systex | bc39413f29362dd605b89fddb83136ed16299af21d3fd4019c51b4e453164459

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 00:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample261018-a83pgshd64
SHA256 bc39413f29362dd605b89fddb83136ed16299af21d3fd4019c51b4e453164459
MD5 f6e49b9a5088ee33b494d12328b22a09
SHA1 4a1de82a9d3300be308c522d9d0dbcc0e0114b6e
SHA512 aa90ffd97050cd8838cf027e0bc4eb0a94799176875c4ff5417c57e40445ecc6683651ef8a3faf7b8c78165588fbe100ba7a8f8fc5b8bc53dd63ba069c02adfa
SSDEEP 6144:pflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:pflfAsiVGjSGecvX
TLSH
T1EF747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
2088	vtnlfdxvtnlidavt.exe
3532	vtnlfdxvtnlidavt.sys
3340	CreateProcess.exe
4912	aysqkigayq.exe
4664	CreateProcess.exe
3432	CreateProcess.exe
4764	i_aysqkigayq.exe
3272	nkicavsqki.sys
1960	CreateProcess.exe
4328	axvpnhfdxv.exe
5432	CreateProcess.exe
2552	CreateProcess.exe
3848	i_axvpnhfdxv.exe
5308	hfaxspkica.sys
5404	CreateProcess.exe
6120	faxspkicax.exe
5968	CreateProcess.exe
4588	CreateProcess.exe
6056	i_faxspkicax.exe
3420	urpkhfzxrp.sys
2760	CreateProcess.exe
5900	urpmhezxup.exe
948	CreateProcess.exe
2684	CreateProcess.exe
3140	i_urpmhezxup.exe
5468	zwupmgezwr.sys
124	CreateProcess.exe
5408	xrpjhbzurm.exe
3848	CreateProcess.exe
2368	CreateProcess.exe
4340	i_xrpjhbzurm.exe
3188	wtrmjecwtr.sys
896	CreateProcess.exe
824	romgebztro.exe
4996	CreateProcess.exe
3420	CreateProcess.exe
1940	i_romgebztro.exe
4720	geywuomgdb.sys
932	CreateProcess.exe
3016	gebwuolgeb.exe
5636	CreateProcess.exe
5168	CreateProcess.exe
1112	i_gebwuolgeb.exe
5620	vtrljdbvtn.sys
5320	CreateProcess.exe
5672	wtolgdywto.exe
3716	CreateProcess.exe
5608	CreateProcess.exe
5648	i_wtolgdywto.exe
1836	jgbqlidavt.sys
2056	CreateProcess.exe
4988	bvsqlidbsq.exe
4928	CreateProcess.exe
5936	CreateProcess.exe
3164	i_bvsqlidbsq.exe
3712	davtnlidbv.sys
5696	CreateProcess.exe
5536	aytndxvpni.exe
3944	CreateProcess.exe
4224	CreateProcess.exe
3832	i_aytndxvpni.exe
1004	dxvpnhcaxs.sys
5324	CreateProcess.exe
2028	vsnkfaxsnk.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4572_1141341587\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4572_1141341587\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4572_413092304\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4572_2030702677\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4572_2030702677\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4572_727834754\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4572_727834754\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4572_1141341587\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4572_1141341587\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqkigayq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gebwuolgeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezxromhec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tolgdywtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tolgdywtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqnlgdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpjhbzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_romgebztro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtolgdywto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvsqlidbsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpjhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezxromhec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxvpnkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlgdyvqnli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlgdyvqnli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqnlgdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxvpnkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axvpnhfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aytndxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpjhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvpnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqkigayq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxspkicax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxspkicax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urpmhezxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gebwuolgeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uspkhfcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdxvtnlidavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uspkhfcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojhezwrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojhezwrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	romgebztro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axvpnhfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urpmhezxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtolgdywto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvsqlidbsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aytndxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhbzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnkfaxsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnkfaxsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvpnlfdx.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4384	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5988	ipconfig.exe
4840	ipconfig.exe
4548	ipconfig.exe
932	ipconfig.exe
1848	ipconfig.exe
4092	ipconfig.exe
4460	ipconfig.exe
4692	ipconfig.exe
3020	ipconfig.exe
748	ipconfig.exe
