systex | cb5fc887f588410911cc333369cce1310bdd4fe003f878b052abb707313e27fe

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample261006-phyeeays2l
SHA256 cb5fc887f588410911cc333369cce1310bdd4fe003f878b052abb707313e27fe
MD5 73f57dc0b88ad7a4dfe29270d1c5bce2
SHA1 8c78b979fd3d7f575cb40b88bf843066564a0e15
SHA512 afec90633548189c9abcc339bb9fa2788a54b8dc3c3f60fc61dfa7b8c603f65cf74466f17cde14f883d69b692aa1def4b4cb413a17526ca935b16feda3493db2
SSDEEP 3072:kjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:6yLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T178847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3732	dbwtomgeywqojgey.exe
3656	dbwtomgeywqojgey.sys
6028	CreateProcess.exe
4384	geywqomjey.exe
3004	CreateProcess.exe
604	CreateProcess.exe
5872	i_geywqomjey.exe
2980	tnlgdywqoi.sys
5972	CreateProcess.exe
4300	igavtolfdy.exe
768	CreateProcess.exe
4780	CreateProcess.exe
2288	i_igavtolfdy.exe
2500	nlidbvtnlf.sys
2524	CreateProcess.exe
2356	aysqkidavs.exe
3276	CreateProcess.exe
5872	CreateProcess.exe
4408	i_aysqkidavs.exe
1860	vpnifdxvqn.sys
3380	CreateProcess.exe
3160	kifaysqkic.exe
3184	CreateProcess.exe
2204	CreateProcess.exe
3060	i_kifaysqkic.exe
3688	pkicausnkf.sys
5804	CreateProcess.exe
4544	axspkicaus.exe
4436	CreateProcess.exe
1324	CreateProcess.exe
4108	i_axspkicaus.exe
5124	fzxspkhcau.sys
4996	CreateProcess.exe
2564	rpjhfzxrpj.exe
4852	CreateProcess.exe
5500	CreateProcess.exe
3856	i_rpjhfzxrpj.exe
1596	cwurmkecwu.sys
3060	CreateProcess.exe
4100	rmjecwuomg.exe
6096	CreateProcess.exe
2900	CreateProcess.exe
5980	i_rmjecwuomg.exe
5684	ebwuomgezw.sys
3136	CreateProcess.exe
2352	wrojhezwro.exe
2752	CreateProcess.exe
4796	CreateProcess.exe
4712	i_wrojhezwro.exe
5648	ljdbwtoljh.sys
3476	CreateProcess.exe
2440	mgeywrojhb.exe
5720	CreateProcess.exe
2772	CreateProcess.exe
5580	i_mgeywrojhb.exe
2392	bvtolgeywq.sys
5756	CreateProcess.exe
200	ywtolgeyvq.exe
2896	CreateProcess.exe
2448	CreateProcess.exe
2324	i_ywtolgeyvq.exe
1712	igaysqlidb.sys
3532	CreateProcess.exe
5892	kidavtnlfd.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2720_17169008\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2720_1011369711\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2720_1835495011\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2720_1429826820\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2720_1429826820\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2720_1429826820\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2720_1011369711\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2720_1835495011\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2720_1429826820\office_endpoints_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywqomjey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kifaysqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kifaysqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywtolgeyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aywqoljdby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvtnlgdbvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axspkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojhezwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrojhezwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgeywrojhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kidavtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxrpjecz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wromgeytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjecwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kidavtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkicxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkicxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywrojgeczt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvtnlgdbvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhfzxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbwtomgeywqojgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igavtolfdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhfzxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgeywrojhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywtolgeyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxrpjecz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wromgeytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqkidavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axspkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjecwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvsqnifdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvsqnifdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczxspkhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywrojgeczt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aywqoljdby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywqomjey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igavtolfdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqkidavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hczxspkhfz.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4612	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4544	ipconfig.exe
5856	ipconfig.exe
4916	ipconfig.exe
260	ipconfig.exe
1032	ipconfig.exe
1552	ipconfig.exe
5224	ipconfig.exe
4080	ipconfig.exe
3104	ipconfig.exe
4956	ipconfig.exe
5684	ipconfig.exe
4336	ipconfig.exe
1980	ipconfig.exe
3160	ipconfig.exe
4824	ipconfig.exe
2096	ipconfig.exe
3748	ipconfig.exe
2248	ipconfig.exe
4172	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-696679853-3915825385-3233721679-1000\{63F9367E-6250-4E2A-9989-F68D1C4AB5EC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3732	dbwtomgeywqojgey.exe
3732	dbwtomgeywqojgey.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3732	dbwtomgeywqojgey.exe
3732	dbwtomgeywqojgey.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3732	dbwtomgeywqojgey.exe
3732	dbwtomgeywqojgey.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3732	dbwtomgeywqojgey.exe
3732	dbwtomgeywqojgey.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3732	dbwtomgeywqojgey.exe
3732	dbwtomgeywqojgey.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3732	dbwtomgeywqojgey.exe
4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3732	dbwtomgeywqojgey.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5872	i_geywqomjey.exe
Token: SeDebugPrivilege	2288	i_igavtolfdy.exe
Token: SeDebugPrivilege	4408	i_aysqkidavs.exe
Token: SeDebugPrivilege	3060	i_kifaysqkic.exe
Token: SeDebugPrivilege	4108	i_axspkicaus.exe
Token: SeDebugPrivilege	3856	i_rpjhfzxrpj.exe
Token: SeDebugPrivilege	5980	i_rmjecwuomg.exe
Token: SeDebugPrivilege	4712	i_wrojhezwro.exe
Token: SeDebugPrivilege	5580	i_mgeywrojhb.exe
Token: SeDebugPrivilege	2324	i_ywtolgeyvq.exe
Token: SeDebugPrivilege	1224	i_kidavtnlfd.exe
Token: SeDebugPrivilege	4892	i_xvsqnifdxv.exe
Token: SeDebugPrivilege	2996	i_sqkicxvpnh.exe
Token: SeDebugPrivilege	4804	i_hczxspkhfz.exe
Token: SeDebugPrivilege	3744	i_hfzxrpjecz.exe
Token: SeDebugPrivilege	4468	i_ywrojgeczt.exe
Token: SeDebugPrivilege	4116	i_wromgeytrl.exe
Token: SeDebugPrivilege	4944	i_aywqoljdby.exe
Token: SeDebugPrivilege	6056	i_yvtnlgdbvq.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2720	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 3732	4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 4648 wrote to memory of 1220	4648	2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 1220 wrote to memory of 2720	1220	iexplore.exe	91
PID 2720 wrote to memory of 4732	2720	msedge.exe	92
PID 2720 wrote to memory of 1392	2720	msedge.exe	93
PID 2720 wrote to memory of 4612	2720	msedge.exe	94
PID 2720 wrote to memory of 1392	2720	msedge.exe	93
PID 2720 wrote to memory of 1392	2720	msedge.exe	93
PID 2720 wrote to memory of 1420	2720	msedge.exe	95
PID 2720 wrote to memory of 1420	2720	msedge.exe	95
PID 2720 wrote to memory of 3176	2720	msedge.exe	97
PID 2720 wrote to memory of 3176	2720	msedge.exe	97
PID 2720 wrote to memory of 3176	2720	msedge.exe	97
PID 2720 wrote to memory of 3784	2720	msedge.exe	98
PID 2720 wrote to memory of 3784	2720	msedge.exe	98
PID 2720 wrote to memory of 3784	2720	msedge.exe	98
PID 2720 wrote to memory of 5092	2720	msedge.exe	99
PID 2720 wrote to memory of 2368	2720	msedge.exe	100
PID 2720 wrote to memory of 5092	2720	msedge.exe	99
PID 2720 wrote to memory of 5092	2720	msedge.exe	99
PID 2720 wrote to memory of 2368	2720	msedge.exe	100
PID 2720 wrote to memory of 2368	2720	msedge.exe	100
PID 2720 wrote to memory of 4320	2720	msedge.exe	101
PID 2720 wrote to memory of 4320	2720	msedge.exe	101
PID 3732 wrote to memory of 6028	3732	dbwtomgeywqojgey.exe	105
PID 2720 wrote to memory of 3704	2720	msedge.exe	108
PID 2720 wrote to memory of 4132	2720	msedge.exe	109
PID 2720 wrote to memory of 3704	2720	msedge.exe	108
PID 2720 wrote to memory of 4132	2720	msedge.exe	109
PID 4384 wrote to memory of 3004	4384	geywqomjey.exe	110
PID 2720 wrote to memory of 2568	2720	msedge.exe	114
PID 2720 wrote to memory of 2564	2720	msedge.exe	115
PID 2720 wrote to memory of 2564	2720	msedge.exe	115
PID 2720 wrote to memory of 2564	2720	msedge.exe	115
PID 2720 wrote to memory of 4544	2720	msedge.exe	116
PID 2720 wrote to memory of 4544	2720	msedge.exe	116
PID 2720 wrote to memory of 3276	2720	msedge.exe	119
PID 2720 wrote to memory of 3276	2720	msedge.exe	119
PID 2720 wrote to memory of 5704	2720	msedge.exe	120
PID 2720 wrote to memory of 5704	2720	msedge.exe	120
PID 2720 wrote to memory of 5704	2720	msedge.exe	120
PID 3732 wrote to memory of 604	3732	dbwtomgeywqojgey.exe	121
PID 3732 wrote to memory of 5972	3732	dbwtomgeywqojgey.exe	125
PID 4300 wrote to memory of 768	4300	igavtolfdy.exe	127
PID 3732 wrote to memory of 4780	3732	dbwtomgeywqojgey.exe	130
PID 3732 wrote to memory of 2524	3732	dbwtomgeywqojgey.exe	134
PID 2356 wrote to memory of 3276	2356	aysqkidavs.exe	136
PID 3732 wrote to memory of 5872	3732	dbwtomgeywqojgey.exe	139
PID 2720 wrote to memory of 8	2720	msedge.exe	144
PID 2720 wrote to memory of 8	2720	msedge.exe	144
PID 2720 wrote to memory of 8	2720	msedge.exe	144
PID 3732 wrote to memory of 3380	3732	dbwtomgeywqojgey.exe	145
PID 3160 wrote to memory of 3184	3160	kifaysqkic.exe	147
PID 2720 wrote to memory of 2416	2720	msedge.exe	150
PID 2720 wrote to memory of 2416	2720	msedge.exe	150
PID 2720 wrote to memory of 2416	2720	msedge.exe	150
PID 3732 wrote to memory of 2204	3732	dbwtomgeywqojgey.exe	151
PID 2720 wrote to memory of 2568	2720	msedge.exe	153
PID 2720 wrote to memory of 3176	2720	msedge.exe	154
PID 2720 wrote to memory of 248	2720	msedge.exe	155
PID 3732 wrote to memory of 5804	3732	dbwtomgeywqojgey.exe	158
PID 4544 wrote to memory of 4436	4544	axspkicaus.exe	160
PID 3732 wrote to memory of 1324	3732	dbwtomgeywqojgey.exe	163
PID 3732 wrote to memory of 4996	3732	dbwtomgeywqojgey.exe	167

