systex | 8bb438ab60897fcadb6947b8ce5d30e0ab9b2bbdde5dbaed5387650ff41d0e8e

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample261006-phay4seh35
SHA256 8bb438ab60897fcadb6947b8ce5d30e0ab9b2bbdde5dbaed5387650ff41d0e8e
MD5 743e19ccaffd93a7d0d073ecedfbcccf
SHA1 b4d6653c5057e4073938dbf80e8231af0eecb6d2
SHA512 e2b38d1ffb4f59d9ae19919aff8ed74b2d2313d4d81fd588b1993d8144d9c0ba91db2c4dd241905bd5deaea9291ad11f9dd039b0574628815bd9f497efca9795
SSDEEP 3072:fjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:7yLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T12A847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3479F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
692	mkecwupmhfcxupmk.exe
5028	mkecwupmhfcxupmk.sys
3040	CreateProcess.exe
2952	pmhezxrpmf.exe
1956	CreateProcess.exe
1372	CreateProcess.exe
5028	i_pmhezxrpmf.exe
2904	hbzxrpjhez.sys
2508	CreateProcess.exe
3280	ezwrmjecwu.exe
5888	CreateProcess.exe
4240	CreateProcess.exe
3672	i_ezwrmjecwu.exe
5808	jhbzwqojge.sys
3344	CreateProcess.exe
4108	heywqomgeb.exe
3208	CreateProcess.exe
4832	CreateProcess.exe
360	i_heywqomgeb.exe
4156	ebwqomywqo.sys
2412	CreateProcess.exe
4748	vtolgdbvtr.exe
4812	CreateProcess.exe
4276	CreateProcess.exe
5948	i_vtolgdbvtr.exe
5108	ytqljdbvtr.sys
6100	CreateProcess.exe
480	vtqligbyki.exe
5444	CreateProcess.exe
1708	CreateProcess.exe
1320	i_vtqligbyki.exe
2920	lidavtnlfd.sys
5020	CreateProcess.exe
976	aysqkifdxv.exe
616	CreateProcess.exe
4248	CreateProcess.exe
5708	i_aysqkifdxv.exe
4156	sqkicaxvpn.sys
468	CreateProcess.exe
3720	vsqkifdxvp.exe
2852	CreateProcess.exe
3864	CreateProcess.exe
5952	i_vsqkifdxvp.exe
4616	axsqkiusnk.sys
3832	CreateProcess.exe
5832	smhcausmke.exe
1504	CreateProcess.exe
1364	CreateProcess.exe
4564	i_smhcausmke.exe
684	smkecxusmk.sys
5916	CreateProcess.exe
612	hfzxuhecxr.exe
3024	CreateProcess.exe
1320	CreateProcess.exe
5940	i_hfzxuhecxr.exe
3664	ecwupmhecw.sys
2688	CreateProcess.exe
3224	bzurmjhbzu.exe
4236	CreateProcess.exe
4516	CreateProcess.exe
3260	i_bzurmjhbzu.exe
4488	ljhecwuomg.sys
5692	CreateProcess.exe
5452	mjhbzwuomg.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2900_266898657\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2900_363517408\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2900_289068463\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2900_605718403\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2900_605718403\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2900_605718403\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2900_363517408\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2900_289068463\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2900_605718403\office_endpoints_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eczurpjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwrmjecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtqligbyki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqkifdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxuhecxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoljdbvtqg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkicaxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrmjecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhezxrpmf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxuhecxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecxupnhx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwrmjecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtolgdbvtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoljdbvtqg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtolgdbvtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsqkifdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smhcausmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzurmjhbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjhbzwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecxupnhx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecwupmhfcxupmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqkifdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjhbzwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfaysqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eczurpjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_heywqomgeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtqligbyki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsqkifdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzurmjhbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfaysqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkicaxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrmjecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smhcausmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhezxrpmf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	heywqomgeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkigaysqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkigaysqoi.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5556	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
672	ipconfig.exe
4988	ipconfig.exe
1640	ipconfig.exe
4620	ipconfig.exe
4688	ipconfig.exe
2256	ipconfig.exe
4952	ipconfig.exe
2984	ipconfig.exe
3652	ipconfig.exe
2712	ipconfig.exe
4868	ipconfig.exe
768	ipconfig.exe
2540	ipconfig.exe
5240	ipconfig.exe
3352	ipconfig.exe
4068	ipconfig.exe
2668	ipconfig.exe
768	ipconfig.exe
4876	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{EDF79F8B-8841-4915-A7C3-FE23FAF7C0AA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
692	mkecwupmhfcxupmk.exe
692	mkecwupmhfcxupmk.exe
692	mkecwupmhfcxupmk.exe
692	mkecwupmhfcxupmk.exe
692	mkecwupmhfcxupmk.exe
692	mkecwupmhfcxupmk.exe
692	mkecwupmhfcxupmk.exe
692	mkecwupmhfcxupmk.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe
2900	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5028	i_pmhezxrpmf.exe
Token: SeDebugPrivilege	3672	i_ezwrmjecwu.exe
Token: SeDebugPrivilege	360	i_heywqomgeb.exe
Token: SeDebugPrivilege	5948	i_vtolgdbvtr.exe
Token: SeDebugPrivilege	1320	i_vtqligbyki.exe
Token: SeDebugPrivilege	5708	i_aysqkifdxv.exe
Token: SeDebugPrivilege	5952	i_vsqkifdxvp.exe
Token: SeDebugPrivilege	4564	i_smhcausmke.exe
Token: SeDebugPrivilege	5940	i_hfzxuhecxr.exe
Token: SeDebugPrivilege	3260	i_bzurmjhbzu.exe
Token: SeDebugPrivilege	4692	i_mjhbzwuomg.exe
Token: SeDebugPrivilege	5432	i_trljdbytrl.exe
Token: SeDebugPrivilege	1388	i_qoljdbvtqg.exe
Token: SeDebugPrivilege	4324	i_qkigaysqoi.exe
Token: SeDebugPrivilege	3988	i_lfaysqkica.exe
Token: SeDebugPrivilege	6128	i_spkicaxspk.exe
Token: SeDebugPrivilege	3216	i_mkecxupnhx.exe
Token: SeDebugPrivilege	3976	i_eczurpjhcz.exe
Token: SeDebugPrivilege	1676	i_bztrmjecwu.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2900	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3744 wrote to memory of 692	3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 3744 wrote to memory of 4760	3744	2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 4760 wrote to memory of 2900	4760	iexplore.exe	90
PID 2900 wrote to memory of 3000	2900	msedge.exe	91
PID 2900 wrote to memory of 4928	2900	msedge.exe	92
PID 2900 wrote to memory of 5556	2900	msedge.exe	94
PID 2900 wrote to memory of 4928	2900	msedge.exe	92
PID 2900 wrote to memory of 4928	2900	msedge.exe	92
PID 2900 wrote to memory of 3596	2900	msedge.exe	95
PID 2900 wrote to memory of 3596	2900	msedge.exe	95
PID 2900 wrote to memory of 4156	2900	msedge.exe	96
PID 2900 wrote to memory of 4156	2900	msedge.exe	96
PID 2900 wrote to memory of 4156	2900	msedge.exe	96
PID 2900 wrote to memory of 2052	2900	msedge.exe	97
PID 2900 wrote to memory of 2052	2900	msedge.exe	97
PID 2900 wrote to memory of 2052	2900	msedge.exe	97
PID 2900 wrote to memory of 4384	2900	msedge.exe	98
PID 2900 wrote to memory of 4732	2900	msedge.exe	99
PID 2900 wrote to memory of 4384	2900	msedge.exe	98
PID 2900 wrote to memory of 4384	2900	msedge.exe	98
PID 2900 wrote to memory of 4732	2900	msedge.exe	99
PID 2900 wrote to memory of 4732	2900	msedge.exe	99
PID 2900 wrote to memory of 672	2900	msedge.exe	101
PID 2900 wrote to memory of 672	2900	msedge.exe	101
PID 2900 wrote to memory of 2128	2900	msedge.exe	105
PID 2900 wrote to memory of 5932	2900	msedge.exe	104
PID 2900 wrote to memory of 2128	2900	msedge.exe	105
PID 2900 wrote to memory of 5932	2900	msedge.exe	104
PID 692 wrote to memory of 3040	692	mkecwupmhfcxupmk.exe	106
PID 2952 wrote to memory of 1956	2952	pmhezxrpmf.exe	111
PID 2900 wrote to memory of 5744	2900	msedge.exe	110
PID 2900 wrote to memory of 2740	2900	msedge.exe	116
PID 2900 wrote to memory of 2740	2900	msedge.exe	116
PID 2900 wrote to memory of 5604	2900	msedge.exe	117
PID 2900 wrote to memory of 5604	2900	msedge.exe	117
PID 692 wrote to memory of 1372	692	mkecwupmhfcxupmk.exe	119
PID 692 wrote to memory of 2508	692	mkecwupmhfcxupmk.exe	123
PID 3280 wrote to memory of 5888	3280	ezwrmjecwu.exe	125
PID 692 wrote to memory of 4240	692	mkecwupmhfcxupmk.exe	128