2412	ipconfig.exe
2712	ipconfig.exe
1252	ipconfig.exe
4352	ipconfig.exe
1304	ipconfig.exe
1088	ipconfig.exe
5200	ipconfig.exe
5716	ipconfig.exe
5108	ipconfig.exe
5648	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-461973139-3212354679-1508698038-1000\{1A3977CE-469E-4DDC-B192-BB904C12D5B4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2088	vtnlfdxvtnlidavt.exe
2088	vtnlfdxvtnlidavt.exe
2088	vtnlfdxvtnlidavt.exe
2088	vtnlfdxvtnlidavt.exe
2088	vtnlfdxvtnlidavt.exe
2088	vtnlfdxvtnlidavt.exe
2088	vtnlfdxvtnlidavt.exe
2088	vtnlfdxvtnlidavt.exe
2088	vtnlfdxvtnlidavt.exe
2088	vtnlfdxvtnlidavt.exe
2088	vtnlfdxvtnlidavt.exe
2088	vtnlfdxvtnlidavt.exe
2088	vtnlfdxvtnlidavt.exe
2088	vtnlfdxvtnlidavt.exe
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4764	i_aysqkigayq.exe
Token: SeDebugPrivilege	3848	i_axvpnhfdxv.exe
Token: SeDebugPrivilege	6056	i_faxspkicax.exe
Token: SeDebugPrivilege	3140	i_urpmhezxup.exe
Token: SeDebugPrivilege	4340	i_xrpjhbzurm.exe
Token: SeDebugPrivilege	1940	i_romgebztro.exe
Token: SeDebugPrivilege	1112	i_gebwuolgeb.exe
Token: SeDebugPrivilege	5648	i_wtolgdywto.exe
Token: SeDebugPrivilege	3164	i_bvsqlidbsq.exe
Token: SeDebugPrivilege	3832	i_aytndxvpni.exe
Token: SeDebugPrivilege	5644	i_vsnkfaxsnk.exe
Token: SeDebugPrivilege	4496	i_uspkhfcaus.exe
Token: SeDebugPrivilege	2176	i_zxrpjhezxr.exe
Token: SeDebugPrivilege	5164	i_hezxromhec.exe
Token: SeDebugPrivilege	3748	i_ojhezwrlje.exe
Token: SeDebugPrivilege	2536	i_tolgdywtol.exe
Token: SeDebugPrivilege	5596	i_nlgdyvqnli.exe
Token: SeDebugPrivilege	4100	i_yvqnlgdyvq.exe
Token: SeDebugPrivilege	5448	i_fdxvpnlfdx.exe
Token: SeDebugPrivilege	820	i_hfzxvpnkfc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4572	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3744 wrote to memory of 2088	3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 3744 wrote to memory of 3468	3744	2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 3468 wrote to memory of 4572	3468	iexplore.exe	90
PID 4572 wrote to memory of 4252	4572	msedge.exe	91
PID 4572 wrote to memory of 5820	4572	msedge.exe	92
PID 4572 wrote to memory of 4384	4572	msedge.exe	93
PID 4572 wrote to memory of 5820	4572	msedge.exe	92
PID 4572 wrote to memory of 5820	4572	msedge.exe	92
PID 4572 wrote to memory of 5772	4572	msedge.exe	94
PID 4572 wrote to memory of 5772	4572	msedge.exe	94
PID 4572 wrote to memory of 1548	4572	msedge.exe	95
PID 4572 wrote to memory of 1548	4572	msedge.exe	95
PID 4572 wrote to memory of 1548	4572	msedge.exe	95
PID 4572 wrote to memory of 5028	4572	msedge.exe	96
PID 4572 wrote to memory of 5028	4572	msedge.exe	96
PID 4572 wrote to memory of 5028	4572	msedge.exe	96
PID 4572 wrote to memory of 1368	4572	msedge.exe	97
PID 4572 wrote to memory of 1368	4572	msedge.exe	97
PID 4572 wrote to memory of 1368	4572	msedge.exe	97
PID 4572 wrote to memory of 5884	4572	msedge.exe	98
PID 4572 wrote to memory of 5884	4572	msedge.exe	98
PID 4572 wrote to memory of 5884	4572	msedge.exe	98
PID 4572 wrote to memory of 1940	4572	msedge.exe	100
PID 4572 wrote to memory of 1940	4572	msedge.exe	100
PID 4572 wrote to memory of 2640	4572	msedge.exe	104
PID 4572 wrote to memory of 2640	4572	msedge.exe	104
PID 4572 wrote to memory of 4516	4572	msedge.exe	105
PID 4572 wrote to memory of 4516	4572	msedge.exe	105
PID 2088 wrote to memory of 3340	2088	vtnlfdxvtnlidavt.exe	106
PID 4572 wrote to memory of 5412	4572	msedge.exe	109
PID 4912 wrote to memory of 4664	4912	aysqkigayq.exe	111
PID 4572 wrote to memory of 5080	4572	msedge.exe	115
PID 4572 wrote to memory of 5080	4572	msedge.exe	115
PID 4572 wrote to memory of 2068	4572	msedge.exe	117
PID 4572 wrote to memory of 2068	4572	msedge.exe	117
PID 2088 wrote to memory of 3432	2088	vtnlfdxvtnlidavt.exe	119
PID 2088 wrote to memory of 1960	2088	vtnlfdxvtnlidavt.exe	123
PID 2088 wrote to memory of 2552	2088	vtnlfdxvtnlidavt.exe	128
PID 2088 wrote to memory of 5404	2088	vtnlfdxvtnlidavt.exe	132
PID 6120 wrote to memory of 5968	6120	faxspkicax.exe	134
PID 2088 wrote to memory of 4588	2088	vtnlfdxvtnlidavt.exe	137
PID 2088 wrote to memory of 2760	2088	vtnlfdxvtnlidavt.exe	141
PID 5900 wrote to memory of 948	5900	urpmhezxup.exe	143
PID 2088 wrote to memory of 2684	2088	vtnlfdxvtnlidavt.exe	147
PID 4572 wrote to memory of 1396	4572	msedge.exe	149
PID 4572 wrote to memory of 2508	4572	msedge.exe	150
PID 4572 wrote to memory of 4576	4572	msedge.exe	151
PID 2088 wrote to memory of 124	2088	vtnlfdxvtnlidavt.exe	154
PID 5408 wrote to memory of 3848	5408	xrpjhbzurm.exe	156
PID 2088 wrote to memory of 2368	2088	vtnlfdxvtnlidavt.exe	159
PID 2088 wrote to memory of 896	2088	vtnlfdxvtnlidavt.exe	163
PID 824 wrote to memory of 4996	824	romgebztro.exe	165
PID 2088 wrote to memory of 3420	2088	vtnlfdxvtnlidavt.exe	168
PID 2088 wrote to memory of 932	2088	vtnlfdxvtnlidavt.exe	172
PID 3016 wrote to memory of 5636	3016	gebwuolgeb.exe	174
PID 2088 wrote to memory of 5168	2088	vtnlfdxvtnlidavt.exe	177
PID 2088 wrote to memory of 5320	2088	vtnlfdxvtnlidavt.exe	181
PID 5672 wrote to memory of 3716	5672	wtolgdywto.exe	183
PID 2088 wrote to memory of 5608	2088	vtnlfdxvtnlidavt.exe	186
PID 4572 wrote to memory of 4304	4572	msedge.exe	190
PID 4572 wrote to memory of 4304	4572	msedge.exe	190
PID 2088 wrote to memory of 2056	2088	vtnlfdxvtnlidavt.exe	194
PID 4988 wrote to memory of 4928	4988	bvsqlidbsq.exe	196
PID 2088 wrote to memory of 5936	2088	vtnlfdxvtnlidavt.exe	199

