systex | 70e13afbebefa25b5fb68c717621472eac3384399a19102929834cd5bdb95dc9

Analysis

max time kernel
149s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 02:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 365KB
Sample261011-daw1tsw15m
SHA256 70e13afbebefa25b5fb68c717621472eac3384399a19102929834cd5bdb95dc9
MD5 c61dd8dcb3ea3fd85c224fbbe287e6d6
SHA1 4274f4ae39cb6bdbf80bf4b43895865eeb3bad70
SHA512 6252315f801ee1551cfc66331fe7a8de50204018ec15f0e14809bbe3227b6631c2fc39c6d01b0d2993ef725c3cdf089bfd4b83b77cab4b9f026b89bcda6dbf04
SSDEEP 3072:Fuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:FuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T16C847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5928	usnkfdxvpnifaysq.exe
1916	usnkfdxvpnifaysq.sys
2408	CreateProcess.exe
2496	axvsnlfdxv.exe
4352	CreateProcess.exe
3148	CreateProcess.exe
2784	i_axvsnlfdxv.exe
5104	spkhcauspn.sys
5572	CreateProcess.exe
1880	spnhfcxvpn.exe
4592	CreateProcess.exe
3608	CreateProcess.exe
5608	i_spnhfcxvpn.exe
4632	smkecwupmh.sys
4612	CreateProcess.exe
3492	rpjhczxrpm.exe
4804	CreateProcess.exe
5528	CreateProcess.exe
4068	i_rpjhczxrpm.exe
3228	urpecwuomg.sys
3844	CreateProcess.exe
4140	pmgebwuomg.exe
4088	CreateProcess.exe
1132	CreateProcess.exe
3128	i_pmgebwuomg.exe
5056	trojhbztrl.sys
1996	CreateProcess.exe
1160	trmjeuomge.exe
856	CreateProcess.exe
2664	CreateProcess.exe
5904	i_trmjeuomge.exe
4300	qojgeywqom.sys
5692	CreateProcess.exe
2484	omjdbvtroj.exe
3884	CreateProcess.exe
3208	CreateProcess.exe
1296	i_omjdbvtroj.exe
3832	vtqligdbvt.sys
6048	CreateProcess.exe
5696	bytqlidbvt.exe
4580	CreateProcess.exe
4328	CreateProcess.exe
4292	i_bytqlidbvt.exe
2824	idbvtnlgdy.sys
2420	CreateProcess.exe
4736	vtnlfdaysq.exe
1668	CreateProcess.exe
716	CreateProcess.exe
3128	i_vtnlfdaysq.exe
5648	nifdavsqki.sys
2604	CreateProcess.exe
5024	qkigaysqki.exe
6068	CreateProcess.exe
4712	CreateProcess.exe
476	i_qkigaysqki.exe
2644	icausnkfdx.sys
2708	CreateProcess.exe
2648	cxvpnhfcxv.exe
6064	CreateProcess.exe
4292	CreateProcess.exe
4716	i_cxvpnhfcxv.exe
920	zxupnhfzxr.sys
2180	CreateProcess.exe
1088	zxupmkhczx.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4732_408100846\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4732_408100846\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4732_1374359455\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4732_408100846\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4732_22317032\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4732_282201175\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4732_282201175\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4732_1374359455\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4732_408100846\llm_user_input_extractor_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spnhfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trmjeuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmgebwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmgebwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omjdbvtroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxvpnhfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtnljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yoigaysqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_auspkhcauk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhczxrpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omjdbvtroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytqlidbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkigaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywrojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvtnljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlidbvsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bytqlidbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxupmkhczx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yoigaysqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spnhfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxupmkhczx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omkhezxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwrpjhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axvsnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhczxrpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlfdaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxvpnhfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omkhezxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwrpjhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywrojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpkhcaxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axvsnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trmjeuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkigaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlidbvsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpkhcaxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	auspkhcauk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usnkfdxvpnifaysq.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2940	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1724	ipconfig.exe
4492	ipconfig.exe
1172	ipconfig.exe
2132	ipconfig.exe
2920	ipconfig.exe
4768	ipconfig.exe
1128	ipconfig.exe
4264	ipconfig.exe
928	ipconfig.exe
4104	ipconfig.exe
5836	ipconfig.exe
5264	ipconfig.exe
1660	ipconfig.exe
4728	ipconfig.exe
4980	ipconfig.exe
3928	ipconfig.exe
2104	ipconfig.exe
6088	ipconfig.exe
3752	ipconfig.exe
1324	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2304238888-3968896904-642854331-1000\{1E2C2846-574E-4A16-9F01-95368DC282C6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5928	usnkfdxvpnifaysq.exe
5928	usnkfdxvpnifaysq.exe
5928	usnkfdxvpnifaysq.exe
5928	usnkfdxvpnifaysq.exe
5928	usnkfdxvpnifaysq.exe
5928	usnkfdxvpnifaysq.exe
5928	usnkfdxvpnifaysq.exe
5928	usnkfdxvpnifaysq.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe
4732	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2784	i_axvsnlfdxv.exe
Token: SeDebugPrivilege	5608	i_spnhfcxvpn.exe
Token: SeDebugPrivilege	4068	i_rpjhczxrpm.exe
Token: SeDebugPrivilege	3128	i_pmgebwuomg.exe
Token: SeDebugPrivilege	5904	i_trmjeuomge.exe
Token: SeDebugPrivilege	1296	i_omjdbvtroj.exe
Token: SeDebugPrivilege	4292	i_bytqlidbvt.exe
Token: SeDebugPrivilege	3128	i_vtnlfdaysq.exe
Token: SeDebugPrivilege	476	i_qkigaysqki.exe
Token: SeDebugPrivilege	4716	i_cxvpnhfcxv.exe
Token: SeDebugPrivilege	5308	i_zxupmkhczx.exe
Token: SeDebugPrivilege	2792	i_omkhezxrpj.exe
Token: SeDebugPrivilege	4848	i_ecwrpjhbzt.exe
Token: SeDebugPrivilege	5740	i_eywrojgbzt.exe
Token: SeDebugPrivilege	4064	i_ljdbvtnljd.exe
Token: SeDebugPrivilege	5540	i_yoigaysqoi.exe
Token: SeDebugPrivilege	5332	i_tnlidbvsqk.exe
Token: SeDebugPrivilege	928	i_snkfdxvpni.exe
Token: SeDebugPrivilege	4068	i_xrpkhcaxrp.exe
Token: SeDebugPrivilege	3216	i_auspkhcauk.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4732	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 5928	4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	89
PID 4552 wrote to memory of 5596	4552	2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	90
PID 5596 wrote to memory of 4732	5596	iexplore.exe	91
PID 4732 wrote to memory of 5384	4732	msedge.exe	92
PID 4732 wrote to memory of 2940	4732	msedge.exe	93
PID 4732 wrote to memory of 5684	4732	msedge.exe	94
PID 4732 wrote to memory of 5684	4732	msedge.exe	94
PID 4732 wrote to memory of 4448	4732	msedge.exe	95
PID 4732 wrote to memory of 4448	4732	msedge.exe	95
PID 4732 wrote to memory of 4448	4732	msedge.exe	95
PID 4732 wrote to memory of 3612	4732	msedge.exe	97
PID 4732 wrote to memory of 3612	4732	msedge.exe	97
PID 4732 wrote to memory of 5560	4732	msedge.exe	98
PID 4732 wrote to memory of 3612	4732	msedge.exe	97
PID 4732 wrote to memory of 5560	4732	msedge.exe	98
PID 4732 wrote to memory of 5560	4732	msedge.exe	98
PID 4732 wrote to memory of 4240	4732	msedge.exe	99
PID 4732 wrote to memory of 5860	4732	msedge.exe	100
PID 4732 wrote to memory of 4240	4732	msedge.exe	99
PID 4732 wrote to memory of 4240	4732	msedge.exe	99
PID 4732 wrote to memory of 5860	4732	msedge.exe	100
PID 4732 wrote to memory of 5860	4732	msedge.exe	100
PID 4732 wrote to memory of 3940	4732	msedge.exe	101
PID 4732 wrote to memory of 3940	4732	msedge.exe	101
PID 4732 wrote to memory of 3252	4732	msedge.exe	105
PID 4732 wrote to memory of 3220	4732	msedge.exe	106
PID 4732 wrote to memory of 3252	4732	msedge.exe	105
PID 4732 wrote to memory of 3220	4732	msedge.exe	106
PID 5928 wrote to memory of 2408	5928	usnkfdxvpnifaysq.exe	107
PID 4732 wrote to memory of 3412	4732	msedge.exe	110
PID 2496 wrote to memory of 4352	2496	axvsnlfdxv.exe	113
PID 4732 wrote to memory of 3060	4732	msedge.exe	117
PID 4732 wrote to memory of 3060	4732	msedge.exe	117
PID 4732 wrote to memory of 5996	4732	msedge.exe	118
PID 4732 wrote to memory of 5996	4732	msedge.exe	118
PID 5928 wrote to memory of 3148	5928	usnkfdxvpnifaysq.exe	119
PID 5928 wrote to memory of 5572	5928	usnkfdxvpnifaysq.exe	123
PID 1880 wrote to memory of 4592	1880	spnhfcxvpn.exe	125
PID 5928 wrote to memory of 3608	5928	usnkfdxvpnifaysq.exe	128
PID 5928 wrote to memory of 4612	5928	usnkfdxvpnifaysq.exe	132
PID 3492 wrote to memory of 4804	3492	rpjhczxrpm.exe	134
