lIW:WflfAsiVGjSGecvXAflfAsiC
TLSH
T1C0A48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4120	hczusmjhczxrpmke.exe
4252	hczusmjhczxrpmke.sys
4088	CreateProcess.exe
4748	smhecxuomh.exe
4556	CreateProcess.exe
488	CreateProcess.exe
4152	i_smhecxuomh.exe
6000	bzurmjhbzu.sys
4680	CreateProcess.exe
1240	wuomjecwuo.exe
1192	CreateProcess.exe
4196	CreateProcess.exe
3048	i_wuomjecwuo.exe
5736	rojhbztrom.sys
5484	CreateProcess.exe
4668	jhbztromge.exe
364	CreateProcess.exe
3424	CreateProcess.exe
2380	i_jhbztromge.exe
5784	wtoljdbwtr.sys
2712	CreateProcess.exe
944	ywqolgeywq.exe
2344	CreateProcess.exe
1136	CreateProcess.exe
2984	i_ywqolgeywq.exe
4576	wqoigayvqo.sys
1140	CreateProcess.exe
4328	tqljdbvqoi.exe
1100	CreateProcess.exe
2820	CreateProcess.exe
4848	i_tqljdbvqoi.exe
5748	dyvqnlfday.sys
1380	CreateProcess.exe
2400	dxvtnlfays.exe
808	CreateProcess.exe
2644	CreateProcess.exe
4180	i_dxvtnlfays.exe
2268	nlfdysqnif.sys
5836	CreateProcess.exe
5808	faysqkicau.exe
2576	CreateProcess.exe
5984	CreateProcess.exe
6080	i_faysqkicau.exe
4984	nhfzxspkif.sys
2984	CreateProcess.exe
1144	kfcxvpnhfz.exe
3708	CreateProcess.exe
3204	CreateProcess.exe
2828	i_kfcxvpnhfz.exe
4188	pkhfzxupmh.sys
5992	CreateProcess.exe
4400	hcausmkezx.exe
5884	CreateProcess.exe
468	CreateProcess.exe
1132	i_hcausmkezx.exe
1232	hurpjhbzur.sys
1860	CreateProcess.exe
6092	rpjhbztrmj.exe
4364	CreateProcess.exe
4940	CreateProcess.exe
3268	i_rpjhbztrmj.exe
5008	omgezwromh.sys
4188	CreateProcess.exe
5848	jebwuojhbz.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2376_1414373005\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2376_874140526\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2376_854298438\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2376_874140526\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2376_874140526\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2376_874140526\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2376_139975507\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2376_854298438\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2376_1414373005\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfcxvpnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnhfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhezwurmcw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqljdbvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfcxvpnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hcausmkezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hcausmkezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhbztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbzurpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczusmjhczxrpmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomjecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqolgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvtnlfays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhezwurmcw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbztromge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvtnlfays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljebwtomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljebwtomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gayvtolgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlfdbvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomjecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqljdbvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhbztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gayvtolgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkhcausmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smhecxuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdbvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smhecxuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbztromge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faysqkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebwuojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqdavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkhcausmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbzurpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omjebwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqolgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faysqkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebwuojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqdavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnhfdxvq.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4864	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1852	ipconfig.exe
2520	ipconfig.exe
3124	ipconfig.exe
6056	ipconfig.exe
3412	ipconfig.exe
1000	ipconfig.exe
4932	ipconfig.exe
2468	ipconfig.exe
2916	ipconfig.exe
2092	ipconfig.exe
3048	ipconfig.exe
1236	ipconfig.exe
4920	ipconfig.exe
3716	ipconfig.exe
4772	ipconfig.exe
4580	ipconfig.exe
5948	ipconfig.exe
1832	ipconfig.exe
1000	ipconfig.exe
1064	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1704430598-3087477806-3297458608-1000\{8FF0D1FC-31F7-4359-9296-A54DDB65A594}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4120	hczusmjhczxrpmke.exe
4120	hczusmjhczxrpmke.exe
4120	hczusmjhczxrpmke.exe
4120	hczusmjhczxrpmke.exe
4120	hczusmjhczxrpmke.exe
4120	hczusmjhczxrpmke.exe
4120	hczusmjhczxrpmke.exe
4120	hczusmjhczxrpmke.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4152	i_smhecxuomh.exe
Token: SeDebugPrivilege	3048	i_wuomjecwuo.exe
Token: SeDebugPrivilege	2380	i_jhbztromge.exe
Token: SeDebugPrivilege	2984	i_ywqolgeywq.exe
Token: SeDebugPrivilege	4848	i_tqljdbvqoi.exe
Token: SeDebugPrivilege	4180	i_dxvtnlfays.exe
Token: SeDebugPrivilege	6080	i_faysqkicau.exe
Token: SeDebugPrivilege	2828	i_kfcxvpnhfz.exe
Token: SeDebugPrivilege	1132	i_hcausmkezx.exe
Token: SeDebugPrivilege	3268	i_rpjhbztrmj.exe
Token: SeDebugPrivilege	2520	i_jebwuojhbz.exe
Token: SeDebugPrivilege	5564	i_ljebwtomge.exe
Token: SeDebugPrivilege	4464	i_gayvtolgdy.exe
Token: SeDebugPrivilege	200	i_vtnlfdbvqn.exe
Token: SeDebugPrivilege	1988	i_aysqdavsnl.exe
Token: SeDebugPrivilege	1132	i_xvpnhfdxvq.exe
Token: SeDebugPrivilege	2920	i_pkhcausmke.exe
Token: SeDebugPrivilege	1528	i_jhbzurpjhb.exe
Token: SeDebugPrivilege	1488	i_jhezwurmcw.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2376	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6028 wrote to memory of 4120	6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 6028 wrote to memory of 632	6028	2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 632 wrote to memory of 2376	632	iexplore.exe	91
PID 2376 wrote to memory of 1724	2376	msedge.exe	92
PID 2376 wrote to memory of 4864	2376	msedge.exe	93
PID 2376 wrote to memory of 5932	2376	msedge.exe	94
PID 2376 wrote to memory of 4412	2376	msedge.exe	95
PID 2376 wrote to memory of 5932	2376	msedge.exe	94
PID 2376 wrote to memory of 5932	2376	msedge.exe	94
PID 2376 wrote to memory of 4412	2376	msedge.exe	95
PID 2376 wrote to memory of 2484	2376	msedge.exe	97
PID 2376 wrote to memory of 5056	2376	msedge.exe	98
PID 2376 wrote to memory of 2484	2376	msedge.exe	97
PID 2376 wrote to memory of 2484	2376	msedge.exe	97
PID 2376 wrote to memory of 5056	2376	msedge.exe	98
PID 2376 wrote to memory of 5056	2376	msedge.exe	98
PID 2376 wrote to memory of 4504	2376	msedge.exe	99
PID 2376 wrote to memory of 1404	2376	msedge.exe	100
PID 2376 wrote to memory of 4504	2376	msedge.exe	99
PID 2376 wrote to memory of 4504	2376	msedge.exe	99
PID 2376 wrote to memory of 1404	2376	msedge.exe	100
PID 2376 wrote to memory of 1404	2376	msedge.exe	100
PID 2376 wrote to memory of 912	2376	msedge.exe	101
PID 2376 wrote to memory of 912	2376	msedge.exe	101
PID 2376 wrote to memory of 4604	2376	msedge.exe	105
PID 2376 wrote to memory of 564	2376	msedge.exe	106
PID 2376 wrote to memory of 4604	2376	msedge.exe	105
PID 2376 wrote to memory of 564	2376	msedge.exe	106
PID 2376 wrote to memory of 4428	2376	msedge.exe	108
PID 4120 wrote to memory of 4088	4120	hczusmjhczxrpmke.exe	109
PID 4748 wrote to memory of 4556	4748	smhecxuomh.exe	114
PID 2376 wrote to memory of 5808	2376	msedge.exe	117
PID 2376 wrote to memory of 5808	2376	msedge.exe	117
PID 2376 wrote to memory of 4536	2376	msedge.exe	118
PID 2376 wrote to memory of 4536	2376	msedge.exe	118
PID 4120 wrote to memory of 488	4120	hczusmjhczxrpmke.exe	119
PID 4120 wrote to memory of 4680	4120	hczusmjhczxrpmke.exe	123
PID 1240 wrote to memory of 1192	1240	wuomjecwuo.exe	125
PID 4120 wrote to memory of 4196	4120	hczusmjhczxrpmke.exe	128
PID 4120 wrote to memory of 5484	4120	hczusmjhczxrpmke.exe	132
PID 4668 wrote to memory of 364	4668	jhbztromge.exe	134
PID 4120 wrote to memory of 3424	4120	hczusmjhczxrpmke.exe	137
PID 4120 wrote to memory of 2712	4120	hczusmjhczxrpmke.exe	142
PID 944 wrote to memory of 2344	944	ywqolgeywq.exe	144
PID 4120 wrote to memory of 1136	4120	hczusmjhczxrpmke.exe	147