C:\Users\Admin\AppData\Local\Temp\2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-17_f6e49b9a5088ee33b494d12328b22a09_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3744
- C:\Temp\vtnlfdxvtnlidavt.exe
  C:\Temp\vtnlfdxvtnlidavt.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2088
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aysqkigayq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3340
  - - C:\Temp\aysqkigayq.exe
      C:\Temp\aysqkigayq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4912
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4664
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4692
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aysqkigayq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3432
  - - C:\Temp\i_aysqkigayq.exe
      C:\Temp\i_aysqkigayq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4764
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\axvpnhfdxv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1960
  - - C:\Temp\axvpnhfdxv.exe
      C:\Temp\axvpnhfdxv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4328
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5432
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4548
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_axvpnhfdxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2552
  - - C:\Temp\i_axvpnhfdxv.exe
      C:\Temp\i_axvpnhfdxv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3848
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\faxspkicax.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5404
  - - C:\Temp\faxspkicax.exe
      C:\Temp\faxspkicax.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6120
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5968
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_faxspkicax.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4588
  - - C:\Temp\i_faxspkicax.exe
      C:\Temp\i_faxspkicax.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6056
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urpmhezxup.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2760
  - - C:\Temp\urpmhezxup.exe
      C:\Temp\urpmhezxup.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5900
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:948
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:932
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urpmhezxup.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2684
  - - C:\Temp\i_urpmhezxup.exe
      C:\Temp\i_urpmhezxup.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3140
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpjhbzurm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:124
  - - C:\Temp\xrpjhbzurm.exe
      C:\Temp\xrpjhbzurm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5408
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3848
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpjhbzurm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2368
  - - C:\Temp\i_xrpjhbzurm.exe
      C:\Temp\i_xrpjhbzurm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4340
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\romgebztro.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:896
  - - C:\Temp\romgebztro.exe
      C:\Temp\romgebztro.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:824
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4996
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3020
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_romgebztro.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3420
  - - C:\Temp\i_romgebztro.exe
      C:\Temp\i_romgebztro.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1940
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gebwuolgeb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:932
  - - C:\Temp\gebwuolgeb.exe
      C:\Temp\gebwuolgeb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3016
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5636
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:748
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gebwuolgeb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5168
  - - C:\Temp\i_gebwuolgeb.exe
      C:\Temp\i_gebwuolgeb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1112
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtolgdywto.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5320
  - - C:\Temp\wtolgdywto.exe
      C:\Temp\wtolgdywto.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5672
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3716
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtolgdywto.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5608
  - - C:\Temp\i_wtolgdywto.exe
      C:\Temp\i_wtolgdywto.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5648
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bvsqlidbsq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2056
  - - C:\Temp\bvsqlidbsq.exe
      C:\Temp\bvsqlidbsq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4988
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4928
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1848
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bvsqlidbsq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5936
  - - C:\Temp\i_bvsqlidbsq.exe
      C:\Temp\i_bvsqlidbsq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3164
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aytndxvpni.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5696
  - - C:\Temp\aytndxvpni.exe
      C:\Temp\aytndxvpni.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5536
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3944
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5108
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aytndxvpni.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4224
  - - C:\Temp\i_aytndxvpni.exe
      C:\Temp\i_aytndxvpni.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3832
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vsnkfaxsnk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5324
  - - C:\Temp\vsnkfaxsnk.exe
      C:\Temp\vsnkfaxsnk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2028
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2856
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5648
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vsnkfaxsnk.exe ups_ins
    3⤵
    PID:4744
  - - C:\Temp\i_vsnkfaxsnk.exe
      C:\Temp\i_vsnkfaxsnk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5644
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uspkhfcaus.exe ups_run
    3⤵
    PID:5868
  - - C:\Temp\uspkhfcaus.exe
      C:\Temp\uspkhfcaus.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4628
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3184
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2412
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uspkhfcaus.exe ups_ins
    3⤵
    PID:3448
  - - C:\Temp\i_uspkhfcaus.exe
      C:\Temp\i_uspkhfcaus.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4496
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxrpjhezxr.exe ups_run
    3⤵
    PID:5848
  - - C:\Temp\zxrpjhezxr.exe
      C:\Temp\zxrpjhezxr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4984
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1708
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxrpjhezxr.exe ups_ins
    3⤵
    PID:4416
  - - C:\Temp\i_zxrpjhezxr.exe
      C:\Temp\i_zxrpjhezxr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2176
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hezxromhec.exe ups_run
    3⤵
    PID:1920
  - - C:\Temp\hezxromhec.exe
      C:\Temp\hezxromhec.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2840
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3076
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hezxromhec.exe ups_ins
    3⤵
    PID:6084
  - - C:\Temp\i_hezxromhec.exe
      C:\Temp\i_hezxromhec.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5164
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ojhezwrlje.exe ups_run
    3⤵
    PID:1816
  - - C:\Temp\ojhezwrlje.exe
      C:\Temp\ojhezwrlje.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3012
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4516
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5988
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ojhezwrlje.exe ups_ins
    3⤵
    PID:5908
  - - C:\Temp\i_ojhezwrlje.exe
      C:\Temp\i_ojhezwrlje.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3748
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tolgdywtol.exe ups_run
    3⤵
    PID:5376
  - - C:\Temp\tolgdywtol.exe
      C:\Temp\tolgdywtol.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4268
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5456
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2712
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tolgdywtol.exe ups_ins
    3⤵
    PID:3712
  - - C:\Temp\i_tolgdywtol.exe
      C:\Temp\i_tolgdywtol.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2536
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlgdyvqnli.exe ups_run
    3⤵
    PID:4452
  - - C:\Temp\nlgdyvqnli.exe
      C:\Temp\nlgdyvqnli.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2428
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4320
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlgdyvqnli.exe ups_ins
    3⤵
    PID:5428
  - - C:\Temp\i_nlgdyvqnli.exe
      C:\Temp\i_nlgdyvqnli.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5596
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvqnlgdyvq.exe ups_run
    3⤵
    PID:1716
  - - C:\Temp\yvqnlgdyvq.exe
      C:\Temp\yvqnlgdyvq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5988
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3908
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1304
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvqnlgdyvq.exe ups_ins
    3⤵
    PID:3084
  - - C:\Temp\i_yvqnlgdyvq.exe
      C:\Temp\i_yvqnlgdyvq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4100
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdxvpnlfdx.exe ups_run
    3⤵
    PID:6040
  - - C:\Temp\fdxvpnlfdx.exe
      C:\Temp\fdxvpnlfdx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1972
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4388
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdxvpnlfdx.exe ups_ins
    3⤵
    PID:4916
  - - C:\Temp\i_fdxvpnlfdx.exe
      C:\Temp\i_fdxvpnlfdx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfzxvpnkfc.exe ups_run
    3⤵
    PID:1736
  - - C:\Temp\hfzxvpnkfc.exe
      C:\Temp\hfzxvpnkfc.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5008
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4764
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1088
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfzxvpnkfc.exe ups_ins
    3⤵
    PID:4576
  - - C:\Temp\i_hfzxvpnkfc.exe
      C:\Temp\i_hfzxvpnkfc.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:820
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x31c,0x7ffac080c188,0x7ffac080c194,0x7ffac080c1a0
      4⤵
      PID:4252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,8257635125256681606,8661763004064365460,262144 --field-trial-handle=2424,i,12566879254601271402,5627437783595193861,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:2
      4⤵
      PID:5820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,13571392691541099539,44696991298223757,524288 --field-trial-handle=2424,i,12566879254601271402,5627437783595193861,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:11
      4⤵
      System Time Discovery
      PID:4384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2132,i,12186268783014506783,3404652015834445828,524288 --field-trial-handle=2424,i,12566879254601271402,5627437783595193861,262144 --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:13
      4⤵
      PID:5772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3564,i,2861732040552593937,13796254734802179066,2097152 --field-trial-handle=2424,i,12566879254601271402,5627437783595193861,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
      4⤵
      PID:1548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,9507026863067280050,9981161954076129275,2097152 --field-trial-handle=2424,i,12566879254601271402,5627437783595193861,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
      4⤵
      PID:5028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4316,i,3970377755454380637,18044744077412374382,2097152 --field-trial-handle=2424,i,12566879254601271402,5627437783595193861,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:1
      4⤵
      PID:1368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4328,i,3546997584204653506,127512347364066524,2097152 --field-trial-handle=2424,i,12566879254601271402,5627437783595193861,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:9
      4⤵
      PID:5884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3356,i,8090025043060162334,9498234852524897396,524288 --field-trial-handle=2424,i,12566879254601271402,5627437783595193861,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:14
      4⤵
      PID:1940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,12788727087086449056,7256939092236219067,524288 --field-trial-handle=2424,i,12566879254601271402,5627437783595193861,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
      4⤵
      PID:2640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,3497852687230863720,8287198877427335237,524288 --field-trial-handle=2424,i,12566879254601271402,5627437783595193861,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
      4⤵
      PID:4516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,16003102081593586418,7002904242674600375,524288 --field-trial-handle=2424,i,12566879254601271402,5627437783595193861,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
      4⤵
      PID:2840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,16003102081593586418,7002904242674600375,524288 --field-trial-handle=2424,i,12566879254601271402,5627437783595193861,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
      4⤵
      PID:5412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,13481336089923433735,7765474482059590119,524288 --field-trial-handle=2424,i,12566879254601271402,5627437783595193861,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
      4⤵
      PID:5080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,7459797762496461271,7081937745433017015,524288 --field-trial-handle=2424,i,12566879254601271402,5627437783595193861,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:14
      4⤵
      PID:2068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,2803408712456680935,17706663887482030379,524288 --field-trial-handle=2424,i,12566879254601271402,5627437783595193861,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
      4⤵
      PID:1396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,17379920993379649566,2521348483799649045,524288 --field-trial-handle=2424,i,12566879254601271402,5627437783595193861,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:14
      4⤵
      PID:2508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,3988458832888514210,3293057399665043305,524288 --field-trial-handle=2424,i,12566879254601271402,5627437783595193861,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:14
      4⤵
      PID:4576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,1155104358971433617,4636105655149484769,524288 --field-trial-handle=2424,i,12566879254601271402,5627437783595193861,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
      4⤵
      PID:4304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,6623199321759945182,6605176203477472197,524288 --field-trial-handle=2424,i,12566879254601271402,5627437783595193861,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
      4⤵
      PID:5384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,1846957810579177117,11998632332115607752,524288 --field-trial-handle=2424,i,12566879254601271402,5627437783595193861,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:14
      4⤵
      PID:3104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,1030312475831224053,6117493720180376744,524288 --field-trial-handle=2424,i,12566879254601271402,5627437783595193861,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:14
      4⤵
      PID:2140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6692,i,5608352427757610498,2625916075099142418,262144 --field-trial-handle=2424,i,12566879254601271402,5627437783595193861,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:10
      4⤵
      PID:1088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1196,i,16813726958880616626,12320784578498858913,524288 --field-trial-handle=2424,i,12566879254601271402,5627437783595193861,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
      4⤵
      PID:4676