PID 5928 wrote to memory of 5528	5928	usnkfdxvpnifaysq.exe	137
PID 5928 wrote to memory of 3844	5928	usnkfdxvpnifaysq.exe	141
PID 4140 wrote to memory of 4088	4140	pmgebwuomg.exe	143
PID 5928 wrote to memory of 1132	5928	usnkfdxvpnifaysq.exe	147
PID 4732 wrote to memory of 5804	4732	msedge.exe	149
PID 4732 wrote to memory of 5632	4732	msedge.exe	150
PID 4732 wrote to memory of 2784	4732	msedge.exe	151
PID 5928 wrote to memory of 1996	5928	usnkfdxvpnifaysq.exe	154
PID 1160 wrote to memory of 856	1160	trmjeuomge.exe	156
PID 5928 wrote to memory of 2664	5928	usnkfdxvpnifaysq.exe	159
PID 5928 wrote to memory of 5692	5928	usnkfdxvpnifaysq.exe	163
PID 2484 wrote to memory of 3884	2484	omjdbvtroj.exe	165
PID 5928 wrote to memory of 3208	5928	usnkfdxvpnifaysq.exe	168
PID 5928 wrote to memory of 6048	5928	usnkfdxvpnifaysq.exe	172
PID 5696 wrote to memory of 4580	5696	bytqlidbvt.exe	174
PID 5928 wrote to memory of 4328	5928	usnkfdxvpnifaysq.exe	177
PID 5928 wrote to memory of 2420	5928	usnkfdxvpnifaysq.exe	181
PID 4736 wrote to memory of 1668	4736	vtnlfdaysq.exe	183
PID 5928 wrote to memory of 716	5928	usnkfdxvpnifaysq.exe	186
PID 4732 wrote to memory of 552	4732	msedge.exe	188
PID 4732 wrote to memory of 552	4732	msedge.exe	188
PID 5928 wrote to memory of 2604	5928	usnkfdxvpnifaysq.exe	194
PID 5024 wrote to memory of 6068	5024	qkigaysqki.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-10_c61dd8dcb3ea3fd85c224fbbe287e6d6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Temp\usnkfdxvpnifaysq.exe
  C:\Temp\usnkfdxvpnifaysq.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5928
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\axvsnlfdxv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2408
  - - C:\Temp\axvsnlfdxv.exe
      C:\Temp\axvsnlfdxv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2496
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4352
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_axvsnlfdxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3148
  - - C:\Temp\i_axvsnlfdxv.exe
      C:\Temp\i_axvsnlfdxv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2784
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spnhfcxvpn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5572
  - - C:\Temp\spnhfcxvpn.exe
      C:\Temp\spnhfcxvpn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1880
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4592
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5264
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spnhfcxvpn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3608
  - - C:\Temp\i_spnhfcxvpn.exe
      C:\Temp\i_spnhfcxvpn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5608
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpjhczxrpm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4612
  - - C:\Temp\rpjhczxrpm.exe
      C:\Temp\rpjhczxrpm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3492
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4804
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4492
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpjhczxrpm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5528
  - - C:\Temp\i_rpjhczxrpm.exe
      C:\Temp\i_rpjhczxrpm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4068
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmgebwuomg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3844
  - - C:\Temp\pmgebwuomg.exe
      C:\Temp\pmgebwuomg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4140
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4088
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1660
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmgebwuomg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1132
  - - C:\Temp\i_pmgebwuomg.exe
      C:\Temp\i_pmgebwuomg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3128
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trmjeuomge.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1996
  - - C:\Temp\trmjeuomge.exe
      C:\Temp\trmjeuomge.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1160
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:856
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1128
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trmjeuomge.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2664
  - - C:\Temp\i_trmjeuomge.exe
      C:\Temp\i_trmjeuomge.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5904
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omjdbvtroj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5692
  - - C:\Temp\omjdbvtroj.exe
      C:\Temp\omjdbvtroj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2484
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3884
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2104
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omjdbvtroj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3208
  - - C:\Temp\i_omjdbvtroj.exe
      C:\Temp\i_omjdbvtroj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1296
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bytqlidbvt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6048
  - - C:\Temp\bytqlidbvt.exe
      C:\Temp\bytqlidbvt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5696
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4580
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4264
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bytqlidbvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4328
  - - C:\Temp\i_bytqlidbvt.exe
      C:\Temp\i_bytqlidbvt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4292
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnlfdaysq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2420
  - - C:\Temp\vtnlfdaysq.exe
      C:\Temp\vtnlfdaysq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4736
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1668
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4728
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnlfdaysq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:716
  - - C:\Temp\i_vtnlfdaysq.exe
      C:\Temp\i_vtnlfdaysq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3128
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qkigaysqki.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2604
  - - C:\Temp\qkigaysqki.exe
      C:\Temp\qkigaysqki.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5024
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6068
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1172
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qkigaysqki.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4712
  - - C:\Temp\i_qkigaysqki.exe
      C:\Temp\i_qkigaysqki.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:476
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cxvpnhfcxv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2708
  - - C:\Temp\cxvpnhfcxv.exe
      C:\Temp\cxvpnhfcxv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2648
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6064
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6088
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cxvpnhfcxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4292
  - - C:\Temp\i_cxvpnhfcxv.exe
      C:\Temp\i_cxvpnhfcxv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxupmkhczx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2180
  - - C:\Temp\zxupmkhczx.exe
      C:\Temp\zxupmkhczx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1088
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4524
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4980
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxupmkhczx.exe ups_ins
    3⤵
    PID:5880
  - - C:\Temp\i_zxupmkhczx.exe
      C:\Temp\i_zxupmkhczx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5308
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omkhezxrpj.exe ups_run
    3⤵
    PID:2312
  - - C:\Temp\omkhezxrpj.exe
      C:\Temp\omkhezxrpj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3044
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:200
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3928
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omkhezxrpj.exe ups_ins
    3⤵
    PID:3832
  - - C:\Temp\i_omkhezxrpj.exe
      C:\Temp\i_omkhezxrpj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2792
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwrpjhbzt.exe ups_run
    3⤵
    PID:5996
  - - C:\Temp\ecwrpjhbzt.exe
      C:\Temp\ecwrpjhbzt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3732
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5568
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:928
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwrpjhbzt.exe ups_ins
    3⤵
    PID:3464
  - - C:\Temp\i_ecwrpjhbzt.exe
      C:\Temp\i_ecwrpjhbzt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4848
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eywrojgbzt.exe ups_run
    3⤵
    PID:2536
  - - C:\Temp\eywrojgbzt.exe
      C:\Temp\eywrojgbzt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2368
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5920
