systex | 200c62980ffdd163a1bca35bc0b788fd57fd39983810b1a16166b779f0a8fb2a

Analysis

max time kernel
149s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/10/2026, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample261019-e2zfpszscx
SHA256 200c62980ffdd163a1bca35bc0b788fd57fd39983810b1a16166b779f0a8fb2a
MD5 59ccd67903e9f4c593d8d39832c848ed
SHA1 2b0a6cf3171bebdc71134df349ba72ff5fe43ed6
SHA512 b041da2f7a940fe12f749b6f9e2b4c9d3bcb76551e57e7044644a8bb3dd33e1d9fef52c3bde87e5c1886406dc284ea120125f416226bec94e83cbf5014eec869
SSDEEP 3072:WKFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLn:WKFL1JeIJjiJcbI03GBc3ucY5DCSjXh
TLSH
T1E4847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4396	nifaxspnlfdxvpnl.exe
2788	CreateProcess.exe
4416	nifaxspnlfdxvpnl.sys
5012	faxvpnkica.exe
2672	CreateProcess.exe
1392	CreateProcess.exe
2840	i_faxvpnkica.exe
5944	pkicausnkf.sys
5052	CreateProcess.exe
4808	czxusmkhcw.exe
3680	CreateProcess.exe
1256	CreateProcess.exe
4708	i_czxusmkhcw.exe
2412	fzxrpkeczu.sys
436	CreateProcess.exe
700	upmkhfzwus.exe
3912	CreateProcess.exe
2304	CreateProcess.exe
2332	i_upmkhfzwus.exe
3052	zwurpjhbzt.sys
5188	CreateProcess.exe
2728	zwrpjhecwu.exe
3224	CreateProcess.exe
944	CreateProcess.exe
1268	i_zwrpjhecwu.exe
4260	trljdbwtol.sys
2940	CreateProcess.exe
2344	uomebwuomg.exe
5972	CreateProcess.exe
1516	CreateProcess.exe
3460	i_uomebwuomg.exe
920	gebwtoljdb.sys
4920	CreateProcess.exe
1240	gdytqligby.exe
1476	CreateProcess.exe
3388	CreateProcess.exe
2308	i_gdytqligby.exe
6128	gaytqligay.sys
4364	CreateProcess.exe
5864	jgayoigavs.exe
3504	CreateProcess.exe
1544	CreateProcess.exe
4080	i_jgayoigavs.exe
5808	qnlidavsqk.sys
1920	CreateProcess.exe
1732	nlfdbvtnki.exe
3600	CreateProcess.exe
5640	CreateProcess.exe
3572	i_nlfdbvtnki.exe
1528	pnifaysqni.sys
6140	CreateProcess.exe
4688	nlfcausnkf.exe
4012	CreateProcess.exe
124	CreateProcess.exe
6076	i_nlfcausnkf.exe
2324	vpnkfcausm.sys
5772	CreateProcess.exe
5984	mkifausmkf.exe
4876	CreateProcess.exe
5556	CreateProcess.exe
5268	i_mkifausmkf.exe
5500	mkhczxspjh.sys
5244	CreateProcess.exe
4776	fzxrpjhbzu.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4792_473004407\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4792_306235680\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4792_306235680\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4792_1267117332\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4792_798877997\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4792_798877997\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4792_1267117332\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4792_1267117332\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4792_1267117332\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 40 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgayoigavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdbvtnki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkifausmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tromgebwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomebwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dvqoifdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqlidavtq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmhfcxusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czxusmkhcw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwrpjhecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomebwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxrpjhbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnlfaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upmkhfzwus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgayoigavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdbvtnki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkifausmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tromgebwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dvqoifdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nifaxspnlfdxvpnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxvpnkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhcwurmjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqlidavtq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spnhfaxspn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxvpnkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czxusmkhcw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwrpjhecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfcausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spnhfaxspn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmkhfzwus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdytqligby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdytqligby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfcausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgeytrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxrpjhbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhcwurmjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgeytrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnlfaysqk.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2920	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5772	ipconfig.exe
3256	ipconfig.exe
4900	ipconfig.exe
4176	ipconfig.exe
1348	ipconfig.exe
3464	ipconfig.exe
6072	ipconfig.exe
4020	ipconfig.exe
3460	ipconfig.exe
6128	ipconfig.exe
3672	ipconfig.exe
6068	ipconfig.exe
4016	ipconfig.exe
3464	ipconfig.exe
3580	ipconfig.exe
4708	ipconfig.exe
2616	ipconfig.exe
4440	ipconfig.exe
4388	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{007ED2DF-5946-4C69-8F4C-A2B73075A41C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4396	nifaxspnlfdxvpnl.exe
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4396	nifaxspnlfdxvpnl.exe
4396	nifaxspnlfdxvpnl.exe
4396	nifaxspnlfdxvpnl.exe
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4396	nifaxspnlfdxvpnl.exe
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4396	nifaxspnlfdxvpnl.exe
4396	nifaxspnlfdxvpnl.exe
2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4396	nifaxspnlfdxvpnl.exe
4396	nifaxspnlfdxvpnl.exe
4396	nifaxspnlfdxvpnl.exe
4396	nifaxspnlfdxvpnl.exe
4396	nifaxspnlfdxvpnl.exe
4396	nifaxspnlfdxvpnl.exe
4396	nifaxspnlfdxvpnl.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	2840	i_faxvpnkica.exe
Token: SeDebugPrivilege	4708	i_czxusmkhcw.exe
Token: SeDebugPrivilege	2332	i_upmkhfzwus.exe
Token: SeDebugPrivilege	1268	i_zwrpjhecwu.exe
Token: SeDebugPrivilege	3460	i_uomebwuomg.exe
Token: SeDebugPrivilege	2308	i_gdytqligby.exe
Token: SeDebugPrivilege	4080	i_jgayoigavs.exe
Token: SeDebugPrivilege	3572	i_nlfdbvtnki.exe
Token: SeDebugPrivilege	6076	i_nlfcausnkf.exe
Token: SeDebugPrivilege	5268	i_mkifausmkf.exe
Token: SeDebugPrivilege	248	i_fzxrpjhbzu.exe
Token: SeDebugPrivilege	5444	i_pjhcwurmjh.exe
Token: SeDebugPrivilege	5788	i_tromgebwro.exe
Token: SeDebugPrivilege	2452	i_olgeytrljd.exe
Token: SeDebugPrivilege	5116	i_dvqoifdyvq.exe
Token: SeDebugPrivilege	4500	i_ysqlidavtq.exe
Token: SeDebugPrivilege	4444	i_vpnlfaysqk.exe
Token: SeDebugPrivilege	3460	i_spnhfaxspn.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4792	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 4396	2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 2908 wrote to memory of 2500	2908	2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 2500 wrote to memory of 4792	2500	iexplore.exe	90
PID 4792 wrote to memory of 5844	4792	msedge.exe	91
PID 4792 wrote to memory of 3968	4792	msedge.exe	92
PID 4792 wrote to memory of 2920	4792	msedge.exe	93
PID 4792 wrote to memory of 3968	4792	msedge.exe	92
PID 4792 wrote to memory of 3968	4792	msedge.exe	92
PID 4792 wrote to memory of 3640	4792	msedge.exe	95
PID 4792 wrote to memory of 3640	4792	msedge.exe	95
PID 4792 wrote to memory of 5680	4792	msedge.exe	96
PID 4792 wrote to memory of 5680	4792	msedge.exe	96
PID 4792 wrote to memory of 5680	4792	msedge.exe	96
PID 4792 wrote to memory of 2460	4792	msedge.exe	97
PID 4792 wrote to memory of 2460	4792	msedge.exe	97
PID 4792 wrote to memory of 2460	4792	msedge.exe	97
PID 4792 wrote to memory of 1360	4792	msedge.exe	98
PID 4792 wrote to memory of 1360	4792	msedge.exe	98
PID 4792 wrote to memory of 1360	4792	msedge.exe	98
PID 4792 wrote to memory of 5820	4792	msedge.exe	99
PID 4792 wrote to memory of 5820	4792	msedge.exe	99
PID 4792 wrote to memory of 5820	4792	msedge.exe	99
PID 4792 wrote to memory of 3520	4792	msedge.exe	100
PID 4792 wrote to memory of 3520	4792	msedge.exe	100
PID 4396 wrote to memory of 2788	4396	nifaxspnlfdxvpnl.exe	103
PID 5012 wrote to memory of 2672	5012	faxvpnkica.exe	107
PID 4792 wrote to memory of 5804	4792	msedge.exe	109
PID 4792 wrote to memory of 1468	4792	msedge.exe	110
PID 4792 wrote to memory of 5804	4792	msedge.exe	109
PID 4792 wrote to memory of 1468	4792	msedge.exe	110
PID 4792 wrote to memory of 2488	4792	msedge.exe	113
PID 4792 wrote to memory of 6124	4792	msedge.exe	114
PID 4792 wrote to memory of 6124	4792	msedge.exe	114