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:424

C:\Temp\vtnlfdxvtnlidavt.sys
C:\Temp\vtnlfdxvtnlidavt.sys
1⤵
- Executes dropped EXE
PID:3532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:424

C:\Temp\nkicavsqki.sys
C:\Temp\nkicavsqki.sys
1⤵
- Executes dropped EXE
PID:3272

C:\Temp\hfaxspkica.sys
C:\Temp\hfaxspkica.sys
1⤵
- Executes dropped EXE
PID:5308

C:\Temp\urpkhfzxrp.sys
C:\Temp\urpkhfzxrp.sys
1⤵
- Executes dropped EXE
PID:3420

C:\Temp\zwupmgezwr.sys
C:\Temp\zwupmgezwr.sys
1⤵
- Executes dropped EXE
PID:5468

C:\Temp\wtrmjecwtr.sys
C:\Temp\wtrmjecwtr.sys
1⤵
- Executes dropped EXE
PID:3188

C:\Temp\geywuomgdb.sys
C:\Temp\geywuomgdb.sys
1⤵
- Executes dropped EXE
PID:4720

C:\Temp\vtrljdbvtn.sys
C:\Temp\vtrljdbvtn.sys
1⤵
- Executes dropped EXE
PID:5620

C:\Temp\jgbqlidavt.sys
C:\Temp\jgbqlidavt.sys
1⤵
- Executes dropped EXE
PID:1836

C:\Temp\davtnlidbv.sys
C:\Temp\davtnlidbv.sys
1⤵
- Executes dropped EXE
PID:3712

C:\Temp\dxvpnhcaxs.sys
C:\Temp\dxvpnhcaxs.sys
1⤵
- Executes dropped EXE
PID:1004

C:\Temp\usmkicausm.sys
C:\Temp\usmkicausm.sys
1⤵
PID:3748

C:\Temp\khfzxupmhf.sys
C:\Temp\khfzxupmhf.sys
1⤵
PID:1828

C:\Temp\kecwurmkec.sys
C:\Temp\kecwurmkec.sys
1⤵
PID:6104

C:\Temp\mgebztrpjg.sys
C:\Temp\mgebztrpjg.sys
1⤵
PID:5648

C:\Temp\wtomgeywqo.sys
C:\Temp\wtomgeywqo.sys
1⤵
PID:5252

C:\Temp\wtnlgdbytq.sys
C:\Temp\wtnlgdbytq.sys
1⤵
PID:3916

C:\Temp\vtnligaysq.sys
C:\Temp\vtnligaysq.sys
1⤵
PID:4728

C:\Temp\fdxvqnifay.sys
C:\Temp\fdxvqnifay.sys
1⤵
PID:5248

C:\Temp\fcausmkhfc.sys
C:\Temp\fcausmkhfc.sys
1⤵
PID:2232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

axvpnhfdxv.exe

Path C:\Temp\axvpnhfdxv.exe
Size 361KB
SHA256 1b5f8b7f2dd3cc63badec3d6ba25d7ed8a7c8fc5670568f17a895c2726c6b87b
MD5 f1b3b84daf92152310fd87de9dd9a199
SHA1 0177624b37e2df3b8853727a85a666f59eca3a8d
SHA512 81258efa789ce01df8fce2a1b90aca85639c491ca07b639f9c73f30421bf3b547e32973cda83de8bf73936fbda97cae5b8086e1145f5b6201cfb1e87ff55e1c9
SSDEEP 6144:wflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:wflfAsiVGjSGecvX
TLSH
T103747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aysqkigayq.exe

Path C:\Temp\aysqkigayq.exe
Size 361KB
SHA256 db716bdef4dcadbd148f1ddb94ca1c88e1f38e199ff5c0aae603a1b9e19524a3
MD5 4a13765ae269cca01007a6810e76674e
SHA1 a62a90d3686156a39241a45ee2cd9f50190b9762
SHA512 4938127880376503e02d5c7fd7d694dfe231bdca31a618c98b09496b19c446caf2a65185f17bdef9ac6b84caf64b66c0571d5bf81c8bf938cf4071794fc5695c
SSDEEP 6144:FflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:FflfAsiVGjSGecvX
TLSH
T1F9747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faxspkicax.exe

