systex | 5e346472e54a44fc429c6db9379a476aa2a2f1959c357e3bce387db8d65c0737

Analysis

max time kernel
149s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/10/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample261013-2cfzdsvsbv
SHA256 5e346472e54a44fc429c6db9379a476aa2a2f1959c357e3bce387db8d65c0737
MD5 b663068ba817dda61e1b4d07d935acc8
SHA1 5c68cdbc4d09bca13fbc5ffb575e644fe7f1930c
SHA512 204a0b8617449f0bedd80bcc175fdfaa366838def46e011b0fdbd72a25f7fbf1021482bdb65efa3da987ff1cfb10dec2d2a41a817335a227bb8cdfe2ac9ffd45
SSDEEP 6144:bflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:bflfAsiVGjSGecvX
TLSH
T1AC747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4900	pkhcausmkhcaxspn.exe
2792	pkhcausmkhcaxspn.sys
2432	CreateProcess.exe
3760	xspkhfzusp.exe
5632	CreateProcess.exe
1300	CreateProcess.exe
3084	i_xspkhfzusp.exe
3300	cwusmkeczu.sys
2816	CreateProcess.exe
5624	urmkecwuom.exe
3872	CreateProcess.exe
5592	CreateProcess.exe
5716	i_urmkecwuom.exe
4184	bztrmgebzt.sys
4704	CreateProcess.exe
3156	wuomgezwrp.exe
2804	CreateProcess.exe
1272	CreateProcess.exe
6012	i_wuomgezwrp.exe
3948	omgeywqojg.sys
460	CreateProcess.exe
1880	omgeywrojg.exe
5760	CreateProcess.exe
884	CreateProcess.exe
3440	i_omgeywrojg.exe
4192	trojgbywqo.sys
1172	CreateProcess.exe
2728	igbvtqlgdy.exe
948	CreateProcess.exe
5460	CreateProcess.exe
3696	i_igbvtqlgdy.exe
2104	igaytqoigd.sys
3616	CreateProcess.exe
3936	gdyvqoigdy.exe
5304	CreateProcess.exe
2572	CreateProcess.exe
2956	i_gdyvqoigdy.exe
3856	avsnlfdxvt.sys
3084	CreateProcess.exe
2692	xvqnigaysq.exe
5740	CreateProcess.exe
4980	CreateProcess.exe
3472	i_xvqnigaysq.exe
4960	fdqnhfdxvp.sys
2932	CreateProcess.exe
1468	xusqnifaxs.exe
1688	CreateProcess.exe
5952	CreateProcess.exe
3488	i_xusqnifaxs.exe
2768	nkfcxvsmkf.sys
5064	CreateProcess.exe
1392	fczxspcaus.exe
4640	CreateProcess.exe
4364	CreateProcess.exe
1236	i_fczxspcaus.exe
4880	czuspkhfzx.sys
6092	CreateProcess.exe
6120	czxrpkhczu.exe
2792	CreateProcess.exe
4192	CreateProcess.exe
1984	i_czxrpkhczu.exe
1044	wuomjhbzur.sys
3080	CreateProcess.exe
5092	ztrmjecwuo.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4856_482225353\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4856_1075660744\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4856_1419068534\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4856_482225353\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4856_1075660744\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4856_1267061843\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4856_1267061843\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4856_1267061843\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4856_1267061843\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgeywrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fczxspcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrmjecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrmjecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdxvpnkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfcxupmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtomgezwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkhcausmkhcaxspn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspkhfzusp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomgezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdyvqoigdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvqnigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xusqnifaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmkecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igbvtqlgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvqnigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtomgezwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrljdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtqljdbvtq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdxvpnkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfdxvqnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmkecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfdxvqnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwupmhczx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgeywrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrljdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czxrpkhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomgezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fczxspcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igbvtqlgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdyvqoigdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xusqnifaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czxrpkhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfcxupmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtromgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtqljdbvtq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwupmhczx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspkhfzusp.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2108	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1884	ipconfig.exe
2756	ipconfig.exe
5376	ipconfig.exe
3332	ipconfig.exe
1528	ipconfig.exe
3616	ipconfig.exe
1496	ipconfig.exe
3752	ipconfig.exe
1640	ipconfig.exe
5380	ipconfig.exe
2884	ipconfig.exe
5884	ipconfig.exe
3856	ipconfig.exe
4636	ipconfig.exe
1240	ipconfig.exe
3368	ipconfig.exe
5704	ipconfig.exe
1748	ipconfig.exe
4184	ipconfig.exe
4328	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4057491610-3392471755-192832105-1000\{07A00EF3-826C-4423-89AA-388DA1FC677B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4900	pkhcausmkhcaxspn.exe
4900	pkhcausmkhcaxspn.exe
4900	pkhcausmkhcaxspn.exe
4900	pkhcausmkhcaxspn.exe
4900	pkhcausmkhcaxspn.exe
4900	pkhcausmkhcaxspn.exe
4900	pkhcausmkhcaxspn.exe
4900	pkhcausmkhcaxspn.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3084	i_xspkhfzusp.exe
Token: SeDebugPrivilege	5716	i_urmkecwuom.exe
Token: SeDebugPrivilege	6012	i_wuomgezwrp.exe
Token: SeDebugPrivilege	3440	i_omgeywrojg.exe
Token: SeDebugPrivilege	3696	i_igbvtqlgdy.exe
Token: SeDebugPrivilege	2956	i_gdyvqoigdy.exe
Token: SeDebugPrivilege	3472	i_xvqnigaysq.exe
Token: SeDebugPrivilege	3488	i_xusqnifaxs.exe
Token: SeDebugPrivilege	1236	i_fczxspcaus.exe
Token: SeDebugPrivilege	1984	i_czxrpkhczu.exe
Token: SeDebugPrivilege	5716	i_ztrmjecwuo.exe
Token: SeDebugPrivilege	1244	i_wtomgezwro.exe
Token: SeDebugPrivilege	6008	i_ztrljdbwto.exe
Token: SeDebugPrivilege	5028	i_vtqljdbvtq.exe
Token: SeDebugPrivilege	3832	i_tnlidavtnl.exe
Token: SeDebugPrivilege	3776	i_lfdxvpnkfd.exe
Token: SeDebugPrivilege	5268	i_nkfdxvqnhf.exe
Token: SeDebugPrivilege	5080	i_hfcxupmkec.exe
Token: SeDebugPrivilege	2448	i_ecwupmhczx.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4856	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 4900	4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 4952 wrote to memory of 2676	4952	2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	91
PID 2676 wrote to memory of 4856	2676	iexplore.exe	92
PID 4856 wrote to memory of 4644	4856	msedge.exe	93
PID 4856 wrote to memory of 2108	4856	msedge.exe	95
PID 4856 wrote to memory of 5660	4856	msedge.exe	96
PID 4856 wrote to memory of 5660	4856	msedge.exe	96
PID 4856 wrote to memory of 5560	4856	msedge.exe	97
PID 4856 wrote to memory of 5560	4856	msedge.exe	97
PID 4856 wrote to memory of 5560	4856	msedge.exe	97
PID 4856 wrote to memory of 1504	4856	msedge.exe	98
PID 4856 wrote to memory of 5360	4856	msedge.exe	99
PID 4856 wrote to memory of 1504	4856	msedge.exe	98
PID 4856 wrote to memory of 1504	4856	msedge.exe	98
PID 4856 wrote to memory of 5360	4856	msedge.exe	99
PID 4856 wrote to memory of 5360	4856	msedge.exe	99
PID 4856 wrote to memory of 2720	4856	msedge.exe	100
PID 4856 wrote to memory of 1388	4856	msedge.exe	101
PID 4856 wrote to memory of 2720	4856	msedge.exe	100
PID 4856 wrote to memory of 2720	4856	msedge.exe	100
PID 4856 wrote to memory of 1388	4856	msedge.exe	101
PID 4856 wrote to memory of 1388	4856	msedge.exe	101
PID 4856 wrote to memory of 3424	4856	msedge.exe	102
PID 4856 wrote to memory of 3424	4856	msedge.exe	102
PID 4856 wrote to memory of 1256	4856	msedge.exe	106
PID 4856 wrote to memory of 5996	4856	msedge.exe	107
PID 4856 wrote to memory of 1256	4856	msedge.exe	106
PID 4856 wrote to memory of 5996	4856	msedge.exe	107
PID 4856 wrote to memory of 4936	4856	msedge.exe	109
PID 4856 wrote to memory of 4320	4856	msedge.exe	110
PID 4856 wrote to memory of 4320	4856	msedge.exe	110
PID 4900 wrote to memory of 2432	4900	pkhcausmkhcaxspn.exe	112
PID 3760 wrote to memory of 5632	3760	xspkhfzusp.exe	116
PID 4856 wrote to memory of 908	4856	msedge.exe	119
PID 4856 wrote to memory of 908	4856	msedge.exe	119
PID 4900 wrote to memory of 1300	4900	pkhcausmkhcaxspn.exe	120
PID 4900 wrote to memory of 2816	4900	pkhcausmkhcaxspn.exe	124
PID 5624 wrote to memory of 3872	5624	urmkecwuom.exe	126
PID 4900 wrote to memory of 5592	4900	pkhcausmkhcaxspn.exe	129
PID 4900 wrote to memory of 4704	4900	pkhcausmkhcaxspn.exe	133