PID 4792 wrote to memory of 5032	4792	msedge.exe	115
PID 4792 wrote to memory of 5032	4792	msedge.exe	115
PID 4396 wrote to memory of 1392	4396	nifaxspnlfdxvpnl.exe	119
PID 4396 wrote to memory of 5052	4396	nifaxspnlfdxvpnl.exe	123
PID 4808 wrote to memory of 3680	4808	czxusmkhcw.exe	125
PID 4396 wrote to memory of 1256	4396	nifaxspnlfdxvpnl.exe	128
PID 4396 wrote to memory of 436	4396	nifaxspnlfdxvpnl.exe	132
PID 700 wrote to memory of 3912	700	upmkhfzwus.exe	134
PID 4396 wrote to memory of 2304	4396	nifaxspnlfdxvpnl.exe	137
PID 4396 wrote to memory of 5188	4396	nifaxspnlfdxvpnl.exe	142
PID 2728 wrote to memory of 3224	2728	zwrpjhecwu.exe	144
PID 4792 wrote to memory of 5408	4792	msedge.exe	147
PID 4792 wrote to memory of 5944	4792	msedge.exe	148
PID 4792 wrote to memory of 2620	4792	msedge.exe	149
PID 4396 wrote to memory of 944	4396	nifaxspnlfdxvpnl.exe	150
PID 4396 wrote to memory of 2940	4396	nifaxspnlfdxvpnl.exe	154
PID 2344 wrote to memory of 5972	2344	uomebwuomg.exe	156
PID 4396 wrote to memory of 1516	4396	nifaxspnlfdxvpnl.exe	159
PID 4396 wrote to memory of 4920	4396	nifaxspnlfdxvpnl.exe	163
PID 1240 wrote to memory of 1476	1240	gdytqligby.exe	165
PID 4396 wrote to memory of 3388	4396	nifaxspnlfdxvpnl.exe	168
PID 4396 wrote to memory of 4364	4396	nifaxspnlfdxvpnl.exe	172
PID 5864 wrote to memory of 3504	5864	jgayoigavs.exe	174
PID 4396 wrote to memory of 1544	4396	nifaxspnlfdxvpnl.exe	177
PID 4396 wrote to memory of 1920	4396	nifaxspnlfdxvpnl.exe	181
PID 1732 wrote to memory of 3600	1732	nlfdbvtnki.exe	183
PID 4792 wrote to memory of 1896	4792	msedge.exe	186
PID 4792 wrote to memory of 1896	4792	msedge.exe	186
PID 4396 wrote to memory of 5640	4396	nifaxspnlfdxvpnl.exe	190
PID 4396 wrote to memory of 6140	4396	nifaxspnlfdxvpnl.exe	194
PID 4688 wrote to memory of 4012	4688	nlfcausnkf.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-17_59ccd67903e9f4c593d8d39832c848ed_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Temp\nifaxspnlfdxvpnl.exe
  C:\Temp\nifaxspnlfdxvpnl.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4396
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\faxvpnkica.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2788
  - - C:\Temp\faxvpnkica.exe
      C:\Temp\faxvpnkica.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5012
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2672
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4388
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_faxvpnkica.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1392
  - - C:\Temp\i_faxvpnkica.exe
      C:\Temp\i_faxvpnkica.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\czxusmkhcw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5052
  - - C:\Temp\czxusmkhcw.exe
      C:\Temp\czxusmkhcw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4808
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3680
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4176
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_czxusmkhcw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1256
  - - C:\Temp\i_czxusmkhcw.exe
      C:\Temp\i_czxusmkhcw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\upmkhfzwus.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:436
  - - C:\Temp\upmkhfzwus.exe
      C:\Temp\upmkhfzwus.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:700
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3912
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6068
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_upmkhfzwus.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2304
  - - C:\Temp\i_upmkhfzwus.exe
      C:\Temp\i_upmkhfzwus.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwrpjhecwu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5188
  - - C:\Temp\zwrpjhecwu.exe
      C:\Temp\zwrpjhecwu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2728
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3224
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1348
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwrpjhecwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:944
  - - C:\Temp\i_zwrpjhecwu.exe
      C:\Temp\i_zwrpjhecwu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1268
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uomebwuomg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2940
  - - C:\Temp\uomebwuomg.exe
      C:\Temp\uomebwuomg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2344
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5972
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4016
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uomebwuomg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1516
  - - C:\Temp\i_uomebwuomg.exe
      C:\Temp\i_uomebwuomg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gdytqligby.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4920
  - - C:\Temp\gdytqligby.exe
      C:\Temp\gdytqligby.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1240
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1476
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3464
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gdytqligby.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3388
  - - C:\Temp\i_gdytqligby.exe
      C:\Temp\i_gdytqligby.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2308
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgayoigavs.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4364
  - - C:\Temp\jgayoigavs.exe
      C:\Temp\jgayoigavs.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5864
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3504
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5772
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgayoigavs.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1544
  - - C:\Temp\i_jgayoigavs.exe
      C:\Temp\i_jgayoigavs.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4080
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlfdbvtnki.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1920
  - - C:\Temp\nlfdbvtnki.exe
      C:\Temp\nlfdbvtnki.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1732
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3600
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6072
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlfdbvtnki.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5640
  - - C:\Temp\i_nlfdbvtnki.exe
      C:\Temp\i_nlfdbvtnki.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlfcausnkf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6140
  - - C:\Temp\nlfcausnkf.exe
      C:\Temp\nlfcausnkf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4688
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4012
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3464
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlfcausnkf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:124
  - - C:\Temp\i_nlfcausnkf.exe
      C:\Temp\i_nlfcausnkf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6076
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkifausmkf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5772
  - - C:\Temp\mkifausmkf.exe
      C:\Temp\mkifausmkf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5984
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4876
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3580
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkifausmkf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5556
  - - C:\Temp\i_mkifausmkf.exe
      C:\Temp\i_mkifausmkf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5268
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fzxrpjhbzu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5244
  - - C:\Temp\fzxrpjhbzu.exe
      C:\Temp\fzxrpjhbzu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4776
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2192
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fzxrpjhbzu.exe ups_ins
    3⤵
    PID:1832
  - - C:\Temp\i_fzxrpjhbzu.exe
      C:\Temp\i_fzxrpjhbzu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:248
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhcwurmjh.exe ups_run
    3⤵
    PID:1412
  - - C:\Temp\pjhcwurmjh.exe
      C:\Temp\pjhcwurmjh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2580
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4284
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjhcwurmjh.exe ups_ins
    3⤵
    PID:1632
  - - C:\Temp\i_pjhcwurmjh.exe
      C:\Temp\i_pjhcwurmjh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5444
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tromgebwro.exe ups_run
    3⤵
    PID:5552
  - - C:\Temp\tromgebwro.exe
      C:\Temp\tromgebwro.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4600
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4292
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2616