PID 2376 wrote to memory of 3332	2376	msedge.exe	149
PID 2376 wrote to memory of 6132	2376	msedge.exe	150
PID 2376 wrote to memory of 4984	2376	msedge.exe	151
PID 4120 wrote to memory of 1140	4120	hczusmjhczxrpmke.exe	154
PID 4328 wrote to memory of 1100	4328	tqljdbvqoi.exe	156
PID 4120 wrote to memory of 2820	4120	hczusmjhczxrpmke.exe	159
PID 4120 wrote to memory of 1380	4120	hczusmjhczxrpmke.exe	163
PID 2400 wrote to memory of 808	2400	dxvtnlfays.exe	165
PID 4120 wrote to memory of 2644	4120	hczusmjhczxrpmke.exe	168
PID 4120 wrote to memory of 5836	4120	hczusmjhczxrpmke.exe	172
PID 5808 wrote to memory of 2576	5808	faysqkicau.exe	174
PID 4120 wrote to memory of 5984	4120	hczusmjhczxrpmke.exe	177
PID 4120 wrote to memory of 2984	4120	hczusmjhczxrpmke.exe	181
PID 1144 wrote to memory of 3708	1144	kfcxvpnhfz.exe	183
PID 4120 wrote to memory of 3204	4120	hczusmjhczxrpmke.exe	186
PID 2376 wrote to memory of 240	2376	msedge.exe	188
PID 2376 wrote to memory of 240	2376	msedge.exe	188
PID 4120 wrote to memory of 5992	4120	hczusmjhczxrpmke.exe	194
PID 4400 wrote to memory of 5884	4400	hcausmkezx.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-06_63d6d100447ee8f66686c0cc19494831_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6028
- C:\Temp\hczusmjhczxrpmke.exe
  C:\Temp\hczusmjhczxrpmke.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\smhecxuomh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4088
  - - C:\Temp\smhecxuomh.exe
      C:\Temp\smhecxuomh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4748
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4556
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_smhecxuomh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:488
  - - C:\Temp\i_smhecxuomh.exe
      C:\Temp\i_smhecxuomh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4152
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wuomjecwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4680
  - - C:\Temp\wuomjecwuo.exe
      C:\Temp\wuomjecwuo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1240
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1192
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4580
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wuomjecwuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4196
  - - C:\Temp\i_wuomjecwuo.exe
      C:\Temp\i_wuomjecwuo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3048
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhbztromge.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5484
  - - C:\Temp\jhbztromge.exe
      C:\Temp\jhbztromge.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4668
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:364
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5948
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhbztromge.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3424
  - - C:\Temp\i_jhbztromge.exe
      C:\Temp\i_jhbztromge.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywqolgeywq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2712
  - - C:\Temp\ywqolgeywq.exe
      C:\Temp\ywqolgeywq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:944
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2344
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1852
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywqolgeywq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1136
  - - C:\Temp\i_ywqolgeywq.exe
      C:\Temp\i_ywqolgeywq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqljdbvqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1140
  - - C:\Temp\tqljdbvqoi.exe
      C:\Temp\tqljdbvqoi.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4328
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1100
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3048
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqljdbvqoi.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2820
  - - C:\Temp\i_tqljdbvqoi.exe
      C:\Temp\i_tqljdbvqoi.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4848
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dxvtnlfays.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1380
  - - C:\Temp\dxvtnlfays.exe
      C:\Temp\dxvtnlfays.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2400
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:808
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1832
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dxvtnlfays.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2644
  - - C:\Temp\i_dxvtnlfays.exe
      C:\Temp\i_dxvtnlfays.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4180
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\faysqkicau.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5836
  - - C:\Temp\faysqkicau.exe
      C:\Temp\faysqkicau.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5808
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2576
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1236
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_faysqkicau.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5984
  - - C:\Temp\i_faysqkicau.exe
      C:\Temp\i_faysqkicau.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6080
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kfcxvpnhfz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2984
  - - C:\Temp\kfcxvpnhfz.exe
      C:\Temp\kfcxvpnhfz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1144
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3708
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1000
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kfcxvpnhfz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3204
  - - C:\Temp\i_kfcxvpnhfz.exe
      C:\Temp\i_kfcxvpnhfz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hcausmkezx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5992
  - - C:\Temp\hcausmkezx.exe
      C:\Temp\hcausmkezx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4400
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5884
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2520
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hcausmkezx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:468
  - - C:\Temp\i_hcausmkezx.exe
      C:\Temp\i_hcausmkezx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1132
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpjhbztrmj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1860
  - - C:\Temp\rpjhbztrmj.exe
      C:\Temp\rpjhbztrmj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6092
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4364
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1000
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpjhbztrmj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4940
  - - C:\Temp\i_rpjhbztrmj.exe
      C:\Temp\i_rpjhbztrmj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3268
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jebwuojhbz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4188
  - - C:\Temp\jebwuojhbz.exe
      C:\Temp\jebwuojhbz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5848
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:912
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4920
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jebwuojhbz.exe ups_ins
    3⤵
    PID:3392
  - - C:\Temp\i_jebwuojhbz.exe
      C:\Temp\i_jebwuojhbz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2520
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljebwtomge.exe ups_run
    3⤵
    PID:3832
  - - C:\Temp\ljebwtomge.exe
      C:\Temp\ljebwtomge.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1232
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1236
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljebwtomge.exe ups_ins
    3⤵
    PID:3880
  - - C:\Temp\i_ljebwtomge.exe
      C:\Temp\i_ljebwtomge.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gayvtolgdy.exe ups_run
    3⤵
    PID:5752
  - - C:\Temp\gayvtolgdy.exe
      C:\Temp\gayvtolgdy.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1404
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1156
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6056
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gayvtolgdy.exe ups_ins
    3⤵
    PID:2772
  - - C:\Temp\i_gayvtolgdy.exe
      C:\Temp\i_gayvtolgdy.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4464
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnlfdbvqn.exe ups_run
    3⤵
    PID:2120
  - - C:\Temp\vtnlfdbvqn.exe
      C:\Temp\vtnlfdbvqn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5852
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5660
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4932
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnlfdbvqn.exe ups_ins
    3⤵
    PID:4740
  - - C:\Temp\i_vtnlfdbvqn.exe