PID 3156 wrote to memory of 2804	3156	wuomgezwrp.exe	135
PID 4900 wrote to memory of 1272	4900	pkhcausmkhcaxspn.exe	138
PID 4900 wrote to memory of 460	4900	pkhcausmkhcaxspn.exe	143
PID 1880 wrote to memory of 5760	1880	omgeywrojg.exe	145
PID 4900 wrote to memory of 884	4900	pkhcausmkhcaxspn.exe	148
PID 4856 wrote to memory of 1612	4856	msedge.exe	150
PID 4856 wrote to memory of 4824	4856	msedge.exe	151
PID 4856 wrote to memory of 3852	4856	msedge.exe	152
PID 4900 wrote to memory of 1172	4900	pkhcausmkhcaxspn.exe	155
PID 2728 wrote to memory of 948	2728	igbvtqlgdy.exe	157
PID 4900 wrote to memory of 5460	4900	pkhcausmkhcaxspn.exe	160
PID 4900 wrote to memory of 3616	4900	pkhcausmkhcaxspn.exe	164
PID 3936 wrote to memory of 5304	3936	gdyvqoigdy.exe	166
PID 4900 wrote to memory of 2572	4900	pkhcausmkhcaxspn.exe	169
PID 4900 wrote to memory of 3084	4900	pkhcausmkhcaxspn.exe	173
PID 2692 wrote to memory of 5740	2692	xvqnigaysq.exe	175
PID 4900 wrote to memory of 4980	4900	pkhcausmkhcaxspn.exe	178
PID 4900 wrote to memory of 2932	4900	pkhcausmkhcaxspn.exe	182
PID 1468 wrote to memory of 1688	1468	xusqnifaxs.exe	184
PID 4900 wrote to memory of 5952	4900	pkhcausmkhcaxspn.exe	187
PID 4856 wrote to memory of 4228	4856	msedge.exe	189
PID 4856 wrote to memory of 4228	4856	msedge.exe	189
PID 4900 wrote to memory of 5064	4900	pkhcausmkhcaxspn.exe	194
PID 1392 wrote to memory of 4640	1392	fczxspcaus.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-12_b663068ba817dda61e1b4d07d935acc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Temp\pkhcausmkhcaxspn.exe
  C:\Temp\pkhcausmkhcaxspn.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xspkhfzusp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2432
  - - C:\Temp\xspkhfzusp.exe
      C:\Temp\xspkhfzusp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3760
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5632
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xspkhfzusp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1300
  - - C:\Temp\i_xspkhfzusp.exe
      C:\Temp\i_xspkhfzusp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3084
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urmkecwuom.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2816
  - - C:\Temp\urmkecwuom.exe
      C:\Temp\urmkecwuom.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5624
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3872
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urmkecwuom.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5592
  - - C:\Temp\i_urmkecwuom.exe
      C:\Temp\i_urmkecwuom.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wuomgezwrp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4704
  - - C:\Temp\wuomgezwrp.exe
      C:\Temp\wuomgezwrp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3156
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2804
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3616
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wuomgezwrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1272
  - - C:\Temp\i_wuomgezwrp.exe
      C:\Temp\i_wuomgezwrp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6012
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omgeywrojg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:460
  - - C:\Temp\omgeywrojg.exe
      C:\Temp\omgeywrojg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1880
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5760
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3368
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omgeywrojg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:884
  - - C:\Temp\i_omgeywrojg.exe
      C:\Temp\i_omgeywrojg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3440
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igbvtqlgdy.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1172
  - - C:\Temp\igbvtqlgdy.exe
      C:\Temp\igbvtqlgdy.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2728
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:948
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1884
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igbvtqlgdy.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5460
  - - C:\Temp\i_igbvtqlgdy.exe
      C:\Temp\i_igbvtqlgdy.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gdyvqoigdy.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3616
  - - C:\Temp\gdyvqoigdy.exe
      C:\Temp\gdyvqoigdy.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3936
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5304
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2756
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gdyvqoigdy.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2572
  - - C:\Temp\i_gdyvqoigdy.exe
      C:\Temp\i_gdyvqoigdy.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2956
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvqnigaysq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3084
  - - C:\Temp\xvqnigaysq.exe
      C:\Temp\xvqnigaysq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2692
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5740
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1496
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvqnigaysq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4980
  - - C:\Temp\i_xvqnigaysq.exe
      C:\Temp\i_xvqnigaysq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3472
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xusqnifaxs.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2932
  - - C:\Temp\xusqnifaxs.exe
      C:\Temp\xusqnifaxs.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1468
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1688
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3752
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xusqnifaxs.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5952
  - - C:\Temp\i_xusqnifaxs.exe
      C:\Temp\i_xusqnifaxs.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3488
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fczxspcaus.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5064
  - - C:\Temp\fczxspcaus.exe
      C:\Temp\fczxspcaus.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1392
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4640
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1640
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fczxspcaus.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4364
  - - C:\Temp\i_fczxspcaus.exe
      C:\Temp\i_fczxspcaus.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1236
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\czxrpkhczu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6092
  - - C:\Temp\czxrpkhczu.exe
      C:\Temp\czxrpkhczu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6120
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2792
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5376
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_czxrpkhczu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4192
  - - C:\Temp\i_czxrpkhczu.exe
      C:\Temp\i_czxrpkhczu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ztrmjecwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3080
  - - C:\Temp\ztrmjecwuo.exe
      C:\Temp\ztrmjecwuo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5092
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:592
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2884
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ztrmjecwuo.exe ups_ins
    3⤵
    PID:932
  - - C:\Temp\i_ztrmjecwuo.exe
      C:\Temp\i_ztrmjecwuo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtomgezwro.exe ups_run
    3⤵
    PID:2000
  - - C:\Temp\wtomgezwro.exe
      C:\Temp\wtomgezwro.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4148
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1764
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtomgezwro.exe ups_ins
    3⤵
    PID:5960
  - - C:\Temp\i_wtomgezwro.exe
      C:\Temp\i_wtomgezwro.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1244
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ztrljdbwto.exe ups_run
    3⤵
    PID:3572
  - - C:\Temp\ztrljdbwto.exe
      C:\Temp\ztrljdbwto.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6060
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1932
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1748
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ztrljdbwto.exe ups_ins
    3⤵
    PID:1636
  - - C:\Temp\i_ztrljdbwto.exe
      C:\Temp\i_ztrljdbwto.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6008
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtqljdbvtq.exe ups_run
    3⤵
    PID:5684
  - - C:\Temp\vtqljdbvtq.exe
      C:\Temp\vtqljdbvtq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5036
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2104
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4184