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4104
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eywrojgbzt.exe ups_ins
    3⤵
    PID:2188
  - - C:\Temp\i_eywrojgbzt.exe
      C:\Temp\i_eywrojgbzt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5740
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdbvtnljd.exe ups_run
    3⤵
    PID:2644
  - - C:\Temp\ljdbvtnljd.exe
      C:\Temp\ljdbvtnljd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2396
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3756
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2132
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdbvtnljd.exe ups_ins
    3⤵
    PID:1920
  - - C:\Temp\i_ljdbvtnljd.exe
      C:\Temp\i_ljdbvtnljd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yoigaysqoi.exe ups_run
    3⤵
    PID:4960
  - - C:\Temp\yoigaysqoi.exe
      C:\Temp\yoigaysqoi.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4560
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3080
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3752
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yoigaysqoi.exe ups_ins
    3⤵
    PID:4488
  - - C:\Temp\i_yoigaysqoi.exe
      C:\Temp\i_yoigaysqoi.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tnlidbvsqk.exe ups_run
    3⤵
    PID:3028
  - - C:\Temp\tnlidbvsqk.exe
      C:\Temp\tnlidbvsqk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4496
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5300
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1324
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tnlidbvsqk.exe ups_ins
    3⤵
    PID:1508
  - - C:\Temp\i_tnlidbvsqk.exe
      C:\Temp\i_tnlidbvsqk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\snkfdxvpni.exe ups_run
    3⤵
    PID:2588
  - - C:\Temp\snkfdxvpni.exe
      C:\Temp\snkfdxvpni.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4092
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1560
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1724
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_snkfdxvpni.exe ups_ins
    3⤵
    PID:3460
  - - C:\Temp\i_snkfdxvpni.exe
      C:\Temp\i_snkfdxvpni.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:928
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpkhcaxrp.exe ups_run
    3⤵
    PID:4848
  - - C:\Temp\xrpkhcaxrp.exe
      C:\Temp\xrpkhcaxrp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4640
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2500
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2920
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpkhcaxrp.exe ups_ins
    3⤵
    PID:4384
  - - C:\Temp\i_xrpkhcaxrp.exe
      C:\Temp\i_xrpkhcaxrp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4068
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\auspkhcauk.exe ups_run
    3⤵
    PID:2160
  - - C:\Temp\auspkhcauk.exe
      C:\Temp\auspkhcauk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5428
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4880
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4768
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_auspkhcauk.exe ups_ins
    3⤵
    PID:5808
  - - C:\Temp\i_auspkhcauk.exe
      C:\Temp\i_auspkhcauk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3216
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ff95f20c188,0x7ff95f20c194,0x7ff95f20c1a0
      4⤵
      PID:5384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,16642192124795859669,17447834167766991085,524288 --field-trial-handle=2256,i,2438308890738045984,15409995342753659019,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:11
      4⤵
      System Time Discovery
      PID:2940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,18039337943941612080,17130553715971334482,524288 --field-trial-handle=2256,i,2438308890738045984,15409995342753659019,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:13
      4⤵
      PID:5684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,5735719294376313116,17814917724407082963,262144 --field-trial-handle=2256,i,2438308890738045984,15409995342753659019,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
      4⤵
      PID:4448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,5287567396291112735,11407523036015041239,2097152 --field-trial-handle=2256,i,2438308890738045984,15409995342753659019,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
      4⤵
      PID:3612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,8654732372801620107,12054062412844256280,2097152 --field-trial-handle=2256,i,2438308890738045984,15409995342753659019,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
      4⤵
      PID:5560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,15613123230440703212,15617067891629932265,2097152 --field-trial-handle=2256,i,2438308890738045984,15409995342753659019,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
      4⤵
      PID:4240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,2944890050647521355,3020267788782942091,2097152 --field-trial-handle=2256,i,2438308890738045984,15409995342753659019,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:9
      4⤵
      PID:5860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,12604624189670327054,17483689027999904958,524288 --field-trial-handle=2256,i,2438308890738045984,15409995342753659019,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:14
      4⤵
      PID:3940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,8902532190346207269,5419340403644530527,524288 --field-trial-handle=2256,i,2438308890738045984,15409995342753659019,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
      4⤵
      PID:3252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,10738863241420329003,16359741960768096359,524288 --field-trial-handle=2256,i,2438308890738045984,15409995342753659019,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:14
      4⤵
      PID:3220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,8530100076808883057,17542237669510269842,524288 --field-trial-handle=2256,i,2438308890738045984,15409995342753659019,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
      4⤵
      PID:856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,8530100076808883057,17542237669510269842,524288 --field-trial-handle=2256,i,2438308890738045984,15409995342753659019,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
      4⤵
      PID:3412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,16538347433792240896,18341053360939903515,524288 --field-trial-handle=2256,i,2438308890738045984,15409995342753659019,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:14
      4⤵
      PID:3060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,16657977754509972092,11390979010500732702,524288 --field-trial-handle=2256,i,2438308890738045984,15409995342753659019,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:14
      4⤵
      PID:5996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,17997954563837670104,2182981949858843169,524288 --field-trial-handle=2256,i,2438308890738045984,15409995342753659019,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:14
      4⤵
      PID:5804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,10126415783916807041,1520537101574541463,524288 --field-trial-handle=2256,i,2438308890738045984,15409995342753659019,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:14
      4⤵
      PID:5632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,6411869993666196773,11422221773650489474,524288 --field-trial-handle=2256,i,2438308890738045984,15409995342753659019,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
      4⤵
      PID:2784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,1422981465377672813,18438504344778374568,524288 --field-trial-handle=2256,i,2438308890738045984,15409995342753659019,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:14
      4⤵
      PID:552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,13075118073459104678,7238177205385821350,524288 --field-trial-handle=2256,i,2438308890738045984,15409995342753659019,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
      4⤵
      PID:928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,10340917400047237559,14869569884107068006,524288 --field-trial-handle=2256,i,2438308890738045984,15409995342753659019,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14
      4⤵
      PID:292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5588,i,3204847510477200587,12506615382816007279,524288 --field-trial-handle=2256,i,2438308890738045984,15409995342753659019,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
      4⤵
      PID:2764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5872,i,14748761564641311477,3488679978258322737,262144 --field-trial-handle=2256,i,2438308890738045984,15409995342753659019,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:10
      4⤵
      PID:4692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2652,i,17817330855535994299,11634079174774839685,524288 --field-trial-handle=2256,i,2438308890738045984,15409995342753659019,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:14
      4⤵
      PID:2864