C:\Users\Admin\AppData\Local\Temp\2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-06_73f57dc0b88ad7a4dfe29270d1c5bce2_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Temp\dbwtomgeywqojgey.exe
  C:\Temp\dbwtomgeywqojgey.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3732
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\geywqomjey.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6028
  - - C:\Temp\geywqomjey.exe
      C:\Temp\geywqomjey.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4384
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3004
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3160
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_geywqomjey.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:604
  - - C:\Temp\i_geywqomjey.exe
      C:\Temp\i_geywqomjey.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5872
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igavtolfdy.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5972
  - - C:\Temp\igavtolfdy.exe
      C:\Temp\igavtolfdy.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4300
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:768
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4824
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igavtolfdy.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4780
  - - C:\Temp\i_igavtolfdy.exe
      C:\Temp\i_igavtolfdy.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2288
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aysqkidavs.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2524
  - - C:\Temp\aysqkidavs.exe
      C:\Temp\aysqkidavs.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2356
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3276
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aysqkidavs.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5872
  - - C:\Temp\i_aysqkidavs.exe
      C:\Temp\i_aysqkidavs.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4408
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kifaysqkic.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3380
  - - C:\Temp\kifaysqkic.exe
      C:\Temp\kifaysqkic.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3160
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3184
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2096
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kifaysqkic.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2204
  - - C:\Temp\i_kifaysqkic.exe
      C:\Temp\i_kifaysqkic.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\axspkicaus.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5804
  - - C:\Temp\axspkicaus.exe
      C:\Temp\axspkicaus.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4544
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4436
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5684
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_axspkicaus.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1324
  - - C:\Temp\i_axspkicaus.exe
      C:\Temp\i_axspkicaus.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4108
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpjhfzxrpj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4996
  - - C:\Temp\rpjhfzxrpj.exe
      C:\Temp\rpjhfzxrpj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2564
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4852
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4336
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpjhfzxrpj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5500
  - - C:\Temp\i_rpjhfzxrpj.exe
      C:\Temp\i_rpjhfzxrpj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rmjecwuomg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3060
  - - C:\Temp\rmjecwuomg.exe
      C:\Temp\rmjecwuomg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4100
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6096
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1032
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rmjecwuomg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2900
  - - C:\Temp\i_rmjecwuomg.exe
      C:\Temp\i_rmjecwuomg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5980
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wrojhezwro.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3136
  - - C:\Temp\wrojhezwro.exe
      C:\Temp\wrojhezwro.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2352
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2752
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1980
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wrojhezwro.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4796
  - - C:\Temp\i_wrojhezwro.exe
      C:\Temp\i_wrojhezwro.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4712
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mgeywrojhb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3476
  - - C:\Temp\mgeywrojhb.exe
      C:\Temp\mgeywrojhb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2440
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5720
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mgeywrojhb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2772
  - - C:\Temp\i_mgeywrojhb.exe
      C:\Temp\i_mgeywrojhb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5580
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywtolgeyvq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5756
  - - C:\Temp\ywtolgeyvq.exe
      C:\Temp\ywtolgeyvq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:200
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2896
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3748
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywtolgeyvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2448
  - - C:\Temp\i_ywtolgeyvq.exe
      C:\Temp\i_ywtolgeyvq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2324
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kidavtnlfd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3532
  - - C:\Temp\kidavtnlfd.exe
      C:\Temp\kidavtnlfd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5892
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3044
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1552
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kidavtnlfd.exe ups_ins
    3⤵
    PID:2416
  - - C:\Temp\i_kidavtnlfd.exe
      C:\Temp\i_kidavtnlfd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1224
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvsqnifdxv.exe ups_run
    3⤵
    PID:1304
  - - C:\Temp\xvsqnifdxv.exe
      C:\Temp\xvsqnifdxv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5684
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1652
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5224
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvsqnifdxv.exe ups_ins
    3⤵
    PID:4304
  - - C:\Temp\i_xvsqnifdxv.exe
      C:\Temp\i_xvsqnifdxv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4892
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqkicxvpnh.exe ups_run
    3⤵
    PID:5648
  - - C:\Temp\sqkicxvpnh.exe
      C:\Temp\sqkicxvpnh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5712
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2036
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4080
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqkicxvpnh.exe ups_ins
    3⤵
    PID:3232
  - - C:\Temp\i_sqkicxvpnh.exe
      C:\Temp\i_sqkicxvpnh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2996
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hczxspkhfz.exe ups_run
    3⤵
    PID:1376
  - - C:\Temp\hczxspkhfz.exe
      C:\Temp\hczxspkhfz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3660
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2844
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hczxspkhfz.exe ups_ins
    3⤵
    PID:2428
  - - C:\Temp\i_hczxspkhfz.exe
      C:\Temp\i_hczxspkhfz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfzxrpjecz.exe ups_run
    3⤵
    PID:4636
  - - C:\Temp\hfzxrpjecz.exe
      C:\Temp\hfzxrpjecz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3800
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1876
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2248
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfzxrpjecz.exe ups_ins
    3⤵
    PID:3124
  - - C:\Temp\i_hfzxrpjecz.exe
      C:\Temp\i_hfzxrpjecz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3744
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywrojgeczt.exe ups_run
    3⤵
    PID:3224
  - - C:\Temp\ywrojgeczt.exe
      C:\Temp\ywrojgeczt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1284
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4076
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4172
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywrojgeczt.exe ups_ins
    3⤵
    PID:240
  - - C:\Temp\i_ywrojgeczt.exe
      C:\Temp\i_ywrojgeczt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4468
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wromgeytrl.exe ups_run
    3⤵
    PID:3020
  - - C:\Temp\wromgeytrl.exe
      C:\Temp\wromgeytrl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6012
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2000