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtqljdbvtq.exe ups_ins
    3⤵
    PID:1728
  - - C:\Temp\i_vtqljdbvtq.exe
      C:\Temp\i_vtqljdbvtq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5028
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tnlidavtnl.exe ups_run
    3⤵
    PID:2088
  - - C:\Temp\tnlidavtnl.exe
      C:\Temp\tnlidavtnl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4620
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1380
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5884
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tnlidavtnl.exe ups_ins
    3⤵
    PID:1080
  - - C:\Temp\i_tnlidavtnl.exe
      C:\Temp\i_tnlidavtnl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3832
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lfdxvpnkfd.exe ups_run
    3⤵
    PID:4260
  - - C:\Temp\lfdxvpnkfd.exe
      C:\Temp\lfdxvpnkfd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6008
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3652
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4328
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lfdxvpnkfd.exe ups_ins
    3⤵
    PID:1340
  - - C:\Temp\i_lfdxvpnkfd.exe
      C:\Temp\i_lfdxvpnkfd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3776
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkfdxvqnhf.exe ups_run
    3⤵
    PID:5704
  - - C:\Temp\nkfdxvqnhf.exe
      C:\Temp\nkfdxvqnhf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4376
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3556
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkfdxvqnhf.exe ups_ins
    3⤵
    PID:1268
  - - C:\Temp\i_nkfdxvqnhf.exe
      C:\Temp\i_nkfdxvqnhf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5268
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfcxupmkec.exe ups_run
    3⤵
    PID:1660
  - - C:\Temp\hfcxupmkec.exe
      C:\Temp\hfcxupmkec.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4840
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2408
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfcxupmkec.exe ups_ins
    3⤵
    PID:4628
  - - C:\Temp\i_hfcxupmkec.exe
      C:\Temp\i_hfcxupmkec.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5080
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwupmhczx.exe ups_run
    3⤵
    PID:4216
  - - C:\Temp\ecwupmhczx.exe
      C:\Temp\ecwupmhczx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4104
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2428
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4636
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwupmhczx.exe ups_ins
    3⤵
    PID:520
  - - C:\Temp\i_ecwupmhczx.exe
      C:\Temp\i_ecwupmhczx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bwtromgeyw.exe ups_run
    3⤵
    PID:5820
  - - C:\Temp\bwtromgeyw.exe
      C:\Temp\bwtromgeyw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1984
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4592
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1528
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffd7f95c188,0x7ffd7f95c194,0x7ffd7f95c1a0
      4⤵
      PID:4644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2160,i,9042711118591214815,6386532579784889275,524288 --field-trial-handle=2464,i,3765909995001066028,16387052693560858949,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:11
      4⤵
      System Time Discovery
      PID:2108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,2889210396862527021,11225670389231055621,524288 --field-trial-handle=2464,i,3765909995001066028,16387052693560858949,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:13
      4⤵
      PID:5660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1880,i,10361337603072387766,17632205754965530331,262144 --field-trial-handle=2464,i,3765909995001066028,16387052693560858949,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:2
      4⤵
      PID:5560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,3005219093445307096,323865708726830437,2097152 --field-trial-handle=2464,i,3765909995001066028,16387052693560858949,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
      4⤵
      PID:1504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,15557587583496826038,5857880210636262814,2097152 --field-trial-handle=2464,i,3765909995001066028,16387052693560858949,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
      4⤵
      PID:5360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4348,i,10310863733609597475,18054854492649023559,2097152 --field-trial-handle=2464,i,3765909995001066028,16387052693560858949,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:1
      4⤵
      PID:2720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4360,i,7693853904512431921,14891156189639212404,2097152 --field-trial-handle=2464,i,3765909995001066028,16387052693560858949,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:9
      4⤵
      PID:1388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,2580915442954804712,16618152298121370483,524288 --field-trial-handle=2464,i,3765909995001066028,16387052693560858949,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
      4⤵
      PID:3424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,17823230244264164620,8651681989872337030,524288 --field-trial-handle=2464,i,3765909995001066028,16387052693560858949,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
      4⤵
      PID:1256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,7260602044775809042,4086573482183508720,524288 --field-trial-handle=2464,i,3765909995001066028,16387052693560858949,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:14
      4⤵
      PID:5996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,3048972155545830679,7295415486259242822,524288 --field-trial-handle=2464,i,3765909995001066028,16387052693560858949,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
      4⤵
      PID:1904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,3048972155545830679,7295415486259242822,524288 --field-trial-handle=2464,i,3765909995001066028,16387052693560858949,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
      4⤵
      PID:4936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,1795113653449872528,17899337824802448063,524288 --field-trial-handle=2464,i,3765909995001066028,16387052693560858949,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
      4⤵
      PID:4320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,15645924705203555579,13452238644731930120,524288 --field-trial-handle=2464,i,3765909995001066028,16387052693560858949,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:14
      4⤵
      PID:908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1288,i,14747383593045939558,9283736303108098006,524288 --field-trial-handle=2464,i,3765909995001066028,16387052693560858949,262144 --variations-seed-version --mojo-platform-channel-handle=1380 /prefetch:14
      4⤵
      PID:1612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1292,i,3590915727167003238,6316223521510514240,524288 --field-trial-handle=2464,i,3765909995001066028,16387052693560858949,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
      4⤵
      PID:4824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1296,i,17498857787059560615,17304348627763381802,524288 --field-trial-handle=2464,i,3765909995001066028,16387052693560858949,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:14
      4⤵
      PID:3852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,12122202341905177830,13581017719686860994,524288 --field-trial-handle=2464,i,3765909995001066028,16387052693560858949,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
      4⤵
      PID:4228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,3814903388505804253,13857526769399452886,524288 --field-trial-handle=2464,i,3765909995001066028,16387052693560858949,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:14
      4⤵
      PID:6132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,9104238383103222350,15800528076790502315,524288 --field-trial-handle=2464,i,3765909995001066028,16387052693560858949,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:14
      4⤵
      PID:1240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,6726733956606974882,18032566164934599879,524288 --field-trial-handle=2464,i,3765909995001066028,16387052693560858949,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:14
      4⤵
      PID:1064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4948,i,18153795585225922253,7873951091621976431,262144 --field-trial-handle=2464,i,3765909995001066028,16387052693560858949,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:10
      4⤵
      PID:4732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,17848445910409994793,15397072928297717059,524288 --field-trial-handle=2464,i,3765909995001066028,16387052693560858949,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:14
      4⤵
      PID:5808