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6088

C:\Temp\usnkfdxvpnifaysq.sys
C:\Temp\usnkfdxvpnifaysq.sys
1⤵
- Executes dropped EXE
PID:1916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5328

C:\Temp\spkhcauspn.sys
C:\Temp\spkhcauspn.sys
1⤵
- Executes dropped EXE
PID:5104

C:\Temp\smkecwupmh.sys
C:\Temp\smkecwupmh.sys
1⤵
- Executes dropped EXE
PID:4632

C:\Temp\urpecwuomg.sys
C:\Temp\urpecwuomg.sys
1⤵
- Executes dropped EXE
PID:3228

C:\Temp\trojhbztrl.sys
C:\Temp\trojhbztrl.sys
1⤵
- Executes dropped EXE
PID:5056

C:\Temp\qojgeywqom.sys
C:\Temp\qojgeywqom.sys
1⤵
- Executes dropped EXE
PID:4300

C:\Temp\vtqligdbvt.sys
C:\Temp\vtqligdbvt.sys
1⤵
- Executes dropped EXE
PID:3832

C:\Temp\idbvtnlgdy.sys
C:\Temp\idbvtnlgdy.sys
1⤵
- Executes dropped EXE
PID:2824

C:\Temp\nifdavsqki.sys
C:\Temp\nifdavsqki.sys
1⤵
- Executes dropped EXE
PID:5648

C:\Temp\icausnkfdx.sys
C:\Temp\icausnkfdx.sys
1⤵
- Executes dropped EXE
PID:2644

C:\Temp\zxupnhfzxr.sys
C:\Temp\zxupnhfzxr.sys
1⤵
- Executes dropped EXE
PID:920

C:\Temp\xupnhezwus.sys
C:\Temp\xupnhezwus.sys
1⤵
PID:3404

C:\Temp\ecwuomhezx.sys
C:\Temp\ecwuomhezx.sys
1⤵
PID:2568

C:\Temp\bzwromgebz.sys
C:\Temp\bzwromgebz.sys
1⤵
PID:3204

C:\Temp\jgbywtnljd.sys
C:\Temp\jgbywtnljd.sys
1⤵
PID:1268

C:\Temp\ywqoigaytq.sys
C:\Temp\ywqoigaytq.sys
1⤵
PID:928

C:\Temp\xvqnigdyvq.sys
C:\Temp\xvqnigdyvq.sys
1⤵
PID:2436

C:\Temp\vsnlfdxvpn.sys
C:\Temp\vsnlfdxvpn.sys
1⤵
PID:2192

C:\Temp\icausnkfvs.sys
C:\Temp\icausnkfvs.sys
1⤵
PID:4272

C:\Temp\zxusmkecxu.sys
C:\Temp\zxusmkecxu.sys
1⤵
PID:3716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

axvsnlfdxv.exe

Path C:\Temp\axvsnlfdxv.exe
Size 365KB
SHA256 fa0dc0902d535d6ce881744b5599eb102247a96ec702003ec624fc2e6336caeb
MD5 8a275e64b634a78609b4c20285d26d5f
SHA1 b1880b44d5b199c3e3f0959fde925a42ed101b6c
SHA512 34b0bef8bd7011bfbcfec1ac69d259d8b0ebb7ee680160cc045cd0b3017d720e86c64445d7d7eb342f550129786069de4a8aa2408bfbb2c3a1e5a7bd00c9e418
SSDEEP 3072:Uuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:UuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B2847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_axvsnlfdxv.exe