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tromgebwro.exe ups_ins
    3⤵
    PID:4448
  - - C:\Temp\i_tromgebwro.exe
      C:\Temp\i_tromgebwro.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5788
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\olgeytrljd.exe ups_run
    3⤵
    PID:1728
  - - C:\Temp\olgeytrljd.exe
      C:\Temp\olgeytrljd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3440
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4744
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4020
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_olgeytrljd.exe ups_ins
    3⤵
    PID:5912
  - - C:\Temp\i_olgeytrljd.exe
      C:\Temp\i_olgeytrljd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2452
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dvqoifdyvq.exe ups_run
    3⤵
    PID:5276
  - - C:\Temp\dvqoifdyvq.exe
      C:\Temp\dvqoifdyvq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4880
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2060
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dvqoifdyvq.exe ups_ins
    3⤵
    PID:4620
  - - C:\Temp\i_dvqoifdyvq.exe
      C:\Temp\i_dvqoifdyvq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5116
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ysqlidavtq.exe ups_run
    3⤵
    PID:1908
  - - C:\Temp\ysqlidavtq.exe
      C:\Temp\ysqlidavtq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:800
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3316
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6128
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ysqlidavtq.exe ups_ins
    3⤵
    PID:2104
  - - C:\Temp\i_ysqlidavtq.exe
      C:\Temp\i_ysqlidavtq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4500
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vpnlfaysqk.exe ups_run
    3⤵
    PID:6080
  - - C:\Temp\vpnlfaysqk.exe
      C:\Temp\vpnlfaysqk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3464
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3688
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3672
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vpnlfaysqk.exe ups_ins
    3⤵
    PID:3584
  - - C:\Temp\i_vpnlfaysqk.exe
      C:\Temp\i_vpnlfaysqk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4444
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spnhfaxspn.exe ups_run
    3⤵
    PID:4720
  - - C:\Temp\spnhfaxspn.exe
      C:\Temp\spnhfaxspn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2776
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5464
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4900
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spnhfaxspn.exe ups_ins
    3⤵
    PID:672
  - - C:\Temp\i_spnhfaxspn.exe
      C:\Temp\i_spnhfaxspn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\upmhfcxusm.exe ups_run
    3⤵
    PID:5444
  - - C:\Temp\upmhfcxusm.exe
      C:\Temp\upmhfcxusm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2436
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3148
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4440
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffaa0b5c188,0x7ffaa0b5c194,0x7ffaa0b5c1a0
      4⤵
      PID:5844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,13677347325169092101,8822357532403203825,262144 --field-trial-handle=2396,i,1656485787513159587,212058922850490594,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:2
      4⤵
      PID:3968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,5653571813076102723,17385784878170048368,524288 --field-trial-handle=2396,i,1656485787513159587,212058922850490594,262144 --variations-seed-version --mojo-platform-channel-handle=3028 /prefetch:11
      4⤵
      System Time Discovery
      PID:2920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,4523935230138484906,12070187513132139392,524288 --field-trial-handle=2396,i,1656485787513159587,212058922850490594,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:13
      4⤵
      PID:3640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,7406836492931939532,7713080016204191965,2097152 --field-trial-handle=2396,i,1656485787513159587,212058922850490594,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
      4⤵
      PID:5680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,3638349875588855046,9179272275700377012,2097152 --field-trial-handle=2396,i,1656485787513159587,212058922850490594,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:2460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,17332954516330252711,16144716314114668852,2097152 --field-trial-handle=2396,i,1656485787513159587,212058922850490594,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:1
      4⤵
      PID:1360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,14350012667787061880,3456843540571880671,2097152 --field-trial-handle=2396,i,1656485787513159587,212058922850490594,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:9
      4⤵
      PID:5820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,5633542366533692519,7132426440173159577,524288 --field-trial-handle=2396,i,1656485787513159587,212058922850490594,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:14
      4⤵
      PID:3520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,967790314723283540,9092795355035508284,524288 --field-trial-handle=2396,i,1656485787513159587,212058922850490594,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
      4⤵
      PID:5804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,8652174907026921944,18298094981168703184,524288 --field-trial-handle=2396,i,1656485787513159587,212058922850490594,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
      4⤵
      PID:1468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,9697297566953023463,9874212878520159505,524288 --field-trial-handle=2396,i,1656485787513159587,212058922850490594,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
      4⤵
      PID:3816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,9697297566953023463,9874212878520159505,524288 --field-trial-handle=2396,i,1656485787513159587,212058922850490594,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
      4⤵
      PID:2488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,11370922835614596599,16539489219403620104,524288 --field-trial-handle=2396,i,1656485787513159587,212058922850490594,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
      4⤵
      PID:6124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,8676657269995923203,18236920202366752155,524288 --field-trial-handle=2396,i,1656485787513159587,212058922850490594,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:14
      4⤵
      PID:5032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,13904073681012585275,5374777782965745939,524288 --field-trial-handle=2396,i,1656485787513159587,212058922850490594,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
      4⤵
      PID:5408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,374342006325735427,3283195237573545048,524288 --field-trial-handle=2396,i,1656485787513159587,212058922850490594,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
      4⤵
      PID:5944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,896263934885922268,1398108183519809480,524288 --field-trial-handle=2396,i,1656485787513159587,212058922850490594,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
      4⤵
      PID:2620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,12587920778205351177,13101612583907050437,524288 --field-trial-handle=2396,i,1656485787513159587,212058922850490594,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
      4⤵
      PID:1896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,2122651994679844856,9544347656624738008,524288 --field-trial-handle=2396,i,1656485787513159587,212058922850490594,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:14
      4⤵
      PID:4264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,15203605944356631681,15287125843356165944,524288 --field-trial-handle=2396,i,1656485787513159587,212058922850490594,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:14
      4⤵
      PID:4772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7084,i,13618166924669686767,12754702977449184769,524288 --field-trial-handle=2396,i,1656485787513159587,212058922850490594,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:14
      4⤵
      PID:3748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6636,i,2053194167971852541,1761096077152540960,262144 --field-trial-handle=2396,i,1656485787513159587,212058922850490594,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:10
      4⤵
      PID:4068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,15594563082279861419,17380777836171186098,524288 --field-trial-handle=2396,i,1656485787513159587,212058922850490594,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
      4⤵
      PID:2324