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1764

C:\Temp\pkhcausmkhcaxspn.sys
C:\Temp\pkhcausmkhcaxspn.sys
1⤵
- Executes dropped EXE
PID:2792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2888

C:\Temp\cwusmkeczu.sys
C:\Temp\cwusmkeczu.sys
1⤵
- Executes dropped EXE
PID:3300

C:\Temp\bztrmgebzt.sys
C:\Temp\bztrmgebzt.sys
1⤵
- Executes dropped EXE
PID:4184

C:\Temp\omgeywqojg.sys
C:\Temp\omgeywqojg.sys
1⤵
- Executes dropped EXE
PID:3948

C:\Temp\trojgbywqo.sys
C:\Temp\trojgbywqo.sys
1⤵
- Executes dropped EXE
PID:4192

C:\Temp\igaytqoigd.sys
C:\Temp\igaytqoigd.sys
1⤵
- Executes dropped EXE
PID:2104

C:\Temp\avsnlfdxvt.sys
C:\Temp\avsnlfdxvt.sys
1⤵
- Executes dropped EXE
PID:3856

C:\Temp\fdqnhfdxvp.sys
C:\Temp\fdqnhfdxvp.sys
1⤵
- Executes dropped EXE
PID:4960

C:\Temp\nkfcxvsmkf.sys
C:\Temp\nkfcxvsmkf.sys
1⤵
- Executes dropped EXE
PID:2768

C:\Temp\czuspkhfzx.sys
C:\Temp\czuspkhfzx.sys
1⤵
- Executes dropped EXE
PID:4880

C:\Temp\wuomjhbzur.sys
C:\Temp\wuomjhbzur.sys
1⤵
- Executes dropped EXE
PID:1044

C:\Temp\ezwrpjebzt.sys
C:\Temp\ezwrpjebzt.sys
1⤵
PID:4852

C:\Temp\bywrolgdbw.sys
C:\Temp\bywrolgdbw.sys
1⤵
PID:6100

C:\Temp\bvtnlgdywq.sys
C:\Temp\bvtnlgdywq.sys
1⤵
PID:4328

C:\Temp\qnlfdavsqn.sys
C:\Temp\qnlfdavsqn.sys
1⤵
PID:3280

C:\Temp\sqkidaysqk.sys
C:\Temp\sqkidaysqk.sys
1⤵
PID:2532

C:\Temp\kicausnkic.sys
C:\Temp\kicausnkic.sys
1⤵
PID:4852

C:\Temp\hfcxvpnhfz.sys
C:\Temp\hfcxvpnhfz.sys
1⤵
PID:4652

C:\Temp\kecwupmhfz.sys
C:\Temp\kecwupmhfz.sys
1⤵
PID:4320

C:\Temp\jhczurmjeb.sys
C:\Temp\jhczurmjeb.sys
1⤵
PID:5116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bztrmgebzt.sys

Path C:\Temp\bztrmgebzt.sys
Size 293KB
SHA256 5503a9bbcec94b94f18a0a0707f52553720e09afd810a69fa0ab3a91f0a8b9a1
MD5 413c2ad01f23eef5237a9b79158c626e
SHA1 801b9fe01f2536fdbce4a08ef37b9daf74bb6e30
SHA512 fd8cbbc44b7fdf9c579c5f6e80d0ab3d3751249a5aab4970ffb7c8d1be99fb520a9ea25e68ce7d75521017899141ed7eca278ed609f6645d1d53e81858ef9bbe
SSDEEP 3072:4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:4IJjiJcbI03GBc3ucY5DCSj
TLSH
T109545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwusmkeczu.sys

Path C:\Temp\cwusmkeczu.sys
Size 293KB
SHA256 57f1e2795a3d7b51ae8772de66c60ee0f8ac348f2945c4afb82536c5a6cbf1f5
MD5 43c8d1eff27d6ae8ba0806e58220bcfe
SHA1 9762574e9db95ca11ce0308858eb59b50450110b
SHA512 fb58daba5ca2df56647149bc000f517aac0e01b9dc596ea5e720275546c105ebdf966e9a1891d141c01658ccd0df13ce0443507cad1757f98804528eaf1e0be4
SSDEEP 3072:5tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:5IJjiJcbI03GBc3ucY5DCSj
TLSH
T193545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdyvqoigdy.exe

Path C:\Temp\gdyvqoigdy.exe
Size 361KB
SHA256 efa6a5e828cb0de082d3281b47921dd3a67c54a9dbb5ce465bbaa0340b807dc0
MD5 5dc3799df2d30822c7ca2ab87021d557
SHA1 6d1c6a8ffc291621b13f3bf78c1f812684c4f378
SHA512 ae9005784fdf2408cc10664c27b42afb980995551302c54a24c9b8d34efe82c6391110b1525ee57929e40a2c7e48cdb730dbd471f4553491da2d4657a04aefd0
SSDEEP 6144:DflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:DflfAsiVGjSGecvX
TLSH
T16B747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igbvtqlgdy.exe