      C:\Temp\i_vtnlfdbvqn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aysqdavsnl.exe ups_run
    3⤵
    PID:1456
  - - C:\Temp\aysqdavsnl.exe
      C:\Temp\aysqdavsnl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3752
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1316
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2468
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aysqdavsnl.exe ups_ins
    3⤵
    PID:3268
  - - C:\Temp\i_aysqdavsnl.exe
      C:\Temp\i_aysqdavsnl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1988
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvpnhfdxvq.exe ups_run
    3⤵
    PID:4764
  - - C:\Temp\xvpnhfdxvq.exe
      C:\Temp\xvpnhfdxvq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4172
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4996
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvpnhfdxvq.exe ups_ins
    3⤵
    PID:4712
  - - C:\Temp\i_xvpnhfdxvq.exe
      C:\Temp\i_xvpnhfdxvq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1132
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pkhcausmke.exe ups_run
    3⤵
    PID:2932
  - - C:\Temp\pkhcausmke.exe
      C:\Temp\pkhcausmke.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:832
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5492
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2916
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pkhcausmke.exe ups_ins
    3⤵
    PID:5792
  - - C:\Temp\i_pkhcausmke.exe
      C:\Temp\i_pkhcausmke.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2920
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhbzurpjhb.exe ups_run
    3⤵
    PID:2516
  - - C:\Temp\jhbzurpjhb.exe
      C:\Temp\jhbzurpjhb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4600
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4192
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4772
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhbzurpjhb.exe ups_ins
    3⤵
    PID:3192
  - - C:\Temp\i_jhbzurpjhb.exe
      C:\Temp\i_jhbzurpjhb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1528
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhezwurmcw.exe ups_run
    3⤵
    PID:5712
  - - C:\Temp\jhezwurmcw.exe
      C:\Temp\jhezwurmcw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3704
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4512
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhezwurmcw.exe ups_ins
    3⤵
    PID:4964
  - - C:\Temp\i_jhezwurmcw.exe
      C:\Temp\i_jhezwurmcw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1488
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omjebwuomg.exe ups_run
    3⤵
    PID:2980
  - - C:\Temp\omjebwuomg.exe
      C:\Temp\omjebwuomg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4828
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1856
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3412
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7fff3a2ec188,0x7fff3a2ec194,0x7fff3a2ec1a0
      4⤵
      PID:1724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,7838338118034043389,4262592569091795056,524288 --field-trial-handle=2328,i,7790335860418353081,17734907707392791904,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:11
      4⤵
      System Time Discovery
      PID:4864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,8731978790807498130,14178938077733640905,262144 --field-trial-handle=2328,i,7790335860418353081,17734907707392791904,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
      4⤵
      PID:5932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,1391308201591842070,18193183810791216383,524288 --field-trial-handle=2328,i,7790335860418353081,17734907707392791904,262144 --variations-seed-version --mojo-platform-channel-handle=2952 /prefetch:13
      4⤵
      PID:4412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3624,i,12805084235878819720,14806121671182496218,2097152 --field-trial-handle=2328,i,7790335860418353081,17734907707392791904,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
      4⤵
      PID:2484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3628,i,10702173064213599356,14148993402874095917,2097152 --field-trial-handle=2328,i,7790335860418353081,17734907707392791904,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
      4⤵
      PID:5056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,10327141956396049373,9382020333758389379,2097152 --field-trial-handle=2328,i,7790335860418353081,17734907707392791904,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:1
      4⤵
      PID:4504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4328,i,12290962876875531876,10964753834490660781,2097152 --field-trial-handle=2328,i,7790335860418353081,17734907707392791904,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:9
      4⤵
      PID:1404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,12595803436023453940,10641828103885175667,524288 --field-trial-handle=2328,i,7790335860418353081,17734907707392791904,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
      4⤵
      PID:912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,13778531355873651674,6666548872234484982,524288 --field-trial-handle=2328,i,7790335860418353081,17734907707392791904,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
      4⤵
      PID:4604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,8619393035646930142,3616856365018620136,524288 --field-trial-handle=2328,i,7790335860418353081,17734907707392791904,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
      4⤵
      PID:564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,1290821864341944147,9950172275654904090,524288 --field-trial-handle=2328,i,7790335860418353081,17734907707392791904,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
      4⤵
      PID:3412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,1290821864341944147,9950172275654904090,524288 --field-trial-handle=2328,i,7790335860418353081,17734907707392791904,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
      4⤵
      PID:4428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,11433727847576047449,9040223787995960467,524288 --field-trial-handle=2328,i,7790335860418353081,17734907707392791904,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
      4⤵
      PID:5808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,2147899176747558214,13379728669951833191,524288 --field-trial-handle=2328,i,7790335860418353081,17734907707392791904,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:14
      4⤵
      PID:4536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4384,i,12604898808956395325,6935799052418488580,524288 --field-trial-handle=2328,i,7790335860418353081,17734907707392791904,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:14
      4⤵
      PID:3332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,16197440437818958923,9347293265334007741,524288 --field-trial-handle=2328,i,7790335860418353081,17734907707392791904,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
      4⤵
      PID:6132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,8342117970081200439,10795192969639229731,524288 --field-trial-handle=2328,i,7790335860418353081,17734907707392791904,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:14
      4⤵
      PID:4984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,7916601190874420622,6821295781498954607,524288 --field-trial-handle=2328,i,7790335860418353081,17734907707392791904,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:14
      4⤵
      PID:240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,1005278807089469822,9667165056101569469,524288 --field-trial-handle=2328,i,7790335860418353081,17734907707392791904,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:14
      4⤵
      PID:5888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,17174145109398271191,9190161543326835087,524288 --field-trial-handle=2328,i,7790335860418353081,17734907707392791904,262144 --variations-seed-version --mojo-platform-channel-handle=924 /prefetch:14
      4⤵
      PID:3472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,5249278422804854767,13977743602945167615,524288 --field-trial-handle=2328,i,7790335860418353081,17734907707392791904,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:14
      4⤵
      PID:4248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6256,i,2108646156316406018,11894359446678107076,262144 --field-trial-handle=2328,i,7790335860418353081,17734907707392791904,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:10
      4⤵
      PID:1264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,14664003566332619614,7141094442707527620,524288 --field-trial-handle=2328,i,7790335860418353081,17734907707392791904,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:14
      4⤵
      PID:4756