Path C:\Temp\i_axvsnlfdxv.exe
Size 365KB
SHA256 c0ebda678da360790d072abd291c3ee5703c505a615a1912745472d4383d3305
MD5 90f13ef26d6dc52215a475a5f3021b22
SHA1 995926549079885a3c6c11085c8d87bfb101516c
SHA512 cbb8dba7b3c6d9ce7f5efec76e3c678f169dff9aeb2e3f516c22c5491d1b85220640990f09515bf605372808e42b5032d49c65620bd4999cf9e2d2c1e00a4bb9
SSDEEP 3072:iuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:iuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AD847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pmgebwuomg.exe

Path C:\Temp\i_pmgebwuomg.exe
Size 365KB
SHA256 f4daf6f0e209ad70659531ee8996d085201f8f9a8bc6b721b43ef7ea7d6c8e41
MD5 b24c09f00582c918654506987956c670
SHA1 3ae3be5167282354c4212c99b759964d5f53f669
SHA512 396dcd79d37ed6314a7a13c7fdcf690d96ec7b325af2e0e3dacabe7176b3decbf201ef7134d05ccc5473ab41d9a02c8f5c8c912a72454e6c72673057eb7aec3d
SSDEEP 3072:Suxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:SuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T13B847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rpjhczxrpm.exe

Path C:\Temp\i_rpjhczxrpm.exe
Size 365KB
SHA256 c3eb4dc56cbfb4af05a2c6b868b2cd0b5c9237b81f8275da8e95227caa4cb8c7
MD5 cce7b3fca1cd7c86bfa91f00053da421
SHA1 5d4659da9d220b3c3323aa982e59fedc4168daf1
SHA512 547aa214eaca368fa6caa7d5334e43f6414180aac6c73390ecc4dba7c8a710270c516ae7934ba8ccb23860a9ff58b63e5be23a4d9a3a514fccbb399cd5602e39
SSDEEP 3072:muxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:muxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T195847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_spnhfcxvpn.exe

Path C:\Temp\i_spnhfcxvpn.exe
Size 365KB
SHA256 066cfcb5c636cdc6cbf7911493ce9596d7be092f4249764845cf1c55383e9db1
MD5 3bd9f83d7932e5262100fee29c486263
SHA1 8d6139d5eb6a8dff6b6950ac4af11245773bd581
SHA512 2da88c37db2fe4b73296cc777b9002dd84a74f4cfd392b3694901e2249e3f6df75c49fd02202650a789a5bcbad45df3ef4c1352a9c47d22f6b1aa7b40574fc2a
SSDEEP 3072:euxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:euxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T16C847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_trmjeuomge.exe

Path C:\Temp\i_trmjeuomge.exe
Size 365KB
SHA256 184c9aabe5767426c541c4308aa0c9dfffea53f3a606d1b85ffb083f53d32ae5
MD5 2d1aae9e0e734feeb5933e8348e736f8
SHA1 0437fe210fa9229106b683b55f9f958e5b5f4f4a
SHA512 578418533cc224f70b07a16d8acac01760bb0c2914c116788672cb876283b3429db8e0119d48e54c5937d2434e8ff7ccf1c0157a5f67820ee8e06fe3e789e057
SSDEEP 3072:puxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:puxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T17F847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omjdbvtroj.exe

Path C:\Temp\omjdbvtroj.exe
Size 365KB
SHA256 cb21c2a3762a1c5a191a4bfa40e60354e8629e401700e03548c30fc57837a625
MD5 2b83c9cd94ef33d565ec15f348ea4188
SHA1 c06efbe1742de9c00426c8af080432106de4867b
SHA512 6e289611eb4f0a847a908d3b023b8c9fb6a637493cee2d59350cd9464feca424105d45d93902870a534484667392147ca6213e59b48a3122e0817ce6ef13cce6
SSDEEP 3072:Zuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:ZuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C5847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmgebwuomg.exe

Path C:\Temp\pmgebwuomg.exe
Size 365KB
SHA256 8833438bd7dc14bbc8785f8977b6d55acae4b7d674ac3cab2ab72734cda70032
MD5 310292e8f5370bc1cf7323e290714c0d
SHA1 f394f43854054b6a4cceafdd01e616c6a1e26196
SHA512 0cf445df365c463697080fadae3cb000d2803b1e3fa976491ca3686f9ed23a16d4f77367a454425741f7ec1ce9a10d159cf88d3fe58ce1d0b54637ecb4f4fff2
SSDEEP 3072:rruxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBL7:PuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T153847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qojgeywqom.sys

Path C:\Temp\qojgeywqom.sys
Size 293KB
SHA256 5e3b7a5390845fe98c0ceef559834ccae286435f6babc16087e6e0445eddede5
MD5 c77ff51e051dd5e170dd38b5f36d5f5e
SHA1 a783e3945a4b6bfc6561e2cee88d1915e845dee1
SHA512 356a9ff3af527e36cebb13050704f00ce9e7fe1dbaa1b55121c3615cb7cd47c055c4150e41ecd85bbbc7d14c9f9640c63e53c08c0185961de8dacaa37620df17
SSDEEP 3072:NtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:NIJjiJcbI03GBc3ucY5DCSj
TLSH
T141545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpjhczxrpm.exe

Path C:\Temp\rpjhczxrpm.exe
Size 365KB
SHA256 69a2b7096e106cbc932aafebcb043eb9a2d8c0c978958edbfd4fd595a6818a22
MD5 5eadabae67833b65b7c2fac8efb9059b
SHA1 608ab6552b6e4755e6696efd4361c9cba7ee41c5
SHA512 691a353d62d3849d00600b22ee51357929d700f9753b1b31de00227f8bc3f902e087adfaa7812da3c21eca6a3cdc280a43e08a3c078584e54d34434f557a682d
SSDEEP 3072:Puxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:PuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1BD847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smkecwupmh.sys

Path C:\Temp\smkecwupmh.sys
Size 293KB
SHA256 9ef9320065f93acbee32cb1cbafeb3b46ad75df5ec6de2fbe34e4c118616b0fe
MD5 dcd2f4c6f8e882ef33214b59314ac63b
SHA1 62f94f371466bef3dc4f1ccfdba0cfccc6c818a0
SHA512 be1d0f731e1c09c2713e9ebdef666768d10ba26dc96e4872bdd43fc9275a2a5957614ad1b056455802aefa54804c958ebf52de635746edecd95a1b482cae3ae1
SSDEEP 3072:mtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:mIJjiJcbI03GBc3ucY5DCSj
TLSH
T171545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spkhcauspn.sys