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4972

C:\Temp\nifaxspnlfdxvpnl.sys
C:\Temp\nifaxspnlfdxvpnl.sys
1⤵
- Executes dropped EXE
PID:4416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3688

C:\Temp\pkicausnkf.sys
C:\Temp\pkicausnkf.sys
1⤵
- Executes dropped EXE
PID:5944

C:\Temp\fzxrpkeczu.sys
C:\Temp\fzxrpkeczu.sys
1⤵
- Executes dropped EXE
PID:2412

C:\Temp\zwurpjhbzt.sys
C:\Temp\zwurpjhbzt.sys
1⤵
- Executes dropped EXE
PID:3052

C:\Temp\trljdbwtol.sys
C:\Temp\trljdbwtol.sys
1⤵
- Executes dropped EXE
PID:4260

C:\Temp\gebwtoljdb.sys
C:\Temp\gebwtoljdb.sys
1⤵
- Executes dropped EXE
PID:920

C:\Temp\gaytqligay.sys
C:\Temp\gaytqligay.sys
1⤵
- Executes dropped EXE
PID:6128

C:\Temp\qnlidavsqk.sys
C:\Temp\qnlidavsqk.sys
1⤵
- Executes dropped EXE
PID:5808

C:\Temp\pnifaysqni.sys
C:\Temp\pnifaysqni.sys
1⤵
- Executes dropped EXE
PID:1528

C:\Temp\vpnkfcausm.sys
C:\Temp\vpnkfcausm.sys
1⤵
- Executes dropped EXE
PID:2324

C:\Temp\mkhczxspjh.sys
C:\Temp\mkhczxspjh.sys
1⤵
- Executes dropped EXE
PID:5500

C:\Temp\mheczurmje.sys
C:\Temp\mheczurmje.sys
1⤵
PID:4908

C:\Temp\ywuomgezwu.sys
C:\Temp\ywuomgezwu.sys
1⤵
PID:2692

C:\Temp\ojgdbvtolj.sys
C:\Temp\ojgdbvtolj.sys
1⤵
PID:1584

C:\Temp\igeywqolig.sys
C:\Temp\igeywqolig.sys
1⤵
PID:1416

C:\Temp\aysqoigdyv.sys
C:\Temp\aysqoigdyv.sys
1⤵
PID:2364

C:\Temp\ysqkicayvq.sys
C:\Temp\ysqkicayvq.sys
1⤵
PID:4760

C:\Temp\xvpnhfcxup.sys
C:\Temp\xvpnhfcxup.sys
1⤵
PID:4352

C:\Temp\pmkecauspj.sys
C:\Temp\pmkecauspj.sys
1⤵
PID:4040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

czxusmkhcw.exe

Path C:\Temp\czxusmkhcw.exe
Size 376KB
SHA256 bea1ca22b5de84b214041f1071f4a659b388c1dfd21b93950310ff9d84dad6e3
MD5 f4ffb6fe42c9d9217e4c71bdd0625fe6
SHA1 525b407ddb64dd384ce6d57620424bd91754c96a
SHA512 96ba94eb964de60d6b886e35d8713f7dffd0ebb120b971b14ef32c9d09d573517101e30fef5168555f6011faf6011468b391a13c232090ffd737f54bd1518f6f
SSDEEP 3072:8FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:8FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F2847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faxvpnkica.exe

Path C:\Temp\faxvpnkica.exe
Size 376KB
SHA256 eb1aedae238d141d82ce66907effb6bba73ae2cd5725e8cde89bc4050a1b834b
MD5 0feefa3de0b779b67dfd2a9bff6c5e82
SHA1 909aeb8cef2127d3a629987d1a88136ad7a15e26
SHA512 8170417fe4197a5dc1d805fe8447d4dd49cae51dfb0feb1661c549f2ea9b792189ae1f9b0c99cabe4eda24a5f85dc7bacd1b6b0aae0335c80c336edaeabe4bdb
SSDEEP 3072:wFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:wFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T11B847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxrpkeczu.sys

Path C:\Temp\fzxrpkeczu.sys
Size 293KB
SHA256 74f682918b7a816ed4f5b919b79fd620eacb663a3af882fca4be98b88b2c09c2
MD5 2236a778731ee760e76518b13b452b8b
SHA1 5db962578284ae4df203c559fb8b252bd3466b1e
SHA512 ff07feb0322ee42098ec409ee6de09c603fb20348a25351a1111e47279f1955248ba8aaef6ab33a36666ccd0dda5a7bfd289e1973e921d5a77badd8ff8865dbb
SSDEEP 3072:StKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:SIJjiJcbI03GBc3ucY5DCSj
TLSH
T119545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdytqligby.exe