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5188

C:\Temp\hczusmjhczxrpmke.sys
C:\Temp\hczusmjhczxrpmke.sys
1⤵
- Executes dropped EXE
PID:4252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4648

C:\Temp\bzurmjhbzu.sys
C:\Temp\bzurmjhbzu.sys
1⤵
- Executes dropped EXE
PID:6000

C:\Temp\rojhbztrom.sys
C:\Temp\rojhbztrom.sys
1⤵
- Executes dropped EXE
PID:5736

C:\Temp\wtoljdbwtr.sys
C:\Temp\wtoljdbwtr.sys
1⤵
- Executes dropped EXE
PID:5784

C:\Temp\wqoigayvqo.sys
C:\Temp\wqoigayvqo.sys
1⤵
- Executes dropped EXE
PID:4576

C:\Temp\dyvqnlfday.sys
C:\Temp\dyvqnlfday.sys
1⤵
- Executes dropped EXE
PID:5748

C:\Temp\nlfdysqnif.sys
C:\Temp\nlfdysqnif.sys
1⤵
- Executes dropped EXE
PID:2268

C:\Temp\nhfzxspkif.sys
C:\Temp\nhfzxspkif.sys
1⤵
- Executes dropped EXE
PID:4984

C:\Temp\pkhfzxupmh.sys
C:\Temp\pkhfzxupmh.sys
1⤵
- Executes dropped EXE
PID:4188

C:\Temp\hurpjhbzur.sys
C:\Temp\hurpjhbzur.sys
1⤵
- Executes dropped EXE
PID:1232

C:\Temp\omgezwromh.sys
C:\Temp\omgezwromh.sys
1⤵
- Executes dropped EXE
PID:5008

C:\Temp\jgbzwqomge.sys
C:\Temp\jgbzwqomge.sys
1⤵
PID:1132

C:\Temp\igdbvtqoig.sys
C:\Temp\igdbvtqoig.sys
1⤵
PID:1500

C:\Temp\jgbqlidbvt.sys
C:\Temp\jgbqlidbvt.sys
1⤵
PID:4608

C:\Temp\aysqkidayv.sys
C:\Temp\aysqkidayv.sys
1⤵
PID:5160

C:\Temp\axvpnhfaxs.sys
C:\Temp\axvpnhfaxs.sys
1⤵
PID:2608

C:\Temp\pkhcaxrpnh.sys
C:\Temp\pkhcaxrpnh.sys
1⤵
PID:1748

C:\Temp\usmkecxjhc.sys
C:\Temp\usmkecxjhc.sys
1⤵
PID:4852

C:\Temp\jhczurmjec.sys
C:\Temp\jhczurmjec.sys
1⤵
PID:3472

C:\Temp\mjebztromj.sys
C:\Temp\mjebztromj.sys
1⤵
PID:4184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bzurmjhbzu.sys

Path C:\Temp\bzurmjhbzu.sys
Size 293KB
SHA256 f5c17862051158ef6907e4d444f599a3222f993344ea19a62e2cbb97587a591c
MD5 c7d5b35b3e39d678eb8fcbcd5d83641c
SHA1 6c22d3f878a9cd58a552a8cb05925dd78208e30b
SHA512 af5c038bb9a953ca1f6b3cf9b319a8d7958d31bb174717bd87ab5c8a7914a44cc1e76a0a4e2311eaa5fa9e6944eebaa2c968b0414fec8582f0f98f8bdd709775
SSDEEP 3072:6tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:6IJjiJcbI03GBc3ucY5DCSj
TLSH
T107545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxvtnlfays.exe

Path C:\Temp\dxvtnlfays.exe
Size 456KB
SHA256 31f4cd74d13f27ce556b43e6866bc83516f860a880300c57955159e6ed910356
MD5 f408f8bbc8f9a1600730521a56f533d7
SHA1 25e863007ddf1803208bede94769e65209f7a63b
SHA512 47d039f6393fb3d03d0912c2eaa97db73f35688bccb072598a47b815a4b56821a96b3fd5a0ad0350eca043fe431f92eefec10d4c1f73c26a2f1bca82c4f298f2
SSDEEP 6144:iflfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lI6:iflfAsiVGjSGecvXAflfAsim
TLSH
T16AA48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dyvqnlfday.sys

Path C:\Temp\dyvqnlfday.sys
Size 293KB
SHA256 3d50b8af3e0d914838365c881ac3436636bb276415a41e033058956d75ddf473
MD5 a3b0f9b9c0162da00552e3311647e2ab
SHA1 358a4f074c7a4d18a9b5ad62f70084bb540998a1
SHA512 09177b89462f2b494c5a3c0fdf2cfa4494dfb67ddda4320b1aa6e934bafa88b253a56565398b6bbdfccb0638ee7d3e73aefd97e70ad8b1ed729b6a750d3b80ea
SSDEEP 3072:QtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:QIJjiJcbI03GBc3ucY5DCSj
TLSH
T1DE545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hczusmjhczxrpmke.exe

Path C:\Temp\hczusmjhczxrpmke.exe
Size 456KB
SHA256 04033f1e94b00aaf8b9bf7e63916532c7f1065e72e0d641bbfeb6acad900a1cd
MD5 eb0ef151c478c79ef2b30181f85078ad
SHA1 2b4c5031ccd426f1079f50cdd632ead0726c567a
SHA512 45a1f37f2deb8b3d567e90223925f4f1f0e23058d6d3cce7e80f795ceb8d1f8d754958f9b5a8cbb0b16b9960f4902252ad58b869787f807295a235d194ed121c
SSDEEP 6144:EflfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lII:EflfAsiVGjSGecvXAflfAsi8
TLSH
T1B5A48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hczusmjhczxrpmke.sys