Path C:\Temp\faxspkicax.exe
Size 361KB
SHA256 4581622bbf03f89ab706284d524cb94c2c051346816a4a0672f398e7ed4ac4de
MD5 a9c942abb4e4cd6aa99bf7a8a2b4f00c
SHA1 5b134dc875d238b103d1e484b8b63527ea5704b6
SHA512 5f20f01bc09034e9d7d3ee55f486cd22884a0cc2797b00688b57b4e60be4de57912c802ea3016a86668a5a3a851a034dbcafe3a62d853bcd38e6125bb29e1888
SSDEEP 6144:4flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:4flfAsiVGjSGecvX
TLSH
T1AE747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfaxspkica.sys

Path C:\Temp\hfaxspkica.sys
Size 293KB
SHA256 68a5ed7ddaecb7be9392f9516bc68d3f6453389b5a66e0961b21e0a479dcdf7b
MD5 f27e2c1fb9c906cbabf11c367b0c3b9f
SHA1 ff69def2e21c1ac5d9a36c4fa43eeba4af7a400b
SHA512 b60d98099e187482ac3fe86c786c6dea47339f7fe421d3069613dd8913e535033c915f2c7dd884974fc90dc538627dc9421b583f69a1fa5b196162f46ed3e69e
SSDEEP 3072:KtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:KIJjiJcbI03GBc3ucY5DCSj
TLSH
T1DF545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_axvpnhfdxv.exe

Path C:\Temp\i_axvpnhfdxv.exe
Size 361KB
SHA256 8fd22078798ae9a1a929d5070340dd89ca98d947d18aefac098b6aeb87911a6b
MD5 25b758a81704eb309d40cda86a1b0455
SHA1 07d8ab31bafd56e11cbe6edbc54f431928d53e68
SHA512 970ecf690819945827f27651a29af742bfd551e23601de79527e4277e65db9911ded5a5ba25e4798101a7773c4ac46c0816f764a467a346415ffbf6e9bf76add
SSDEEP 6144:TflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:TflfAsiVGjSGecvX
TLSH
T126747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_aysqkigayq.exe

Path C:\Temp\i_aysqkigayq.exe
Size 361KB
SHA256 e1fd851c5538ea55bda892472ca0703ef84233069e9f598efc048baf958b0365
MD5 05187839efee6ea19bfbac2f52425078
SHA1 d55f810cff2a96de9982d9ce90942f7f3930ae24
SHA512 413a91018486becd6beb27559ecef923a0da3d9efa6c2f9ab96aafbfc064756f149235301a0abd01f683d57b196ed130ddcc6ac8d9032fac342a1a47fa602374
SSDEEP 6144:mflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:mflfAsiVGjSGecvX
TLSH
T1AF747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_faxspkicax.exe

Path C:\Temp\i_faxspkicax.exe
Size 361KB
SHA256 6428c696097183bcdf47a1ad9a84f0486ae470624de84d0491412e63ebb56418
MD5 f4123fcf2839bc791701eb2a3d9ac73e
SHA1 40a6c72da40f7fb790fe09d4a50461f34f163716
SHA512 044729bf8a26d6f974c6f81f4ee78290b0022515f1baa70c27d2be11abc13446a1a9de4ff6a0cb837a41670a43cbc89a17b5074b55dbdd5c387cbe726210b959
SSDEEP 6144:LflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:LflfAsiVGjSGecvX
TLSH
T141747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_romgebztro.exe

Path C:\Temp\i_romgebztro.exe
Size 361KB
SHA256 8e48dc6da6ef92204e8a2dcf46dfb0352e8039825bae7771897fba60e5d44df0
MD5 1664fab5aa28abdf89385946d1fdf65b
SHA1 479ba5bd2d494d2b145e04ef9d4f8bb991a3ee66
SHA512 9e38cc7d78488c73fb74a156b2567c7a35ec4ae475cef3dc31d2074b3f19bbc3c7e780a02ec0b1349d4fc95ecf2b8f83681511c0dfba8b3e2fc263e53c4792fc
SSDEEP 6144:yflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:yflfAsiVGjSGecvX
TLSH
T18F747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_urpmhezxup.exe

Path C:\Temp\i_urpmhezxup.exe
Size 361KB
SHA256 068d11cee7a6e3345b8dfe8c2f051b0e86e438689516814058071dbf0f94851a
MD5 8cdea02169abdff0f9e2e25a722969f6
SHA1 c30403184dfebb293f1ae30d62844838c521eb02
SHA512 932bce45cb8475cf4437f0746a6f96413d0581da468a7450925fee9b5ab8a3634937c36bde643c9fea7ceda00cb525d9d1706c952004169d3698c5aec7e34485
SSDEEP 6144:DflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:DflfAsiVGjSGecvX
TLSH
T1EE747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xrpjhbzurm.exe

Path C:\Temp\i_xrpjhbzurm.exe
Size 361KB
SHA256 b32779be1896e35202d86c3070d3dacb73f6b51c5de4f45091751f454de17688
MD5 01409c2d19bed69384145f55812a60bd
SHA1 c5c44b171c1d2480bb0134efe22e82b5bab18a18
SHA512 630ea466a5e67563a2c336d16197f432d9c9d059c3173df208b42ffdd4a40e2726124c4be07badcc2fbfd9233e1516fa3493ade32d07738051a690410a1ab860
SSDEEP 6144:aflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:aflfAsiVGjSGecvX
TLSH
T116747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkicavsqki.sys

Path C:\Temp\nkicavsqki.sys
Size 293KB
SHA256 cf4216c42653c5aa86694be3983f437923c8874304b85b339df0127dea9eb0e2
MD5 8da38e1c209a9a4de041c35328a23b4a
SHA1 8e86f3f433c363a0e057e077a19ad72488d85411
SHA512 7bb237cad5beeebcabea33a6026573dd56db0e0bac76024e3a0259f94904f45d0506dbef6f46a6e67f7fefcfa7678ec813dc2ecb0990e2adb840fcebada94322
SSDEEP 3072:xtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:xIJjiJcbI03GBc3ucY5DCSj
TLSH
T194545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

romgebztro.exe

Path C:\Temp\romgebztro.exe
Size 361KB
SHA256 0a4683e5b06e686e0f1276152edb602faeceea46957627fe85c29e5d5cfbdd6f
MD5 927e4611f0a21c5cd621d6f415c9ab0d
SHA1 496ad3b4d85d19ac943aa38d12d85894a266294a
SHA512 33a88b66a12c2fc22b002f5a4cb54f7d840a3723353de37701c35dd43db8a3afd0b22d1db43af8a06e9ffe6d5c7d781027a7970f5f7d75107c49e2104b5f9f6d
SSDEEP 6144:yflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:yflfAsiVGjSGecvX
TLSH
T1FC747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urpkhfzxrp.sys