Path C:\Temp\gdytqligby.exe
Size 376KB
SHA256 265774ea3cbb07af4a35dac12e31bc2aaa9e0ff021f4f838fa2de92f48dab19d
MD5 0614bd25721944dffb9403c0fd2bc59b
SHA1 4ca24597480ad3953fa051340ae0001a8953c4be
SHA512 823c343ae7fa4bced70df17119dcd4cbb1bb695df0a54ee18be1d05a690c6c5287811b58865ea1d060d91908de425329dbc58779e8947f2a069a8b94341f8517
SSDEEP 3072:VFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:VFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F7847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gebwtoljdb.sys

Path C:\Temp\gebwtoljdb.sys
Size 293KB
SHA256 49deff2043b49e94a7d4d72461fd6d47082ecbcc9fc953450b57f0b9a3e5f577
MD5 75126ba0fbbce9ff5ea6bf130348a558
SHA1 cd8926533cab560b395a470930389f1a9aa3c880
SHA512 75c80e0465d5e2d8b411d7d718f8da79adfaab1fba7c22ae57166e489c661366762b7831a4c3d3490a29ae173fa236eb8d069ac7300e73d0382351d42d95604e
SSDEEP 3072:WtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:WIJjiJcbI03GBc3ucY5DCSj
TLSH
T1EE545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_czxusmkhcw.exe

Path C:\Temp\i_czxusmkhcw.exe
Size 376KB
SHA256 e94ce3d2d6a8faf997128173fb3f3c28367bc86f2367bcf0b2530fb94c93d8a7
MD5 7412fc296e705a6e3ffde69e1e6a6bf7
SHA1 261d6519e95f13b7f537a03c917e5fcccb829c62
SHA512 3c1bf6f3087ac3a394ffaa75978a8130f537e058c48ef96eac4414a35e13c97086281a24b4c6e0e004b0156f18f024e018ec327119f9bfdc1338b0ad937c230e
SSDEEP 3072:2FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:2FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T19B847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_faxvpnkica.exe

Path C:\Temp\i_faxvpnkica.exe
Size 376KB
SHA256 3ebbec87dedf1d7ab206517b5615fc86fd430f722890c6a1d04735cad6b88066
MD5 2a9bd908edd4e74dde93b05ca2ccf702
SHA1 214423af5bc8682f95338a95e2cc801fdf00d30f
SHA512 3f922599e303035424064b29f98a023f8493520a8f1b93c87c7e71aeff5e41c4914bb4f2f1bdcefc038701e79b6b995e5be93bb395d40a40fae363c5defa1fbd
SSDEEP 3072:dFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:dFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C7847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_uomebwuomg.exe

Path C:\Temp\i_uomebwuomg.exe
Size 376KB
SHA256 cfcd150a9ab060e412cdf9bf028c5ece3bdb39194d5a93afaac9e11c1f752ac4
MD5 d237852a85f116dad8d54c679c5e7d44
SHA1 a5f50441f51f17f25faccb1fcd87d5cbbdb114b2
SHA512 dca0669957fc61ea23409001c120c4d38a4a710351bd825b4b5f513fc6d15fd8318c575c21d7996caf6bd731cdf35b577ce2c21a5172a2f4940bc016abbad1f6
SSDEEP 3072:vFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:vFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B7847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_upmkhfzwus.exe

Path C:\Temp\i_upmkhfzwus.exe
Size 376KB
SHA256 40bb2b8bb5f0eec4de556cd2379df120db9d11748c203f3cdfffcb1565e7bbb2
MD5 f918115c5a7ba421a7d9d932e0005f0a
SHA1 079b7588444e577b3f6b0e5f8ec207aaf90a3dd9
SHA512 8a46c61c9b0b9a3b5842884b91e50b837572f2b13aa8cebfb9eb750fd65eda51a17882e53e0f066a1ffaa3d43ab944452a2ae5b2f284cce66c3015d8cd87b4ae
SSDEEP 3072:CFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:CFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T125847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zwrpjhecwu.exe

Path C:\Temp\i_zwrpjhecwu.exe
Size 376KB
SHA256 a8a139bab756c6951b7d9ae7f6117bd932af8f6e6dac3eefa4cf73aec80b2a70
MD5 a99679780c72b375e5ba917c68d82a43
SHA1 afb9ce97be8fa093589375761687a9786167c1b0
SHA512 ddd78d838b62aa271d0b27a73d009472a4374a4be756a4b8ea0dab6e4e419d259e5a784944b57b72855d56c0762ce6d75b24102c8b5972994cd95754f0ff0a63
SSDEEP 3072:JFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:JFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E7847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nifaxspnlfdxvpnl.exe

Path C:\Temp\nifaxspnlfdxvpnl.exe
Size 376KB
SHA256 046c4288248c346840992529367dfea9c1774de2f396c2c5888dc38e95790b4f
MD5 bacd7c84fb12d14882b0feebb10ba650
SHA1 dcb3c22a8e3fdd198ab8515251d987f41e3620e0
SHA512 359f9a3dd88abe09e7803e9429b8ceade2a2e70f91bea58b8f2aae5b5754d0ca8069ff72024f885ef1176156b9380dcf5500267cce2da3a0f9bfb515352503e2
SSDEEP 3072:5FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:5FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T11E847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nifaxspnlfdxvpnl.sys

Path C:\Temp\nifaxspnlfdxvpnl.sys
Size 293KB
SHA256 f8adec8bc15e0ed41ed521ca929294a98b3d3c41be8b3ce3a0c5d723782bc1ee
MD5 2425d267b071c54cdbc5099c0b050fc1
SHA1 07f449cd343d28bb29d68d81bdb87f8a919fc500
SHA512 cffc13dde093e6a4250954506c7a2e492300783349cb66b10a7175119ac7df657140f795ebacc3d1d262c81a4568919568224c635eadfc5cd510bb286a2280ca
SSDEEP 3072:0tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:0IJjiJcbI03GBc3ucY5DCSj
TLSH
T185545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkicausnkf.sys

Path C:\Temp\pkicausnkf.sys
Size 293KB
SHA256 3c3b31761c92de0b4e4a321ad10d7f3eff465b7e0bae7e003186e88a4198063c
MD5 7af550632347a79f220d6f299fcba0c0
SHA1 e289a87086418159a3993f2f8ca08039da1f75b7
SHA512 353dd2ca44474d788de3e68c1c020821bf4d0c110e7b64b83fdf4c857be3423217dca69ba511b98819ec4f351bc7fa8738c84650e110a2cad03d1839ec244a8b
SSDEEP 3072:mtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:mIJjiJcbI03GBc3ucY5DCSj
TLSH
T141545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljdbwtol.sys

