systex | 221107ff3f21ed1772699d76e92dd464fe92ee3650f9f555e4e88eb57498d8a5

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 03:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 365KB
Sample261011-dnjbwsds7j
SHA256 221107ff3f21ed1772699d76e92dd464fe92ee3650f9f555e4e88eb57498d8a5
MD5 c367ae0ecfc8849bd590e1615d631267
SHA1 34455c2ee321cd58f36edb66046d38de153bd7d9
SHA512 79dfbbb05905b09055731637076e7ff0875be09e015d19c2c7eed49e7aef8d5f05a5b6f2c1e75f96c19ad72b4b900fea44e41bb22d34484803ec5f6204569aca
SSDEEP 3072:CuxIxtcBOaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:CuxIxtdlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T191847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4200	wuomgerojgbztrlj.exe
6076	wuomgerojgbztrlj.sys
2152	CreateProcess.exe
3064	rojgebwolg.exe
4684	CreateProcess.exe
5016	CreateProcess.exe
3260	i_rojgebwolg.exe
2656	trljdbvtol.sys
2056	CreateProcess.exe
1712	ljdbvtgdyv.exe
5128	CreateProcess.exe
6024	CreateProcess.exe
5024	i_ljdbvtgdyv.exe
5780	aytqlidbyt.sys
2496	CreateProcess.exe
1260	bvtnlfdyvq.exe
4320	CreateProcess.exe
1860	CreateProcess.exe
1076	i_bvtnlfdyvq.exe
2544	vsnkigdyvs.sys
1840	CreateProcess.exe
2280	xvtnlfdavs.exe
3816	CreateProcess.exe
5924	CreateProcess.exe
5144	i_xvtnlfdavs.exe
2160	idavsnkfdx.sys
5856	CreateProcess.exe
5480	uspkicausn.exe
504	CreateProcess.exe
824	CreateProcess.exe
3120	i_uspkicausn.exe
4224	caxvpnhfax.sys
5928	CreateProcess.exe
5860	causpkicau.exe
4428	CreateProcess.exe
716	CreateProcess.exe
936	i_causpkicau.exe
1288	czxrpmkecx.sys
3192	CreateProcess.exe
4640	causmkecxu.exe
4300	CreateProcess.exe
3088	CreateProcess.exe
1688	i_causmkecxu.exe
2096	czurmkecwu.sys
5716	CreateProcess.exe
5676	zurmjhecwt.exe
5360	CreateProcess.exe
3984	CreateProcess.exe
5024	i_zurmjhecwt.exe
4136	cztrmjgecw.sys
264	CreateProcess.exe
5072	omjebwuomg.exe
256	CreateProcess.exe
1288	CreateProcess.exe
2716	i_omjebwuomg.exe
3576	ztqojgbzto.sys
1848	CreateProcess.exe
6004	wqojgbztqo.exe
2156	CreateProcess.exe
5812	CreateProcess.exe
5144	i_wqojgbztqo.exe
4176	toljdaywtn.sys
5792	CreateProcess.exe
1984	tqligdbvtn.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4292_1177242847\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4292_1373479439\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4292_1826306688\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4292_1826306688\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4292_1440568540\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4292_1440568540\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4292_1373479439\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4292_1826306688\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4292_1826306688\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnkfcaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojgebwolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtgdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvtnlfdavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlidavtqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxvpmhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojgebwolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvtgdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causpkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurmjhecwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqojgbztqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomgerojgbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnhfzxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurmkecxro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causpkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurmjhecwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnhfzxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbztrojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omjebwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqligdbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurmkecxro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdyvqnlgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uspkicausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uspkicausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omjebwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqojgbztqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxvpmhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmjhbzwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlidavtqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbztrojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvtnlfdavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqligdbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnkfcaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmjhbzwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywtolgey.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5060	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4616	ipconfig.exe
4364	ipconfig.exe
1448	ipconfig.exe
4484	ipconfig.exe
4816	ipconfig.exe
6032	ipconfig.exe
2200	ipconfig.exe
3460	ipconfig.exe
2744	ipconfig.exe
5216	ipconfig.exe
944	ipconfig.exe
4240	ipconfig.exe
2488	ipconfig.exe
4132	ipconfig.exe
1584	ipconfig.exe
984	ipconfig.exe
2492	ipconfig.exe
3080	ipconfig.exe
3936	ipconfig.exe