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4916
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wromgeytrl.exe ups_ins
    3⤵
    PID:5988
  - - C:\Temp\i_wromgeytrl.exe
      C:\Temp\i_wromgeytrl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4116
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aywqoljdby.exe ups_run
    3⤵
    PID:912
  - - C:\Temp\aywqoljdby.exe
      C:\Temp\aywqoljdby.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4760
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3216
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3104
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aywqoljdby.exe ups_ins
    3⤵
    PID:2700
  - - C:\Temp\i_aywqoljdby.exe
      C:\Temp\i_aywqoljdby.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvtnlgdbvq.exe ups_run
    3⤵
    PID:3756
  - - C:\Temp\yvtnlgdbvq.exe
      C:\Temp\yvtnlgdbvq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1240
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4408
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4956
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvtnlgdbvq.exe ups_ins
    3⤵
    PID:5868
  - - C:\Temp\i_yvtnlgdbvq.exe
      C:\Temp\i_yvtnlgdbvq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6056
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7fffc32ec188,0x7fffc32ec194,0x7fffc32ec1a0
      4⤵
      PID:4732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,15079974101094968836,11639164186890147706,262144 --field-trial-handle=2368,i,3354061358202695088,11166307443737389673,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:2
      4⤵
      PID:1392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,12440298918006743844,6097212645616692959,524288 --field-trial-handle=2368,i,3354061358202695088,11166307443737389673,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:11
      4⤵
      System Time Discovery
      PID:4612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2504,i,4774820964609891134,13493694889810500228,524288 --field-trial-handle=2368,i,3354061358202695088,11166307443737389673,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:13
      4⤵
      PID:1420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3616,i,6446237323305660413,9514936859842620726,2097152 --field-trial-handle=2368,i,3354061358202695088,11166307443737389673,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
      4⤵
      PID:3176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3620,i,2402838128184505204,9850721066082200043,2097152 --field-trial-handle=2368,i,3354061358202695088,11166307443737389673,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
      4⤵
      PID:3784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,2684802701879064554,1111166625017420748,2097152 --field-trial-handle=2368,i,3354061358202695088,11166307443737389673,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:1
      4⤵
      PID:5092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,17428482669900927978,13308998163922416731,2097152 --field-trial-handle=2368,i,3354061358202695088,11166307443737389673,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:9
      4⤵
      PID:2368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,4405463545897649311,14869342197378165911,524288 --field-trial-handle=2368,i,3354061358202695088,11166307443737389673,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:14
      4⤵
      PID:4320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,11557869988687024825,5032474071101853272,524288 --field-trial-handle=2368,i,3354061358202695088,11166307443737389673,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:14
      4⤵
      PID:3704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,2754544788273156227,633713550103222860,524288 --field-trial-handle=2368,i,3354061358202695088,11166307443737389673,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
      4⤵
      PID:4132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,11426625914969687202,8159816945706661855,524288 --field-trial-handle=2368,i,3354061358202695088,11166307443737389673,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
      4⤵
      PID:5060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,11426625914969687202,8159816945706661855,524288 --field-trial-handle=2368,i,3354061358202695088,11166307443737389673,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
      4⤵
      PID:2568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6316,i,17712312895817055098,18351705170119558521,2097152 --field-trial-handle=2368,i,3354061358202695088,11166307443737389673,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:1
      4⤵
      PID:2564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,5960618469005310409,4348093018742220990,524288 --field-trial-handle=2368,i,3354061358202695088,11166307443737389673,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:14
      4⤵
      PID:4544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6848,i,5665914627709628633,12795170027310996998,524288 --field-trial-handle=2368,i,3354061358202695088,11166307443737389673,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:14
      4⤵
      PID:3276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6864,i,17479933202473361103,11365112872023726282,2097152 --field-trial-handle=2368,i,3354061358202695088,11166307443737389673,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:1
      4⤵
      PID:5704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6328,i,16272032607757618282,13836980625265092610,2097152 --field-trial-handle=2368,i,3354061358202695088,11166307443737389673,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:1
      4⤵
      PID:8
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6892,i,6915607979272468444,16707899317433370188,2097152 --field-trial-handle=2368,i,3354061358202695088,11166307443737389673,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:1
      4⤵
      PID:2416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6912,i,12420628919810983000,7504892128351789563,524288 --field-trial-handle=2368,i,3354061358202695088,11166307443737389673,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:14
      4⤵
      PID:2568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7076,i,15293116306590375366,2352416669762090163,524288 --field-trial-handle=2368,i,3354061358202695088,11166307443737389673,262144 --variations-seed-version --mojo-platform-channel-handle=7048 /prefetch:14
      4⤵
      PID:3176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7152,i,9762981091099645534,2670644816819246676,524288 --field-trial-handle=2368,i,3354061358202695088,11166307443737389673,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:14
      4⤵
      PID:248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=4636,i,1521800457137140251,160669351697808879,2097152 --field-trial-handle=2368,i,3354061358202695088,11166307443737389673,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:1
      4⤵
      PID:5540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6292,i,9604269417425159833,14139240180100234807,2097152 --field-trial-handle=2368,i,3354061358202695088,11166307443737389673,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:1
      4⤵
      PID:6060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6332,i,11698242969910630848,829284440372643026,2097152 --field-trial-handle=2368,i,3354061358202695088,11166307443737389673,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:1
      4⤵
      PID:1908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,7577547855549044551,4737794390091436867,524288 --field-trial-handle=2368,i,3354061358202695088,11166307443737389673,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:14
      4⤵
      PID:5784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,12988098411353596387,9757248931005721392,524288 --field-trial-handle=2368,i,3354061358202695088,11166307443737389673,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:14
      4⤵
      PID:1280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6872,i,11160616348336261534,2648303970701696475,2097152 --field-trial-handle=2368,i,3354061358202695088,11166307443737389673,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:1
      4⤵
      PID:2484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,8677097644831390880,5523957327116836047,524288 --field-trial-handle=2368,i,3354061358202695088,11166307443737389673,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:14
      4⤵
      PID:2836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3704,i,13578102798909028133,12247521729022551120,524288 --field-trial-handle=2368,i,3354061358202695088,11166307443737389673,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:14
      4⤵
      PID:5628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4284,i,2062423932736092961,6513545440957298080,262144 --field-trial-handle=2368,i,3354061358202695088,11166307443737389673,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:10
      4⤵
      PID:6060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6788,i,796384492693734073,12688281367182040054,524288 --field-trial-handle=2368,i,3354061358202695088,11166307443737389673,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:14
      4⤵
      PID:2140