PID 692 wrote to memory of 3344	692	mkecwupmhfcxupmk.exe	132
PID 4108 wrote to memory of 3208	4108	heywqomgeb.exe	134
PID 692 wrote to memory of 4832	692	mkecwupmhfcxupmk.exe	137
PID 692 wrote to memory of 2412	692	mkecwupmhfcxupmk.exe	142
PID 4748 wrote to memory of 4812	4748	vtolgdbvtr.exe	144
PID 692 wrote to memory of 4276	692	mkecwupmhfcxupmk.exe	147
PID 2900 wrote to memory of 3640	2900	msedge.exe	149
PID 2900 wrote to memory of 3032	2900	msedge.exe	150
PID 2900 wrote to memory of 1364	2900	msedge.exe	151
PID 692 wrote to memory of 6100	692	mkecwupmhfcxupmk.exe	154
PID 480 wrote to memory of 5444	480	vtqligbyki.exe	156
PID 692 wrote to memory of 1708	692	mkecwupmhfcxupmk.exe	159
PID 692 wrote to memory of 5020	692	mkecwupmhfcxupmk.exe	163
PID 976 wrote to memory of 616	976	aysqkifdxv.exe	165
PID 692 wrote to memory of 4248	692	mkecwupmhfcxupmk.exe	168
PID 692 wrote to memory of 468	692	mkecwupmhfcxupmk.exe	172
PID 3720 wrote to memory of 2852	3720	vsqkifdxvp.exe	174
PID 692 wrote to memory of 3864	692	mkecwupmhfcxupmk.exe	177
PID 692 wrote to memory of 3832	692	mkecwupmhfcxupmk.exe	181
PID 5832 wrote to memory of 1504	5832	smhcausmke.exe	183
PID 692 wrote to memory of 1364	692	mkecwupmhfcxupmk.exe	186
PID 2900 wrote to memory of 1196	2900	msedge.exe	188
PID 2900 wrote to memory of 1196	2900	msedge.exe	188
PID 692 wrote to memory of 5916	692	mkecwupmhfcxupmk.exe	194
PID 612 wrote to memory of 3024	612	hfzxuhecxr.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-06_743e19ccaffd93a7d0d073ecedfbcccf_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3744
- C:\Temp\mkecwupmhfcxupmk.exe
  C:\Temp\mkecwupmhfcxupmk.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:692
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmhezxrpmf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3040
  - - C:\Temp\pmhezxrpmf.exe
      C:\Temp\pmhezxrpmf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2952
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1956
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:768
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmhezxrpmf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1372
  - - C:\Temp\i_pmhezxrpmf.exe
      C:\Temp\i_pmhezxrpmf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5028
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ezwrmjecwu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2508
  - - C:\Temp\ezwrmjecwu.exe
      C:\Temp\ezwrmjecwu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3280
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5888
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4952
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ezwrmjecwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4240
  - - C:\Temp\i_ezwrmjecwu.exe
      C:\Temp\i_ezwrmjecwu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3672
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\heywqomgeb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3344
  - - C:\Temp\heywqomgeb.exe
      C:\Temp\heywqomgeb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4108
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3208
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_heywqomgeb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4832
  - - C:\Temp\i_heywqomgeb.exe
      C:\Temp\i_heywqomgeb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:360
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtolgdbvtr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2412
  - - C:\Temp\vtolgdbvtr.exe
      C:\Temp\vtolgdbvtr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4748
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4812
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:672
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtolgdbvtr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4276
  - - C:\Temp\i_vtolgdbvtr.exe
      C:\Temp\i_vtolgdbvtr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5948
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtqligbyki.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6100
  - - C:\Temp\vtqligbyki.exe
      C:\Temp\vtqligbyki.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:480
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5444
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4988
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtqligbyki.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1708
  - - C:\Temp\i_vtqligbyki.exe
      C:\Temp\i_vtqligbyki.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1320
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aysqkifdxv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5020
  - - C:\Temp\aysqkifdxv.exe
      C:\Temp\aysqkifdxv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:976
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:616
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1640
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aysqkifdxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4248
  - - C:\Temp\i_aysqkifdxv.exe
      C:\Temp\i_aysqkifdxv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vsqkifdxvp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:468
  - - C:\Temp\vsqkifdxvp.exe
      C:\Temp\vsqkifdxvp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3720
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2852
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4068
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vsqkifdxvp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3864
  - - C:\Temp\i_vsqkifdxvp.exe
      C:\Temp\i_vsqkifdxvp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5952
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\smhcausmke.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3832
  - - C:\Temp\smhcausmke.exe
      C:\Temp\smhcausmke.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5832
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1504
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4620
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_smhcausmke.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1364
  - - C:\Temp\i_smhcausmke.exe
      C:\Temp\i_smhcausmke.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfzxuhecxr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5916
  - - C:\Temp\hfzxuhecxr.exe
      C:\Temp\hfzxuhecxr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:612
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3024
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4688
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfzxuhecxr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1320
  - - C:\Temp\i_hfzxuhecxr.exe
      C:\Temp\i_hfzxuhecxr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5940
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bzurmjhbzu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2688
  - - C:\Temp\bzurmjhbzu.exe
      C:\Temp\bzurmjhbzu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3224
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4236
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bzurmjhbzu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4516
  - - C:\Temp\i_bzurmjhbzu.exe
      C:\Temp\i_bzurmjhbzu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mjhbzwuomg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5692
  - - C:\Temp\mjhbzwuomg.exe
      C:\Temp\mjhbzwuomg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5452
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3940
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3652
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mjhbzwuomg.exe ups_ins
    3⤵
    PID:2828
  - - C:\Temp\i_mjhbzwuomg.exe
      C:\Temp\i_mjhbzwuomg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4692
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trljdbytrl.exe ups_run
    3⤵
    PID:3132
  - - C:\Temp\trljdbytrl.exe
      C:\Temp\trljdbytrl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2348
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:564
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trljdbytrl.exe ups_ins
    3⤵
    PID:5792
  - - C:\Temp\i_trljdbytrl.exe
      C:\Temp\i_trljdbytrl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5432
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoljdbvtqg.exe ups_run
    3⤵
    PID:5940
  - - C:\Temp\qoljdbvtqg.exe
      C:\Temp\qoljdbvtqg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2840
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1712
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:768
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoljdbvtqg.exe ups_ins
    3⤵
    PID:1608
  - - C:\Temp\i_qoljdbvtqg.exe
      C:\Temp\i_qoljdbvtqg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1388
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qkigaysqoi.exe ups_run
    3⤵
    PID:3388