Path C:\Temp\urpkhfzxrp.sys
Size 293KB
SHA256 48685d062fb461f27eaf1ab3a7822d6dc898663ea078958d6d545aaa86396590
MD5 28d4909272ea6c965990e462d15ca207
SHA1 a1a5941d8467fc70ff31df43d069eacb33070219
SHA512 d815dee3b4f9c57ea7fca2b67da07b9fff47bbc6f5ca04ec3a97fa3c13ec6f8240deacab5adbff83933ff037b4061bf86171434ef7db19826885e67b7393d4c8
SSDEEP 3072:YtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:YIJjiJcbI03GBc3ucY5DCSj
TLSH
T11F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urpmhezxup.exe

Path C:\Temp\urpmhezxup.exe
Size 361KB
SHA256 8b95e51bbb6a028c1a7fb08252cdc415c63595038d0aac3bfdedcd395800803a
MD5 fd77c341a22cce50136e2ba992fcce88
SHA1 0ec2741fab2e967a9e596915aae76743763131d1
SHA512 e791918f952f37ec1a175a25e65c93b758e8e6a89485e5598f7b8b78188007ea91f14de5fbc3c8f3a83a50ed84710ef359172bb4b20005d85ff71ad9f720aa0c
SSDEEP 6144:tflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:tflfAsiVGjSGecvX
TLSH
T181747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlfdxvtnlidavt.exe

Path C:\Temp\vtnlfdxvtnlidavt.exe
Size 361KB
SHA256 b5ea70ad75a11132194b98f00c2d15694bb55faec28fb6bfd2f36408e7b3c162
MD5 e105ee7e416bf9e1ddd4e7a85c035e1a
SHA1 664fcdf225645ae93d177a0b24af4bdaf0d32f59
SHA512 1c9f37b292e29ff3450873fbf79d6b74215657dd59359b3db19e0d9235e428c18c0b3b4abc33dd3e6201d6938b9010f376510e3e39fd234427c5beb522355333
SSDEEP 6144:yflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:yflfAsiVGjSGecvX
TLSH
T106747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlfdxvtnlidavt.sys

Path C:\Temp\vtnlfdxvtnlidavt.sys
Size 293KB
SHA256 6ab58e4fa075264a00d853663bf0bdf8fff259a5a3caee97b6cf04d4dd96750d
MD5 e7578c277fa488e2c9eb9b5cf06840e7
SHA1 04c39ff5331bc6bab070502bc390ef1454644f5f
SHA512 d237326652bec055c025cc8ae0767614962f73c32c4262f4f838c2344871cab10f705e517bf931096475e5c3b8efcd61048888c2f14f243c3ccc611eec5d56f8
SSDEEP 3072:BtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:BIJjiJcbI03GBc3ucY5DCSj
TLSH
T121545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtrmjecwtr.sys

Path C:\Temp\wtrmjecwtr.sys
Size 293KB
SHA256 107bcc2a6e4873a1d0c48c0ccd977d6fb825425919f8026b093f2c4938c80100
MD5 c9f94cf1589ad513d5b85d17db10dcd0
SHA1 30bbb208aa87c96602de70c4a45a308013f98e3e
SHA512 8e939b913087435577187961e28d10be3fde87888a2b387ccf4e34628954097ce75272f8831cb7405eb27406ee3666af977d0b782de5b12beb7cf6109aadeb3e
SSDEEP 3072:QtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:QIJjiJcbI03GBc3ucY5DCSj
TLSH
T1CA545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrpjhbzurm.exe

Path C:\Temp\xrpjhbzurm.exe
Size 361KB
SHA256 c3990c33868553aa786604cceb3d150b236be6a02ff9150b00f87b3962dc9c54
MD5 d990546da6b4af1ea3d00790aec6f978
SHA1 86d5b30c0c130c45b356d329b41651788a5c6285
SHA512 f797202b9fc63a855fb6a3cbc22682a38cee6d873ef1b02b5058d5c8deae5294917fe15d757179bced1729f6b0082464f49ee09088d7c3518efd9fa20ff88b13
SSDEEP 6144:FflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:FflfAsiVGjSGecvX
TLSH
T1EE747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwupmgezwr.sys

Path C:\Temp\zwupmgezwr.sys
Size 293KB
SHA256 d4afd5a64570f9c627dc3bb2013cd872926d696caa415d00eca4313aba2788b3
MD5 17b416ef07f913c32077993a9a467f94
SHA1 0e66d238e3488d76662d1a3c38aa3bf6029c71f6
SHA512 dd49843d6c029059dc57c486066c201a0d40c8a41575c455da25b42b2ae7d830f30796e4cc51c2136bb5d33283938b583ca2d85398c5247109bc81a468bcbc36
SSDEEP 3072:/tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:/IJjiJcbI03GBc3ucY5DCSj
TLSH
T1B4545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

41a105d7-4c12-4709-850e-8f188be55b43.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\41a105d7-4c12-4709-850e-8f188be55b43.tmp
Size 35KB
SHA256 07e5a4f678b17c7be5d112e0fb4f345bb2916f9e947aae7cc71cc242f8f5a1c3
MD5 7dd57957e96cd438d99b465b8d8c0d5f
SHA1 68e5ac9d2e9709d716559098ac92f0ad1c85d7f9
SHA512 01abb8b0627ffcfdcde4c9305ff7c3406328bad49902e367cb2bdb3306de2b35b39c7581744c700084c9a825c4042de2ae088a17d0e99e40c5f54fbe4b460a03
SSDEEP 768:eg3T7gm1IIg4/DmGA5b65Q92RQMPbxKLh:eg3a45AF65dQ6Kd
TLSH
T1EEF2BF71ACA1EE738DB95280769A7392BFF45123D8CD4A9499D96F0C01836CF130BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2faa1b1440ef2e1a669881f74143ac7857706d1524c89e682f713c8f3d38ab23
MD5 6a131a77b0edda45a2895a3d33a867a0
SHA1 2be1a2b3794fa396138562716cc7e4a4f17caa66
SHA512 20cb3d576349a78e3fec9e8b5e0726835f04e7dd74bb2a15edba4417611cdd35bc2d2525fdae7879e8d01d4643f26df1c05a44fb125105ad0bcee8ccd0257571
TLSH
T1F6D02B3176B99CA1D193103D00C386A014BAB0009C0501843B22C0050C401091330206
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4fc7dcf7387fe20ebfe8604da12039dc01420b7c4f9203598cac361fa8e97926
MD5 c3187641f7a33614939d03f0d43ad5e0
SHA1 82b3d0d3fa3092b29b9c8b55ce9fb9bba31c9c23
SHA512 ac0b9a042b5883e5cb0458cdeae19e251d85b3b88bb576dec24d66444085275504065eccb22c8674162977df0a0d2f69723a5923be85a9c5ea85f46af2ce9edc
TLSH
T13FD02B3176B99CA1D193103900C286A014BAB000EC0501843A2280050C40109133120A
MD5 SHA1 SHA512 TLSH