Path C:\Temp\trljdbwtol.sys
Size 293KB
SHA256 45a1d9bf7f3a92c7f908c0604b081e4b6721bc78f6130175c2895ea1bd9ad284
MD5 3b92368c27e9a70b1125c36d99c1956e
SHA1 bed12eb1c3dfd653b7c0e62d4f27b9588bc54c19
SHA512 f12a84812c9ce8f86f75f5fcbb94bec6297b6e2a20468413d6c80dbed6ae900ed10f23a1ea4ce306b6ac3ca7f39cfe839331744b868157b311bf0736d8344cbb
SSDEEP 3072:ttKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:tIJjiJcbI03GBc3ucY5DCSj
TLSH
T105545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uomebwuomg.exe

Path C:\Temp\uomebwuomg.exe
Size 376KB
SHA256 b907282c4ee9216c5f563b4d3bd9895cdd5ce6156fc744ec0a5d96004de289f5
MD5 bfe16afc4e0cb1880943081720e23c2b
SHA1 40ef1de90dfd64992ba171cb82d50958dc0b804d
SHA512 a80b199ec26949015b796d6b34d8f6bbf6981d6c460ac49cf7d1d8fa5f9eb2b16132949826c459302cc673b6f411e0535b0ca95e3ad81295a54444eacca228f6
SSDEEP 3072:2FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:2FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E2847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

upmkhfzwus.exe

Path C:\Temp\upmkhfzwus.exe
Size 376KB
SHA256 81a788c76ddbced79ab6822a3d89d5d54ce2ee96f844f00d468a64dce889f8f2
MD5 d579daa9a4262c081942a946cbdd69dd
SHA1 865fedef1db66aa7a174cc8ca08c06a982e63f71
SHA512 c9d5a14a28340279789d04dc6e4cbd99953df257c41a3b0666eca65d439740f6136b82f535c6cf5871da10752c98089f2569fbd78704cd9e0701d9f16a56de6f
SSDEEP 3072:/FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:/FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F6847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwrpjhecwu.exe

Path C:\Temp\zwrpjhecwu.exe
Size 376KB
SHA256 2ed725dd2bf255d7323209e16585c5804fd8263e91ac27d19a2e034b5e5444c4
MD5 526cb87d8ccb260efa89aa97cb60c50f
SHA1 c4753a48cc056f1aa1374e48ec2976299b27a087
SHA512 3080d176006319ee4c41201d103ddd3bd34b31d1538648335d1e3cf1dc013366817b29faabcb065214d1669f57abb2b4117b128c8d54326eb8e306342bac4cec
SSDEEP 3072:LFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:LFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T13B847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwurpjhbzt.sys

Path C:\Temp\zwurpjhbzt.sys
Size 293KB
SHA256 db98707924fa1dca4de5cc2f71d52abfabeb022eafd3c0a0206a73d56548ef93
MD5 0d8a2b1994059951f0b1445201cfee18
SHA1 ecc1899f3d387c3c2e781e841e75c41307c12f44
SHA512 40494f25ddea2582b80b076df238d35d4ca2ea20d2c477517a08de429569c0a6309a09dcce2738b2470a746bb499da2b7ad98b15096229dfdb74042fa1792d1d
SSDEEP 3072:etKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:eIJjiJcbI03GBc3ucY5DCSj
TLSH
T17F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

45cc9761-4765-4712-8a30-a6614c9f332c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\45cc9761-4765-4712-8a30-a6614c9f332c.tmp
Size 33KB
SHA256 02d4c3ed2e6a55d5d956642717d2d1e416daf256375d69576254ff514d144f8a
MD5 a9445961d286a8ef7305d3142c19cf9e
SHA1 f62520dff99c1ebe462ffa9fae8a258d552484f5
SHA512 c855d53b77e53a111ae9803f0a946e8d0e0c0455f4c14b367cbaa3f5ef28b10b760c3203f302f35603def01e28395b146542d7aae8cce36e81f20f219508147e
SSDEEP 768:tx3F0Ngc7fZrKFp5XSwQs88uBkiT2S89jMLz:tx3SdtrUILNB38FM/
TLSH
T179F2CF34F8959D23DCE69381769A37976FF06147C8C40F84C9EAA61D018739E3B8B857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

76f38b47-e1e2-4b0e-a7ec-e46d60575ff9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\76f38b47-e1e2-4b0e-a7ec-e46d60575ff9.tmp
Size 42KB
SHA256 671d254dd44460043de44f03056ef7389f57565dc385667879290f1bf6f79ba6
MD5 4b981806182cc15d71b463708d15434d
SHA1 b2945eec2fc1bf8389170d0d5d10db0288498d4c
SHA512 7309eed6ada6198883eada64ff668cfcc2ad6da90cdff0c1f1c42690aa71c519f79f1e00378ac81d6921f06229fba999be1d5ffddf94e1a7c481d0a8902e5092
SSDEEP 768:jyFI/39wg40wUAerKHvp5XSwQs88uBkiT2S89jMLz:jr/3DnrixILNB38FM/
TLSH
T1821327F598D38937D8AE4383677D2E469EBCD143B8880984B7D9590CCC862BFD74B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a0b193400a27c0cdf94ac11f5fb5b0747828b5b461169cefeffb96191b9e4834
MD5 edaab58c014c1abbfa900853b2ab2696
SHA1 e35eb02c0343d109af1ddd7dbd39dee3b989aea3
SHA512 b3cca7ed39fd4708b9c01cbefd67aab972f585372e01b5fa39d4a0840a7f579725d1202ab2916cda4e7635fb16dbc74178888461c7b6a2b3ea91d273ce2909ea
TLSH
T1BBD02B75F96ECC23E85204F940D24208329775818C0441812601CC080A603850000182
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 932f01682de6215b2c3b5faeb96a07b886e28db2ff6f8242a36da556c4292464
MD5 667b54168424526a7188593696f59ace
SHA1 deeb9f5ad1bccaabad57a386f08ba0c0740b2f81
SHA512 698f5a88d262c546b9bf21ead67e8dbe00ce6bd13f196761a5910f59ff69ca7532cacdf03c070f8d3b9f5d4fb8990b358e9b60ace9e48a0848e4a9da1d92b3ed
TLSH
T1D4D02B79F95ECD23E85204F540D1420832A77581DC04418125018C080A603850001182
MD5 SHA1 SHA512 TLSH