  - - C:\Temp\qkigaysqoi.exe
      C:\Temp\qkigaysqoi.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6028
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5428
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qkigaysqoi.exe ups_ins
    3⤵
    PID:4932
  - - C:\Temp\i_qkigaysqoi.exe
      C:\Temp\i_qkigaysqoi.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4324
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lfaysqkica.exe ups_run
    3⤵
    PID:1248
  - - C:\Temp\lfaysqkica.exe
      C:\Temp\lfaysqkica.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4004
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3192
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lfaysqkica.exe ups_ins
    3⤵
    PID:3844
  - - C:\Temp\i_lfaysqkica.exe
      C:\Temp\i_lfaysqkica.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3988
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spkicaxspk.exe ups_run
    3⤵
    PID:2056
  - - C:\Temp\spkicaxspk.exe
      C:\Temp\spkicaxspk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4564
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1612
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2712
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spkicaxspk.exe ups_ins
    3⤵
    PID:5472
  - - C:\Temp\i_spkicaxspk.exe
      C:\Temp\i_spkicaxspk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6128
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkecxupnhx.exe ups_run
    3⤵
    PID:5296
  - - C:\Temp\mkecxupnhx.exe
      C:\Temp\mkecxupnhx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:256
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5308
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkecxupnhx.exe ups_ins
    3⤵
    PID:1468
  - - C:\Temp\i_mkecxupnhx.exe
      C:\Temp\i_mkecxupnhx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3216
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eczurpjhcz.exe ups_run
    3⤵
    PID:2420
  - - C:\Temp\eczurpjhcz.exe
      C:\Temp\eczurpjhcz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5804
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3884
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4868
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eczurpjhcz.exe ups_ins
    3⤵
    PID:4780
  - - C:\Temp\i_eczurpjhcz.exe
      C:\Temp\i_eczurpjhcz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3976
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bztrmjecwu.exe ups_run
    3⤵
    PID:3352
  - - C:\Temp\bztrmjecwu.exe
      C:\Temp\bztrmjecwu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2864
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3956
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4876
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bztrmjecwu.exe ups_ins
    3⤵
    PID:4328
  - - C:\Temp\i_bztrmjecwu.exe
      C:\Temp\i_bztrmjecwu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1676
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x320,0x7ffd2699c188,0x7ffd2699c194,0x7ffd2699c1a0
      4⤵
      PID:3000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,14897374079594250898,7996337323971352840,262144 --field-trial-handle=2280,i,8471045967813127401,7065487986256185727,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
      4⤵
      PID:4928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,17330641294164348064,11134061364831859834,524288 --field-trial-handle=2280,i,8471045967813127401,7065487986256185727,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:11
      4⤵
      System Time Discovery
      PID:5556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,6519186937756011811,1870704467549799317,524288 --field-trial-handle=2280,i,8471045967813127401,7065487986256185727,262144 --variations-seed-version --mojo-platform-channel-handle=3012 /prefetch:13
      4⤵
      PID:3596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,3033652038354612745,2498220298741421534,2097152 --field-trial-handle=2280,i,8471045967813127401,7065487986256185727,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
      4⤵
      PID:4156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,12431231640175925704,6867663299128030601,2097152 --field-trial-handle=2280,i,8471045967813127401,7065487986256185727,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
      4⤵
      PID:2052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,1803234941888023375,9507588926185432820,2097152 --field-trial-handle=2280,i,8471045967813127401,7065487986256185727,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:1
      4⤵
      PID:4384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,2433789721400829115,9843146280186265441,2097152 --field-trial-handle=2280,i,8471045967813127401,7065487986256185727,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:9
      4⤵
      PID:4732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,14668855473269619864,9236653209033242914,524288 --field-trial-handle=2280,i,8471045967813127401,7065487986256185727,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
      4⤵
      PID:672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,6024888652327689156,11212689303616371871,524288 --field-trial-handle=2280,i,8471045967813127401,7065487986256185727,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
      4⤵
      PID:5932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,12239483655348763841,15221362230862627102,524288 --field-trial-handle=2280,i,8471045967813127401,7065487986256185727,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
      4⤵
      PID:2128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,10688488354041298819,6861194497666063022,524288 --field-trial-handle=2280,i,8471045967813127401,7065487986256185727,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
      4⤵
      PID:5208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,10688488354041298819,6861194497666063022,524288 --field-trial-handle=2280,i,8471045967813127401,7065487986256185727,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
      4⤵
      PID:5744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,6680253815967890496,14455578283875200067,524288 --field-trial-handle=2280,i,8471045967813127401,7065487986256185727,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
      4⤵
      PID:2740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,4253493247110025249,16196416993609948931,524288 --field-trial-handle=2280,i,8471045967813127401,7065487986256185727,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:14
      4⤵
      PID:5604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,16058211297840881176,828177396072944993,524288 --field-trial-handle=2280,i,8471045967813127401,7065487986256185727,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:14
      4⤵
      PID:3640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,16626284838334822822,5399473491431016877,524288 --field-trial-handle=2280,i,8471045967813127401,7065487986256185727,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:14
      4⤵
      PID:3032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,2330443722935278653,16338681833677838191,524288 --field-trial-handle=2280,i,8471045967813127401,7065487986256185727,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:14
      4⤵
      PID:1364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3040,i,11983362980429239039,9059485803778344252,524288 --field-trial-handle=2280,i,8471045967813127401,7065487986256185727,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:14
      4⤵
      PID:1196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,14776690544891816970,16521535365852227250,524288 --field-trial-handle=2280,i,8471045967813127401,7065487986256185727,262144 --variations-seed-version --mojo-platform-channel-handle=3336 /prefetch:14
      4⤵
      PID:6028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=948,i,10259597408098388941,6014179354104276971,524288 --field-trial-handle=2280,i,8471045967813127401,7065487986256185727,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
      4⤵
      PID:2328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,14888960298004273210,270313724768694470,524288 --field-trial-handle=2280,i,8471045967813127401,7065487986256185727,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
      4⤵
      PID:2160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6772,i,18299302033145688263,18300315453537960569,262144 --field-trial-handle=2280,i,8471045967813127401,7065487986256185727,262144 --variations-seed-version --mojo-platform-channel-handle=948 /prefetch:10
      4⤵
      PID:1252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,10026704865876852917,17590402425821069777,524288 --field-trial-handle=2280,i,8471045967813127401,7065487986256185727,262144 --variations-seed-version --mojo-platform-channel-handle=1192 /prefetch:14
      4⤵
      PID:5612