Path C:\Temp\hczusmjhczxrpmke.sys
Size 293KB
SHA256 242204489bcc410feed9c84172b19532feb56644b8882920a32a0128aae7aea9
MD5 006e6835ddedd3a4d78ef56700eeef9e
SHA1 47795592c73493e5e9017afdbe6e90b97f90bd4f
SHA512 054c42b67deb52a15890689df131729f081ce8af367c4dd6ab1dfcea896f7c23464c5645eabd906195d3ee196f6e7970cb9a42366990e5366f40e7fb2b20d160
SSDEEP 3072:5tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:5IJjiJcbI03GBc3ucY5DCSj
TLSH
T130545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jhbztromge.exe

Path C:\Temp\i_jhbztromge.exe
Size 456KB
SHA256 17a4e231c71058faf9a552a6e8c3304baade028aee6b62a2c563ffecc50c3f46
MD5 4633bc59d8dd5b232ae8dd092e63bee1
SHA1 a53d687194377194578212917b0acd7f2f326508
SHA512 bcd17375b6dfea7ccd403b1de4758bc06a5b46e876d249bc105ba26333517d7fb56fce8ca4ed13a4ee2489df4254d8b0724274bb84fe8fa73e788bcb68e58a8b
SSDEEP 6144:JflfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lIr:JflfAsiVGjSGecvXAflfAsiv
TLSH
T169A48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_smhecxuomh.exe

Path C:\Temp\i_smhecxuomh.exe
Size 456KB
SHA256 b2208a7fd0bc0591eec72ca07c05228b9fe19fa041f84e4dc361e31fcfea9f58
MD5 f621f50f715d15f6bcfec1fdabe96f1c
SHA1 619d363f2524aa9f3fbd9a7ba13a8006b089f811
SHA512 6aa78a9ae2e1debfabfffb526b3d1188d69a4eb44bc55f4c17c17d228b32d89dbc29cdc4946360f06e156102e0eb0752310a48d40c3f0372ec18441d585e8de2
SSDEEP 6144:LflfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lIx:LflfAsiVGjSGecvXAflfAsil
TLSH
T18DA48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tqljdbvqoi.exe

Path C:\Temp\i_tqljdbvqoi.exe
Size 456KB
SHA256 0986c5a8f6a7104c8a6e4669375746327c7876730d2306f15e09ab7103b8bbf5
MD5 5b02714cab740806cdf197c5320be560
SHA1 c229d26166a1b3d9fce7a685fc02f1d46ad090f5
SHA512 00c7d3663eee7a86dab4f6451fa97d34601726b7c21a839449535aad6f1b6162f0ee1dfbd74507681da5d1b7344e3a1d07a1a0e239ece6ce3cb375d5655670bf
SSDEEP 6144:eflfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lIm:eflfAsiVGjSGecvXAflfAsiK
TLSH
T141A48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wuomjecwuo.exe

Path C:\Temp\i_wuomjecwuo.exe
Size 456KB
SHA256 497434d22a1935124d40cc0683264b112e1ae321fc0a1e636945a547d7551303
MD5 3d4a76f0e266ba4cfc3009b201adc4bc
SHA1 11deb663107cdbc9abed182b7a2ff96b73aef39b
SHA512 1f5e7492cd36a2f92d387f6c25f3a3c16a968eeeef75dde51e87e0fcf86f807e2497921df3fede614958160b98244d0cd8855b8c8ccc93ba28155de0c5df3c51
SSDEEP 6144:RflfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lIL:RflfAsiVGjSGecvXAflfAsiH
TLSH
T15AA48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ywqolgeywq.exe

Path C:\Temp\i_ywqolgeywq.exe
Size 456KB
SHA256 1e842889dbe9002903350809b0652a59343f91c481e607d1a230e4edf73b1e48
MD5 bf818ebbb139558a67b7930c2bdb7905
SHA1 1bbe2037239109c390ae72e3e9e240f8ccefa2fa
SHA512 cda360da8bb4080e6075d18436c3265bbb1344d401574108742901192b48b0304bd162e839baee5ac0d432e9c59a9f36a7da5c1d1fabdefc39f29aa5cebb6749
SSDEEP 6144:7flfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lIh:7flfAsiVGjSGecvXAflfAsiF
TLSH
T1B9A48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbztromge.exe

Path C:\Temp\jhbztromge.exe
Size 456KB
SHA256 c252a682f7713b94cf60ad0cc80b2ae79b8a9659d281d774278b3d131d381f14
MD5 66f31317d96c8bd412b4abd2ca5cf00e
SHA1 c0d2f0626e5b7e8780e3635d1f140810c522a6d2
SHA512 0e836ed2d861c5cf972513e556e447e65251e9237094e316675c3707ce97808afa1cb76e1f7f5cd1b6c6238cf4dff334e3a44dbe8ad7161144dd7e7c43187ef6
SSDEEP 6144:+flfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lIe:+flfAsiVGjSGecvXAflfAsiK
TLSH
T135A48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rojhbztrom.sys

Path C:\Temp\rojhbztrom.sys
Size 293KB
SHA256 8d9e037b3841cc88ff4a994375a8ed977c308faefb23a9ec3c6fcc2c8c1b2286
MD5 6c6eb3cdebd490481f46017d546e94b2
SHA1 0621fa4d45d05752093719d3492e404ef439bb75
SHA512 4dacacb08896d24f9c73620fc32bc672e46dfebe95b05a3ddd409ce590390a92621f001fb8cabeb446887c7079542c4a533233f05cd1e946121a5f2d31ed17a9
SSDEEP 3072:ftKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:fIJjiJcbI03GBc3ucY5DCSj
TLSH
T107545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smhecxuomh.exe

Path C:\Temp\smhecxuomh.exe
Size 456KB
SHA256 20c412b07c9ea211d1a560581ba41a19a92afe52bddda1cb5acd41ba873acb0a
MD5 4aecebcac4c187e7690ea8cd3cb621e7
SHA1 0647b46cc37db384ad5743e6047098de3a6cb068
SHA512 8207d7efa76af0998eb75c6a30430dc834ac09197ac81bfd9b7b65a1e65fb6be9e931355046a9bc00bbbe68eb732fb97696f369daf306bce82ae11b8b675315d
SSDEEP 6144:ZflfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lIj:ZflfAsiVGjSGecvXAflfAsiv
TLSH
T17FA48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqljdbvqoi.exe