Path C:\Temp\i_igbvtqlgdy.exe
Size 361KB
SHA256 bcb7ddb7945ac766521793799ba39da7d53be9511d4d2ec85f1ab860f381f7c0
MD5 5d98d9375a06c7874b29e755345953c7
SHA1 95a204e4af760e52afc64aa078329278e7101e8e
SHA512 884e43ddd3495d2aa1b8b68d27d06cf0e999e479c515e4f2c1d948ed4aca3746a450845b4e23725ebd5ef767072d648cba8777cc5a26b5429c4f3766b890fa8e
SSDEEP 6144:HflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:HflfAsiVGjSGecvX
TLSH
T15B747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_omgeywrojg.exe

Path C:\Temp\i_omgeywrojg.exe
Size 361KB
SHA256 10006dfb145915bb8a113a9003b5995e2ba34f6d54a5d82e8a8a342c72a5d7e4
MD5 08352b9259c2c4972f73bc8fadfb3881
SHA1 cd3679b3ec7241cd15ec827783d3cc1c35924efd
SHA512 ecde5bd4b88e16721a42ee2713eb06517b48f19295b2e1f5fef27629c67ecf21d10370396608c2d5012e50adaf7c488104a792fd91d0c442148d4250d52c22b1
SSDEEP 6144:WflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:WflfAsiVGjSGecvX
TLSH
T19E747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_urmkecwuom.exe

Path C:\Temp\i_urmkecwuom.exe
Size 361KB
SHA256 b340f08fe40268d239f7f89b802433cb23b702e8158d13daf9545d4e5b778de0
MD5 e33970ec7d7e5efe4b10bde68409ba4e
SHA1 b868e66a6b73bd821da3012b8a71db88d4599b83
SHA512 1884be97e5523ecb56bcf1a7ecc39d3ede511b2fcb17d8627f244848edecea909fdf7e656b17a9718a2a04b54082e3e5fd1a56f813af4c71d0798ce5fc7505d7
SSDEEP 6144:AflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:AflfAsiVGjSGecvX
TLSH
T19A747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wuomgezwrp.exe

Path C:\Temp\i_wuomgezwrp.exe
Size 361KB
SHA256 17f38c18ce43fdc89a662642c18f855768f73e46fac146eca37ef068a3b278ed
MD5 f1a8d19d594fb1fefb1a45534bf40ded
SHA1 bd5cc4554bf90b3bd65830208f35e383e8287077
SHA512 bc092556cd0df634d146c45ed89a8e863b4867f3b1725a8bd713333f848381aeac39bd9b43912e72999c507f7cf5bf14a5d8b81edc33b8b0feb12de7e9b6f70b
SSDEEP 6144:3flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:3flfAsiVGjSGecvX
TLSH
T180747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xspkhfzusp.exe

Path C:\Temp\i_xspkhfzusp.exe
Size 361KB
SHA256 2fadb9e04cc8250712c5b5e344e31990a7048eb4c06ebd476d27e68f2f005393
MD5 b2a65ceb4d585cde3193501ce2d81581
SHA1 c8b80c49e2920968beea3c80c2ffa0cf5a8206b0
SHA512 1cb769543395efc816b8ddcf268cec80b1b01a7b1daa04498c6970557ae3e417deabcae536c121dd9c37c7ded240212767373bea297bbbc2d96eb935d1959875
SSDEEP 6144:+flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:+flfAsiVGjSGecvX
TLSH
T1AE747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igaytqoigd.sys

Path C:\Temp\igaytqoigd.sys
Size 293KB
SHA256 b842dc7711fa6c70d19e134e7fe46bf921d9e96b0204f5a9a4810a135382477a
MD5 f377bef25fe2641f4287dfce6a1fcf46
SHA1 b99386c049ab80cda6248a7a0e2f82c2c48d446d
SHA512 0323f068924d615a6e7617c636b48b1c969dd2b0e3c21a4a62fdab95a96fa25331492ce6b28bb90e366ca96a401c6c05f63b89d6112ae59844676a2e562f1071
SSDEEP 3072:ytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:yIJjiJcbI03GBc3ucY5DCSj
TLSH
T139545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igbvtqlgdy.exe

Path C:\Temp\igbvtqlgdy.exe
Size 361KB
SHA256 c5e38b20068a762f9f9326def64a719461d1a94988a541b6801111b11ea5fb60
MD5 cc710c24e328517a758b6758a9b0225c
SHA1 f3b1eca01c59d60802abfcbf37b663b9419a38f9
SHA512 d48b12528e8a8a368c542ad144b797bb29e3f488c7313cf22d6327f0562097a757681afa243ad151dccd340f8d16ac3dfdac1b794d49bb76e3a627e0741ed975
SSDEEP 6144:mflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:mflfAsiVGjSGecvX
TLSH
T1B2747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgeywqojg.sys

Path C:\Temp\omgeywqojg.sys
Size 293KB
SHA256 228ab53ca529847d19826abdb5dc2b9735fefb8d0283b6d7876b759e4c6505f3
MD5 ad642be15c5ed33c49c6267483f73d47
SHA1 6ca8d4fb72c0870f87853daa5588106af8e33180
SHA512 df17a4f202f34b502b7ea23ef6c360d6b388054b231be06c50e89d02555d4c8cf40f3cceb2cb98ed998f68bd18a5ae1b63ff3df02f1c30295f31738df7d75fdf
SSDEEP 3072:otKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:oIJjiJcbI03GBc3ucY5DCSj
TLSH
T159545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgeywrojg.exe

Path C:\Temp\omgeywrojg.exe
Size 361KB
SHA256 1aef9a77c25c360d1d04a29dd23b8a2c14b193880c4bbdaa309ee068d98b3e61
MD5 069d48e19b11720041b91ba06ca46770
SHA1 e84bc5192976fd8c18fadd27a2be2d9ca9c03fe6
SHA512 cfac2bde517ba0f63dd6dd352fe5ebbe37959963a7265a6a6dec79689f0b1e0080647958038f5adf2e1399c872dc84a41af64880b75f3901290b0c38bfa45943
SSDEEP 6144:OflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:OflfAsiVGjSGecvX
TLSH
T1FC747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkhcausmkhcaxspn.exe

Path C:\Temp\pkhcausmkhcaxspn.exe
Size 361KB
SHA256 1fde8918164a867d06334598462fed0fa9368eaa071e40b4455758827b69db6f
MD5 8a35380987d2ad34888c905dcc6ee98c
SHA1 46a585722489ddceaf3fb9026b00b55e43c93bfb
SHA512 148e4362dffc03d5a4d098977678a93d4d84026f92f6bca1461de46de94cde14d23c50c7a09385f47e3d42c79bd831405359079e0e6e7b5fac1864ade730d601
SSDEEP 6144:AflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:AflfAsiVGjSGecvX
TLSH
T10A747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkhcausmkhcaxspn.sys

Path C:\Temp\pkhcausmkhcaxspn.sys
Size 293KB
SHA256 36eeaa9f5ff551bd62cf5e4cd229d2f45a751fa00b39cd6f090407be282eb576
MD5 c05b7c71dc2623a95e3be523803161b7
SHA1 217f0bcc4e7e75bc586bfffb134442797c24f4ad
SHA512 6c93dc2b387c3d1d37552db0804830e4275207410be46d4d0269a86e64828dbd2835f09028bbc61106e77d0ace6748ae5e5d85923763f709b27541e7af56e8d8
SSDEEP 3072:RtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:RIJjiJcbI03GBc3ucY5DCSj
TLSH
T193545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trojgbywqo.sys