3036	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-53044966-3830981193-2402648431-1000\{7A2B106E-8B0B-46EC-96ED-712CEFF989E0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4200	wuomgerojgbztrlj.exe
4200	wuomgerojgbztrlj.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4200	wuomgerojgbztrlj.exe
4200	wuomgerojgbztrlj.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4200	wuomgerojgbztrlj.exe
4200	wuomgerojgbztrlj.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4200	wuomgerojgbztrlj.exe
4200	wuomgerojgbztrlj.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4200	wuomgerojgbztrlj.exe
4200	wuomgerojgbztrlj.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4200	wuomgerojgbztrlj.exe
4200	wuomgerojgbztrlj.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3260	i_rojgebwolg.exe
Token: SeDebugPrivilege	5024	i_ljdbvtgdyv.exe
Token: SeDebugPrivilege	1076	i_bvtnlfdyvq.exe
Token: SeDebugPrivilege	5144	i_xvtnlfdavs.exe
Token: SeDebugPrivilege	3120	i_uspkicausn.exe
Token: SeDebugPrivilege	936	i_causpkicau.exe
Token: SeDebugPrivilege	1688	i_causmkecxu.exe
Token: SeDebugPrivilege	5024	i_zurmjhecwt.exe
Token: SeDebugPrivilege	2716	i_omjebwuomg.exe
Token: SeDebugPrivilege	5144	i_wqojgbztqo.exe
Token: SeDebugPrivilege	4212	i_tqligdbvtn.exe
Token: SeDebugPrivilege	3036	i_tnlidavtqk.exe
Token: SeDebugPrivilege	2612	i_pnkfcaysqk.exe
Token: SeDebugPrivilege	1448	i_vpnhfzxspk.exe
Token: SeDebugPrivilege	3036	i_zxvpmhfzxr.exe
Token: SeDebugPrivilege	3460	i_zurmkecxro.exe
Token: SeDebugPrivilege	5004	i_urmjhbzwro.exe
Token: SeDebugPrivilege	4896	i_dbztrojhbz.exe
Token: SeDebugPrivilege	6096	i_geywtolgey.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4292	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 712 wrote to memory of 4200	712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	89
PID 712 wrote to memory of 4552	712	2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	90
PID 4552 wrote to memory of 4292	4552	iexplore.exe	91
PID 4292 wrote to memory of 4520	4292	msedge.exe	92
PID 4292 wrote to memory of 5724	4292	msedge.exe	94
PID 4292 wrote to memory of 5060	4292	msedge.exe	93
PID 4292 wrote to memory of 5724	4292	msedge.exe	94
PID 4292 wrote to memory of 5724	4292	msedge.exe	94
PID 4292 wrote to memory of 4192	4292	msedge.exe	95
PID 4292 wrote to memory of 4192	4292	msedge.exe	95
PID 4292 wrote to memory of 5640	4292	msedge.exe	96
PID 4292 wrote to memory of 5640	4292	msedge.exe	96
PID 4292 wrote to memory of 5640	4292	msedge.exe	96
PID 4292 wrote to memory of 2788	4292	msedge.exe	97
PID 4292 wrote to memory of 2788	4292	msedge.exe	97
PID 4292 wrote to memory of 2788	4292	msedge.exe	97
PID 4292 wrote to memory of 2404	4292	msedge.exe	99
PID 4292 wrote to memory of 5392	4292	msedge.exe	100
PID 4292 wrote to memory of 2404	4292	msedge.exe	99
PID 4292 wrote to memory of 2404	4292	msedge.exe	99
PID 4292 wrote to memory of 5392	4292	msedge.exe	100
PID 4292 wrote to memory of 5392	4292	msedge.exe	100
PID 4292 wrote to memory of 5676	4292	msedge.exe	101
PID 4292 wrote to memory of 5676	4292	msedge.exe	101
PID 4200 wrote to memory of 2152	4200	wuomgerojgbztrlj.exe	105
PID 4292 wrote to memory of 5400	4292	msedge.exe	107
PID 4292 wrote to memory of 2484	4292	msedge.exe	108
PID 4292 wrote to memory of 5400	4292	msedge.exe	107
PID 4292 wrote to memory of 2484	4292	msedge.exe	108
PID 3064 wrote to memory of 4684	3064	rojgebwolg.exe	110
PID 4292 wrote to memory of 2160	4292	msedge.exe	114
PID 4292 wrote to memory of 1716	4292	msedge.exe	115
PID 4292 wrote to memory of 1716	4292	msedge.exe	115
PID 4292 wrote to memory of 4540	4292	msedge.exe	116
PID 4292 wrote to memory of 4540	4292	msedge.exe	116
PID 4200 wrote to memory of 5016	4200	wuomgerojgbztrlj.exe	119
PID 4200 wrote to memory of 2056	4200	wuomgerojgbztrlj.exe	123
PID 1712 wrote to memory of 5128	1712	ljdbvtgdyv.exe	125
PID 4200 wrote to memory of 6024	4200	wuomgerojgbztrlj.exe	128
PID 4200 wrote to memory of 2496	4200	wuomgerojgbztrlj.exe	132
PID 1260 wrote to memory of 4320	1260	bvtnlfdyvq.exe	134
PID 4200 wrote to memory of 1860	4200	wuomgerojgbztrlj.exe	137
PID 4200 wrote to memory of 1840	4200	wuomgerojgbztrlj.exe	142
PID 2280 wrote to memory of 3816	2280	xvtnlfdavs.exe	144
PID 4200 wrote to memory of 5924	4200	wuomgerojgbztrlj.exe	147
PID 4292 wrote to memory of 4124	4292	msedge.exe	149
PID 4292 wrote to memory of 3752	4292	msedge.exe	150
PID 4292 wrote to memory of 3576	4292	msedge.exe	151
PID 4200 wrote to memory of 5856	4200	wuomgerojgbztrlj.exe	154
PID 5480 wrote to memory of 504	5480	uspkicausn.exe	156
PID 4292 wrote to memory of 1056	4292	msedge.exe	159
PID 4292 wrote to memory of 1056	4292	msedge.exe	159
PID 4200 wrote to memory of 824	4200	wuomgerojgbztrlj.exe	160
PID 4200 wrote to memory of 5928	4200	wuomgerojgbztrlj.exe	164
PID 5860 wrote to memory of 4428	5860	causpkicau.exe	166
PID 4200 wrote to memory of 716	4200	wuomgerojgbztrlj.exe	169
PID 4200 wrote to memory of 3192	4200	wuomgerojgbztrlj.exe	173
PID 4640 wrote to memory of 4300	4640	causmkecxu.exe	175
PID 4200 wrote to memory of 3088	4200	wuomgerojgbztrlj.exe	178
PID 4200 wrote to memory of 5716	4200	wuomgerojgbztrlj.exe	182
PID 5676 wrote to memory of 5360	5676	zurmjhecwt.exe	184
PID 4200 wrote to memory of 3984	4200	wuomgerojgbztrlj.exe	187
PID 4292 wrote to memory of 4944	4292	msedge.exe	189
PID 4292 wrote to memory of 4944	4292	msedge.exe	189