Submit Download

25a8f1ee-fcb9-4453-aa7b-39bac2a6e32a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\25a8f1ee-fcb9-4453-aa7b-39bac2a6e32a.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 95de01484028ea7d9f2d679947ff52669c79b82922574c625dfa2acff0abecb0
MD5 c9196a05f4846349a750b4fbb192cf9e
SHA1 3c6ffd6aec63d4549ef20d4e3740c08ffc2df7ec
SHA512 7e2ed74b94bdbfed2703912267fc4e9c2ae2f6ca0bad62982e0c0e7ff4a113ec11b08f751cdf9944a81837a9d1b05d68038c98cec1dee76c11e5988b84442311
TLSH
T17E51C6E9BC68347CDBDE89B1A5E4958B33744B794D832E0399B4E4BACFD6F504344484
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7144f877677e321866560995f41ea67a228cc87e409f88a2e5c24bc6c7a25096
MD5 aa7e059375ec56993a6d6241c75afdd6
SHA1 72a1402199d82ed4e6a7be8a059d9f523e5df389
SHA512 53d4580838f03566d3a227cfdfe9a5f9411e9605a7cccca0e06ddd2d2a962b86ad1dd039666bdee1738813fda75246b280438cc5694ef78ac2a7ad9a3bbf646c
TLSH
T15F51C5E97C68347CDBDE99B0A5E4958B33344B794D832E0399B4E4BACFD6F504344484
MD5 SHA1 SHA512 TLSH

Submit Download

a23d3212-c3ee-4400-bf99-c57586e2f51b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\a23d3212-c3ee-4400-bf99-c57586e2f51b.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

1e87d751-8fbc-4540-82ed-32724c387af5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1e87d751-8fbc-4540-82ed-32724c387af5.tmp
Size 2KB
SHA256 509adacc23f6c57f586e568a7949810be9884fbc17e4ffb185d57b9c2608304a
MD5 a966a3d96d5b1c35ac6b17e4e6b4b680
SHA1 a64545801ded5f229c862cf61dd431fd067e9c74
SHA512 e870149fce17abc892f1525b9d4c8ec69e55ab79a9c4fc441cf0474eb46306c998d946782d9fead2327e1cba51c06335b82be37fbf5681d6cc0500a4fab5d925
TLSH
T1A841D0F783F4853E8A0196F0AA14AF2FCE2D0555432C7D5AC8E09E2B93E3471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

d50d1557-3907-49df-b969-33c70d419e7d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d50d1557-3907-49df-b969-33c70d419e7d.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

d65eba2a-62b3-4729-8cfc-6f78c195cbf9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d65eba2a-62b3-4729-8cfc-6f78c195cbf9.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

d4250f7e-93b2-4fb5-8f6b-715018c8c77f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d4250f7e-93b2-4fb5-8f6b-715018c8c77f.tmp
Size 11KB
SHA256 92a99e84595c31690a3f6efc6543316da48c49bc46356b844102170ad757a125
MD5 0c8ac9bed9c6f71a910a2b630b586f37
SHA1 6065d16524676f9716da80f1e8e20cc90b2d3af3
SHA512 41b1f48c95ccad1ea443cc73ca0d48f04690047c1002f2ffd9ab65731eb4894f245de5a4f53f39bfef27df9796bc7cdf88f6ab35fddcb2ca49f7909bf0714592
SSDEEP 192:sxRMRsCW/fsb1sJ+WZMizoA8p9E/g6+WNCzJ/Y24ccqGqIgVcJ:sxRMNW/fsJsJ+gUu/5k/4wK
TLSH
T16842B815AE24BD3B4CCBD61DFB657F63D2F91032A0941E48A6FC8A1C14EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f24a0901-9289-4614-bf44-12fd7564f217.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f24a0901-9289-4614-bf44-12fd7564f217.tmp
Size 29KB
SHA256 c43552f4f62a1dc6fe2db9a456d70cdcf813e9e5504f6ca7e6810689d15a4f86
MD5 d654346d0f452beb485b6bc927d8f77f
SHA1 047b5106859c24602f3db2c761e2193bd27631bc
SHA512 f14b22810d112aede298a40ece8bb65cfefea7902d2ef69cf7e8b9daf9b97d11db600653d4453793be1237a84cc0de73bad990dc939068b0024f926968fde70b
SSDEEP 768:L7aa8W7pLuLb6DWgptfvD8F1+UoAYDCx9Tuqh0VfUC9xbog/OVqyFdNMxroHr7:L7aa82Eb6DWgptfvDu1jaNyFrMKL7
TLSH
T152D2DB7B640CCB7F4F904ADDDC197E9F6DA802CB9698CD4047FA941C02C6BEA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f52e6c6c-3061-488b-911f-264ab653514e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f52e6c6c-3061-488b-911f-264ab653514e.tmp
Size 12KB
SHA256 85750adcbf2c09fe1fb9fe05dcac9b795216a0e7b8670f46e25b7a17f24543e2
MD5 ad0932a826db28ef975a9589eaee4354
SHA1 d1cf6274cd92e47be87cc9c1451c0484fe864481
SHA512 0b59263c295dc0236edb22518e7da345613dd691bffa6ba8986885d253957463410d90e3330cfe23e2c3a308a0db8f56ac25d7c673deac2b1d0ca9a7e925d041
SSDEEP 192:sxR/RsCW/fsb1sxNWZMizoA8p9E/g6+WNCzJ/Y2HmcqGqIgDgcJ:sxR/NW/fsJsxNgUu/5k/Nwt
TLSH
T1BB42B915AD24BD3B4CCBD61DFB657F63D2F91032A0951E48A6FC8A1C14EB6DD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f7aa0232-c997-4aa0-93cc-efe7a0e3d01a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f7aa0232-c997-4aa0-93cc-efe7a0e3d01a.tmp
Size 11KB
SHA256 94a2e3dc2c76ccf3f0911ddd42a9125fed5c0b30bba5428ee9197e469a0f0dde
MD5 989099d2ed871883a76f7ada8afc065d
SHA1 f1a8c27354d9cba323568bdda981c9aa34edbdc1
SHA512 ecb5d7d0c72801624c721bed234009e088cc082fa881219b72c73f33d7993cf0d464b7cc198e6440e2066a9fe8e30f1afe09fb7b168f3a4d4ee0630b2842176f
SSDEEP 192:sxR/RsCW/fsb1sx+WZMizoA8p9E/g6+WNCzJ/Y24ccqGqIgD6cJ:sxR/NW/fsJsx+gUu/5k/4wb
TLSH
T13042B715AE24BD3B4CCBD61DFB657F63D2F91032A0941E48A6FC8A1C14EB6DD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5b9b13d8-426b-441a-8657-76443ddbb181.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\5b9b13d8-426b-441a-8657-76443ddbb181.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