Path C:\Temp\spkhcauspn.sys
Size 293KB
SHA256 0b89809d52f4a92dc89b51c7084fe9908ee1ed261eb97dd60ae48c923268256d
MD5 95e54a9cbf2c03fbdbd59faa8c640058
SHA1 2ee2255a9dec517033161895421ea7325dd8548a
SHA512 6706fed72e39c03139b495a5dc01dd9a7560eb1878f769351c82f0f410f83b29e1ba0f16be37942313a0c07b7160c2c584923613f567ddee87b69acc8020be86
SSDEEP 3072:TtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:TIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A6545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spnhfcxvpn.exe

Path C:\Temp\spnhfcxvpn.exe
Size 365KB
SHA256 156c6340d118eac9ba4dcef1a04529ada141c9c9b51f339c3cae81738c382fde
MD5 53bbd28211324c39d735c5ee354b8d8a
SHA1 5e07b7ccba29a1dbfeee7b6fa94d655c83c1ad39
SHA512 2522054d314159ea7bcb00871425a48a282fd7ffbe00847a20e2cd9dbfd15c6259f1bb959ac30bcb96110d60e91c8bd5fe9a1594a6e20ee33cd4be23f80b3b15
SSDEEP 3072:Ouxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:OuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A7847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trmjeuomge.exe

Path C:\Temp\trmjeuomge.exe
Size 365KB
SHA256 bfe3077e2ebdbc42544a5af1c1ccdea100ee0b65c99f58f5e66a8f510ecfdce7
MD5 a567c3768d0a1fec6ce0257791e6f55d
SHA1 746eede3e68afbb69af8d0c16e7395ba780a8e01
SHA512 c857a002ccb71568b3d96ae7c7fc762f9693c004bac1cd42bff258356fe58c07219a425cad2706410b7bbaeaadf86556ae6b1ddc3290c6bf2b70eba4655a03cb
SSDEEP 3072:tuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:tuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T135847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trojhbztrl.sys

Path C:\Temp\trojhbztrl.sys
Size 293KB
SHA256 95face59e7c82cba0cae60275d05d2eb2620ec71e41bef29c63d81695b428045
MD5 d691710cb3d4cb453939bb29363feea9
SHA1 67696fd63ac8e0ed90d46b327924d7aab236305f
SHA512 a499be63166717be4ef3e68a43f36ec3c3e83e22a3fd29a83ba853c9bcee1fd0095f811839aacbc8a90aee4fd79febb2e19ecb6d603b77911772ae8d0162effb
SSDEEP 3072:RtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9Ed3:RIJjiJcbI03GBc3ucY5DCSj
TLSH
T175545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urpecwuomg.sys

Path C:\Temp\urpecwuomg.sys
Size 293KB
SHA256 de13251f9190df5cca901e92cf551ce5c4cbeb9e37e4ac543199c1644a463344
MD5 d11a611816181eeb0a6eca9c8705f124
SHA1 92a2b77d4cd1b765e60e23454976bcd045d72af3
SHA512 0a18658d647f1658da41bee8a5ede7b270e2e7542fcd20eec16182967da4d7fea2e111a6195bcc732e483a9a090994cd4ee9548f3cacff99d9dfe4f09755790d
SSDEEP 3072:ntKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:nIJjiJcbI03GBc3ucY5DCSj
TLSH
T15A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usnkfdxvpnifaysq.exe

Path C:\Temp\usnkfdxvpnifaysq.exe
Size 365KB
SHA256 78a7632604126086ce7324da3962a3a3cc9421d05995dc75f314e932e8c79e33
MD5 8554a03a425816612d4a383bfd0120e2
SHA1 d8eb3144fecd9d30eaeeea75b5f737730ff6cdd6
SHA512 7d6817c2c10f9315f48185da93a6e53acb40dc327c3452f6eb7de9a08f8cd3907fb1a8cb4d8ba308ff4f136731de4a92525e623b931915e3568456aac107be17
SSDEEP 3072:Yuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:YuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T12A847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usnkfdxvpnifaysq.sys

Path C:\Temp\usnkfdxvpnifaysq.sys
Size 293KB
SHA256 7f4fed610540f79d1aea7f050716ced5c0b11e6768e8ea1eec60383f9e5666c9
MD5 6aba61f8a74c914d404a41e99b6ad364
SHA1 e5212e565a251dacfc7887775c0d329e3c92397d
SHA512 908c6e4c93c2ff39dcd875723d03347c28df9c5f12fba6ed96ff33c112664add4cd1efce6ee66ae99de513d778bb116a6e90aaaf29ca98926d715d8c3b084654
SSDEEP 3072:YtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:YIJjiJcbI03GBc3ucY5DCSj
TLSH
T19D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

09640cef-54f4-4e66-a7b5-2d0883a8960e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\09640cef-54f4-4e66-a7b5-2d0883a8960e.tmp
Size 42KB
SHA256 2c86a1e468833091c3175316f165f9ed4014d04698c0a0a5055d7633764848be
MD5 bf3ff344393abeb6f64b5841639f6656
SHA1 93abbc79ba462ac22e40637d5b068d64b832f8c6
SHA512 b64cd2a194befd3214f0ae6db422b01ca009a61f2351e462187ef4b8ce5b06e034cc1948a577dc4b9a17b6c25bedb78001215bb96237011b4e7fe038028f4531
SSDEEP 768:+KFQz3dwgiZHXO5pgYA8MIYNa8S5oYklnA+Z3m:+xz3eKSmTWRdAOm
TLSH
T1F51328F598D39A73E8AE4787A37D6E429DBCD163B5885994B7D80D4CCC822BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