C:\Users\Admin\AppData\Local\Temp\2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-10_c367ae0ecfc8849bd590e1615d631267_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:712
- C:\Temp\wuomgerojgbztrlj.exe
  C:\Temp\wuomgerojgbztrlj.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rojgebwolg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2152
  - - C:\Temp\rojgebwolg.exe
      C:\Temp\rojgebwolg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3064
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4684
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2488
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rojgebwolg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5016
  - - C:\Temp\i_rojgebwolg.exe
      C:\Temp\i_rojgebwolg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdbvtgdyv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2056
  - - C:\Temp\ljdbvtgdyv.exe
      C:\Temp\ljdbvtgdyv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1712
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5128
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2492
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdbvtgdyv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6024
  - - C:\Temp\i_ljdbvtgdyv.exe
      C:\Temp\i_ljdbvtgdyv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5024
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bvtnlfdyvq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2496
  - - C:\Temp\bvtnlfdyvq.exe
      C:\Temp\bvtnlfdyvq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1260
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4320
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4616
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bvtnlfdyvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1860
  - - C:\Temp\i_bvtnlfdyvq.exe
      C:\Temp\i_bvtnlfdyvq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1076
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvtnlfdavs.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1840
  - - C:\Temp\xvtnlfdavs.exe
      C:\Temp\xvtnlfdavs.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2280
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3816
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3080
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvtnlfdavs.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5924
  - - C:\Temp\i_xvtnlfdavs.exe
      C:\Temp\i_xvtnlfdavs.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5144
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uspkicausn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5856
  - - C:\Temp\uspkicausn.exe
      C:\Temp\uspkicausn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5480
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:504
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4364
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uspkicausn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:824
  - - C:\Temp\i_uspkicausn.exe
      C:\Temp\i_uspkicausn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\causpkicau.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5928
  - - C:\Temp\causpkicau.exe
      C:\Temp\causpkicau.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5860
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4428
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2744
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_causpkicau.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:716
  - - C:\Temp\i_causpkicau.exe
      C:\Temp\i_causpkicau.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:936
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\causmkecxu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3192
  - - C:\Temp\causmkecxu.exe
      C:\Temp\causmkecxu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4640
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4300
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_causmkecxu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3088
  - - C:\Temp\i_causmkecxu.exe
      C:\Temp\i_causmkecxu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1688
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zurmjhecwt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5716
  - - C:\Temp\zurmjhecwt.exe
      C:\Temp\zurmjhecwt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5676
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5360
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3936
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zurmjhecwt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3984
  - - C:\Temp\i_zurmjhecwt.exe
      C:\Temp\i_zurmjhecwt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5024
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omjebwuomg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:264
  - - C:\Temp\omjebwuomg.exe
      C:\Temp\omjebwuomg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5072
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:256
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4132
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omjebwuomg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1288
  - - C:\Temp\i_omjebwuomg.exe
      C:\Temp\i_omjebwuomg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wqojgbztqo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1848
  - - C:\Temp\wqojgbztqo.exe
      C:\Temp\wqojgbztqo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6004
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2156
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4484
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wqojgbztqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5812
  - - C:\Temp\i_wqojgbztqo.exe
      C:\Temp\i_wqojgbztqo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5144
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqligdbvtn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5792
  - - C:\Temp\tqligdbvtn.exe
      C:\Temp\tqligdbvtn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1984
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4660
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1584
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqligdbvtn.exe ups_ins
    3⤵
    PID:1272
  - - C:\Temp\i_tqligdbvtn.exe
      C:\Temp\i_tqligdbvtn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4212
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tnlidavtqk.exe ups_run
    3⤵
    PID:2328
  - - C:\Temp\tnlidavtqk.exe
      C:\Temp\tnlidavtqk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2084
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5800
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tnlidavtqk.exe ups_ins
    3⤵
    PID:5664
  - - C:\Temp\i_tnlidavtqk.exe
      C:\Temp\i_tnlidavtqk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3036
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnkfcaysqk.exe ups_run
    3⤵
    PID:2232
  - - C:\Temp\pnkfcaysqk.exe
      C:\Temp\pnkfcaysqk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2548
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5780
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5216
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnkfcaysqk.exe ups_ins
    3⤵
    PID:1584
  - - C:\Temp\i_pnkfcaysqk.exe
      C:\Temp\i_pnkfcaysqk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2612
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vpnhfzxspk.exe ups_run
    3⤵
    PID:1612
  - - C:\Temp\vpnhfzxspk.exe
      C:\Temp\vpnhfzxspk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2148
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:200
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6032
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vpnhfzxspk.exe ups_ins
    3⤵
    PID:2776
  - - C:\Temp\i_vpnhfzxspk.exe
      C:\Temp\i_vpnhfzxspk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxvpmhfzxr.exe ups_run
    3⤵
    PID:4228
  - - C:\Temp\zxvpmhfzxr.exe
      C:\Temp\zxvpmhfzxr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4484
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4856
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxvpmhfzxr.exe ups_ins
    3⤵
    PID:2312
  - - C:\Temp\i_zxvpmhfzxr.exe
      C:\Temp\i_zxvpmhfzxr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3036
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zurmkecxro.exe ups_run
    3⤵
    PID:3164
  - - C:\Temp\zurmkecxro.exe
      C:\Temp\zurmkecxro.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4144
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:988
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zurmkecxro.exe ups_ins
    3⤵
    PID:3696
  - - C:\Temp\i_zurmkecxro.exe
      C:\Temp\i_zurmkecxro.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urmjhbzwro.exe ups_run
    3⤵
    PID:4212
  - - C:\Temp\urmjhbzwro.exe
      C:\Temp\urmjhbzwro.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2464
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4132
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urmjhbzwro.exe ups_ins
    3⤵
    PID:2120
  - - C:\Temp\i_urmjhbzwro.exe
      C:\Temp\i_urmjhbzwro.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5004
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbztrojhbz.exe ups_run
    3⤵
    PID:2032
  - - C:\Temp\dbztrojhbz.exe
      C:\Temp\dbztrojhbz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2756
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6028
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbztrojhbz.exe ups_ins
    3⤵
    PID:1476
  - - C:\Temp\i_dbztrojhbz.exe
      C:\Temp\i_dbztrojhbz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\geywtolgey.exe ups_run
    3⤵
    PID:2624
  - - C:\Temp\geywtolgey.exe
      C:\Temp\geywtolgey.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4724
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4956
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3036
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_geywtolgey.exe ups_ins
    3⤵
    PID:5364
  - - C:\Temp\i_geywtolgey.exe
      C:\Temp\i_geywtolgey.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6096
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gdyvqnlgdy.exe ups_run
    3⤵
    PID:2420
  - - C:\Temp\gdyvqnlgdy.exe
      C:\Temp\gdyvqnlgdy.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3016
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4836
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3460
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x260,0x304,0x7ffe077fc188,0x7ffe077fc194,0x7ffe077fc1a0
      4⤵
      PID:4520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,13413126811961250211,11266776689358281094,524288 --field-trial-handle=2292,i,3389210840133165418,10838538698572084242,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:11
      4⤵
      System Time Discovery
      PID:5060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1608,i,7665797804434712290,18248532375359550535,262144 --field-trial-handle=2292,i,3389210840133165418,10838538698572084242,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
      4⤵
      PID:5724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2544,i,10616092724195834795,1102433103793445807,524288 --field-trial-handle=2292,i,3389210840133165418,10838538698572084242,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:13
      4⤵
      PID:4192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,6473841334430432860,8705873658717946474,2097152 --field-trial-handle=2292,i,3389210840133165418,10838538698572084242,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
      4⤵
      PID:5640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,7078991116134443409,5355467079611862706,2097152 --field-trial-handle=2292,i,3389210840133165418,10838538698572084242,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
      4⤵
      PID:2788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,11412776974263631605,6745432389018576189,2097152 --field-trial-handle=2292,i,3389210840133165418,10838538698572084242,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:1
      4⤵
      PID:2404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4364,i,14983637613591536045,8637153528786719799,2097152 --field-trial-handle=2292,i,3389210840133165418,10838538698572084242,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:9
      4⤵
      PID:5392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,16284727371067748168,2964674956606276464,524288 --field-trial-handle=2292,i,3389210840133165418,10838538698572084242,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
      4⤵
      PID:5676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,14219740481692693792,6791284989770831858,524288 --field-trial-handle=2292,i,3389210840133165418,10838538698572084242,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
      4⤵
      PID:5400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,7800121474351981453,8623222618232421055,524288 --field-trial-handle=2292,i,3389210840133165418,10838538698572084242,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
      4⤵
      PID:2484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,1850094115306553229,14573892086642676738,524288 --field-trial-handle=2292,i,3389210840133165418,10838538698572084242,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
      4⤵
      PID:1540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,1850094115306553229,14573892086642676738,524288 --field-trial-handle=2292,i,3389210840133165418,10838538698572084242,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
      4⤵
      PID:2160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,982971626387855937,476854678272735611,524288 --field-trial-handle=2292,i,3389210840133165418,10838538698572084242,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:14
      4⤵
      PID:1716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,10363850049610150298,1934150279884462867,524288 --field-trial-handle=2292,i,3389210840133165418,10838538698572084242,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:14
      4⤵
      PID:4540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4564,i,493568963521396546,1045382082430717508,524288 --field-trial-handle=2292,i,3389210840133165418,10838538698572084242,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
      4⤵
      PID:4124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,15858084105956312455,8266012000956505765,524288 --field-trial-handle=2292,i,3389210840133165418,10838538698572084242,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
      4⤵
      PID:3752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,18359691399639069132,1396453947201125544,524288 --field-trial-handle=2292,i,3389210840133165418,10838538698572084242,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
      4⤵
      PID:3576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,11353914438645993629,1744467682333195333,524288 --field-trial-handle=2292,i,3389210840133165418,10838538698572084242,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:14
      4⤵
      PID:1056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,14481153499761474242,9946464846094724094,524288 --field-trial-handle=2292,i,3389210840133165418,10838538698572084242,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:14
      4⤵
      PID:4944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,6834260994248839087,9333730328659241665,524288 --field-trial-handle=2292,i,3389210840133165418,10838538698572084242,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:14
      4⤵
      PID:2724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=932,i,10060072043699030328,17739857534116433760,524288 --field-trial-handle=2292,i,3389210840133165418,10838538698572084242,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:14
      4⤵
      PID:5408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,6705469952608114268,3849522983450834060,524288 --field-trial-handle=2292,i,3389210840133165418,10838538698572084242,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:14
      4⤵
      PID:2448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=936,i,2399210189615370136,17433939629283694195,262144 --field-trial-handle=2292,i,3389210840133165418,10838538698572084242,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:10
      4⤵
      PID:3408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,15507504464594918925,10098257957352796092,524288 --field-trial-handle=2292,i,3389210840133165418,10838538698572084242,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:14
      4⤵
      PID:2160