a834d7e6-563b-4648-abbb-0e7da6b7c428.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a834d7e6-563b-4648-abbb-0e7da6b7c428.tmp
Size 43KB
SHA256 9e774cfe7ab513943cd9c96c5f0770914638fece400ad9326b0e1786e10f9c35
MD5 c6bdc90cdf3f190106fc5602bef41746
SHA1 b7280e27a3557901906084e50a2a8e10a1cc9f7a
SHA512 fb6c71bd286614c41d17cfd50e4d52ca6e0ada69c94ba3171e572cc480eb91bae5ac60ab886fa192aabeffb48d37ba99942b398540f464c0a753a5ea01c5e8ba
SSDEEP 768:zFdd3jwgq4ue1IIgrDmGA5b65Q92RQMPbxKLh:Td3etAF65dQ6Kd
TLSH
T1D71316F198D39A77D9AD5783677D6E469EBCC163B4888590BBC45D0CCC821BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c44cb56d-fdef-48e3-835c-4a25ffe6cfd0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c44cb56d-fdef-48e3-835c-4a25ffe6cfd0.tmp
Size 35KB
SHA256 d679748e644f8831cd86844b73b64a01bc4825329085128cbe6887a48aa6d641
MD5 58aa62558622bcf86b8fc8ca458b9b60
SHA1 42c4a97045a2dbb873be8c2ed623744393d9eec3
SHA512 eb3d0a6c245546d919db1c91ec557db78641f2b95ae0a9095535dab0475343c149883fec33fc52912d70cd5254f417dd68787a45a37866d70b4422e0452aaadc
SSDEEP 768:yg3m7gm1IIg4/DmGA5b65Q92RQMPbxKLh:yg3R45AF65dQ6Kd
TLSH
T1EEF2BE71ACA1EE738DB95280769A7396BFF45123D8CD4A9499D96F0C01C36CE130BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

84159d54-f311-4cc2-8c26-1ef4f44ce894.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\84159d54-f311-4cc2-8c26-1ef4f44ce894.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

a0c4ae61-6862-42e9-8b03-f630872bf114.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\a0c4ae61-6862-42e9-8b03-f630872bf114.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

b88fe866-60ef-48a8-874b-d65d9b07072d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\b88fe866-60ef-48a8-874b-d65d9b07072d.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

eb2f50e0-b307-467d-a134-deef464e87fe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\eb2f50e0-b307-467d-a134-deef464e87fe.tmp
Size 39KB
SHA256 e83ccbfb733c88dc8bf88269f66af7dbd7f8691fa7bd5a65615b0425ca60cdb2
MD5 9792317b3b3188501428ff94f584d903
SHA1 d0b86eb911ca22fc50c27b04cf5412ed21a08ac2
SHA512 9f6b94e8bbf01df6e22bf856968593ce5ca2c77699d02218d7b84f2a6fd6541cdf65cd536c6dcab02c44f0d87413972ee9c0ec946090840e5d4d1b92a14580a5
SSDEEP 768:U/UxvxjgC+B3Sokqgm1I+tDmGA5b65Q92RQMPbvFj0O:BZj3+B3Zh3AF65dQkFQO
TLSH
T13103C036ECA4AEB7DCF95180374BA35AAFF84473C1C855A049FD6E1D06C768C830B85A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ee542df1-5e1f-48b4-831e-fbe55eb16bfe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ee542df1-5e1f-48b4-831e-fbe55eb16bfe.tmp
Size 39KB
SHA256 3a660e48d26502668119e8da2b38c215ba0f06ca1e1a878a31e3c157d115732b
MD5 eec1105141c384af4543ddb59f58407a
SHA1 ea4a98fc4dece4a9f8112b7f5f28ce6e1d748af2
SHA512 f2f8359a03d69490c2aeca08ab28065fec9f9698989f2fa9ad2bfb2337720a50ba49c31735b2c7118f38ba8c858fc8f2c3f90246f4bd775c8ce40ffe4f84e663
SSDEEP 768:o/UxvxjgC+B3TwVgm1IIg4FDmGA5b65Q92RQMPqxFj0O:1Zj3+B394PAF65dQhFQO
TLSH
T18303C036ECA5EE739CF96280369BA396AFF80473C4C945A059F56E1D058378D070F92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e2a2cb39-8744-4a76-ba18-a9b9aa102320.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e2a2cb39-8744-4a76-ba18-a9b9aa102320.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f61298fd-1f37-4185-b7a5-58d67992094a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f61298fd-1f37-4185-b7a5-58d67992094a.tmp
Size 41KB
SHA256 6edc850155b73b202c2b9f66b148faacfb97e7108c7a05e17c3693452766bb7d
MD5 332b3e6636bab80790548b76ef72a4a9
SHA1 0b20a7af6db29d49bce8f9f5a15fa62ac37cdc3d
SHA512 de16d56a631de3a47dd7ab03a97704b79412c96c907e12b463c6d01690f68f6a31aa727b1b808918773f2b33ce453e69634266216a9e5a4293b9911ac204b093
SSDEEP 768:F/UxvxjgC+U3H7gm1IIg4YDmGA5b65Q92RQMPbx+O:oZj3+U3u44AF65dQ6+O
TLSH
T19C13D032AC64EE7399F96180368BB396AFF4453394C99AA459E85F0D05837CE030BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bab11427-5cfc-432c-99b7-86ebe383db9a.tmp

Path C:\Users\Admin\AppData\Local\Temp\bab11427-5cfc-432c-99b7-86ebe383db9a.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

c8be7a5f-1756-4915-be03-7169c7f38e04.tmp

Path C:\Users\Admin\AppData\Local\Temp\c8be7a5f-1756-4915-be03-7169c7f38e04.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4572_1035588910\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4572_1141341587\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4572_2030702677\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4572_413092304\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4572_727834754\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 9d0263d4cdd74e647538472d9b21e9438378289e79ab88aae021a42a23552f3c
MD5 ba0a7e5d05a350d0b7c73f275351b9d6
SHA1 267c4b67f3268025744d316177253c9701305e0d
SHA512 9a0faf76bc1fae515822f367dcadea664dee576dfa215a50fa9b146161760fbf5ae7b8159a3b716ee939529a7071505f0c42c18749acec2e48b3e4e776069f53
TLSH
T14A71239357B9CAB2C1DE5BF102835644F6FF23380B6330200B955596AB30A3A68B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1004-380-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1828-407-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1836-332-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2232-500-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3188-296-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3272-194-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3420-289-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3420-270-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3532-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3712-382-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3712-350-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3748-393-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3748-425-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3916-456-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4720-329-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4720-323-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4728-478-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5248-482-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5252-452-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5308-242-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5468-282-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5620-327-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5648-440-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6104-428-0x0000000000010000-0x00000000000AB000-memory.dmp

Download