Submit Download

2bf2eceb-db47-4b88-a97c-202b0967ed04.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2bf2eceb-db47-4b88-a97c-202b0967ed04.tmp
Size 12KB
SHA256 5a7e21e5c6cb20d8096138a61b41b131014b673f56c5b83c1702ad4f572d4bf1
MD5 96b2fee1d224823889418778bf0fec7c
SHA1 d07a10426445c6197042fafdc8fbe411c41e3ba9
SHA512 96c6efbb7f8a7cc6c668490deef7698284ef76492725a222e64ddee95ec7420556d752accdda88738d5c5724c5a8ffdeeebab3ef411c3888b738328a5e716dfd
SSDEEP 192:sxRgRHCV/fUsg+5ZKZzoA8p93/g6+WNCuN/YE2S3G3IgD7RJ:sxRgQV/fUsg+X7d/5V/GT
TLSH
T1DE42B915AD34A93B8CCBD21DBA69BF53D6FD1072A0911E48A6FC8A1C05E76DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

33946e19-917f-466c-8358-a96d89b1eb65.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\33946e19-917f-466c-8358-a96d89b1eb65.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4bb2ec13-828b-423a-89cc-02aa8d2df653.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4bb2ec13-828b-423a-89cc-02aa8d2df653.tmp
Size 12KB
SHA256 47ad8da7103ddde984855dfa6de73fc04d85e1e806f455df236c8fa7090e041f
MD5 8eb078281532865bf1f666aa393032bb
SHA1 b9eaf4a26a78c5bb412639234dbd9918c337be0f
SHA512 050e772da5ba75a213025721f6601bdd64fb0af686b7385a4e9ddfc2e64ace0dd978a28f5c842413591e61092fe9536493ce682b460a3574e93daebc2b734c70
SSDEEP 192:sxRgRHCV/fUsgdx5ZKZzoA8p93/g6+WNCuN/YEve3G3IgDJRJ:sxRgQV/fUsgdxX7d/5V/zt
TLSH
T17042C915AD38A93B8CCBD21DBB59BF53D6FD107260911F48A6FC8A1C05E7ADD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8a809353-d7fb-4cd8-b5f6-d31fddf14c42.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8a809353-d7fb-4cd8-b5f6-d31fddf14c42.tmp
Size 29KB
SHA256 3530ebaa84c7346d9774dab4e3f55981d8c273d915341e71783aa12a3c52041c
MD5 a52e016e3437ebda54b12cb78aeed790
SHA1 91e7e70602f7635746d96059111a03d25947aafc
SHA512 a6fb2f5070f5e891f802e64a32c0264647f78e1d6a8db64d01f61539e31c32fc9e508994eb2efca65e205d64a6e42a37ba84a598fe3ca6adf5b9681466718fc4
SSDEEP 768:U/pCcx7pLuLbLmWg8KfrL8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEIuyhp3roJHn:U/pCcnEbLmWg8KfrLu1jaHIu8pkx
TLSH
T191D2DA7B740CCB7F4F804ADDA8197ADA6DA902CB9698CD4047FE941C02C77EA91164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 f7fc215505ce93015e7e2fc8041e0f19074a969a1c5aa467ecffbbfdca2e8f0f
MD5 66d71c5d53566d9ee87001aa7f60d812
SHA1 efdf6f8a6a12380c239957118636af7fc5087a0e
SHA512 45362e715bdc2f3853549403c8c8e4cf3005a88009590b480cfbff9fee788a74bac1111cb8854b32b55d96aa35baf32304ea00fae83f966a6d25a956ebfe4ad8
TLSH
T1D441EB828AC40044E7AE26F985EE3B733AB854BF4E731E012D68D876635776481C6F7C
MD5 SHA1 SHA512 TLSH

Submit Download

055b2743-0587-4d58-a0f8-053d4f7aeef1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\055b2743-0587-4d58-a0f8-053d4f7aeef1.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

23171827-218b-4897-8cae-d02c34b4ea4b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\23171827-218b-4897-8cae-d02c34b4ea4b.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0607b3db2c1184d1518a2837fba7cee6ad94b4319b28fdd407e4ca20e6d20df2
MD5 1eff499db7e0219dfff58ae105e3f575
SHA1 e836fd8918b56194b21700551a45026d53511e8a
SHA512 b10505bf86507a8efe596fe9461c0a8f42c0211c69279fed647e3af514a9736341cdbeeb286cea786efe6f732e5146d04170fce68030f1d2c64299817f6172af
TLSH
T12B41B0F783F4857D8E0196F0AA146E1FCE2D0515432C7C5689E09E2B93E3471D181A9F
MD5 SHA1 SHA512 TLSH

Submit Download

cbe74464-2ce4-4e5b-82f8-9a63eabe515f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\cbe74464-2ce4-4e5b-82f8-9a63eabe515f.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 07a995420c63d61912d4457e9d6a462edad49163e8c20aa6e17bf7b1ed9b8465
MD5 7b2e88deb887934a61c1002ca48c3f2f
SHA1 7fcdc3817a83539063e751db5045fd1a7f9a03a0
SHA512 87c66ef9c7c0d34ac6300a78268a1b96b841eca5b8ee2d34c3a97059cb168ead7bed2f99c3bf8b64d775963ddbaac59e950dc264a7040380503688672f9a87f4
SSDEEP 96:KbwgKFqyiGkKP6uhSlxnjXwz74jZJwKBlZvwFZJoPhdMyD8Y6U:3HXNhSlxnjX874FJdlZvEZJoPhdMyD8Y
TLSH
T1CF914F4071AF124538BE290951A9D72A4A8235B33059E5BB7FBC40B24F2BF445CFDDD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aa59194c-57c2-4f45-ba38-1e077994d14c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\aa59194c-57c2-4f45-ba38-1e077994d14c.tmp
Size 12KB
SHA256 57e71dd283d0f45781998703c5f5b77ec33c635a4d662f8877258bcbca418370
MD5 5ee5dd48a1ef08b94d88a82b35482d82
SHA1 de70f71abfa24c18adab59490341831539c131f5
SHA512 7aafbf72060ad8df022bcb52eec89b333a41c021fd54e6d91b4973039a1f42b838f6279a3bf435de445f369c0c72495832f25bb3b3d9a98e091eedf461624969
SSDEEP 192:sxRbRHCV/fUsS5ZKZzoA8p93/g6+WNCuN/YE2S3G3IgVRJ:sxRbQV/fUsSX7d/5V/G1
TLSH
T17742BA15AD38A93B8CCBD31DBA69BF53D6FD103270951E48A6FC8A1C05E76DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c3f80de8-69e2-4957-9721-9af33c2d334f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c3f80de8-69e2-4957-9721-9af33c2d334f.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