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1768

C:\Temp\mkecwupmhfcxupmk.sys
C:\Temp\mkecwupmhfcxupmk.sys
1⤵
- Executes dropped EXE
PID:5028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2424

C:\Temp\hbzxrpjhez.sys
C:\Temp\hbzxrpjhez.sys
1⤵
- Executes dropped EXE
PID:2904

C:\Temp\jhbzwqojge.sys
C:\Temp\jhbzwqojge.sys
1⤵
- Executes dropped EXE
PID:5808

C:\Temp\ebwqomywqo.sys
C:\Temp\ebwqomywqo.sys
1⤵
- Executes dropped EXE
PID:4156

C:\Temp\ytqljdbvtr.sys
C:\Temp\ytqljdbvtr.sys
1⤵
- Executes dropped EXE
PID:5108

C:\Temp\lidavtnlfd.sys
C:\Temp\lidavtnlfd.sys
1⤵
- Executes dropped EXE
PID:2920

C:\Temp\sqkicaxvpn.sys
C:\Temp\sqkicaxvpn.sys
1⤵
- Executes dropped EXE
PID:4156

C:\Temp\axsqkiusnk.sys
C:\Temp\axsqkiusnk.sys
1⤵
- Executes dropped EXE
PID:4616

C:\Temp\smkecxusmk.sys
C:\Temp\smkecxusmk.sys
1⤵
- Executes dropped EXE
PID:684

C:\Temp\ecwupmhecw.sys
C:\Temp\ecwupmhecw.sys
1⤵
- Executes dropped EXE
PID:3664

C:\Temp\ljhecwuomg.sys
C:\Temp\ljhecwuomg.sys
1⤵
- Executes dropped EXE
PID:4488

C:\Temp\bztrljebom.sys
C:\Temp\bztrljebom.sys
1⤵
PID:3080

C:\Temp\ytoljdbvtn.sys
C:\Temp\ytoljdbvtn.sys
1⤵
PID:1432

C:\Temp\oigaysqoig.sys
C:\Temp\oigaysqoig.sys
1⤵
PID:2540

C:\Temp\lfdxvqnifd.sys
C:\Temp\lfdxvqnifd.sys
1⤵
PID:3736

C:\Temp\causnkfcav.sys
C:\Temp\causnkfcav.sys
1⤵
PID:5644

C:\Temp\vpnkfcxvpn.sys
C:\Temp\vpnkfcxvpn.sys
1⤵
PID:5088

C:\Temp\fcxupmjhfz.sys
C:\Temp\fcxupmjhfz.sys
1⤵
PID:3260

C:\Temp\ebwuomgezw.sys
C:\Temp\ebwuomgezw.sys
1⤵
PID:5772

C:\Temp\jhecwuromg.sys
C:\Temp\jhecwuromg.sys
1⤵
PID:3336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aysqkifdxv.exe

Path C:\Temp\aysqkifdxv.exe
Size 376KB
SHA256 212a150f9e58ff19b27d8ec433c3116d8b985228175e9a4d7ff5f3ef8f54cf1d
MD5 578f1ab2b413fe33b614641228659adc
SHA1 d53774dcff90c659fec8c5a5c92875f1b08cef93
SHA512 7c830e68fea1d6722670259b944398a390974cf84870e1d77065fe2ab4b165d5f697b9689c8082b4a6064fec9cc3e7d02db71df6c1b84db7d9da57f6e4831e66
SSDEEP 3072:SjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:syLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T172847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebwqomywqo.sys

