systex | e0c5b5e61a28f95960064e983c43e41b14eeb96d1c0ad38f81350cdbbef0bc34

Analysis

max time kernel
149s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/10/2026, 06:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample261019-hlblgsf16w
SHA256 e0c5b5e61a28f95960064e983c43e41b14eeb96d1c0ad38f81350cdbbef0bc34
MD5 3e43ff4fef37c711fa6de8f83db7e8d5
SHA1 1956e3d091021ef69131cb2d1179e6d06fd03acb
SHA512 a4817076ddebe0f308d28bf0aab055087cd64b582442d36de0defa0c628c31390f5c6cde34f1bfe48f45f4e6b4c765d11cae77f012d00426ff073ecedc947a0b
SSDEEP 6144:WflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:WflfAsiVGjSGecvX
TLSH
T173747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
1504	ecwupmhfzxrpjhbz.exe
5848	ecwupmhfzxrpjhbz.sys
4104	CreateProcess.exe
3476	jhczuomkez.exe
4920	CreateProcess.exe
5988	CreateProcess.exe
5544	i_jhczuomkez.exe
4636	ztrmjebztr.sys
1380	CreateProcess.exe
4884	uomgeywuom.exe
632	CreateProcess.exe
3248	CreateProcess.exe
2200	i_uomgeywuom.exe
4392	wtoljgbywt.sys
2576	CreateProcess.exe
3024	wqojgbztrl.exe
6084	CreateProcess.exe
4700	CreateProcess.exe
1708	i_wqojgbztrl.exe
2856	tqljdbvtnl.sys
264	CreateProcess.exe
3816	tqljdbvtnl.exe
6032	CreateProcess.exe
1432	CreateProcess.exe
1812	i_tqljdbvtnl.exe
4916	ytqlidaysq.sys
1088	CreateProcess.exe
4200	kidaysnlid.exe
4332	CreateProcess.exe
4548	CreateProcess.exe
2580	i_kidaysnlid.exe
3948	qkidavtnlf.sys
1768	CreateProcess.exe
2016	nifdxvpnif.exe
432	CreateProcess.exe
4800	CreateProcess.exe
5668	i_nifdxvpnif.exe
2608	ifaxsqkica.sys
5152	CreateProcess.exe
6124	axsqkicaus.exe
2476	CreateProcess.exe
3404	CreateProcess.exe
3412	i_axsqkicaus.exe
4820	uspkhczxrp.sys
4636	CreateProcess.exe
5544	uspjhecxup.exe
3088	CreateProcess.exe
720	CreateProcess.exe
1832	i_uspjhecxup.exe
2676	hczxrpkhca.sys
1524	CreateProcess.exe
572	frpjhbzxrp.exe
3312	CreateProcess.exe
4808	CreateProcess.exe
5696	i_frpjhbzxrp.exe
5932	wurmkebztr.sys
4164	CreateProcess.exe
3292	wurpjhbztr.exe
4860	CreateProcess.exe
4888	CreateProcess.exe
1500	i_wurpjhbztr.exe
3444	ezwqojgbwu.sys
4876	CreateProcess.exe
4624	ywrojhbztr.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2468_1798180128\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2468_1486557768\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2468_1486557768\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2468_466974014\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2468_466974014\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2468_466974014\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2468_1357750111\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2468_466974014\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2468_1798180128\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtroigdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbytqligb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdavtnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omhezwrpmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trojgeyvtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqojgbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kidaysnlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nifdxvpnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wurpjhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtroigdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdavtnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgeywrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgeywrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhczuomkez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uspkicausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wupmkhcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomgeywuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcaxvpnhfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wupmkhcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omhezwrpmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomgeywuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uspjhecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywrojhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kidaysnlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcaxvpnhfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uspkicausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwupmhfzxrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhczuomkez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywrojhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbytqligb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqojgbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqljdbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqljdbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nifdxvpnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axsqkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axsqkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	frpjhbzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wurpjhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uspjhecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_frpjhbzxrp.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5784	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3412	ipconfig.exe