Path C:\Temp\tqljdbvqoi.exe
Size 456KB
SHA256 27f6f4a9260bea619e65e6a36ed5782cba26ddfcb19300a45b3944ae4f6c3f50
MD5 7b97dd77b37d94966d2bf9765a8633c4
SHA1 122857add9cb5aade8ebbf1434fd3c37606848f3
SHA512 1361a7eddf443783f1d5be4a45ad686bd047000561366e218f23681cac8284121630b383f8b39c79d975970717df731758a71a1256750e3d217b66d8f2c4a607
SSDEEP 6144:gflfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lIE:gflfAsiVGjSGecvXAflfAsiA
TLSH
T1A1A48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqoigayvqo.sys

Path C:\Temp\wqoigayvqo.sys
Size 293KB
SHA256 be6ba28f2038149f73014a86aaa35b9fbb088343dfcad832ce39b09b5b3186c2
MD5 e9547b08a69771696a5dc0895a230c94
SHA1 122aedffbb537184dd2802abdbd9053a006df87b
SHA512 429c78fcf6ffe9115e0e8506df3531b0340e0ff09b66ef825e95cc464938576df0cfb85366a7b81805a3f236dc169b6f032f48816377186d422fcd8e81e05cdb
SSDEEP 3072:ZtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:ZIJjiJcbI03GBc3ucY5DCSj
TLSH
T12B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtoljdbwtr.sys

Path C:\Temp\wtoljdbwtr.sys
Size 293KB
SHA256 21408eb1ef95062bd5936995ed00f21bd60aab763efdf0217faa0d09f2a1f1b5
MD5 23d00a22dd0ab94dbc4ee8cf948e88dc
SHA1 a5f5e4c6a7e9820088dca40a0be720f3bd3c043f
SHA512 222406d918484de5a5b00d51517eca17d4a7f00a9610ba56255fe68ae91e7e0153315a217b2ceece7ee2df1e1f1b69cdbbae1a5eba8dba3527bfca1f75e430ec
SSDEEP 3072:UtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:UIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E7545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomjecwuo.exe

Path C:\Temp\wuomjecwuo.exe
Size 456KB
SHA256 3dd4745470dcf10de71c23d2dc37fa91c3f5a339a7f5824e1b78d210e4a9b9b6
MD5 24443b29b788598756c31d924d962d72
SHA1 b42d442baf6fe811e66aea7caa785e2ca2ec4330
SHA512 28ef7766a00cdc166b2c50fe19658aef6026cc20df7ff61214c7db2c4f19dc1b6196c668c9aa0dc55a351db87e4f2dad4318c56585cf50577c52fb90e784aa12
SSDEEP 6144:pflfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lIz:pflfAsiVGjSGecvXAflfAsiv
TLSH
T194A48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqolgeywq.exe

Path C:\Temp\ywqolgeywq.exe
Size 456KB
SHA256 6f4be20e759b3a1d447f9d22b081e6a976971a9d64bd38f1e5ceb9287b21eec8
MD5 f053d7a148cf54cca236c1ecd6eec576
SHA1 4414cd7d9021a8e5a97975831f61bd4457166845
SHA512 84a67a95c3d87a404cecd6208bd87fa90bb5016d2c62616974afbfc87e6de29ee04fb451a27af59319032391d39521ca7163e69c51cbd73bb4bb50bd6c11c31c
SSDEEP 6144:PflfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lIF:PflfAsiVGjSGecvXAflfAsih
TLSH
T140A48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

09e4dfff-2b8a-40c4-b766-a5e25e23cfe2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\09e4dfff-2b8a-40c4-b766-a5e25e23cfe2.tmp
Size 37KB
SHA256 3bae1a5e831b43c9881ead9734c193ca347bdad4db2e16a4fb9c5f030415fc0a
MD5 b3cc90dc98c77d758485a4e1414555c6
SHA1 c15032a3c3788fe6a6687f3c4f7eb7761a8c46d3
SHA512 995d6602512aeeb01ad73445aca501409908624650728679c1efe86ee50b2cafae5033ac7d5452b1755625a86a8f733e34e29a9830bc79091349f9e314d62211
SSDEEP 768:vw/UxvxjgC+5j3QVVC8nieOIkMjFnUPO4Qp7cPAiSm2eo4w4cciGrTF5hAgZbCMc:vdZj3+5j3QPC86MjFwQpYoimeoR4ccFg
TLSH
T1AE03CF75A8A8AE77DCF39784365D6342FFF0416395C12AA4CAED2E0D42873AD430BC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1d86349d-0366-4aca-bf3b-d0dd4bd044ed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1d86349d-0366-4aca-bf3b-d0dd4bd044ed.tmp
Size 39KB
SHA256 fb4ef91641f0fe5d4ddd0777cb5aed6026d6632a355a742c7d573b17867a876f
MD5 c955f266b5128335aceb15192c7ce30d
SHA1 be80953f988838a88fc5a24aea7e6fc0ceb457dd
SHA512 b93ea540835825d8807048f932c46aa3d9db5f04370e908dd6739f0453c166370eaeec1b7e01d94c91a48f46a67e5bd86f19755ca1ca498d3fba808282dc0de2
SSDEEP 768:38/UxvxjgC+L32Ll9fSZpieOIkdotA4nUPO4Qp7cPAiSm2eo4w4cciGrTFlOMM48:3pZj3+L32h9av6F4wQpYoimeoR4ccFFq
TLSH
T15603BF74A8A8AE639CF3A348365D2383FFF01563A4C55E98CAEA5E0D014779E070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