Path C:\Temp\ebwqomywqo.sys
Size 293KB
SHA256 83a832b8931c3635bf410ed549b6a1d42f2b667d0c184bfa0a872b1e8a3f93d8
MD5 0542cb434441242b15694f3562d47fd0
SHA1 468dcf80c77cad1ee6018894ef0d158ad48d6d78
SHA512 b9a79d1bc78766ba8b0f0e4b2690449abedbbb91330a3c820c98509e05311ccd3adf9df4888e85a60d255ecfe443c1cd9c123b4723175e961e445785beef6e96
SSDEEP 3072:stKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:sIJjiJcbI03GBc3ucY5DCSj
TLSH
T10B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ezwrmjecwu.exe

Path C:\Temp\ezwrmjecwu.exe
Size 376KB
SHA256 3d7e0346ec1dd21a1ff569e457c91a635f10457d224bea221d6d164943b87d0c
MD5 35392da81557866f42775d7a16bc2195
SHA1 c371535f58d0ef42164269a9b11cb8e3d50ce429
SHA512 fde66b6a798d81a694bb652cf625b386324a96963c958e9857b721a422d30ee8512e274f64de8fbaabfb57c978ce56f33ab23f70c41cbccc86f02adb62d79391
SSDEEP 3072:KjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:kyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T10D847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbzxrpjhez.sys

Path C:\Temp\hbzxrpjhez.sys
Size 293KB
SHA256 e7685d0ad0fe1becbd4b70f3312d577442c1c1c35a5bf8d54e096bf2197be4c2
MD5 6b8fb6abb4a3daeaf6c005aec64ea817
SHA1 a5f889988d2a38507e510d1627d25f03615a6d12
SHA512 0205079e8db0cdb32143c7fc1871670011045b3d8e9e85db8f69e06c0c67202c50e1990084c09a71597f4edb0ae3660a1dffe17664dbf0328cd61004ef2bbdff
SSDEEP 3072:4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:4IJjiJcbI03GBc3ucY5DCSj
TLSH
T17E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

heywqomgeb.exe

Path C:\Temp\heywqomgeb.exe
Size 376KB
SHA256 113612956daa7906a33a8430dbf2098066528badad8bd7d95d5f42e52e44e69e
MD5 1bc1dc6df503f81e0b1b289420903eca
SHA1 dd3dfa3ac730042f9e5f9782ff6f6a91ef2e1c69
SHA512 132493df8d7dc712befc6bbcc5611f8e3c667c939a10010609e6b2e73c4f4d4272fe296ddb722940ef8163a7be2c4336d711360b3bc55c87342780da853dc480
SSDEEP 3072:+jyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:QyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T199847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ezwrmjecwu.exe

Path C:\Temp\i_ezwrmjecwu.exe
Size 376KB
SHA256 826c41a953f5065999b077e118168764bf0a684b9c183e9cb315b5ba26044382
MD5 6693f72cfb7d85413354c09740429567
SHA1 2da1cb62d333fd7ca7c0217724f1d0f42d208888
SHA512 fd759b087cd5b1a18a15ae64aa81d1397b048b4950d7af42eab8d5e1c7576c1914909fc4be506acabc5fce3e9479857efb62e834fb2055fed8f9a3cd4cb20f3e
SSDEEP 3072:mjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:4yLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T143847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_heywqomgeb.exe

Path C:\Temp\i_heywqomgeb.exe
Size 376KB
SHA256 d5ed416bea978321238160e9e092a1d9456c321a1c5eb4a8aa3a6ecea258f913
MD5 a2dc41fb71ce6647af00a7fe6318f11c
SHA1 a368074bc24d6a605806613485432bc6e53a7778
SHA512 ddb34ec31f95e7df46f5ce5ab2993c1f323c8de80af49de3ac7cd827b8f9214d1965ef43f3762fce1a7e888b4603596178b267e4a4bfc6d7036098abaf451941
SSDEEP 3072:tjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:lyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T164847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pmhezxrpmf.exe

Path C:\Temp\i_pmhezxrpmf.exe
Size 376KB
SHA256 701ca76c5f2c20483783bfa2cbb73e16e7a5ce256be7dea586702b0cda23edea
MD5 25bce4b6305ba57913feeb25d5cc6670
SHA1 0d2a39aa5ac48279e2044ee14e86f33c2ead05b0
SHA512 c67dc1c200d7d150b845fce1bebd1d85434667c31e854f7c1a4bf74f9d14ca82f1d718d2acec48c3e024684495f08711d0cab9da44e419c297a3ba5a69cdb99d
SSDEEP 3072:fjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:7yLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T189847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtolgdbvtr.exe

Path C:\Temp\i_vtolgdbvtr.exe
Size 376KB
SHA256 34e31420127b30c99974f8cfaaf2ea816d725309718ab9e974f0e68cc473cc87
MD5 f68d77cb8f8c962027133f1fb478fd26
SHA1 0b24c5e8719a29d8b553cb1d4a687b8a410f58dd
SHA512 4375fdf833f35780b2207ab2d726cbd61adec128b4a9cf2deb52b148f2b3a0dbb6b045f718d0bcd3a3816108d21b7f7f9bd0155bec4df69f622faea409325986
SSDEEP 3072:ojyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:2yLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T105847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtqligbyki.exe

Path C:\Temp\i_vtqligbyki.exe
Size 376KB
SHA256 9463725aa4f6c34ab44ad9f597819293664d32a20779d0716f52ad0e9d5f73e6
MD5 4bb708c5918765fb0b1efe9986b4ab25
SHA1 09279b60b7b4f48f69a76f3b867cf04b95b5281d
SHA512 e859af1ba496c1cb45a60846226ca18a4d58b83635d0d8b72ccf4a1d303df5eec204bc0c200e6240390db57d1f21074177209237f3499ebd676ed6a43a964857
SSDEEP 3072:djyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:1yLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T184847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbzwqojge.sys

Path C:\Temp\jhbzwqojge.sys
Size 293KB
SHA256 3e557c61e12a25bbe663982e7bfead9f4b218dff16a471fe5511cbf1d98fc944
MD5 011f7ca1e15ca19037bb279e0a6daf60
SHA1 4ad71bebb6be086fe8866f65979220eaf3bbf2b8
SHA512 72139a52e64ff4df4f87b209a49727bfbc75b54084e39bc8653cc7891034f2acd6563d2f83138caa14b2b9db1457492792bd9db164a8c3cc81e28be180d27db2
SSDEEP 3072:AtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:AIJjiJcbI03GBc3ucY5DCSj
TLSH
T172545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lidavtnlfd.sys