Path C:\Temp\trojgbywqo.sys
Size 293KB
SHA256 18014caad1b022e75003aa769a9c821e13099481f1cff220b5f8b8b42d2f4fb3
MD5 bcbbfcc029ef3f14274defb4ef9c6474
SHA1 ce159cb5851169f47a7325d7092aa35788fc2b24
SHA512 5ce803e093a408df2cceba263819a33a8ec6f80575ffa25445f705a34c8c7ffed9fe848c0c8261bf8d8a29cf0c2e5603c7a235bff68be62e91532495e29a5028
SSDEEP 3072:gtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:gIJjiJcbI03GBc3ucY5DCSj
TLSH
T123545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urmkecwuom.exe

Path C:\Temp\urmkecwuom.exe
Size 361KB
SHA256 4b45572ceccda02c2304b50ce3c2ffa22cbd7433937c609f376a9164e904aa6c
MD5 e0ff1a045dcd1af3e40b5515c979ff14
SHA1 bbcbb3db9e10616256966c53c701928e6a2962e7
SHA512 7a55e346bb838258b41e41ffbca3e75c9f27fafe5c853986d3a8fe71dba6956b0242fc58ad3339a2096b8740e71fad761e43578398c9ec6c94bf91b4b0c66d9f
SSDEEP 6144:NflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:NflfAsiVGjSGecvX
TLSH
T128747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomgezwrp.exe

Path C:\Temp\wuomgezwrp.exe
Size 361KB
SHA256 a6f30653245c09635898662ac1fb1484c004a716cea06585575ba1c9f1eb099f
MD5 25c3316621998d90c34d841f448b99a0
SHA1 e0aff20de40fd86b04aa47f35ce33e4d56261dca
SHA512 f7f361ad059da4d0235677d808a630c8242930532f1cbfb56edbc6c7d6aa6d4c208c766167dd031378e439f03eca0f8fef991e5d968eec28ab739c44412785d5
SSDEEP 6144:GflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:GflfAsiVGjSGecvX
TLSH
T1AB747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xspkhfzusp.exe

Path C:\Temp\xspkhfzusp.exe
Size 361KB
SHA256 97d340e6c9906f9f0b1ca249c87800462b097b6c9414d08af6a10ae4bd62f1e1
MD5 35e174fd43ba1793de365345cd2d0db4
SHA1 9fbda11ada86fb15b91c7444da179d7f01c0ba14
SHA512 a095152445ecd18c833fba33adee6374e9a9aa3a5336b6a610c7a437e7b56c59c75b78954287c9ae5fe98e2ff470543f66199871f0fa6bbb8c231ac6fe01aee4
SSDEEP 6144:GflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:GflfAsiVGjSGecvX
TLSH
T199747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

15ade827-c175-4d62-9381-47249028f2f3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\15ade827-c175-4d62-9381-47249028f2f3.tmp
Size 42KB
SHA256 9d6fb1c3715db3e7b07a0adf828a59ddc16e3de0bf47f2fa890163f618318a6e
MD5 f5b598616b935dd25c1a8238c74dd573
SHA1 39b773f15d6193f031de8d31736534f2ec6df52a
SHA512 95e8a5255c82453c93fb4d96583e461fa96a796ea513e5d9ad64b95bc9589e4653d97351144551cefa340899e7639cc0f1f7fe369e31f7d22ab1d38910235f82
SSDEEP 768:VFQ+3hwgPByUNAjE57Y0GZxJsXBdK8Z8xTL:0+3vJAa70/JsXf7uh
TLSH
T1B21328F198E39A77D9AE8783673D2E469ABCC163B5844984F7D49E0CCC461BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

414d6e04-236a-479f-b6a3-8c1ba0d73571.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\414d6e04-236a-479f-b6a3-8c1ba0d73571.tmp
Size 34KB
SHA256 d2eea22835aa857438916abdfed1a2af8aed84c9c59718adecebc7185e4daad7
MD5 4a017197210ac696da288c720c849e55
SHA1 a1820a07464c23c28b4a0e56a0819cabad58f788
SHA512 d4883c44002d00c4ea096495b65e3941d8a6e3edaf48075a440ed372690e532071e164e3c1199be7e96d2b4cff3b2cfc0e28c31c87ff2f747d596948c096d9f3
SSDEEP 384:nwZcIj38NSxcgdOMtimy5B/nfydXfjUooubsrgYg57HD8CJGZXhJqlX/XBdm/e5y:Oj3WmyPK+AsE57Y0GZxJsXBdK8Z8xTL
TLSH
T1EDF2BF30A870EEB399FBD391794A3687AEF456B3DAC40E48DAD9DB0D014719E170781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5cbd2c5d-b411-4f75-a9e1-ed07946abf19.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5cbd2c5d-b411-4f75-a9e1-ed07946abf19.tmp
Size 37KB
SHA256 b1d9b1c591b019a600484e43fd6f51cfc5bc6e461fbd8483ba938cf57e2ed7b4
MD5 f21947ec64e7314e79f7efced3acb3c5
SHA1 79e92420c587492fa9ee5a0b791bbed8cf16a009
SHA512 5be5fee6265d1ff54a9513c3cc6dc508f6692f6166ccc549647bf034e9bef74252abae280b0e082160e3963891b5838ebaedd5c16c7934cadbc64462c41b79f1
SSDEEP 768:A/UxvxjgC+I3pEK+AE57Y0GZxJsXBdK8lISHUPpMs:tZj3+I3+370/JsXf7CSfs
TLSH
T1E603B035ECA09D735DF7A3903A0D7357EEF446B3C5C55AA48AED5B0D028B2AD430391A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6e7031c9-7907-452b-aff5-9456f59113d9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6e7031c9-7907-452b-aff5-9456f59113d9.tmp
Size 34KB
SHA256 7d4fd62a3639c1a11a24d93bd455dcee6dcbc98126badc0e002060106e59ac68
MD5 f81fa1c3aa3d1256fb5d0ef35a9c11f6
SHA1 809c7dd269042fff487019c611c76cf3e576a4e9
SHA512 e6037064cbdba5ba0daa2018960a6c7be3bb03e19fd473db0a48c47c7395e34e3baa6295a90b3180d89d6e0c01ea45f4178800e4984d63d20ce1e1036c85d3da
SSDEEP 384:nrZcIj38NSmcgdOMtimy5B/nfydXfjUooubsrgYg57HD8CJGZXhJqlX/XBdm/e5y:zj3lmyPK+AsE57Y0GZxJsXBdK8Z8xTL
TLSH
T1A9F2BF30A870EEB399FBD39179493687AEF45673DAC40E48DAE9DB0D014719E170781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7b6fa7f8-0006-40c4-a0ed-a32f2e0d3238.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7b6fa7f8-0006-40c4-a0ed-a32f2e0d3238.tmp
Size 38KB
SHA256 3b1e4ee3c33b7fc08525ae197c1966822bf0fc6bbd101e0b2ae3958cf30d458a
MD5 38458274fe39d816dbfca4b717aeeb07
SHA1 b096a7295065883bbc7dba4e898297f89ff87b7e
SHA512 ef14c348823c9721bf09beb0d0a86906225fd31788a4810dee3d29b5df73edde8d8741ac45e7d707b81c41de15924524a1f88db8bced10691b3b751bbdd1ce23
SSDEEP 768:d/UxvxjgC+I3FmiVK+ABE57Y0GZxJsXBdK8E8SHUPpMs:AZj3+I3F9Ag70/JsXf7VSfs
TLSH
T10603C030E8619D6359FB93A0364E73C7EEF416F3D9C14D688AE99B0C018729D134791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