646b4db7-2e4e-4ef7-b4a6-13b61c16ab9b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\646b4db7-2e4e-4ef7-b4a6-13b61c16ab9b.tmp
Size 34KB
SHA256 33aebeec3aa9b81dbee3560a9d041b04c2f6e916eceecfc857d7897497774730
MD5 e63c74e5344226b4a5d0d67b56e05b4b
SHA1 5338ea3e1efbaa614bab0da9ab25a7531d7f4a08
SHA512 5a3b7991782fb403321f4512e56caca4b29da620bc129f512fe2e82dab0fec54f00bf6ee904745bddb3047fbe89241fcefc61c1a2eb5607413b5586ebcc10354
SSDEEP 768:b63hl9fGvpieOIkdotAcnUPO4Qp7cPAiSm2eo4w4cciGrTFlO2sb+N:b63n9OB6FcwQpYoimeoR4ccFFo2s6N
TLSH
T165F2BFB099A8DE736CF7A289765D3742BFF01063A8C54E88D5EA5B0D41436AE070BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1fe20d96-f17b-4ca8-8d1f-57a040923496.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\1fe20d96-f17b-4ca8-8d1f-57a040923496.tmp
Size 105KB
SHA256 9ea13bef147b77cf059af0bbd32c4029231ee71a5eeb87da41465837f995c823
MD5 57517d7e9ca7c7dbf0369b56fc0b7190
SHA1 a15c2c9123a0f7f8e518a208d6f83aaea1923b00
SHA512 b584ef39e653fe4d5ada82f1439bada3ed13f5368752b2c2bfc5418788b2c6d6c615bca5636bbeb2f36bed6c3cf3f63c9dff735604a91156a020790610f0581d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7u:fwUQC5VwBIiElEd2K57P7u
TLSH
T15EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 68f353a62995fc87917d7d1eef768abe00ffab02e1d3e469100f99b6987f6488
MD5 5ba62d3fe2ddefdf87e8dd139f3e421b
SHA1 1986deda7bda2ac5b490eacb9fe2784fb6d01648
SHA512 4e6a767b24298d2e01c8dbefa41509e1bc67cf2c2f34fd0bf866fc1017e1d15a470a5a95feb8ee1cccf4b8ccf5fa9054bcbb93919c00de89eeffec199b68baf9
TLSH
T19CD02BB5DFFCCC62D54820B802518E116085B41519490040DA03FC04DD110814D03555
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 648887a89dac8888df245d8758dcd78e85ae79931c9464f19b0967fcd69c3d2f
MD5 b053e18c94ac6f6c60a9e0a281e1687b
SHA1 17ed2d8ae6844c2878132336a2fea7d044381f8b
SHA512 abf3d05979a55f573445c0c7a95529a5899c0d9f55f350b3eb35132d8502e23e6c764ffc98e92f4374754aa22e9292fd03f8e6e8113c0e919f428e797e339bfa
TLSH
T151D02BB9DFECCD62D54820B402508E116095B4156D490040D903BC04DD110814D03569
MD5 SHA1 SHA512 TLSH

Submit Download

39c1c564-898d-47f8-afc1-6b3603967baa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\39c1c564-898d-47f8-afc1-6b3603967baa.tmp
Size 11KB
SHA256 477413ee1f7ac121de84ebd90b6cdd92e5f6cbf65e02b170ddcc0a4ce8653968
MD5 2d69cf7db5cf23f152080aea6cd07f9f
SHA1 6f5ab9549605ef028f9686fbf24bcad05bd5bbe4
SHA512 6b6d10c78925be699f15c11e1390375c473a40f974ac06b8909ebdc97c0b59e595b7e027b66b04ac6d7d148e325670acbc22a0aacd4a835958d7fb9e8a7217a3
SSDEEP 192:sxRiR6CN/feBs0azkZfzoA8p92/g6+WNCcg/YcqXtiTmGyIgD0gJ:sxRifN/feBsla24/52/K9iT0F
TLSH
T17442C755AD28A97B9CCBE21DFB657F53D6F82032A0D51F48A6FC8A1C04E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

48c46e53-eef0-4df1-9ebf-dde244b581ec.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\48c46e53-eef0-4df1-9ebf-dde244b581ec.tmp
Size 29KB
SHA256 9fe7f33c98ae48513397a2c1c3a1434d1bb852c724fc2e9b41cb152e3d2a1148
MD5 9702e635e000fe6a32adeb3b4a33ab82
SHA1 4051236cd5f8a94155b2d3c4194e1ca49bf73a19
SHA512 8c0608fe457ed9e6701050e9a6815bb5bb709f144fce7f888dafb7ae78d1f0dba2e7f896b84d952aaaf8d40a8e8649d41d3f0eec72eca03603d2814d433a4102
SSDEEP 768:DFakr4yG7pLuLbs5Wg1Bf9t8F1+UoAYDCx9Tuqh0VfUC9xbog/OVxVJ97gLroMTT:DFakr4ymEbs5Wg1Bf9tu1jaWVJxg4M5B
TLSH
T1A8D2EB7B744CCB7F4F804A9DDC197E8B6DA802CB9598C98047FE981D03C67EA521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

82b649a9-a859-43ef-b737-525b62b9aa85.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\82b649a9-a859-43ef-b737-525b62b9aa85.tmp
Size 11KB
SHA256 6106ecdcfab451ee9630db9a60e284c21b5fc66c8a979767f21a46c51806d43c
MD5 e6b93cb3b7ea418dcd08021de05f93fd
SHA1 d4c38f744744a4f240f72c542b791f595ce42690
SHA512 a767c80287f4b7ae1e728cee36e4d64a3721b9c8f9059446693afe51bd90377fea07a83825893e276010b8c4753f552e454d1b0ebae33d57aaddae9dcef7a669
SSDEEP 192:sxRiR6CN/feBs0ajkZfzoA8p92/g6+WNCcg/YceXtiTmGyIgDOgJ:sxRifN/feBs9a24/52/+9iT0j
TLSH
T1EE42C855AD28A97F8CCBE21DBB657F53D6F82032A0D11E48A6FC8A1C04E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 02db5dfe4ce2731fb856b88f624d0f17f76646ddcb30278a993e449072280d76
MD5 57963a31434d50c7a6c095b5093c06dd
SHA1 8ff2797090d96e1c833900aa3668a2304a2af942
SHA512 01b545cd5235951794a91bbbbf277205ad6afb974e7aa69000388aed65b44608cb2c5e7c662bff3fc57b9be4008a1aef4c8461f383539f3d2edfee93bcdee36a
TLSH
T1DB61608D43BCA25FF7942231A8D02E8F767C69BC53A39DD207E8D4B5788A3E5817101C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 72fe87ccb34a3dcf2f9261373b1666b4fdbc3eec39ba4e0f8a5d8d045ec98a1b
MD5 b9836e3efb7445b0c264bd905bb5dc1a
SHA1 01c61fccaf4bce2976c5b5d8cf62645a9ba558f6
SHA512 4a07d11dab8b09536b08795fcad3c132c6213b86a438bf78c9895a69baa83127c989c92a62df97fb67dd4f205bc876bc064b71e4b2dc2c5f7ccaf3b985f15e63
TLSH
T194615F8D43BCA25FF7942231A8D02E8F763C69BC53A39DD207E8D4B9788A3E5817101C
MD5 SHA1 SHA512 TLSH

Submit Download

d72fa3d4-2334-478d-9475-77be7e3953ff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\d72fa3d4-2334-478d-9475-77be7e3953ff.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

4bf52bca-4536-4258-b985-466fc7eb6881.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4bf52bca-4536-4258-b985-466fc7eb6881.tmp
Size 2KB
SHA256 e62126f0c23f86953d78f9d8445f53d5c8849106bb271b7fc10b5c7519f68868
MD5 c5d43dfbad2f7e5233596bf845efb36b
SHA1 e579e80bb7eb8b15dedcaeafb3537d1f084ca2be
SHA512 5189d07b93cf4b830f0650adff104fb7a097d8d57a1eb4e1fc73d8dec485c71eff9461d4633006f261a2e95581205a6e76d752f4ab30fb2e31845d0e5c48b490
TLSH
T193519EF3C6E8866E890156F4AB147E2BCE2D0924532C3D5AC8E4DF2B93F2471D18199F
MD5 SHA1 SHA512 TLSH