Path C:\Temp\lidavtnlfd.sys
Size 293KB
SHA256 f58c580a775b1e409ed46db869458680872aa08f4564c2ec4257f471b088382f
MD5 e859bfc2614db6699f8cff7a0bc306dd
SHA1 235e65502b0e2ab536a87a719b4883752f8e0280
SHA512 2921e983e72e04ce259c2bd320fbdcc2b72f71337b46c9001082de29c7987c6f2a3b7ee574c492c8bfef73f61638efbfdf5550a5c314589a247ee50fa6d3b07b
SSDEEP 3072:ZtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:ZIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F6545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkecwupmhfcxupmk.exe

Path C:\Temp\mkecwupmhfcxupmk.exe
Size 376KB
SHA256 88fc5b0728a73c5f6ebe073a360943eb2864353c3543d8825534f3e8e837c63f
MD5 b2adfef3bafb8351f644c60a7cf46d94
SHA1 616f599647464d9b50842bad14166a860c7e6e2e
SHA512 19b04e90565ff87990f299c9332e184ff8ac3a013610d0ce915e3b9dbcd8854674fa50b74caa1582aa32ef84bf787bd93db4c6b23bbf1210ffcb790ec9bc00d5
SSDEEP 3072:AjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:OyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1CF847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkecwupmhfcxupmk.sys

Path C:\Temp\mkecwupmhfcxupmk.sys
Size 293KB
SHA256 065a81008505a31ed144fda9db9905f4064a853f42f1a04abfb86d394220a30b
MD5 f5246254360dc6d6df5c2897be46d0a3
SHA1 fe48123e2d8a0ae7b75911b5d384c1f9675ce221
SHA512 2cc82fc96eea2afe53a3322162e037be32eb279e170ab92d551f13950d40128a46738f0a65c51d03e7c5212ecd9e4230e3a983008940657fed2a90e1f70c1cd2
SSDEEP 3072:AtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:AIJjiJcbI03GBc3ucY5DCSj
TLSH
T13D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmhezxrpmf.exe

Path C:\Temp\pmhezxrpmf.exe
Size 376KB
SHA256 ee6c476a3503e96e9b1d535efc5d4c02bcb79f263a607de750ec674f0bc05fea
MD5 cf7e22a01a8288abdb0d736dc1f6a6fc
SHA1 5c9c114779d950d4ee9a11c292b6f539592fe827
SHA512 cdd72628560367f2f96e021bc9c5ca53d812d3dd258547b8f0d849480f0781f960f24517d392c56b47b3897294a250df45f4847777154d9dd3b94566ae4b9b3f
SSDEEP 3072:UjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:KyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T169847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtolgdbvtr.exe

Path C:\Temp\vtolgdbvtr.exe
Size 376KB
SHA256 1ea900e8ff6fd42272105dc044f7af347b9ac1a709dd087ab3608fe3c8958f02
MD5 8d600ef00c8082ea3f1a7d1088eec531
SHA1 3f4f7ab27b1e7dcb890e6c2b28efb74739d358cf
SHA512 6d6f7916ecb0a1855119075fdb3d8f1c11c6dea19ae9b4c258cd5a325acfe2361e3ccb4ed9459029416b5cc07d8aed7dec6152381c500e4aeef4a2f55b646151
SSDEEP 3072:FjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:dyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T126847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtqligbyki.exe

Path C:\Temp\vtqligbyki.exe
Size 376KB
SHA256 78668767463e11b89411c883386e506bf04204dcc281adec033baf74c11f4361
MD5 011b62a012bdf7ed4f189bcc4e0caa3e
SHA1 1897d8b126a15829e500b5c76e575d4bc2b0361d
SHA512 94a5f7043782359f496c653fdf97b90603bf201c5cda99b6cc2283a54409777d62f27314af18587e1319c82b85544e57ae7f1cb64360c13dc34e6119e76ba61d
SSDEEP 3072:kjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:6yLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T116847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytqljdbvtr.sys

Path C:\Temp\ytqljdbvtr.sys
Size 293KB
SHA256 e06ac09d440d2593264c690492c601c123a8e56d4f7c1a3720e099d984d56648
MD5 16ce6931f66242217860be2c85761e50
SHA1 bcece3777ff811730f66460f3098a242c22592e6
SHA512 88c0bece1202497e5e5668d81545eb6362ea828484d9d53ebf8c217298451be687b1ebfd2a6b222a7175a9946fc49f6834d0f582cc020f2198f76d65c1d96587
SSDEEP 3072:dtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:dIJjiJcbI03GBc3ucY5DCSj
TLSH
T190545B44AAA4B0F6D9D5043C40EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65fa4048-4d1b-49b2-b523-4a2872395af0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\65fa4048-4d1b-49b2-b523-4a2872395af0.tmp
Size 37KB
SHA256 18d76ca71846ac3d5666d11a282d5dee8e882271ee89f67a0b6e7417e2b998fd
MD5 2dbe6ddaa06a41582b87cb97fc355f6a
SHA1 cba05985b7ff1478d50144760ac6222c8bb69cd2
SHA512 d469a90bb73b24b93d5f23c76c8f1f42ff4a7c690b0dbfbed4ffb90562d659f6dd5ba21f7e0fc396518503a3984c45d8c608b6d589faa24371b71667774cc14f
SSDEEP 768:R/UxvxjgC+W3D5fc7fZrKup5XSwQs88uBkiTCq/P84g:kZj3+W3DitrxILNBTHg
TLSH
T19503C039FC946873ACF39385365A275BAFF06153C4C41B9849EE7A1E028B39D6307897
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