141060ef-a69f-4f14-b717-b51ecfcf6ee0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\141060ef-a69f-4f14-b717-b51ecfcf6ee0.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ad44b718-e599-47d1-8f8a-52f7f6b5322c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ad44b718-e599-47d1-8f8a-52f7f6b5322c.tmp
Size 38KB
SHA256 5d2edf5941b8e232fa810c207fa5743893792c2e4815e0550cda5bf6dc4969bc
MD5 f297a8de7588460f050084a7fd4d780a
SHA1 c8daae3b010cf2aee427724ae171fb9699e29694
SHA512 80a7a0e9e5ce5fce169d7c9a48c996cbb8c00adb3b14f3546f00fe5a09f45736b791fe782c6ae66030e4677bcaa6f91df377583d4f74a561248fcd8374cc647c
SSDEEP 768:D/UxvxjgC+W3X9Kc7fZrKup5XSwQs88uBkiTzS/P84g:WZj3+W3Xjtr1ILNBAHg
TLSH
T10003C039F8955C23ACF79351355B279BAFF06193C4C40E9889EEAA0E018735E374B857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b4e34021-7792-448f-a60a-b518f1e7dc2b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b4e34021-7792-448f-a60a-b518f1e7dc2b.tmp
Size 33KB
SHA256 a448c72d3bff19cbd755572b0019677514557ae3644408cdfd3a408ae613334c
MD5 c2a3fa179526e0f133e149a602f3540a
SHA1 00ddeee42e530faac00443f89a6c6dc520a16cb0
SHA512 0e3b9fae1ea9e6d59e9eadc9d5d79b0fdaf06185c8515e5e55073a03bb145407c0f6579997b3cfd31fa109f4843fe2187579abbcb4b5578457e20e7f5586e589
SSDEEP 768:fx3h0Ngc7fZrKFp5XSwQs88uBkiT2S89jMLz:fx3edtrUILNB38FM/
TLSH
T1FCF2C034F8959D23DCE69381769A37876FE06147C8C40F98C9EAA61D018739E374B857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5c3e4e30-5ac2-40f4-b21d-88c89aae4b27.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\5c3e4e30-5ac2-40f4-b21d-88c89aae4b27.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

7e771fde-9ce7-44b1-b268-508e9f25ad13.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\7e771fde-9ce7-44b1-b268-508e9f25ad13.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

a1e26854-4d1f-4fbd-af03-982489dfe200.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\a1e26854-4d1f-4fbd-af03-982489dfe200.tmp
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

efc397cf-8897-41a9-aaf4-ce469d5ff7c4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\efc397cf-8897-41a9-aaf4-ce469d5ff7c4.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

d90facc3-bda9-4cbe-a582-fa80a187d5d6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d90facc3-bda9-4cbe-a582-fa80a187d5d6.tmp
Size 33KB
SHA256 a604b1cf31ff1c2e50289179af40fd29a42861d3124f68a0093ed34103419917
MD5 277be444ac016a3606c80aa45d8f84fe
SHA1 5706f98da8624898cdfc3658ca954316c569d3c0
SHA512 6c5633d53b5a88dd6a0a6345b0699841d66ede0e5b801779fa113cc4f7371949270c136a751eed0ff097b9769087ce8ca9cf2defb79da6cf5d6c8252cb746541
SSDEEP 768:dx320Rgc7fZrKwp5XSwQs88uBkiT2S89jMLz:dx3txtr9ILNB38FM/
TLSH
T138F2CF34B8969D23DCF69381769A37936FF06147C8C40F94C9EAA61D018739E3B8B857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

696a40ca-8549-4d16-a938-de6f651c5237.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\696a40ca-8549-4d16-a938-de6f651c5237.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f71cd510-1d81-4cd0-a7df-6ece6dfcc90d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f71cd510-1d81-4cd0-a7df-6ece6dfcc90d.tmp
Size 37KB
SHA256 05bdeb95cd99f75e2c7ffb375fa56385f3bfcae9e25fddef0491ec531440feb7
MD5 714376ac85d3a63b60e4af8a6349e4d7
SHA1 e46c0625e8327fcb1ce79a111786af49894090ae
SHA512 424fb338d6e657aac4984dcd3dee1dfdd6e39df2a9a81e1c4cea406f35827daedf0f63e8ede954825f440de56c879a5e8bc298811c9ac9ae51395ed20dd3973e
SSDEEP 768:R/UxvxjgC+W3DTgc7fZrKrp5XSwQs88uBkiTCt5Z/P84g:kZj3+W3DPtrgILNBA5ZHg
TLSH
T19D03D039EC946873ECB79385365A275BAFF06153C4C40B9849EE7A0F028B35D6707897
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffbed5b4-aa3b-42ed-9f95-a2aac5d61e08.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ffbed5b4-aa3b-42ed-9f95-a2aac5d61e08.tmp
Size 33KB
SHA256 cb3e4a1765f585901521c2b8f7b223d3ca543be551f7f8a620dc691bee4c1783
MD5 8ea5e4ea3b01849980f0bb7673e990d7
SHA1 2ddcde9f31ebb9f9a0f2c9646d6fd816860be0dc
SHA512 c26be18b7e10a17d9dc22923a41c4508577f0683f6250308ab0484174ea049699c2c0d63b93c1d1474814431a4d550e7b0ff9635d0fcfd6cadceb10920716455
SSDEEP 768:qx3F0Rgc7fZrKwp5XSwQs88uBkiT2S89jMLz:qx3Sxtr9ILNB38FM/
TLSH
T167F2BF34B8959D23DCF69381769A37876FF06147C8C40F88C9EAA61D018739E3B4B857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

33eccc59-78f8-4330-b086-e6d38cb3b9f2.tmp

Path C:\Users\Admin\AppData\Local\Temp\33eccc59-78f8-4330-b086-e6d38cb3b9f2.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4d6f9d38-3957-4d88-bc19-26b9cd05c456.tmp

Path C:\Users\Admin\AppData\Local\Temp\4d6f9d38-3957-4d88-bc19-26b9cd05c456.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4792_769665737\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4792_1267117332\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4792_306235680\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4792_473004407\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4792_798877997\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 a428bd9c6007f5c6d57e81cadc05c02c28c991c71b26f449b78b69d3e3940cf0
MD5 9c4beb3727d3b51674ed562e12ab51d0
SHA1 6866fd9af8e8dad94e4e2f3711da078241b1e3a4
SHA512 b0fe6ff4a5d7bd4f5a6409bf4bdfe4169fc3da19a48012e65d889751806e0a07a633084e770fd5f5a1e3ad69cc6291b736fe8034a6a93842c348f7a43c8a83e6
TLSH
T1ED71238356F9C9B3C1DB5FF502835688F6FF2238472330244B615987AB70A3A58B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/920-314-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1416-445-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1528-343-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1584-441-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2324-375-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2364-465-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2412-241-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2692-429-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3052-266-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4040-509-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4260-286-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4352-505-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4416-65-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4760-485-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4908-407-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5500-395-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5808-327-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5944-192-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6128-323-0x0000000000010000-0x00000000000AB000-memory.dmp

Download