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3776

C:\Temp\dbwtomgeywqojgey.sys
C:\Temp\dbwtomgeywqojgey.sys
1⤵
- Executes dropped EXE
PID:3656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1520

C:\Temp\tnlgdywqoi.sys
C:\Temp\tnlgdywqoi.sys
1⤵
- Executes dropped EXE
PID:2980

C:\Temp\nlidbvtnlf.sys
C:\Temp\nlidbvtnlf.sys
1⤵
- Executes dropped EXE
PID:2500

C:\Temp\vpnifdxvqn.sys
C:\Temp\vpnifdxvqn.sys
1⤵
- Executes dropped EXE
PID:1860

C:\Temp\pkicausnkf.sys
C:\Temp\pkicausnkf.sys
1⤵
- Executes dropped EXE
PID:3688

C:\Temp\fzxspkhcau.sys
C:\Temp\fzxspkhcau.sys
1⤵
- Executes dropped EXE
PID:5124

C:\Temp\cwurmkecwu.sys
C:\Temp\cwurmkecwu.sys
1⤵
- Executes dropped EXE
PID:1596

C:\Temp\ebwuomgezw.sys
C:\Temp\ebwuomgezw.sys
1⤵
- Executes dropped EXE
PID:5684

C:\Temp\ljdbwtoljh.sys
C:\Temp\ljdbwtoljh.sys
1⤵
- Executes dropped EXE
PID:5648

C:\Temp\bvtolgeywq.sys
C:\Temp\bvtolgeywq.sys
1⤵
- Executes dropped EXE
PID:2392

C:\Temp\igaysqlidb.sys
C:\Temp\igaysqlidb.sys
1⤵
- Executes dropped EXE
PID:1712

C:\Temp\lfdxvpnifd.sys
C:\Temp\lfdxvpnifd.sys
1⤵
PID:4236

C:\Temp\pnhfaxspki.sys
C:\Temp\pnhfaxspki.sys
1⤵
PID:4332

C:\Temp\nhfzxrpmki.sys
C:\Temp\nhfzxrpmki.sys
1⤵
PID:6108

C:\Temp\fzxrpmjhcz.sys
C:\Temp\fzxrpmjhcz.sys
1⤵
PID:3216

C:\Temp\pmgezwrpjh.sys
C:\Temp\pmgezwrpjh.sys
1⤵
PID:2372

C:\Temp\omjhbzwuom.sys
C:\Temp\omjhbzwuom.sys
1⤵
PID:2696

C:\Temp\dbwtolgebw.sys
C:\Temp\dbwtolgebw.sys
1⤵
PID:4400

C:\Temp\tnljdbvtqo.sys
C:\Temp\tnljdbvtqo.sys
1⤵
PID:3328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

axspkicaus.exe

Path C:\Temp\axspkicaus.exe
Size 376KB
SHA256 ccae798772065efb6e612cf6931bf0ab0ad3923733324a42bb8922314c501bd6
MD5 57cd73dbd1aef2c5a2288c282f155023
SHA1 d2892db13683fc4b77266cc5d6aa0e18ce9fd35a
SHA512 062be42406c7acf117f311864031eb1b4a44ae398bacf7d7cae78bda1d1a6937b1289656d70fb3432f43a164cd6545a51039774791eb0277a5350cb0c9fa9dbe
SSDEEP 3072:sjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:CyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T16C847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aysqkidavs.exe