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5544

C:\Temp\wuomgerojgbztrlj.sys
C:\Temp\wuomgerojgbztrlj.sys
1⤵
- Executes dropped EXE
PID:6076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:300

C:\Temp\trljdbvtol.sys
C:\Temp\trljdbvtol.sys
1⤵
- Executes dropped EXE
PID:2656

C:\Temp\aytqlidbyt.sys
C:\Temp\aytqlidbyt.sys
1⤵
- Executes dropped EXE
PID:5780

C:\Temp\vsnkigdyvs.sys
C:\Temp\vsnkigdyvs.sys
1⤵
- Executes dropped EXE
PID:2544

C:\Temp\idavsnkfdx.sys
C:\Temp\idavsnkfdx.sys
1⤵
- Executes dropped EXE
PID:2160

C:\Temp\caxvpnhfax.sys
C:\Temp\caxvpnhfax.sys
1⤵
- Executes dropped EXE
PID:4224

C:\Temp\czxrpmkecx.sys
C:\Temp\czxrpmkecx.sys
1⤵
- Executes dropped EXE
PID:1288

C:\Temp\czurmkecwu.sys
C:\Temp\czurmkecwu.sys
1⤵
- Executes dropped EXE
PID:2096

C:\Temp\cztrmjgecw.sys
C:\Temp\cztrmjgecw.sys
1⤵
- Executes dropped EXE
PID:4136

C:\Temp\ztqojgbzto.sys
C:\Temp\ztqojgbzto.sys
1⤵
- Executes dropped EXE
PID:3576

C:\Temp\toljdaywtn.sys
C:\Temp\toljdaywtn.sys
1⤵
- Executes dropped EXE
PID:4176

C:\Temp\vtqnigaysq.sys
C:\Temp\vtqnigaysq.sys
1⤵
PID:880

C:\Temp\gaysqnifdx.sys
C:\Temp\gaysqnifdx.sys
1⤵
PID:4676

C:\Temp\axsqkicaus.sys
C:\Temp\axsqkicaus.sys
1⤵
PID:1548

C:\Temp\xspkhfzxus.sys
C:\Temp\xspkhfzxus.sys
1⤵
PID:4628

C:\Temp\zxupmhezxr.sys
C:\Temp\zxupmhezxr.sys
1⤵
PID:3532

C:\Temp\hbzurmjecw.sys
C:\Temp\hbzurmjecw.sys
1⤵
PID:5656

C:\Temp\jebwtrljge.sys
C:\Temp\jebwtrljge.sys
1⤵
PID:2040

C:\Temp\igbytrljdb.sys
C:\Temp\igbytrljdb.sys
1⤵
PID:5080

C:\Temp\jdbvtnlgdy.sys
C:\Temp\jdbvtnlgdy.sys
1⤵
PID:5840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aytqlidbyt.sys

Path C:\Temp\aytqlidbyt.sys
Size 293KB
SHA256 11847aefcbe8eec0f437281dff066cc8c8876ec7955e492331fc5832e563cde9
MD5 07cb06c84e83aba5e6a3a5d473b79cfd
SHA1 5295d8aa088ddd4128aaf7ee305b1ab67763a79a
SHA512 fbcf28b190b5bcd35ee162488dc41ffe8634e99452b8a34eebb936d142e83d891d688f4cd99adb756cd4e8a630d52d4d38f86011a4bb2f8b2c1b2ad1136985f0
SSDEEP 3072:RtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:RIJjiJcbI03GBc3ucY5DCSj
TLSH
T1EE545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bvtnlfdyvq.exe