37ea9656-c6b3-40c1-9bc2-f5ded54cf86a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\37ea9656-c6b3-40c1-9bc2-f5ded54cf86a.tmp
Size 38KB
SHA256 7cb8bf68e4fb14dd60e884cf1ff7d899de8a09063f8a86300bc0b15e856de99e
MD5 405645d8326f9e59124cdaa6ff533f79
SHA1 02769b732b66a90325f7d5b02da3b5b464749d84
SHA512 96713449ffe06ddf596697e840de3be28d85669721959f00e07cba31b803c3177fdb98c75691378129da4ef402005ff31bbba4e496c6e5d8c0a6ee63774d0904
SSDEEP 768:do/UxvxjgC+23lfISO5pgCJMIYNa8S5oYklnAagSH8L4:nZj3+23VQTHTWRdAzS04
TLSH
T14E03C03AAC946D73CCF653C4760A9347AEF55263E0C169F88AEC1F0E16C72AD5303452
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9a1d37d7-2653-46dd-adfe-4b7fc48ba429.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9a1d37d7-2653-46dd-adfe-4b7fc48ba429.tmp
Size 34KB
SHA256 f7d526dc656952058da19d3761a6e870d780d2dddb170ae34b75003347ac31c1
MD5 6303db431116c57b3e552494967c990b
SHA1 b90596ebf5b109451938ebbff5886681e8861189
SHA512 98d8d7fb0586d4edcc17fe4a5d60b0c0092c1010ee4e809f916bd12baf4c13c1899464d80174369e553ca9318cd1e11a4ffc8bbebf61e608f8c8ecb0f70c0c3f
SSDEEP 768:2yY3ERISO5pgYUwMIYNa8S5oYklnA+Z3m:2yY3EySqTWRdAOm
TLSH
T155F2BF35A960DD73DCEE9284F2467782AEE41133E4C85EE8D8DC4B5D05877AF1703826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 72a43fbaed1cd4a89462ff759b5bb2f6f6d1a7a9c08002937c809c101fc685e4
MD5 b04c9bc22d86d65999036cf784bd7a42
SHA1 74f3b96e34181e491a9fd238877d82f72fce321d
SHA512 9bbf9224f5546df81a26e79932518e2c3bea2fc0e37127e4af1f02d1a5543680b5d9370365c28b8bb5427b3bb4f27eb12737d158490216ff77859483f95a6b00
TLSH
T189D02B316CED4C23C08CA27C0057004117517400EA1040401221504808082414281399
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 84d025c8484a1ba1eae075fe4fb60ee1013d5e3c0fe4757f9d23c77a5ecf4bff
MD5 40a03f8f45ceb83458e7ff6718e8114c
SHA1 3aee2deed85e7e1b8a1a9090347606288ce5f90c
SHA512 011f7c1ff606c9271e176c099ac19361c51f6a3eb7ee8dae4e0bead781595a3fa38a006247688a203ba11818d1de1b9066033932d5d22ba79d5a19f921cf6159
TLSH
T164D02B316CDD4D23C08CA27C0056004117617400FE10404011211048080824142823AD
MD5 SHA1 SHA512 TLSH

Submit Download

19bc9c56-f16f-4076-a4a5-b073b6a70e26.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\19bc9c56-f16f-4076-a4a5-b073b6a70e26.tmp
Size 29KB
SHA256 55fa8f7757705ab495310c03964be61f92d8a644ac5716564cb4d7b1daba6c07
MD5 2adf854411cf4f76c589d44e18d789bf
SHA1 b6a187ab367048f38edc957f723bcb8264a303ea
SHA512 3effeffa0fae606f6a8267b62a1c4cd8a68bcd91fcfaf83bb3575d45fba898af8b9754f13184b341d5141b281d50302cc62f63ab0e811b56bed46dcc55406d1f
SSDEEP 768:/jnhqH7pLuLbcJWg6cfCw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV+clRkP1ros+rt:/jnhqBEbcJWg6cfCwu1ja1cliPO3rt
TLSH
T164D2D97B740CCB7F8F804ADD98197E9B6DA802CB96D8C98047FE945C02C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

39e6bbfc-8564-4bc5-8151-e53ca7555c32.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\39e6bbfc-8564-4bc5-8151-e53ca7555c32.tmp
Size 12KB
SHA256 653f162d59949454495bcc5b5f3fc8aa593ac1dbbac7f62005bd518a91e1ec6c
MD5 db2a8ab1be26142481a04f4ffd529442
SHA1 e6f252eeae22596486aa8d5eed188c6cfdbf2de6
SHA512 4789595eecefcbb6b454df8ccc93e7abf9a373dd93fdc327bf443beff5b343aa962949db103f8715ec07f8a7d3efb1fd0216543a1a62b14dda20d669eed8b969
SSDEEP 192:sxRYRyCp/fQsktRgZYTslzoA8p9i/g6+WNCyp/Yu6oSjG5IgD5jJ:sxRYfp/fQsWR+GsI0/5R/Rn
TLSH
T10442C819AD28A93B9CCBD21DBB55BF53D2F81032A1D51E48A6FC8A2C04E76DD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 12e393e3d7ffc3b8fc1348e1a3c0ca1ead822c2e58609d2b2efd9f33f3b263e9
MD5 4f476b715280d0475aebc1f0f2ebb218
SHA1 376ff045a567c1e75a233cd4e522c158d037991b
SHA512 0cb3236dacbf6bc8bb273bada683f435b911a2f52065133bfff6d22a1ebbb2ebf586da6f169efcb9ef9ce97fa2c5ac27798c1a89a7380349fb03653454e8af14
TLSH
T1DC41D8486B60819FF798F1F3B6D05E87F6B4CA8259CF1E5106B5C1BC9A0D3D641B6074
MD5 SHA1 SHA512 TLSH

Submit Download

4dc3dcd6-1295-4a10-a20a-da5bac6028ed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\4dc3dcd6-1295-4a10-a20a-da5bac6028ed.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

2ead55c5-4438-4695-9d2d-936e5dfe0c2f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2ead55c5-4438-4695-9d2d-936e5dfe0c2f.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