Path C:\Temp\aysqkidavs.exe
Size 376KB
SHA256 b6501ef3813fb175230c73ffebae43c76803b11e6f144adfdf2873b69fb75964
MD5 85d8c4f8be94c0c61c7f54d8c937eba8
SHA1 f34ca44d8276dfabda146acf86af8289484755db
SHA512 e1fc83b6d6a063a72af37ab11f4ed941767cc0176665cb58d5636646fb8cae8b07fd9b66156bc9e592e18b653964487610f6c2b667fe6d1ccf1f12c3008cb5c9
SSDEEP 3072:djyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:1yLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T188847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbwtomgeywqojgey.exe

Path C:\Temp\dbwtomgeywqojgey.exe
Size 376KB
SHA256 50be1d43a94a82eadea578a39ba7050e80457047faf54bf0a046163080ea28ef
MD5 7fe7f26fc947921e2a51699a90b2954d
SHA1 a6c55ee2afc0b2ab38b1178f5557ae376f7bb994
SHA512 9ebcc934255ab9398dc1f32c248c07ee7fcaae07a31b9059bc36ef77f1f09c8d1527440e1c01c121600de431710a6c1f4c292d204cc3c92815f3c7fca2d5f73a
SSDEEP 3072:0jyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:qyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T186847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbwtomgeywqojgey.sys

Path C:\Temp\dbwtomgeywqojgey.sys
Size 293KB
SHA256 0695031a630e9dc5640897561b5bd35d5a5b9c5d89620ced5d4aecd8f38d2036
MD5 22024e30556f035a184d4e0410e971f7
SHA1 5d0f1e4e4e11a3fd0c47aad35422546c4acc24b1
SHA512 291f888739eb6f6c15a0c016984d13e5169e19ae49feb2d4bd4714fb03ede5bc5cd00da1a40e0a9a28ce2f8ad61d724c322ae7d6e95bc3116d66cdda41fa9069
SSDEEP 3072:qtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:qIJjiJcbI03GBc3ucY5DCSj
TLSH
T11C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxspkhcau.sys

Path C:\Temp\fzxspkhcau.sys
Size 293KB
SHA256 6bd16cf63cd1eebaef3c0f9af04ac4fb7654fccd77fee7fbde24eece83801487
MD5 507d3dcb4b12afb699c805f978832152
SHA1 6a58bb560657454e5c3509dd3ad3f5ff60538c8a
SHA512 fc15702f4bc1b28cf9b4e1bcc1fc645c3b67ffbebb8878f9a42699e7d38a992a2d1d11e836df5fe6496f8175be809844c73cb79db4b78fd46dfef10a70f879d9
SSDEEP 3072:UtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:UIJjiJcbI03GBc3ucY5DCSj
TLSH
T14B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywqomjey.exe

Path C:\Temp\geywqomjey.exe
Size 376KB
SHA256 6e8a6dfea425b02b58cca95cfbbe546da047555f794798da65ab34db3ee819f3
MD5 ae2a088938115d6c2e6a50d79a1d46e6
SHA1 f4310c2962e39f5d93bbf4357bf93e016d2113cf
SHA512 68fdb5ec7c8ec30bd57d3f380797a85ae71f4257e3d6095eb9428bc080b2e82d7bf11b1a9a863fbd95e2c247dcc4e7939531d28d32ea6f6b320077d148d1b5db
SSDEEP 3072:fjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:7yLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T15D847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_axspkicaus.exe

Path C:\Temp\i_axspkicaus.exe
Size 376KB
SHA256 b2e517e2bf3baa80d95d8cbb2e8193b2d48b33594f406ee6665a7e18d7abc727
MD5 c8861b2749a90a9b878197f484504bdd
SHA1 45aee3c9164957f7a76bcd9f914690dd7e6bba89
SHA512 9da345ac5e91c8d005e04065d21c9cf53dc8a5f7b5daff741a3aa7be99fbf3af981fa00943371e1619dd0e7d9af4f14416333261884c7ed2bb808690348d1cda
SSDEEP 3072:kjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:6yLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T185847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_aysqkidavs.exe

Path C:\Temp\i_aysqkidavs.exe
Size 376KB
SHA256 999796ab15b13c1b05ba361483321af641464abd9f9d24598e70021cf96d42da
MD5 388eff8aa84596e2042af2ecb383bc77
SHA1 3970c767a6da9a3c62299bab14c002c135b1d340
SHA512 438e9abc8c943c433c7302fac58b138c60b531edbab0996d645230ec7c212d68c38859bc2e8944043b98894a1333be65285c36c1310eb29aadd3242e2f83a023
SSDEEP 3072:IjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:WyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D9847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_geywqomjey.exe

Path C:\Temp\i_geywqomjey.exe
Size 376KB
SHA256 de2f3d1d4577bf8f166d5ac65915970218e74ba029c1b711611592c2ed8f355c
MD5 64db2dda4c0e63b78d22b397c94fdd26
SHA1 967c43317b3a6c8e689afb26ac9f21de92e1279e
SHA512 66d819b2e46cea7003cf4b17667bfdf59c43fe62cafbb68ac93e9cbb7e0a97feb903a2d77473afac3bbdef4f925f4ce121941c1a676e509d0cf48f98d77a92fe
SSDEEP 3072:tjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:lyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T178847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igavtolfdy.exe

Path C:\Temp\i_igavtolfdy.exe
Size 376KB
SHA256 adb325e2c9f1322c6334d9e323f32120552766c5fcca2b0206b0a9f78e461a5b
MD5 cf11d40f6b7c8e45b50539aab12cb08f
SHA1 f66279a41776d2770a4ca28a610d9ef56648b01d
SHA512 765240906bc69839b2a448f711e529f29336c955ef19fcd5a9a398d5b05fe8d016c409a81f288f0c9e041d618a4dc1f64807a667d428c796ebdf5979d44153b8
SSDEEP 3072:cjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:SyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T13F847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kifaysqkic.exe

Path C:\Temp\i_kifaysqkic.exe
Size 376KB
SHA256 af5e0681bae4cee9a94ba5ac86e666853d0219cb9a07046642b3b63d9693b0b9
MD5 f73e70781b9066f465e17867a97afb28
SHA1 703d57c2fbc0facd3bff6b914b4300b810499be5
SHA512 3dba05622e1e76dafd085dac2434c949518f83a338516bcd196a706f0bc4bf9695343858c1e015313556a0cf6453c821f0e8b21971f8c9f5d9971c8ac9bb89d4
SSDEEP 3072:gjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:uyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1CA847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igavtolfdy.exe