Path C:\Temp\bvtnlfdyvq.exe
Size 365KB
SHA256 7234a502ef548e5e8058e009ff1cff8daab4fe7b4693dc1eafaec68f09f6c5f3
MD5 7028fed1498d264bb92904d3f8a8e0b3
SHA1 2f1b29aac767bf2df056759346f4ad263f195080
SHA512 f8e160d06a1f54653ab14453d8c89ab010001c496573ae5752d5c02e412997b28d22cd416fe51d455491ba80a7a12e57c51f63b82cb32f0c86f93d1e91ba814c
SSDEEP 3072:9uxIxtcBOaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:9uxIxtdlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T107847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

causpkicau.exe

Path C:\Temp\causpkicau.exe
Size 365KB
SHA256 b141418e7919a058b6d3a1a8da2237adc53f2d516cf4288d364f0af38eff89bc
MD5 18f7070f2ec126ea919dd6dc23468d43
SHA1 0f56e672b7d860ab9e0a6656dcc651145b3b3a3b
SHA512 378cc5c35be7d16a3df56b7a6a2d32b57d925f73f624948a6f8ca109c85fb3ac95b1489fa35af30ffb5e24f7950d422974b679da73ddc3634f2f23a9bf66f4d1
SSDEEP 3072:RuxIxtcBOaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:RuxIxtdlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T105847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

caxvpnhfax.sys

Path C:\Temp\caxvpnhfax.sys
Size 293KB
SHA256 b3ab8b3a7914e033e640c0fed65185fd36482842a4594a893229b8acb759d3b8
MD5 4d8e06468ab587488e3099455a6eaaa1
SHA1 e4f7b7d007f3eea6fc6c4a6d939a1c62b3d947a7
SHA512 8083d097fe6cc409c4ec6ae726b0cfb516f49c2489f91792a66de89705c4a88617b13aba2ef576e958cc26669e383aaf3c1072747e57bf4a0d99d9c98138afa1
SSDEEP 3072:qtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:qIJjiJcbI03GBc3ucY5DCSj
TLSH
T1DE545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bvtnlfdyvq.exe

Path C:\Temp\i_bvtnlfdyvq.exe
Size 365KB
SHA256 36637314603cedeb8027ddbb3a3d35ab1c4e887a892554c3802a5095054af506
MD5 976b83d6df13b4ce218f093093ef33d1
SHA1 2b88612c56179025fc9980540f2d710473e4de81
SHA512 d01e841aa9012bc633c830430eb55f9b6f5706915c5f3ea72ad478d560a2c43dbb88fab9f0dd5c58562a091897ace393968aec17a33cf3d4ae45b13f5333bcfe
SSDEEP 3072:UuxIxtcBOaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:UuxIxtdlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AB847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ljdbvtgdyv.exe

Path C:\Temp\i_ljdbvtgdyv.exe
Size 365KB
SHA256 65c2c76fbc878235a4feddf0bf40b914844abcc284c3b31ccd2f759e73c6b81f
MD5 18321751ca8f3257c124751020f00da0
SHA1 89df4c843c2a1151cfb697014cdf58587d146a3b
SHA512 547c55928c85daf1e18f4d91c9b8ddbc6a6193d9d7d0a9edf2001fc07fff0e3b37a93b8842a53f228595dd10d28cbbf7e09d1f39ff3ad113e1243a1192ad8764
SSDEEP 3072:euxIxtcBOaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:euxIxtdlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T100847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rojgebwolg.exe

Path C:\Temp\i_rojgebwolg.exe
Size 365KB
SHA256 c2a89bd7176c57b2b23ff0d5d63885b6438eba0234adc97b1365a8feee0b22da
MD5 2ee323599995e0bef66c936505e07912
SHA1 e65ba9c460fc9bff74ebca64da411b38bfd04cc6
SHA512 dc57014e022b6302f539f19d22ccdbd5b258a2523a4f2fcb0f288c674d06f5113149fe10b7136ff97b279bb6a5321b37ad9f088ea7b62b42a6f611e93f185f07
SSDEEP 3072:5uxIxtcBOaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:5uxIxtdlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T176847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_uspkicausn.exe

Path C:\Temp\i_uspkicausn.exe
Size 365KB
SHA256 4b08595db30020e29216b27c67735fbf30ea969caffe456a9a08017b98110e4d
MD5 d45d51b3ba25c07191701e9e87c982c1
SHA1 e03614fdaefd06f4c05a5ca85602c7233b27d334
SHA512 56dbb1a7b1f1e54473193a106a36dcfaa047c5a76e6bfb5a63f06680197c3b2196d22e29e61f678f36a3f96451476a8c8eeea10b75212f2d36209750de39bff9
SSDEEP 3072:luxIxtcBOaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:luxIxtdlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T18D847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xvtnlfdavs.exe

Path C:\Temp\i_xvtnlfdavs.exe
Size 365KB
SHA256 07995c01e192fc60e90460fe2ab13be7a9cf0a9d96a56bd031542f281fd48947
MD5 8dde286122f4d1397957d6f1fcb6417e
SHA1 9446e9ce1cb9d74471643bc9ab31b8b8922e97c3
SHA512 ec5f81b3e3d6cd452fc2946eca4c99b3ccee131ced248912867a51d7fb171040bb96e72f1ca1840741ee4ccc8aa1c645b950cee933b8c17cb94f76ac019706ff
SSDEEP 3072:KuxIxtcBOaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:KuxIxtdlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1CB847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idavsnkfdx.sys

Path C:\Temp\idavsnkfdx.sys
Size 293KB
SHA256 34c9e5a025d1e2de40ccb3e1f1617537863d3aad8af4e843abe783c9ffcbbf49
MD5 40f874dc4a46a16f3e2e8bdc39bfdafe
SHA1 6475e0200f9eb9b38c5ddd9ed7f8abb4025a9156
SHA512 3e69f89a9979ec9b2a7b49891be4c261e9001353e1be7cb4372ab78c15918e04ae0753f7ccf8b2061326fd7b4198e32902bf4d86270cd3f90be8b98b204daade
SSDEEP 3072:6tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:6IJjiJcbI03GBc3ucY5DCSj
TLSH
T144545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbvtgdyv.exe

Path C:\Temp\ljdbvtgdyv.exe
Size 365KB
SHA256 815e5563ccf38b92c2f3e60984cc02ff38cac732aa184b1c1a76f4972febd52c
MD5 59feadbc22ad2ef75876f8e6cc49f240
SHA1 9ec835c6ae3983fd10826681a12e17944c77f669
SHA512 c22a3bb5062075ed83148b2d58ad2c9b70d7b7a1bc9b2533494580098d887e9f14cbfbf83772fea6e2726f53a6d7dfd8384d7ce4083a96e7708bde4326dc11aa
SSDEEP 3072:GuxIxtcBOaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:GuxIxtdlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T152847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rojgebwolg.exe

Path C:\Temp\rojgebwolg.exe
Size 365KB
SHA256 f6f7122ac1deb1222446959024aa15f3d50034e9639ea36bb0307d74cd410a48
MD5 97d248112236a941a9039b9166ff3f9b
SHA1 3e396a5c835945b5643c0413ea8b9b0012aea515
SHA512 1ec570aeb53962297f7defe464cc94effe93969e6bd435d8dcececf5a85352976350941ef7ff65eef1a8ba9efe779427e9fa451854646413a63ca946903f2a21
SSDEEP 3072:auxIxtcBOaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:auxIxtdlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F5847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljdbvtol.sys