34ca29e8-5ca9-484f-a2f6-fa926c225050.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\34ca29e8-5ca9-484f-a2f6-fa926c225050.tmp
Size 105KB
SHA256 4ee1e0056f41a046e8efbfc68a394a9993e9e1572e402e58600b2c2d27cdbad0
MD5 cbb9f3725f3320854f02b5fb7d1eee93
SHA1 9c687195aa5a8f617023a505ab65229bb9a04596
SHA512 a8e728ca1dd3f2320d59c0244f1a4c82c5213ac624c22798462d831fa8936055eccd554951d7106079089867cda6e052f87a3bef24aa908224fd8e90caa6ebfc
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Z:fwUQC5VwBIiElEd2K57P7Z
TLSH
T13DB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 54a604899198f01e1a2f5ec52bac53679a6d2775840ba8c81ab97c59f718adf8
MD5 b266cfe7dc8e59a4693bec2c7307d768
SHA1 0ff4c63ce201552fd340f72d3376df63989a21f9
SHA512 6832b9d56510cdd21708734b256b052e90f313f920ebc959b4845a1a4fc17cfbfe75dfa04c5252540531ead21e0662a341763e79030c36867f2823312c51c0f9
TLSH
T1C1D02BB8B77CC476E40210784043050052517004581704D10F05A2448984080804014E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fe09a9e94fbd795d6fab442dc426ef79e7bd47dbd80086b003cb1cd34d18db58
MD5 4da51a25f1a6b822ac642c6eae6f9a72
SHA1 9d4f1d1e83270c8d54d24725cd3d7f406de5967d
SHA512 c027a48a18b3b282e84d69320ca44ca416bceb43057eee8fcf4b2647669c307720f00240e17a22310df0488100938fd8b34a0660ca73adaa5f0433a1657b325a
TLSH
T16CD02BBCB76CC476E40210744042050052617004AC1704D10F0562448984080804114E
MD5 SHA1 SHA512 TLSH

Submit Download

36343c66-dfb5-47aa-aca5-4e973fcd9c98.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\36343c66-dfb5-47aa-aca5-4e973fcd9c98.tmp
Size 11KB
SHA256 99c831f17b63d9ad0eed9deeef678118407c82e4f5b63d54ac75b3f0f854a3bf
MD5 9284dac883bea274cd8ef482c990d617
SHA1 62319d5d7eb53a52f22b06c98a483b50e8b5181a
SHA512 8ce5ee8aea56187fc393fff83bbac95ecae4f441b782c1aed2f30a4aeac524bd00a8c084c6637ad5e0ec73f78f1a5e029d762a9d62ec6ca0779c207361282fa9
SSDEEP 192:sxR8RtC+/fD+s2mzZR/YuTzoA8p9a/g6+WNCvI/YU2gfwc7GQIgVVuAJ:sxR8a+/f6s2m9R7CY/5z/zbuk
TLSH
T16A42D815AE28AA7B8CCBD21DBB557F53D2F91132A0911E48F6FC8A1C15EB6DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

460814f9-d828-4021-97fd-31d6f1c5eac4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\460814f9-d828-4021-97fd-31d6f1c5eac4.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

50427614-d4ae-4d54-a7fb-45ab5f4fb330.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\50427614-d4ae-4d54-a7fb-45ab5f4fb330.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 f017b1abb77c351722f525793b9fff438409bd86b0ffaddb55b4682aa0495329
MD5 a08d0e0a8abeddf7840374703065e70e
SHA1 9f149723f020e134c5fa5dd79bc89d87f835b6d5
SHA512 26479455d5e55c880ad00784836a52ee296a2d371226ae1857e93139b4968d6e9c1fbb91e9fba43f91f0c845472c2349c60e300b7a3e78cda52402e9f174a9d2
TLSH
T1F8616FBA77EC8289FB6C6171D1D69CC736F04688F68F8F0111A9D4BAAC8731BD10C014
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 78b24ec239341a83f968821fbf4ddfc3df4ef610452adcb13af9370978dc92b9
MD5 888393c1aa34ba25ee1c9499d1f0ff1c
SHA1 a485db060d5b54473dd1a307273b68340c4a02c7
SHA512 e913d1ea4a516cf5e64e18a153145c4c6393255e680ed8d93b53a1405d4118fefb0174c11f29177b023df175bcab55af5b950f9c0e8bc3803b5ddd0d3d20ee62
TLSH
T124616EBA77EC8289FBAC6171D1D69CC736F04688F68F8F0111A9D4BAAC8732BD14C014
MD5 SHA1 SHA512 TLSH

Submit Download

d25d2996-cd36-47f7-ba7d-9ad127e345ff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\d25d2996-cd36-47f7-ba7d-9ad127e345ff.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

73247f09-f555-43c7-a43d-ee1279c21fe0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\73247f09-f555-43c7-a43d-ee1279c21fe0.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

b9f766d3-52bc-41a6-8f1b-5f6162913b41.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b9f766d3-52bc-41a6-8f1b-5f6162913b41.tmp
Size 2KB
SHA256 85fdd0d2e628c1a932a223f4490146520cbb76d58ac8f15126cb6f56a57718d7
MD5 4983ab39fa018ea5e513e66383ef4480
SHA1 c0c2fc53d7f6e838bd651fb50a96041f2e405a67
SHA512 c6927041dc06d73cc1e0e05689fbd3f1b60391f33ec8edc76e688b3f3e6e2856531e511fdd6cbd7a8a40cacb35b8817dec6cd735b4758c1d42195706c07a23c0
TLSH
T19141B0F387F4856ECA119AF0AB186E2FCE1D0515432C7D9AC4E49E2B93E3471D141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