Path C:\Temp\igavtolfdy.exe
Size 376KB
SHA256 1ece67a89960eb5fdf6583b59ac75c3b0c6063a741ee39002a7e8ab5e6436a44
MD5 b0f857edecf260e42b827d4d9f792373
SHA1 c165be663563eefeae59af5ec53672556c9bcded
SHA512 7e6601295b86ce93d51ed0cbaf08f6993f48f644ea5eb121de3ccdfbab629ddc6c6b2a1f0cd3af965056e1048c6bf18b02500947be0c6505251e180dc77bfb5e
SSDEEP 3072:+jyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:QyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T13E847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kifaysqkic.exe

Path C:\Temp\kifaysqkic.exe
Size 376KB
SHA256 f07c04ebfac9c4cc2892c32a0985aa17423bb77e309c83e3b7f88aba602539b3
MD5 c5d3e8a76afe57443a40ff774be9b06c
SHA1 164e349b2a6ede0b4baacf853d976873ac18598f
SHA512 5cb8b6def10ddc52d406c84af6f081c3ccd19ed13c0373f116bfc980e4b28378a80320519a9ba18bcd709a602b03c33cc13b056c66b1b6779b0da41436a4dea5
SSDEEP 3072:ujyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:gyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T125847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlidbvtnlf.sys

Path C:\Temp\nlidbvtnlf.sys
Size 293KB
SHA256 a595288ef4c35a42edae3899682affcbda5736397c2709e8bf84a4c0be74babc
MD5 5853e38a584bf8bf0d0c6100027a2c5d
SHA1 8cecbedee39606c0a456c12b7e12b3f4e7fb9b96
SHA512 9739518438cd4a0fd1db600d570be621c5af9e0dc5afb88fcf2642f1841a7e7bba89adb5ee64cfcefac992bf8251b33d81216d1bb89f1e042a142f223850f995
SSDEEP 3072:GtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:GIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A9545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkicausnkf.sys

Path C:\Temp\pkicausnkf.sys
Size 293KB
SHA256 8c12ca5fc193a007f4ca68a4e0d805d0a0a9c96318846a3f07be4c0f1d3e66d6
MD5 d2617a517cbd571bd6c54da79c9dd2f2
SHA1 1771b4633f55519a8f16e7cd4e76370cb93e48a0
SHA512 de6e4ebce47f446d1e23a3337718fb20bc18b2909d886ed75e3edfb01e3bba294dc4c004ee62f24918678bee04fe2f65fbd4bfcb3744085b9cb77bfd3bf33723
SSDEEP 3072:NtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:NIJjiJcbI03GBc3ucY5DCSj
TLSH
T174545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlgdywqoi.sys

Path C:\Temp\tnlgdywqoi.sys
Size 293KB
SHA256 0dee3a918ed01edf88c280601dd6ec38f6a795bdda50f5224b7a985921f2fa41
MD5 aab2eced904ef085234f3c33329b3f9f
SHA1 c7089f478174ebea82e4c858e173b79b21c47ee1
SHA512 f0365d4766db5b1a110aaff31c15dec6a90eb3621b93a8177348950840804cad571dc2d135e62e3990b80350896e84ef28872e4804ad7821b7b0b4afe3756b31
SSDEEP 3072:gtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:gIJjiJcbI03GBc3ucY5DCSj
TLSH
T1DF545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpnifdxvqn.sys

Path C:\Temp\vpnifdxvqn.sys
Size 293KB
SHA256 a0fe573045b924ebb3d6341be747d9aa00b91b87559d59ec7db1fb4f19bb71f7
MD5 9ad46083106e66fa7d6e8451eba07d37
SHA1 085a4c59ac6f38c4960b6e14ebaf382b951726e2
SHA512 e94a049b014f33f61e77969a8d9074b4157fed8b94990d5b8eddcdcf4b10229cbe48b1a39c2ba2a20589b7685dfbb62ea073e5c1d1c17ab09da3e124e28973d0
SSDEEP 3072:7tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:7IJjiJcbI03GBc3ucY5DCSj
TLSH
T1E8545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

02a53dc9-8efa-48f6-981e-6ddb17d44b90.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\02a53dc9-8efa-48f6-981e-6ddb17d44b90.tmp
Size 40KB
SHA256 16a9339fde720ebbbc152e2e32adcfb77794d98fa8ff982e7cb42b01c3fc833f
MD5 2e0484896acb419eacb2b9313311c71d
SHA1 6c10fc5e45779cfca1e8362782c749f828a7df10
SHA512 ece1aad5568aab3f9fd556035bd314924c457b8c41c4ca4cdd9b74448053c54fa61f960fc2ea309b54c15dbdc4fc94331e353c6f57b5b37922ee5bf29b20f239
SSDEEP 768:W/UxvxjgC+l34wcZ0rfZW2YohpYoRBw4Ot5AEl94BHYjH+a4YGHZP:LZj3+l3TBVa5AEncHYj/4YUZP
TLSH
T11913B039E8B59D239CF6F785B60737879FF154A3A8C15ED889D85E0D0A8729E130780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

74e85d70-4e73-48ea-ab57-22211b1871a4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\74e85d70-4e73-48ea-ab57-22211b1871a4.tmp
Size 38KB
SHA256 8c6119584d48c81ae123be1e9addffe0a5131bc61c29ffec43629893b39df616
MD5 b14bd87264cf33bf52902b0aaaf2edf2
SHA1 204295e1105998bbab1980252d9657fc2a1a7ca0
SHA512 fb24e13748663f0c8478d45f3ac4621247de9e550884576722bc207063446885dae3f1c5bbcfc3ab8a234c70abd8ff5aa79cfc78c6b4bfe277f3ef2c79be6ad6
SSDEEP 768:z/UxvxjgC+b3/ScZ0rfZW2YohBBw4Ot5AEl94BHYj/MAFTN/:GZj3+b3OBVa5AEncHYjUAFB/
TLSH
T1AC03BF39DCA59923CCF6A785770B3347AFF19463A5C15ED489DC2E1E0A8729D130B80A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 91a032a4ffcdd10503afdeb5220904a7e7cea899c3a55606bb3e90180ed9472e
MD5 f04321ebc7aa4a8f91bb5362a6c4c79b
SHA1 c98d3283204e4a0453e416a04c3ae56e4c3feed8
SHA512 c2faa7fae738d85299e6f63b9eaf33c25db5a255ea3f5f6a8551842b7e0cec73c7e8b5e86a9cfb9714287d2b382b57b7249bc70671dbfde2815d5937243570af
TLSH
T1DED02B71F678E8D2C140043C00420920705035061F6801C207034038040324B55012C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 59619e39464102fa53912dd9a15237954c5125d546c48a72b8bdb58ad9eb9753
MD5 f80a0057aa895d42a15b594d07d09f76
SHA1 2478a67794a5362ccf809b7a2c8f64a03c72fa32
SHA512 4a9ec8459a11d9e573883d5eacfd5386cf838bad2bd0b33ff1b37017f5f2cf6bfcef877344a87892e3c49ce624e0cae52791ded1593b8233138de87fd2e5e634
TLSH
T1C6D02B75F668E9D2C140043C00410920706035066F6801C206030038040324B55022C7
MD5 SHA1 SHA512 TLSH