Path C:\Temp\trljdbvtol.sys
Size 293KB
SHA256 fdd2c55bf37afb003ae3c1ecd0331b06e8c62f1564c3afa366fea6062d0edbf3
MD5 a21e56e067483626caa3d764e279b6e1
SHA1 5ef0e06c66a44e3d3f822fc069e571e2643a80fa
SHA512 ff5465189a1219e3f464f937d00f5c13592bd9e8d161bd96a11a569066678f60b306e9d0362446ed86685ed10a1000f5f72800840b1dafd0c023e2f4aaeb0edd
SSDEEP 3072:EtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:EIJjiJcbI03GBc3ucY5DCSj
TLSH
T1BD545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uspkicausn.exe

Path C:\Temp\uspkicausn.exe
Size 365KB
SHA256 d25629de82e865468a28dc99170393e53482aa6d90464694054d863323f4157b
MD5 583ce94d96fa5539960c31a5444fd6b6
SHA1 443644e9f9e968521ac9a9b5aedcca1ca1d5f65a
SHA512 35077deeb17e66f05c3a5770731f2f8837eb9c9aa57304a5d90d519504b953fe7ea0fa4e799bfc1ab505eb8f5771cf81c85276df43b4681df98c9ea5d7e7443b
SSDEEP 3072:HuxIxtcBOaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:HuxIxtdlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T18D847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsnkigdyvs.sys

Path C:\Temp\vsnkigdyvs.sys
Size 293KB
SHA256 9fb772a73cad5a816d78cc936b5de58c851db8e6609ddfceb25a5467bf67c10c
MD5 31d0b3508128977741aeab59f2ffa42c
SHA1 c857d1e54a48578100b73e7ca9709aa586cbb66c
SHA512 931cb8729fa66c2442182283da9e35e210cf6dc4ea5d77f06be38864c9f8867af7077f0ad65cc31c6d146d1d80b6ac7495a9914bfab79a173d95e4e5dc4e0759
SSDEEP 3072:ztKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:zIJjiJcbI03GBc3ucY5DCSj
TLSH
T152545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomgerojgbztrlj.exe

Path C:\Temp\wuomgerojgbztrlj.exe
Size 365KB
SHA256 bbfcb3e50d194218893a2b2ecfbe82b928acf69500d758ec9205f91bd5aac7f7
MD5 998fd3dd01a9dc5e32da3b4127f5fff0
SHA1 1a869eb07c843571fed0e5da7a7e6a54deb100a4
SHA512 5ce64cca3c65ac9afb057f49366deb874d71bcf2c7066728039bb9aa903707e2be0706138d40cc7a7527baeacb2cd36c402587c119c8e857f1485351d56488c6
SSDEEP 3072:PuxIxtcBOaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:PuxIxtdlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1BC847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomgerojgbztrlj.sys

Path C:\Temp\wuomgerojgbztrlj.sys
Size 293KB
SHA256 7c8a0956d717b2418da9b2d273c0c25bb43a6145b0b8b0011b83967eb13bdaf4
MD5 84148e7b2daec5cdd8e8f1cce4c35c82
SHA1 0fcef11f8485de2bff579e5a4ed5b46003c34186
SHA512 dccedeac4284a47590d732b783f4da46b7a9113881a8ed1e3bebb8fdd524ea500116d5ce5b8853036f1450d45c923d31a9a8e334e954d04b7ff2a861068ba2c1
SSDEEP 3072:FtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:FIJjiJcbI03GBc3ucY5DCSj
TLSH
T145545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvtnlfdavs.exe

Path C:\Temp\xvtnlfdavs.exe
Size 365KB
SHA256 db069007cc060a0ab21e84828241d0ee7b6f63748b17371f21c4f0d712e72741
MD5 10f024ce826580109d91b6793ab87f39
SHA1 ed8976f64b41bed4b671ff9471c1ea2ac00a6dba
SHA512 5777fb95d771422176fe71a84554476e7f0aff0ddbfc82329b0eb8207784216b70e0f8ebec6164f93fc367a29a5a6eb74a675ad2e9ae8b0d1104eab54c08f061
SSDEEP 3072:puxIxtcBOaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:puxIxtdlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T16F847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

45e6b0e6-b478-4e2c-b410-817689e85c05.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\45e6b0e6-b478-4e2c-b410-817689e85c05.tmp
Size 42KB
SHA256 8c9ddd70d97332eae4f865205d296b7e872ecce28e0743088393a382ecacabfe
MD5 dc91ea6005f3c2168f157bbb2cbd3aab
SHA1 75cb6e6b055de265e0f78a82f38c69335cbad85e
SHA512 b2e3228844a88c54532440b6915868c6d1accbc9b589e2df29a5ee951035727f9f633b3884dffd332cb6b3ad1a55ab6296c9ca07923b08c0fee8b2d8e6e8494e
SSDEEP 768:yFQD3ewg3rCnY1OfkfqSfJt2GJYe1ELsAvC8/YEHqfq:JD3GrefkfVfDYe1EQujYK3
TLSH
T11D1318F198E3CA36E9AD5787A37D2E429DBCC123B4885994B7C91D0CCC861BFD30A855
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