81385a07-1b5e-4397-83f5-e2e6d1dc04eb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\81385a07-1b5e-4397-83f5-e2e6d1dc04eb.tmp
Size 33KB
SHA256 7d753a6011d9669c3e2bb00aeaebc204638bd4a6016a93c2a717d4889d4bbdde
MD5 1ea2b07b6bfb42c652ffc5b86e53d9d0
SHA1 84f4efc4508af5513b56adeac9cbe70666f6f8af
SHA512 72cf494009e21ffda2f5a7ab384c493091ff07f556e4b60a313f9143e51a0188a8eb3043747d4e2321bc97f487810d9fbaa5ab208a02b9002432f518e7ac1bf4
SSDEEP 768:DR3MC5c7fZrK11tip5XSwQs88uBkiT2+2sXlD:DR3Mjtr2sILNBT2s1D
TLSH
T199F2AF35EC958CB3ACF6A386768667436FF07157C4C40B48C5EEA61E018379E2B4B85B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8f056240-b961-4175-af53-c8bf8a230897.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8f056240-b961-4175-af53-c8bf8a230897.tmp
Size 38KB
SHA256 53c5fdb656477343c422779c1bb4a882af92163e742454e3ad24af928d34156c
MD5 0af3146a2e1c468567626930e2faf227
SHA1 07fb5bc634fcf415eb2810fcc003a0e5842c81e6
SHA512 361fbe1c4c7c2ab828a2e627ce730f0bc970f966c3feed03d6898d610901e1b18a3a5c6fe646d85a5d633cb8034dcecb09ef59299980f7b20bb354831157dc97
SSDEEP 768:Q/UxvxjgC+43d25c7fZrK11top5XSwQs88uBkiT2++0i:9Zj3+43dPtr22ILNBTVi
TLSH
T1DA03C039B8955C63ACF7E341365B2787AFF02067C8C40A5C89EE660E028775D6B4B85B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a0b193400a27c0cdf94ac11f5fb5b0747828b5b461169cefeffb96191b9e4834
MD5 edaab58c014c1abbfa900853b2ab2696
SHA1 e35eb02c0343d109af1ddd7dbd39dee3b989aea3
SHA512 b3cca7ed39fd4708b9c01cbefd67aab972f585372e01b5fa39d4a0840a7f579725d1202ab2916cda4e7635fb16dbc74178888461c7b6a2b3ea91d273ce2909ea
TLSH
T1BBD02B75F96ECC23E85204F940D24208329775818C0441812601CC080A603850000182
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 932f01682de6215b2c3b5faeb96a07b886e28db2ff6f8242a36da556c4292464
MD5 667b54168424526a7188593696f59ace
SHA1 deeb9f5ad1bccaabad57a386f08ba0c0740b2f81
SHA512 698f5a88d262c546b9bf21ead67e8dbe00ce6bd13f196761a5910f59ff69ca7532cacdf03c070f8d3b9f5d4fb8990b358e9b60ace9e48a0848e4a9da1d92b3ed
TLSH
T1D4D02B79F95ECD23E85204F540D1420832A77581DC04418125018C080A603850001182
MD5 SHA1 SHA512 TLSH

Submit Download

283895c7-f4cb-4279-95e4-143c436487d4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\283895c7-f4cb-4279-95e4-143c436487d4.tmp
Size 11KB
SHA256 9acf28a911aa45b3c6503d15523d99f82aa5a4a1dbcc67c40d865513512d0d22
MD5 68211d4014a3e56ff6920c37a3677702
SHA1 41984ea25326b0f5af629de28449adb7bc281ad4
SHA512 ea64495bf87b510fb0ddab553a00c29f9c1554d2939583a6d570c9089422dbe49cc364aa78a480037d8a5b0ad8604eebbb506748a5fd573b53e53f0887ec2d01
SSDEEP 192:sxRORPCi6/fCsGCZ6VZzoA8p9G7/g6+WNCAH/YEqlGtnIgDXDJ:sxROYp/fCsGETO/5h/Rp
TLSH
T13442B815AD28A97B5CCBE21DBB55BF53E2F95032A0D41E48E6FC8A1C15E76CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

734f6df4-a726-4c70-be54-fcd8af6cc376.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\734f6df4-a726-4c70-be54-fcd8af6cc376.tmp
Size 29KB
SHA256 6d357fbf08fc1a73b37b5e12f5f0af78b72a55be3f69565064dab1d63e34b874
MD5 7e726222b14e4cc6bf1ec4941ce3358e
SHA1 6b5aa5009c4f5246faf9f31a835f5c872226578e
SHA512 a123cf318dfff65c2ae4a5b3c1500f2d504b9f4acd36fa3495f1d32ec7c2b46045e50f81d8487107eced5b40f5c36a698ca67e2c03e501f194793c11559d084b
SSDEEP 768:U/pCyx7pLuLbLmWg8KfrL8F1+UoAYDCx9Tuqh0VfUC9xbog/OVRGuyhpproJLf:U/pCynEbLmWg8KfrLu1jaWGu8pCJf
TLSH
T1EFD2D97B740CCA7F4F804ADDA8197ADB6DA802CB9A98CD4047FE941D02C77EB511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 7772c1ba096c7695d457b702856a00473199b30e82915778b4a4f4eca5e35941
MD5 8ad540865c0a0eb6942191b5ef5d6bf3
SHA1 cf9e10cae71f77eda6cc0ae45a7742dabe24f777
SHA512 49ce1d78d217186ccf2d02355e7d3df0b32ca9c4f999d4d4e10565076e81a5c1f64f3c76718c71d695451cdb074fff07d7a83c3e0b91199fb08b786bac8a06c2
TLSH
T1A551C7C342C25C7EC77AE93A01E8211B3E3094B426CB2FD91C97EBFD7B69B199560091
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 72761c754438907bdede2bc96d60c985042450b233a815272e72312ab1cf73b8
MD5 4c443b2aca4cd43b20745abbb6f8fe55
SHA1 d93859659bebc5ea8e689fc1bc2570905794ce41
SHA512 632a98b194dd87f2383f74d45adcec9b143f958e028fc1d79fa20dfcfa1919affc198c129f3affbc40c0bda521dc658b2e31bde8df3e31d1dee8d283d66a6048
TLSH
T15451D8C342C25C7EC77AE83A41E8211B3E3095B416CB2FD91C57EBFD7B29B199560091
MD5 SHA1 SHA512 TLSH

Submit Download

ac311478-a53f-4abd-9a8d-e8557c884e41.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\ac311478-a53f-4abd-9a8d-e8557c884e41.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