Submit Download

0f2071bb-473a-4d28-a2f7-701fdf5a12fd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0f2071bb-473a-4d28-a2f7-701fdf5a12fd.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3a5475f1-f4c2-46e6-b309-686bff13d305.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3a5475f1-f4c2-46e6-b309-686bff13d305.tmp
Size 11KB
SHA256 f6e57fb7b7e3abd0dda9a1e2d8ff747557aff241cf721f681b4a6fb1c590afd6
MD5 707af70d7b07324ca5a19f19fce3c2c1
SHA1 a667a344480cc21e2d7f5fd4825bf36df9f1e87a
SHA512 30f00e70e054e6dee74a5d76bd5a9765bd9311531e162cebfb40a7d2579aee90db4dd6a3a5ba8ad9e77a38b66d19b7662e642524a4d6b53142b60465bf336660
SSDEEP 192:sxRhRbCY/fjsDPzZSfcDaezoA8p9V/g6+WNIYiIaiGoIgDJrJ:sxRhAY/fjsDP9yTDj/5I0H
TLSH
T1AD42A755AD28AA7B9CC7E219FB65BF13D2F9603260D11E48E6FC861C05EB6DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

51d5588f-16fe-4bf1-bc72-fdadc3ee69ab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\51d5588f-16fe-4bf1-bc72-fdadc3ee69ab.tmp
Size 11KB
SHA256 62a91206cd6546e890447c90f7825b53b9015d09cf53f7e33a0cd10abffaf46e
MD5 fc6d640ff862f5adde82a365db493ae2
SHA1 1306910b6f9125a31e81bd9a937119075cb85618
SHA512 60d52372db7d65dfc6c7d6fcdcd69bd91013fbc3c21eb2c198723c3ebe7b31f1f319b099659565090cbeab37ee72c373054b2510fb4748cbfe856b98dd322aca
SSDEEP 192:sxRqRbCY/fjsQzZSfcDaezoA8p9s/g6+WNIYiVaiGoIgVrJ:sxRqAY/fjsQ9yTDq/5Iff
TLSH
T1C432A615AD28A97B9CCBE219FB65BF53D2F9203260D11E48E6FC861C04EB6DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6eb84710-c62b-4187-bfc6-91c35f0e35d7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6eb84710-c62b-4187-bfc6-91c35f0e35d7.tmp
Size 11KB
SHA256 f9647e2a8c066beb36f6c1ee9276a0a2d0583d2a6933ba677d22f8716dbc8455
MD5 396d33a6119d3559e2cf213ea58fd686
SHA1 a8198b60a087727dd07df416448d9296414671b4
SHA512 f1ab2e47e9dfc4d571b1ca8a30590f68f542b12e5970491f50ab5a7af9646e45f268a15a77c38ef20ac66fe2062a47f046248d6043e3a3cfda0948c51fcd7fa1
SSDEEP 192:sxRhRbCY/fjsMzZSfcDaezoA8p9s/g6+WNIYiVaiGoIgD7rJ:sxRhAY/fjsM9yTDq/5Ifl
TLSH
T16832A615AD28A97B9CCBE219FB65BF53D2F9603260D11E48E6FC861C04EB6DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

734b90b0-345c-46bc-af9b-18070805b0e5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\734b90b0-345c-46bc-af9b-18070805b0e5.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 420edc4b74eb8d4dae4ca4c628c0a6e5d310313060153e9f6fed4b4d2b4e7b82
MD5 79fc9841bb077478c000862fd23ff51b
SHA1 da9f13848a87fc89af98d0b1e6a3408cd7a811f0
SHA512 64c9f2bb97e8dc9972211b1b7b3ba1510336745e37109713e36fa9ece51c3217ace5d57c4a4df24b5e612c5a971d7cf8f3cfd8dea7b5e337b4c45496bbac8184
TLSH
T18C512BB1B67089DEF7480230A6D15C9F363106C0648B1FD217A8EBBCF55A39E40AC218
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9707e884bb863aa548b2fe559163d3be87615e29eb6cb1e2b576152c186aa00b
MD5 7ec7b92de54a2b6dfea8a8ab2a9cedf9
SHA1 70dea11771c7af6d5ab7ee0b645b071169b6b170
SHA512 50988e18e84b9604e411d57e413d5a0b34e1a830fbf56d91a864399f78e3a9b45240fc8e053052635a2724b3eda5139ca39e1fed05d4e8f243ae26add28a2f69
TLSH
T1D4513CB1B63049DDF7480230B6D15C9F363106C0748B1FD217A8EBBCF95A3AE40AC218
MD5 SHA1 SHA512 TLSH

Submit Download

cf2612e0-f5a0-49f3-a943-c125eb64c1bb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\cf2612e0-f5a0-49f3-a943-c125eb64c1bb.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

4ff7971b-965e-4fe5-97c4-925b2060a9fd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4ff7971b-965e-4fe5-97c4-925b2060a9fd.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

84d2628a-dc5f-4735-ab24-756f1ce31b9c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\84d2628a-dc5f-4735-ab24-756f1ce31b9c.tmp
Size 2KB
SHA256 26292ae2fb8b16f6c2a6a7b0501f20c674fc20a6ccfe67599ae06777c6bfa04f
MD5 9ea712bb4fc32a462fe21c03ff3d0655
SHA1 0ac21bd0e5cf9c1189351059a51f65afc751dd6f
SHA512 8d0b44cd27271062c60cdc892e14f391415a7cbcb3b876a1a680cc574dbfb807b431cb58966c3fd655d4bd20b486bb62fa43e0758b029f77821c658ed5d25d5a
TLSH
T1E351B0F3C2E8866EC91156F0AA146E2BCE1D0955432C3D5AC9E4EF1B93E34B1E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

d035af0e-75ec-4dad-9370-fd7b84289076.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d035af0e-75ec-4dad-9370-fd7b84289076.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 fbeb7c8de099251ba9cef3816ddca766094a2ca3fd6f3e77eba467c3f06f0d0d
MD5 0657b7338d4e0631b302e2d03b41d44f
SHA1 0e630cbe50f05377bc0ec7bc294ed994f369e8a9
SHA512 afb725bc42cd4b45a3126441b418670d740f23aa35b58cef300497754ae91ade746338e92502221371b6e17728c2b1eaf921f4fc3a37137256f5e749d771bdc7
SSDEEP 48:KUoIvK1+cTyPfqT/dFF+/VolI+f+KlLNh+5HuQgRJyVtIBKes8/:KUowK1+K64YKJmQ+tuKesw
TLSH
T1B3913320317B1241397E3514A4E49F6A074671A33464FA7F7BEA14928F6BE044DBDCEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