d937fbaf-e552-4209-ba53-a4ef4a1e910b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d937fbaf-e552-4209-ba53-a4ef4a1e910b.tmp
Size 2KB
SHA256 682486d0a2d194fb86af682ef8a21f3896eacf628d7e51785602ba67a864fe13
MD5 8c1442dd592f836ba0e9af881f3f7257
SHA1 553815b7c04b8c6cb88d53c12ec177fdc17cec02
SHA512 31b9d3fe0a1ba19dd953d6e281bf922ee4ae47f6e9ffbbe1ed3bcf818d473117ab046cc1a8e936f6f685d3d669ba9ff286db7b631dbc118f634d02d314d6590f
TLSH
T17E51C2F3C3E8862D891156F4AB187E1BCE1D0915432C3D5AC4E49F2B93E34B1E541A9F
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 78fa7caa01d9e4d11bdec87cfb777f37abcb3c376c707beafc7c681f65574e05
MD5 b39daa2365a22e415d348e9712ed2712
SHA1 b3d2a2c7abe45432118f2f0f670892319bc7f1a9
SHA512 5c40a8aef44c532db6a83cbf8e8c1071778bbccfd6cf15a2897d17ca151cc5b0b366800f05a3343474e080ed30a20bcaf84e7aa3f397c9c03a95f4232df51d60
SSDEEP 48:KTs5IMCKK+Ma3lIFs+KqLy++WUu/Pu8fyFhIRKyMMqBIVKCoIwy0:KQXSKAce2hiKyM9BeKCo1T
TLSH
T1C891745531272205387D3A0C94EBAA9A4A5271B33464EA6F3FEFC4568D2BE080DFD4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bb22507d-c934-46dd-926a-2da082618b6f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bb22507d-c934-46dd-926a-2da082618b6f.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d0ddac0e-03e5-4b2a-818a-6314259cf779.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d0ddac0e-03e5-4b2a-818a-6314259cf779.tmp
Size 11KB
SHA256 a14f771ee8aa2e7b5b6e3390767487d87e7d23f95b6293f43bd5237ec6548f69
MD5 00c78a849b0b8c30af653ab48da7ad0a
SHA1 cea9097bfcf503404c782480adcc78562ee4ae6f
SHA512 0e3ea7ce1dcb9313a8d1e16885e58532acc2404371d6b3bba27be71e34106c696b822c07ba9495f4de2c6a28fcf60ed0057bb1d2e7e9ed6ca79d4088d56798e8
SSDEEP 192:sxRbRyCp/fQs4tRgZYTslzoA8p9i/g6+WNCyp/Yu6oSjG5IgVjJ:sxRbfp/fQsCR+GsI0/5R/Rn
TLSH
T14442C819AD68A93B9CCBD20DBB557F53D2F91032A1D51E48A6FC8A2C14E76DD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d1251f9b-05bc-4266-bf77-c1b23582647d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d1251f9b-05bc-4266-bf77-c1b23582647d.tmp
Size 12KB
SHA256 7742ce8b5fa3a66a3e2b6d2ba9f46dd4bec9dc82c12d5024dd7139320e5cb4eb
MD5 18d587d7dfd19ccc6aab32470e92d177
SHA1 0472b1fa30d1318743cbc8886c4e9c7ca2ffe41c
SHA512 44b62bbac11c9adb7250d54222d3510c365a7726bccb9de633bf47321cf594ee4a46fedebefd0da717e06a5f95824a29ff9d70bdd0a4c67214f5d801a0671e2b
SSDEEP 192:sxRYRyCp/fQsksRgZYTslzoA8p9i/g6+WNCyp/Yu2oSjG5IgDTjJ:sxRYfp/fQsnR+GsI0/5R/1d
TLSH
T10942C719AD286D3B9CDBD209BB557F53E2F81032A1D51E48A6FC8A1C14E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f719222f-a207-40ab-8432-36dd1e961636.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f719222f-a207-40ab-8432-36dd1e961636.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

34470338-2886-46f5-917c-ee1975f46560.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\34470338-2886-46f5-917c-ee1975f46560.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

0be3571e-e9e3-4a62-b2e0-22363eb5e749.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\0be3571e-e9e3-4a62-b2e0-22363eb5e749.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

545ae2ae-b5de-4d93-babd-c77af882e155.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\545ae2ae-b5de-4d93-babd-c77af882e155.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

d1e54168-4dd8-47b5-b817-3a032195d687.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\d1e54168-4dd8-47b5-b817-3a032195d687.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

8a2ca016-cbb9-4996-a522-f798dc5b2102.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8a2ca016-cbb9-4996-a522-f798dc5b2102.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f5e63649-6d62-4a4b-a869-8568211b5ab0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f5e63649-6d62-4a4b-a869-8568211b5ab0.tmp
Size 34KB
SHA256 5cf467e145f460d605dfbd1da7115a23c133f61b172a53fa0c46f984d46c6b45
MD5 adde20cfd33e81127e805c626b81a3db
SHA1 1dfc4cffa44f4a0f84a1458e5c4e372da60ae988
SHA512 08005eaae114fd171d6bc10e641251a242d37c679339e45d2eb5e1fa7755c5296d7ac9c86c031867d189f947c2aaedffa1086a421105698255d5dc817957f7f3
SSDEEP 768:FWyY3VRISO5pgYUwMIYNa8S5oYklnA+Z3m:YyY3VySqTWRdAOm
TLSH
T1D8F2BF35A960DD739CEE9284F2467782AEE41133E4C45EE8D8DC4B5D05877AF1703826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fe437a15-601f-40f2-bee3-7ec3409d318d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fe437a15-601f-40f2-bee3-7ec3409d318d.tmp
Size 39KB
SHA256 f13864cf6884753831462f9d321ec42c643d9b550fdfd8adf580d449b51fc10c
MD5 e98487c4eb45357c7c3be3f3c6e52774
SHA1 e4830a8b7f9f439f23af0c053e605a9bfca58acd
SHA512 f5ef3962cba2ab74e4628936e7ced656ee78f1b3fdfb7c8efbd91fda781c6536a4299d98bf1e5c815ccb178882bc82981a71007ca48eb7b4148381eda303b952
SSDEEP 768:5Wy/UxvxjgC+F3PFISO5pgYUwMIYNa8S5oYklnA+Z3o4e:U3Zj3+F3POSqTWRdAOo4e
TLSH
T1FE03C039A8A5AD638CFA9384B34AA7C3EEE41173E0C55DEC89E81F0D15873AE1703456
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

032a7112-64e1-4312-954e-5b705cc8f67c.tmp

Path C:\Users\Admin\AppData\Local\Temp\032a7112-64e1-4312-954e-5b705cc8f67c.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

df91e18c-ff29-43f3-b87a-db3930743df1.tmp

Path C:\Users\Admin\AppData\Local\Temp\df91e18c-ff29-43f3-b87a-db3930743df1.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4732_1887250300\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4732_1374359455\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4732_22317032\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4732_282201175\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4732_408100846\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 7022814abc698534a18b4ea9d7631c6e3bd6811cd4624e323fcfe7161cec41bd
MD5 7f51711825fde92a27bbbf54ff52106e
SHA1 553abffe91104cfd601698f1af3b170f47c40d1b
SHA512 0793d845c7f1cbc6fb543afb7c52714d07b359c2b61a18d59fe24ef83ef7cea6c12ca6bf542daa63ff6d2e77cf2343b00a3fca0586a9d9721d6a35b8347b4188
TLSH
T15971238366B8C9F3C2EA5BF003835284F5FF223C076330240B515987AB34A7A58B8F14
MD5 SHA1 SHA512 TLSH

Submit Download

memory/920-372-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/928-450-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1268-438-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1916-60-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2192-476-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2436-454-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2568-396-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2644-341-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2824-321-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3204-418-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3228-267-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3404-384-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3716-498-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3832-317-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4272-480-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4300-293-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4632-273-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4632-241-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5056-280-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5104-192-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5104-247-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5648-359-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5648-325-0x0000000000010000-0x00000000000AB000-memory.dmp

Download