70515b93-6e18-4bd7-91f2-7254077df475.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\70515b93-6e18-4bd7-91f2-7254077df475.tmp
Size 33KB
SHA256 6deca6b7fcb5bfd8574c96010cf98c1a01f42f25269fdb3ebf245980db51e18a
MD5 9c156da6211c332507a22b72ef67753e
SHA1 2c5681966361d9f8c92955135235e9475841633c
SHA512 3fe6ed9ebd7a33dcd18b856efc40e5625b0e0042de097c5155aca2e9339b2a415f41d76fbf9da16c8b80e4d0ae8b3933f02911209de53f8a7009355450c0899f
SSDEEP 768:iD3rrCoo9TOfkfqSfJtOyJYe1ELsAvC8/YEHqfq:iD3rrDfkfVfTYe1EQujYK3
TLSH
T1DDF2AE70EC74DD376EF59689B2862B53BEF4412394C84B58E1DD2B0C44876ED270F82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9dde0da8-ef5d-4547-a021-861f2a7ae1a2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9dde0da8-ef5d-4547-a021-861f2a7ae1a2.tmp
Size 33KB
SHA256 d7d0d4d9ceb2ac6431d3067730bae26c5b2612b9c42b301217a0a30ed62df3b3
MD5 2c851cab95576c3d0efaecc63bd490db
SHA1 5e5c7c1d3c5021092c241621568d69385689157b
SHA512 d2d8cc0c2d4079403e5ad306fd32c2b8addd943109bc3a542359efeeef82b23a81d230ce05d00e68406e71417d84ba1247b9668b03fc642c05d44891cc913ce8
SSDEEP 768:9D3orCho9TOfkfqSfJtOyJYe1ELsAvC8/YEHqfq:9D3or8fkfVfTYe1EQujYK3
TLSH
T1F4F2AE70EC74DD376EF59689B2862B53BEF4412394C84B58E1DD2B0C44876ED270F82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ec245fab-ba7b-4c70-a8cc-f2b3a79090e5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\ec245fab-ba7b-4c70-a8cc-f2b3a79090e5.tmp
Size 105KB
SHA256 d94841acc41ca658a5ee48a1ef8763d968ff86dec9b648ab9d4d5f3d4fea0d3a
MD5 3ec4eb6dbe24df0552b56af18c05a2b9
SHA1 fd334aef86650c95ae106374f1bb923cd2432390
SHA512 44bb44d7dffcecb78e155155b9571e4c572f63ed79c2a0c69cf356c04a91ff7d4cca3351e2c6a641095a4fbe0d38498ae9c3f0ebaf029b3ba42f1da7597e026e
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1B6B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a9db3b181fe23d2da858b764c2d3bc2baae4a7e217d8cc5885ed34c7b21166b7
MD5 c2e18a2143bb27e5b37e2d5b65c09643
SHA1 43bb7d235630acc17d81e04e37f3cd25e299ecc7
SHA512 08f1e7fa966122b22bea5e316c89298987fac4c53be675ad48a1c1c8a784dc7b1d8789be8d1abdb8cdb59c14d6757e0f1934d0a56d919c8fb08e311621fe4d9c
TLSH
T109D02BB0B77DCCD3D00310FE0015AE0421A370159E0402802302885844001041101358
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2664448b8ab4f4edce89a8c875c31ed1e748ff3060fa1567c434149210bb4fc5
MD5 35b0bc3bbbf168c9b6c74d3bc119d3eb
SHA1 3dde0e79982d9dbcf2dbd3045bae0a5bc63e14cd
SHA512 9c5f83f731b8e4bf7f7e64c2e51191192b13fa5260950a1fcade843318dbf7d5b99057f3ca893e35cb6c19942f5b5852e7124ed01f7c46e7de9bcea70152fc0d
TLSH
T173D02BB4B76DCDD3D00310FE0014AE0421B37015EE040280230248484400104110236C
MD5 SHA1 SHA512 TLSH

Submit Download

12fd2590-aad1-4ca8-8c46-2654f0f48a13.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\12fd2590-aad1-4ca8-8c46-2654f0f48a13.tmp
Size 29KB
SHA256 38f298e4ab78527cbee7b3cd73489f07a60dee679b26c1c896e8375da07b037c
MD5 8aacb692163fe431c876412eb550da5d
SHA1 ac277baf46adf0f2f580e63d2953825e32e616a7
SHA512 198998608fd520555341ca9099f7b84198fa63859e8a9bd600246de88e238cac9e70c13904a8a7bfa23d8c05da58581c73f38a3a4ece0d69baf79faf90dce51c
SSDEEP 768:zBDnqx7pLuLbYFWgbjfkW8F1+UoAYDCx9Tuqh0VfUC9xbog/OV6D+BK3erofTB:zBDnqnEbYFWgbjfkWu1japD+031bB
TLSH
T17CD2C87B640CCA7F4F804A9D98197E9E6DA802CB9698CD4047FE945C02C67EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1d4fdfc6-ad0e-44f5-bb1b-392a6e3943bd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1d4fdfc6-ad0e-44f5-bb1b-392a6e3943bd.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

8daf3091-e884-4fec-a862-eae2698eee4d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8daf3091-e884-4fec-a862-eae2698eee4d.tmp
Size 11KB
SHA256 4217917d7b42ebcf7b609dc0634c8a7f05967fd29a5e9417ed289183cca8bdb8
MD5 adecc489558117a6c29b56a68d9250a4
SHA1 13608bc948fe4bf3f36aaaf8420b72a4ce137d00
SHA512 54ad0a0e120ca6c7fc2c96448f21d8ef7eda8a638139db58393fc976670999a8fa3bd8fcfee17a81cea138c317a5eacc3631c3c3a509d183c42c4b04bf59d9a8
SSDEEP 192:sxRiR7Ck/fe+snlbZuZI/jzoA8p94/g6+WNC3o/YxVUU3GEIgDCiJ:sxRisk/fjsnlV2G/5L/pU1x
TLSH
T1D142B819AE24BA3B4CC7D21DFB65BF53D2F91032A1D51E44A6FC8A1C04E66DD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9e062fab-0383-4c65-8686-ea2bf8d5e30a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9e062fab-0383-4c65-8686-ea2bf8d5e30a.tmp
Size 11KB
SHA256 0d91e0b219599cf292e442d34f89dba29f6aa348674147962fe3ebffd0432a9a
MD5 fe225eabf809da95cf4735aa5b24af6d
SHA1 9b199d839107ff51f4d4b1f731b6c6ddbba3bee2
SHA512 b2f90db3e73966592678c7785a8ec19944cb8ce20056460434cc984433ca19811e08e273914407c9dbc8ea74c39b89f41ca6008d3bf76247b5f64e40fb6d13c0
SSDEEP 192:sxRFR7Ck/fe+s/lbZuZI/jzoA8p94/g6+WNC3o/YxVUU3GEIgViJ:sxRFsk/fjs/lV2G/5L/pU1E
TLSH
T12242A719AE28BA3B4CC7D21DFA65BF53D2F91032A1D51E44A6FC8A1C14E66DD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 529b9ebb6c55a5c98583d91de7d604eb05ac39811fc833f4f458732e3dcc14b2
MD5 09fd5e50eefae3ebdb840fea36d14cb9
SHA1 33ebbce58b1d87828873c15f7f84d43c728f547c
SHA512 e8c357006d51d8b1d6419138df015687af65fd133a3da1a33c6473768b434c4ca615b6ccab74cc04af22a9a6fa9ac0adca55e22278a66bdcd2e692ea4e772cca
TLSH
T159E026D406C9C26FF30A66C74378430D8384365E96C0BB3F3788C59972466C4ABC66A4
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 7cc0fe94a1b40a3fcf987554bbde9de483cc08d0c20d9e271c435535ad84d30a
MD5 7deb96562b77c01f16d9f9e69a31cd4a
SHA1 8fa9419f17f80dec6d7f10439b2e739b8aa4add3
SHA512 ec5997d9c79ef331170b16ed1c4864c77029742ca7e391c9ea00a0634f60691b1c03fe4d0bed900b2b50f4381bbf2674e136348039f988959f7db5e88a0f88cf
TLSH
T108512EF5339C90F1F7A8007147C3ED83B6B145D0D54A1E6210E8CABDA8C632598EE29A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 4f7ca5778a91563be6632623da2afa82e3ab62e32fde40b5e1d68b674802ab91
MD5 97df6136f6109c45ec8152b434943aab
SHA1 00e6384d174338075c258d507a3967b9fc7fed0d
SHA512 cfd0d04f271172f019f8502674c33f32a1377d3f61fbafac6c2a1c33c0e44e1c35ca27b72e592a0e3f89a7a1bd127939b4954ec40dc12818662c0184f9a7b274
TLSH
T111513FF5739C90F5F768007147D3FD83B6B045D0D54A1E5214E8CABDA8C63259CEE28A
MD5 SHA1 SHA512 TLSH