caab3858-5e92-4d7f-8d82-5ac30dbe0f5e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\caab3858-5e92-4d7f-8d82-5ac30dbe0f5e.tmp
Size 29KB
SHA256 be25bdfd36b8918da679b18d47f137a6f9cc0cbccf9e43025e2ab57dd5322d9b
MD5 b666ad618999e837dd9399cb467180d5
SHA1 94254b887b7121e18087d50d89194344181f4704
SHA512 1f7dc3d17a3d568ec469b96463716f7ad6f84f5636b047d51d8c857cc1596e971431d13fba3ace266a4ecb1c91f18d49b5035949f902d85c995125798c565f11
SSDEEP 768:XIDmY17pLuLbdoWgvHfnv8F1+UoAYDCx9Tuqh0VfUC9xbog/OVdQ3MIljOroTBy4:XIDmYDEbdoWgvHfnvu1jaeQ3MmjFTBy4
TLSH
T16AD2DB7B640DCB7F4F800ADDEC297A9B6DA802CB9698C94047FA941C02D6BEF51164DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

49631f1e-9bd7-48a9-8d2f-199f5a21f1bc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\49631f1e-9bd7-48a9-8d2f-199f5a21f1bc.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

b856e4c3-ec2f-4d97-9dd0-cfcab2f3c064.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b856e4c3-ec2f-4d97-9dd0-cfcab2f3c064.tmp
Size 34KB
SHA256 a40315cc30fa1a0050021553238eb94fec75f929c756f13bcca4896a6e9cbdbb
MD5 4da8a85fe29a997bb4a5d209499c11eb
SHA1 292ed7b3935056c7381c3191d734ca71fc962b79
SHA512 6460b999c7db09732632829fc99aed3424ecf573403c5893f6157127f0e07e9e2faf31fb69c4bc92d2b1e6d9e8274a52b38722a62402fbd8c7442e7067f2c343
SSDEEP 768:hA3YwcZ0rfZW2YohpYoWBw4Ot5AEl94BHYjH+a4YGHx1:hA3YBVa5AEncHYj/4YUx1
TLSH
T184F2AF74ECB58D639CFAF786FA0637865FF154A3A8C14EC4D8D86A1E094729E130781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1cc4c0dd-a8be-4f46-b10a-e82fa6ea9580.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\1cc4c0dd-a8be-4f46-b10a-e82fa6ea9580.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

5b0f2e05-5eff-4609-b1a7-ee99cfc94000.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\5b0f2e05-5eff-4609-b1a7-ee99cfc94000.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

69d6ff55-dbb9-4d74-81e9-1dee5eab183e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\69d6ff55-dbb9-4d74-81e9-1dee5eab183e.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

d8a754a1-91a0-497e-8aa4-2cb18aaad86c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d8a754a1-91a0-497e-8aa4-2cb18aaad86c.tmp
Size 37KB
SHA256 0e7d8eab5c317cbe8c188f8117f3b0925648e59d4677a6d3a740f1b3b7f59f6b
MD5 1eaa66e0584c79f460ef5aea49e7b6d5
SHA1 c2501fbe811416d23a7c01d2c7fe03dd7b987828
SHA512 150244f8ec8801ed1b35bc8dd6b972bd5a4e74cbf7a14486eacb9a59e2ec6062f4de6bc1c131c867c525c77e450df196a6189db3a54a4b71017496a9d56e4a01
SSDEEP 768:0FQT3YwgJ00zcW2YohpYo5Bw4Ot5AEl94BHYjH+a4YGHx1:XT3PBVa5AEncHYj/4YUx1
TLSH
T11D038D79DCA5CA67ACF7A7C6FB06764A9EF150A399C58DC4D9C86E0D04831DE130BC0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e15e9ec3-4ab9-4963-b541-6f23ac382a61.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e15e9ec3-4ab9-4963-b541-6f23ac382a61.tmp
Size 34KB
SHA256 508cd7a9afed19a49d252835f16462515012ece51b696f71f479ff83f12af351
MD5 7e3d57c9921b8b1dac902f391f827af5
SHA1 cc40197ffd3aadd9be12a616e891584ae64ab156
SHA512 4dba3539b216df920ba7a8eb650ac6262f7372a120f678b94c54f0e8dcfe9e1f79bbe466d07176a19d0c2e14ae68ce1086cc54e7e6f0f3c0061a6d5595ffb08d
SSDEEP 768:uA33wcZ0rfZW2YohpYoWBw4Ot5AEl94BHYjH+a4YGHx1:uA3BBVa5AEncHYj/4YUx1
TLSH
T1F2F2AF74ECB58D635CFAE786FA0637865FF154A3A8C14EC4D8D86A1E094729E130781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e08bbbf6-84a6-442e-a845-30902990baa3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e08bbbf6-84a6-442e-a845-30902990baa3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5d526c2a-60df-45a5-bcbc-8458764e5e5d.tmp

Path C:\Users\Admin\AppData\Local\Temp\5d526c2a-60df-45a5-bcbc-8458764e5e5d.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

c0bf4e5d-bf47-4b59-8e08-3e12854adafb.tmp

Path C:\Users\Admin\AppData\Local\Temp\c0bf4e5d-bf47-4b59-8e08-3e12854adafb.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2720_819064373\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2720_1011369711\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2720_1429826820\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2720_17169008\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2720_1835495011\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 18de459d7f2a66c785f3532de9a0de9711f6aca0bea73ebac1df6ed307aec797
MD5 eabc45568adac770f9db98ef59b64ab2
SHA1 6836920a0927ef520025e33a85bdaa6a2445d32a
SHA512 afe67c5e64297861c8e7762896b9e5feb4977ac3dab40521518512de155ee702b2a132d71a88b02c27ea8b7729dfe79ffecf2cbe896e916adc550673fe258b3a
TLSH
T18E71238357A8C6F2C1DA5BF102835644F6FB223C4B2330240FA1554AEB30ABA24B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1596-318-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1712-372-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1712-394-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1860-290-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1860-271-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2372-460-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2392-363-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2500-243-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2696-481-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2980-194-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3216-448-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3328-504-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3656-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3688-284-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4236-416-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4236-392-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4332-415-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4400-486-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4400-506-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5124-313-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5648-338-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5684-322-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6108-444-0x0000000000010000-0x00000000000AB000-memory.dmp

Download