e8908a7e-d01e-4738-aa12-96c685ca8f04.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e8908a7e-d01e-4738-aa12-96c685ca8f04.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d8b6e5f0a75bcd142b749f7bd0d6f94e4d73a97d8e5bf65b80e3c4ad042b81d0
MD5 4ab6fdcfd751ce3718e918e78df484c8
SHA1 767805037116062f3916cb16a1445d9baad3047c
SHA512 e6c88c97c3ec2521ad55d777a9d565c0762c78b4ad9cc723fbcfc4f5ea9bbfcce262e0ea63ba318343cc990c151607164a4385bdf006beb4272df749623a209b
SSDEEP 48:KgpItK6AQfyVnIVKAcwGaBkYKosv9kDmIgQvKD+bevXy/SL08kyB:KgpOK6AaunqKAcbJmKSYiW
TLSH
T18D919A10313B324138BE3A4854E8A69A474371733599E9BF37EA48628D6BE058DFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ab717735-31e2-4850-a0aa-44568eb3b2f4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ab717735-31e2-4850-a0aa-44568eb3b2f4.tmp
Size 12KB
SHA256 1ebef00433ffe3ce1234ab040140d90b1e14219b241444b35aaebffe348ce22d
MD5 9eeec95d037055aa5ebd172e392fc363
SHA1 f4a6531fd498e0583f3df5849e3cb5086dd26882
SHA512 74239ad48605620ff9da7d932499fc0e9a0365a94d9d3bbe9e40bff9eddb72974629fdd642d38719a42a62162ceaf027d9af8b9d7e3bab27557b585a7f9a10ae
SSDEEP 192:sxRHRtC+/fD+sdmzZR/YuTzoA8p9a/g6+WNCvI/YU2g8sc7GQIgDrVuAJ:sxRHa+/f6sdm9R7CY/5z/I1uk
TLSH
T13C42D915AD28AA7B8CCBD21DBB557F53D2F91132A0911E48B6FC8A1C15FB6CE120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b70605a1-498d-4a22-a729-db6b01bebbd8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b70605a1-498d-4a22-a729-db6b01bebbd8.tmp
Size 12KB
SHA256 e8938e35840c52ae63454783aeebd2abaa3031765c1cd73f09749fe810400552
MD5 745501bcdd1edda427b2e1377127c438
SHA1 68262e0c7af7eb23c9b59055a5edcaa07ef4fc91
SHA512 a5c7858070ba826ac6f6808f78efe131e634102c403d8e912ff4ecfe02df61e5f03fae0bc8540d92416fa68611d15dd429bd1875339c1c02061b9afa20f542fb
SSDEEP 192:sxRHRtC+/fD+sFmzZR/YuTzoA8p9a/g6+WNCvI/YU2gfwc7GQIgDBVuAJ:sxRHa+/f6sFm9R7CY/5z/zjuk
TLSH
T12142D815AE28AA7B8CCBD21DBB55BF53D2F91132A0D11E48B6FC8A1C15EB6DD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba70f941-ccac-4c83-8249-96f643b10bfb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ba70f941-ccac-4c83-8249-96f643b10bfb.tmp
Size 29KB
SHA256 cb8b3330ae8a327f37ac5cec4907a3682d7da1a4bb00b6b055306a02dd60f109
MD5 56f84dd4eb8bec074aef2ab6f309823c
SHA1 70011f015a73589360ea9bfae0a7a106fc788f63
SHA512 1aa3ba5918a9240225ce8e663d4b831faf5d90557b0e7f841f8d9cdbbfbdcff51ddb232cf8225e209e57f5763c5e5ec71c923649a7090d4d527950bbbcc223e3
SSDEEP 768:6Jaj3+7pLuLb/KWgm0fsO7n8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/OTomB5roQL5:6Jaj3+Eb/KWgm0fbbu1jaAOThByQt
TLSH
T1F4D2DA7B740CCB7F4F800ADD99197E9B6DA802CB9698CD8047FA941C02C6BEB511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1e6feb44-e316-4040-9194-b9dc3e36b33d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1e6feb44-e316-4040-9194-b9dc3e36b33d.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

21f4ac8c-0178-4a5c-8d59-008b19d25626.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\21f4ac8c-0178-4a5c-8d59-008b19d25626.tmp
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

d757dca0-9d62-4246-afe5-db7f188ac9b6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\d757dca0-9d62-4246-afe5-db7f188ac9b6.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

e21c95c0-1e95-4622-81f8-55d8ec7f73a4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\e21c95c0-1e95-4622-81f8-55d8ec7f73a4.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

f58af189-f764-499b-8db8-6ca26c702709.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\f58af189-f764-499b-8db8-6ca26c702709.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

d9d4d6ab-41d3-4a49-b240-c3ee63251f33.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d9d4d6ab-41d3-4a49-b240-c3ee63251f33.tmp
Size 40KB
SHA256 387b2181990b537cf50612baba2f84a88287071b5f8a1b946cbad531d175c195
MD5 fe7f162bd63f8bbcf96a08a4bbc80d11
SHA1 3b91a7a61e67e471b970c40a432fa018684346ba
SHA512 e06b79013723e53c24420f86020898cea24329c8d38f70099c9f89146de79471f12cead76bef58c4d0e2d73209e88bbc40749b1d7f3c38dc5d9719f96663750b
SSDEEP 768:2/UxvxjgC+u34m4PK+AsE57Y0GZxJsXBdK8Z8xTXL:rZj3+u345Ab70/JsXf7ulL
TLSH
T16713BF34A870AE6389FBD350364A3397EEF419B3D9C14D68CAD99B0D058729E170791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

49d83fbb-73ad-4fa9-b425-2d263be05af1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\49d83fbb-73ad-4fa9-b425-2d263be05af1.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

1cc4eb76-c2db-40ce-90f1-a70c16841c4c.tmp

Path C:\Users\Admin\AppData\Local\Temp\1cc4eb76-c2db-40ce-90f1-a70c16841c4c.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

396d5591-d107-4f34-a5af-92390f198546.tmp

Path C:\Users\Admin\AppData\Local\Temp\396d5591-d107-4f34-a5af-92390f198546.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4856_130710567\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4856_1075660744\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4856_1267061843\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4856_1419068534\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4856_482225353\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 868c0650b956ce91d3e968f181d4a69fb1f7a761ab12263a4af95868c16270c4
MD5 eb3a06b069142d10349fa98878ac9560
SHA1 1fed336f1971d69796d066780f1cadbd23f2101b
SHA512 b21098acc6dd9507901336e8f82d93555f1751071f5820a37a0f12393626db52a980f3d099b10fd4f85dec27421eeb8990b2413f017607f7d1361039c4bccbfe
TLSH
T1C271238357ADC5F2C1DA5FF102835248F1FB2338072370214751594AAB34A3A64B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1044-381-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2104-301-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2532-451-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2768-347-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2792-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3280-452-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3280-439-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3300-198-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3856-327-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3948-275-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3948-294-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4184-247-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4192-287-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4192-323-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4320-496-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4328-427-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4652-478-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4852-473-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4852-401-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4880-351-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4960-331-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5116-500-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6100-423-0x0000000000010000-0x00000000000AB000-memory.dmp

Download