Submit Download

7f23e72f-8424-43cc-ab5e-81f61d0c0551.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7f23e72f-8424-43cc-ab5e-81f61d0c0551.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

c659b794-b223-489d-97ea-a971dc452cee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c659b794-b223-489d-97ea-a971dc452cee.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e56a2e94295f99a514e2e7a5e38c36c7cddb6e2a98e43238c5a6e9fd53161083
MD5 70b58422de1ddf40cac7a575b02451c3
SHA1 dff42a7808ac0f37d04640eaf56b5db8bfc83ba4
SHA512 0e138439fbf81e9b1a9f8cd723430453f4a22f6a8ac056d8ff30e0dbc60072b6bcec71c027b5b3423decb4a12b2adcd8ae5817bcac49979cc7653bcf314e4370
SSDEEP 48:KQBIhK6kEbyF1INKGgQvyM1IRKeE0nFcLHVg:KQBCK6kKu1aKGg6716KeEMFcLHVg
TLSH
T1F1913722713B1602393E7D18B2D4B79A174571A37438EA6B7BE500928D5EF044CBC5FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a4b26d45-5ccb-4fc6-91bb-1f17fef809fb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a4b26d45-5ccb-4fc6-91bb-1f17fef809fb.tmp
Size 11KB
SHA256 768ef1ae736c101e3e59a667474415a25eef15fb651fc1bb3b884dc3ef2adad5
MD5 1a0daf561de217a0b199ee238f137ab2
SHA1 e150a073d7031bd5560a2d229ea884e3690a6880
SHA512 41e540a87b69c551fec0bea516b021c7681bccfb9861bcc06d08a5aa664129abe25bcbbfe676f195ac9f6583795b679d826ec27895bb692adc9eb101e5694a7a
SSDEEP 192:sxRFR6CN/feBsAajkZfzoA8p92/g6+WNCcg/YceXtiTmGyIgVgJ:sxRFfN/feBsZa24/52/+9iT02
TLSH
T13032B855AD28A97F8CDBE21DBB657F53D6F92032A0D11E48A6FC8A1C04E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

afdf7425-1962-422a-b2fc-988966cc38e2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\afdf7425-1962-422a-b2fc-988966cc38e2.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e390561a-3fe7-4c61-99ab-2d1dc5b47272.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e390561a-3fe7-4c61-99ab-2d1dc5b47272.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

0c86e917-e709-456e-8b25-f86b630f7434.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\0c86e917-e709-456e-8b25-f86b630f7434.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

72dfab06-9784-4873-9ea2-fd86b68e484f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\72dfab06-9784-4873-9ea2-fd86b68e484f.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

d4fdd743-fdd5-4286-9dc6-6ce95cbe1db3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\d4fdd743-fdd5-4286-9dc6-6ce95cbe1db3.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

e801927a-97b6-4dac-9b93-2dddee579495.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\e801927a-97b6-4dac-9b93-2dddee579495.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

e0de8f71-6bba-4fdd-9c84-c0f3a913d5a1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e0de8f71-6bba-4fdd-9c84-c0f3a913d5a1.tmp
Size 42KB
SHA256 90e04bd80fe52348d7a0f4565e5dbfa4c04c4ed18f713332340c67b17605629b
MD5 c1b296eff14fa1f2056e8f3a77133ad2
SHA1 b8d93a255f4f187fada88fec6bf64df1fcda4c4d
SHA512 2dbc435b6ec9c6529d0190a2ff7f26796e60e0f4cefd396c80253e152e4e11eb524a4c324326e8cf5d58e2ce25636a25aee0d7a778dad15f690643ab74652ad7
SSDEEP 768:3FQD3PwgRl9fkvruOIkdotNtnUPO4Qp7cPAiSm2eo4w4cciGrTFlO2sb+N:KD359szQtwQpYoimeoR4ccFFo2s6N
TLSH
T1881328F198E79A76E8AE5387677C6E42AEBCD053B4889984F7D51D0CCC421BFC70A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e107966d-1f4a-4e7e-9527-624981cbb0c4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e107966d-1f4a-4e7e-9527-624981cbb0c4.tmp
Size 34KB
SHA256 9ff6a79f879cba69796d68d326c2989b49393fcea61f0b3443272bd4befe8101
MD5 3200b0f319894133d4bc75c7e2176211
SHA1 60b3ea4e0dd95d314e4a44dc3f0badf8a94ffa83
SHA512 a029a161d176c5f7e1172dc58ced87795471f6420876adf31ca7508213ba268f9516e90ee80d0310beb6025f79e4228ee2e96a9fb9fb7cb6d1179bb55c4274f9
SSDEEP 768:3k63Il9fGvpieOIkdotAcnUPO4Qp7cPAiSm2eo4w4cciGrTFlO2sb+N:3k63m9OB6FcwQpYoimeoR4ccFFo2s6N
TLSH
T1F1F2CFB099A8DEB36CF7A289765D3742BFF01063A8C54E88D5EA5B0D41436AE070BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4b266a77-06cf-4f83-8f0c-f50361866360.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4b266a77-06cf-4f83-8f0c-f50361866360.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

7bd03a23-a7b4-4ed2-9348-bef93bbd2d64.tmp

Path C:\Users\Admin\AppData\Local\Temp\7bd03a23-a7b4-4ed2-9348-bef93bbd2d64.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

8bb70766-75dd-40a7-838b-80bdf5a3bcca.tmp

Path C:\Users\Admin\AppData\Local\Temp\8bb70766-75dd-40a7-838b-80bdf5a3bcca.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2376_717197830\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2376_139975507\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2376_1414373005\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2376_854298438\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2376_874140526\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 1f61e81f571d65023b0b5fba9db3ce7f9ad5c06c9d9f2f42d6036e046dc4a574
MD5 8b2c399cfa6ae1fa7fd45f42f9b01943
SHA1 c1d83c38660467f3d8f675d2c5931b5d8e96ff47
SHA512 5dce0a9cfecf0ddeb299b0976c1a53592ed6afd1d9a3e8062418d95696ef5ffe179d99bfc3c00ab20c44f8548119c294cd1899ee280b2838bf4852a3dd872f3d
TLSH
T1EE7123835AB9DAF3C1DB5BF002839648F2FF22380B2330304B565546AB34A7E18B9F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1132-397-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1232-347-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1500-419-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1748-462-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1748-484-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2268-322-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2608-456-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3472-488-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4184-506-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4188-343-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4252-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4576-285-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4608-423-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4608-445-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4852-483-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4984-327-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5008-377-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5160-458-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5160-443-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5736-245-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5748-324-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5748-298-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5784-273-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6000-196-0x0000000000010000-0x00000000000AB000-memory.dmp

Download