Submit Download

47f4f2ec-58fc-4dc0-b315-26e376408edc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\47f4f2ec-58fc-4dc0-b315-26e376408edc.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

0bce8579-3afa-4cda-a94d-6781a91bb2b5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0bce8579-3afa-4cda-a94d-6781a91bb2b5.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

330eb9dc-20a0-4a09-aede-b5cbd4614bc4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\330eb9dc-20a0-4a09-aede-b5cbd4614bc4.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

79b70f43-211b-4881-aaa9-4425465e9f20.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\79b70f43-211b-4881-aaa9-4425465e9f20.tmp
Size 2KB
SHA256 f64732a18a132848a72543c7c0019b0da1ff0a57624614b392b7064779d190e9
MD5 09f7f4f1133296361acbce76efa01067
SHA1 d6cdb72ac349e133a27016a5301a09e969da1b63
SHA512 1fe29e97347294c9cceee6d726ad53938bc057a16128b3ef056017f1eb8d81c0f67b1f64db8450b9606e0233d4b44f7dd13a968644890b7f995f2af9a06751c4
TLSH
T117419EF3C3F8862D891155F4AA186F1BCE2D0954532C7D5AC8E4AF2B93E24B1E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ae1ef29d25153577234e46db85b05f87dc2482923ea29d19347d01f8913565e0
MD5 803b30ad52d8fb178b13237d9326b55c
SHA1 3dad743e900cdc817a5be445a4da4e6ae006c839
SHA512 8d745a54e8f09465fb8677c701e06a59efd4417114b96c81095298a5fa46188926813a8e0948a4d65e8e0851fb35555375aa883f3e57d7c03a94a73f0f7ceb00
SSDEEP 96:KU+AKrquayhkIy0UhToz8ZghKhIZyh9KiLgvpEfrpPvBqLqcMzBKkoMpBIx5yzPc:2rl/pEfrpPvYLq/zVoMpix5yzPCBZUvQ
TLSH
T1D391681531770215387E790C92E5ABFA538275733029F62B3BEA48924E6BE140EFD4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b42b088d-4436-4038-a7a4-0b046634415a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b42b088d-4436-4038-a7a4-0b046634415a.tmp
Size 12KB
SHA256 8fbeec20b912493b393f9e76ffc6117b8e1f4cf8c00bd8ccfdc19d3a899aaac1
MD5 d00d6d1791f9c090bfc9b086994f734f
SHA1 16de51cea0615fa85e4baf1a233c4e87649a8ad5
SHA512 6d7e314cb8e0e5318e2328a7a543fa0697ee99cde859b20eff252b4ea07a231f3caccfca375d8538251c58518b575169b548ca0ff198705b30b6a6017f861ebd
SSDEEP 192:sxRiR7Ck/fe+snkbZuZI/jzoA8p94/g6+WNC3o/Yx3UU3GEIgDYiJ:sxRisk/fjsnkV2G/5L/ZU1P
TLSH
T11B42C819AD24AA3B4CC7D21DFB66BF53E2F9103261D51E44A6FC8A1C14E76DD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f8744ccc-dd6f-4a9f-9629-02acf18f4e7a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f8744ccc-dd6f-4a9f-9629-02acf18f4e7a.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b1c621a3-5385-4449-85af-c1e0d8ba9203.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b1c621a3-5385-4449-85af-c1e0d8ba9203.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b4a79126-909b-4f95-aa51-e7bfd251accb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b4a79126-909b-4f95-aa51-e7bfd251accb.tmp
Size 37KB
SHA256 5366c9c6bee01c7c200e9ecc4af75cb377a2ea4e8169cdb913dac150e6b81aea
MD5 51bc921af12555ce88d1a20e2bc0b3e3
SHA1 cb598275fe41b7aef34fd6423015ac5ad6a5c8b5
SHA512 b6248db8784a83ac2c41f2579012281a83994ae3eef8c3abc889463e895d1b8daa48eed7fc914fbbebd8380075196032e124a98a97be01b76095cd775342f8f2
SSDEEP 768:h/UxvxjgC+i3yr9TOfkfqlKJYe1ELsAvC8/YMuDSHrkw:0Zj3+i3lfkfHYe1EQujYbS4w
TLSH
T17D03C035ECA48D375DF2A688774A5713FEF4812394C46BA496DD2B0D05C72BCA30F89A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

72dcc66b-93f0-4a57-bdcc-d5b7505fd1ec.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\72dcc66b-93f0-4a57-bdcc-d5b7505fd1ec.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

edacb6db-004d-4b7b-9bb2-aa6d1713735d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\edacb6db-004d-4b7b-9bb2-aa6d1713735d.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

25425953-cf04-426d-872a-f61410cbfa38.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\25425953-cf04-426d-872a-f61410cbfa38.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5771e055-a1d2-45de-9da4-f52353fabaaa.tmp

Path C:\Users\Admin\AppData\Local\Temp\5771e055-a1d2-45de-9da4-f52353fabaaa.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

9f820c68-c56d-41e0-ae35-3748b60ab25a.tmp

Path C:\Users\Admin\AppData\Local\Temp\9f820c68-c56d-41e0-ae35-3748b60ab25a.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4292_1942020376\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4292_1177242847\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4292_1373479439\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4292_1440568540\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4292_1826306688\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 b6902a40baa020e20e7a38d60fff773647f7fdd3ca993c1e5d362f4702c4da97
MD5 307924f5f450cadfe49c59ff03fa32fe
SHA1 fd673b2683a2547963a3d33ca40ca26947777dab
SHA512 adc53679f65d8fdbd1106a9fda87e53cf4ff1a6f11a34a65b900489d2773a60711b2b0376325ccef618d576784ff1f30b08ea9621811d45c41025c5d74175223
TLSH
T14571008357B8C5B3C1DA5FF102835248F5BB22384B2330350B965586AB30A3A24B8F48
MD5 SHA1 SHA512 TLSH

Submit Download

memory/880-427-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/880-396-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1288-328-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1548-431-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2040-489-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2096-332-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2096-349-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2160-287-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2544-275-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2656-197-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3532-463-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3576-353-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4136-348-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4136-371-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4176-384-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4224-304-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4628-451-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4676-426-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5080-494-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5656-468-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5656-490-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5780-247-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5840-512-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6076-232-0x0000000000010000-0x00000000000AB000-memory.dmp

Download