09dfbc8b-8fea-440f-8f73-2fcdab996dcf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\09dfbc8b-8fea-440f-8f73-2fcdab996dcf.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

a443cb6c-4f12-443b-81fa-46a4bb922191.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a443cb6c-4f12-443b-81fa-46a4bb922191.tmp
Size 2KB
SHA256 be0e38e6a6ff3727b4d77b8afdf7306d79e27fa2202a058f6ecd4377d13e2441
MD5 45145b8ffb2c8844522a234e22183f8e
SHA1 c907f66821a4bb226cddd104a840bb59f48d3d28
SHA512 9a5ef6bf0c6bcfc0d3d8c1ffcfa6796f6c29591b3679cb359b2a53aff23be294ff02d129cd0a9df7300c34ec657b12aaea6026280d213f6a36b25fe5cc371dd4
TLSH
T14A51C0F3C3E8866DCA0156F4AB186E2BCE2D0954432C7D5AC8E4AF1B93E3471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

a7a68274-efc3-450c-b09c-7d0819d62574.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a7a68274-efc3-450c-b09c-7d0819d62574.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a14ec96399ad88d0f72c8b521d1ae8c34f311f5e189568b2ea4c9bd8c7b09772
MD5 7c922c7f2e8b1e560eca0280d4022aac
SHA1 3967a17911bb8df9f5200d61d9b6e032e6aa5ce8
SHA512 c907883cf6ce451c885620e020b351300e770c64115aa72db652c8b968ba8754ac109875b1d8a1f6b8c94665fa43e65d61dc45b315dad55c8621a4540edf8d91
SSDEEP 192:sxRhRPCi6/fCsBCZ6VZzoA8p9G7/g6+WNCAH/YEKlGtnIgVDJ:sxRhYp/fCsBETO/5h/5b
TLSH
T1A132C915AE28A97B5CCBE21DBB65BF53D6F95032A0D41E48E6FC8A1C05E76CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bbaa11de-05f1-4025-8e52-e6c07dd992a9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bbaa11de-05f1-4025-8e52-e6c07dd992a9.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eb04d687-47e7-4c85-a549-68baf914eefc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\eb04d687-47e7-4c85-a549-68baf914eefc.tmp
Size 11KB
SHA256 ccedf9e202e6c2c87dc49ab05bc3af1f67f59e158531daa52e291bc939a90ab6
MD5 66b42e304c50a1cd5f858168d2d9d11b
SHA1 42318d346b2caadd268b869125d38dc1e59ad9c1
SHA512 41d836db68ae83d49eb309ee1df5ed824e1e46cafa72e4e62b4371528e74b2aa2f6e9f05bf7fda6e34aaf311692458020483f00d1265ce7a0bb7e7f35dec390f
SSDEEP 192:sxRORPCi6/fCslCZ6VZzoA8p9G7/g6+WNCAH/YEKlGtnIgDtDJ:sxROYp/fCslETO/5h/5X
TLSH
T10542B815AE28A97B5CCBE21DBB65BF53D6F95032A0D41E48E6FC8A1C05E76CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

afd7b858-9694-4b84-93d9-17dc4c8d446d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\afd7b858-9694-4b84-93d9-17dc4c8d446d.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4eda3ab3-8299-4955-a803-e190573c548b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\4eda3ab3-8299-4955-a803-e190573c548b.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

9ab1d80a-2315-4e3e-a3a8-b82fec401eb3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\9ab1d80a-2315-4e3e-a3a8-b82fec401eb3.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

a91fe7b2-11a2-4378-8e32-27cecebbf484.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\a91fe7b2-11a2-4378-8e32-27cecebbf484.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

3f8effb1-5541-46d8-9756-42d0f91d0127.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3f8effb1-5541-46d8-9756-42d0f91d0127.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f68e3c86-9503-4951-a2a9-b3e671795527.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f68e3c86-9503-4951-a2a9-b3e671795527.tmp
Size 42KB
SHA256 518916f71551ca51d970ec9e42731417c483f4caa55a59954eef6b1f55006542
MD5 66c5038a435a93a1366cfe19c6a79736
SHA1 bb7aadb4299588780382a821edeb89b6790ed0dd
SHA512 510485578374f952fdb314f0e2c1d4f2afb99c68099f7186b2da66369c842cca97ff770a8a80a273fa94ff674a686da03df225ad8f2a6295d9af30100cbf4e6a
SSDEEP 768:mFQb3fwgM4hAerK11tr+p5XSwQs88uBkiT2+2sXlD:tb3iYr2bwILNBT2s1D
TLSH
T1BA1348F598D38976E8AE5383677D6E025EFCE053B4884984B7D9590DCC822BFC70B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f98d1a2a-bc84-4bf5-8e51-de04bf21661d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f98d1a2a-bc84-4bf5-8e51-de04bf21661d.tmp
Size 33KB
SHA256 091db9f59bbcbd88dabe2a8cdecd1949bb6ede0859a86df216800a814b291c32
MD5 ea935ae6e3ddcd967d5143550263e203
SHA1 ea1a1f5228b38487b40babade3dccf865fe94a28
SHA512 8f16f0133a088f9b90d9afd14f5601afc3e1399bb62354d7d2bad5a7e4e220952a8abc59641be6b3e18453e9bb52bf451c6a710d51b922c22636adc1308419f1
SSDEEP 768:AR3dC5c7fZrK11tip5XSwQs88uBkiT2+2sXlD:AR3djtr2sILNBT2s1D
TLSH
T14FF2A035EC958CB3ACF6A386768667436FF07157C4C40B48C5EEA61E018379E2B4B85B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

31a7ff6f-e4bf-42dc-8358-75e5d391046f.tmp

Path C:\Users\Admin\AppData\Local\Temp\31a7ff6f-e4bf-42dc-8358-75e5d391046f.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

551a0b15-b2b8-43e9-8c47-017c9eabeec0.tmp

Path C:\Users\Admin\AppData\Local\Temp\551a0b15-b2b8-43e9-8c47-017c9eabeec0.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2900_839221210\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2900_266898657\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2900_289068463\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2900_363517408\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2900_605718403\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 92de07801eaea27ac27bd4dba05917cfbb5819016b1f700221e815bc443db742
MD5 d5b044074411fe2f5ff7e7480d06ea75
SHA1 c6a05b094faa1a11d340f6cbde2303f42ed9c882
SHA512 e41329c7c6e27d0f37d42d7c1f3698b2c9a6a5e00ffa793ea10c25a54dd913456ad9cee8e8344c64f8ff9c1f62c6df797cf9d541e66490c86afd2ae015620ab2
TLSH
T10F71238357B9C6B3C5DA5FF102836648F1FB23780B2370614B555546AB34A3A54B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/684-343-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1432-421-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2540-425-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2904-196-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2920-314-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3080-399-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3260-482-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3336-504-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3664-349-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3736-445-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4156-323-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4156-273-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4488-379-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4616-327-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5028-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5088-478-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5108-285-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5644-457-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5772-486-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5808-245-0x0000000000010000-0x00000000000AB000-memory.dmp

Download