3220	ipconfig.exe
4672	ipconfig.exe
988	ipconfig.exe
3712	ipconfig.exe
5728	ipconfig.exe
836	ipconfig.exe
4852	ipconfig.exe
5616	ipconfig.exe
3280	ipconfig.exe
704	ipconfig.exe
2904	ipconfig.exe
3520	ipconfig.exe
3244	ipconfig.exe
6116	ipconfig.exe
1664	ipconfig.exe
2472	ipconfig.exe
3780	ipconfig.exe
4976	ipconfig.exe
3984	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-560646293-820748483-2532804640-1000\{4154ECC1-DB79-4F44-8D0C-DB5D380AAF44}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1504	ecwupmhfzxrpjhbz.exe
1504	ecwupmhfzxrpjhbz.exe
1504	ecwupmhfzxrpjhbz.exe
1504	ecwupmhfzxrpjhbz.exe
1504	ecwupmhfzxrpjhbz.exe
1504	ecwupmhfzxrpjhbz.exe
1504	ecwupmhfzxrpjhbz.exe
1504	ecwupmhfzxrpjhbz.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5544	i_jhczuomkez.exe
Token: SeDebugPrivilege	2200	i_uomgeywuom.exe
Token: SeDebugPrivilege	1708	i_wqojgbztrl.exe
Token: SeDebugPrivilege	1812	i_tqljdbvtnl.exe
Token: SeDebugPrivilege	2580	i_kidaysnlid.exe
Token: SeDebugPrivilege	5668	i_nifdxvpnif.exe
Token: SeDebugPrivilege	3412	i_axsqkicaus.exe
Token: SeDebugPrivilege	1832	i_uspjhecxup.exe
Token: SeDebugPrivilege	5696	i_frpjhbzxrp.exe
Token: SeDebugPrivilege	1500	i_wurpjhbztr.exe
Token: SeDebugPrivilege	4376	i_ywrojhbztr.exe
Token: SeDebugPrivilege	2796	i_bvtroigdyv.exe
Token: SeDebugPrivilege	3444	i_jdbytqligb.exe
Token: SeDebugPrivilege	5812	i_fdavtnlfdx.exe
Token: SeDebugPrivilege	3244	i_fcaxvpnhfc.exe
Token: SeDebugPrivilege	2064	i_uspkicausm.exe
Token: SeDebugPrivilege	3460	i_wupmkhcaus.exe
Token: SeDebugPrivilege	3452	i_omhezwrpmh.exe
Token: SeDebugPrivilege	3424	i_omgeywrojg.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2468	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 1504	880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 880 wrote to memory of 5556	880	2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 5556 wrote to memory of 2468	5556	iexplore.exe	91
PID 2468 wrote to memory of 4008	2468	msedge.exe	92
PID 2468 wrote to memory of 1120	2468	msedge.exe	93
PID 2468 wrote to memory of 5784	2468	msedge.exe	94
PID 2468 wrote to memory of 1120	2468	msedge.exe	93
PID 2468 wrote to memory of 1120	2468	msedge.exe	93
PID 2468 wrote to memory of 5768	2468	msedge.exe	95
PID 2468 wrote to memory of 5768	2468	msedge.exe	95
PID 2468 wrote to memory of 124	2468	msedge.exe	97
PID 2468 wrote to memory of 124	2468	msedge.exe	97
PID 2468 wrote to memory of 124	2468	msedge.exe	97
PID 2468 wrote to memory of 244	2468	msedge.exe	98
PID 2468 wrote to memory of 244	2468	msedge.exe	98
PID 2468 wrote to memory of 244	2468	msedge.exe	98
PID 2468 wrote to memory of 4420	2468	msedge.exe	99
PID 2468 wrote to memory of 4420	2468	msedge.exe	99
PID 2468 wrote to memory of 4420	2468	msedge.exe	99
PID 2468 wrote to memory of 1948	2468	msedge.exe	100
PID 2468 wrote to memory of 1948	2468	msedge.exe	100
PID 2468 wrote to memory of 1948	2468	msedge.exe	100
PID 2468 wrote to memory of 1500	2468	msedge.exe	101
PID 2468 wrote to memory of 1500	2468	msedge.exe	101
PID 2468 wrote to memory of 2484	2468	msedge.exe	105
PID 2468 wrote to memory of 3040	2468	msedge.exe	106
PID 2468 wrote to memory of 2484	2468	msedge.exe	105
PID 2468 wrote to memory of 3040	2468	msedge.exe	106
PID 2468 wrote to memory of 3312	2468	msedge.exe	108
PID 1504 wrote to memory of 4104	1504	ecwupmhfzxrpjhbz.exe	109
PID 2468 wrote to memory of 1996	2468	msedge.exe	111
PID 2468 wrote to memory of 1996	2468	msedge.exe	111
PID 3476 wrote to memory of 4920	3476	jhczuomkez.exe	113
PID 2468 wrote to memory of 1904	2468	msedge.exe	116
PID 2468 wrote to memory of 1904	2468	msedge.exe	116
PID 1504 wrote to memory of 5988	1504	ecwupmhfzxrpjhbz.exe	119
PID 1504 wrote to memory of 1380	1504	ecwupmhfzxrpjhbz.exe	123
PID 4884 wrote to memory of 632	4884	uomgeywuom.exe	125
PID 1504 wrote to memory of 3248	1504	ecwupmhfzxrpjhbz.exe	128
PID 1504 wrote to memory of 2576	1504	ecwupmhfzxrpjhbz.exe	132
PID 3024 wrote to memory of 6084	3024	wqojgbztrl.exe	134
PID 1504 wrote to memory of 4700	1504	ecwupmhfzxrpjhbz.exe	137
PID 1504 wrote to memory of 264	1504	ecwupmhfzxrpjhbz.exe	142
PID 3816 wrote to memory of 6032	3816	tqljdbvtnl.exe	144
PID 1504 wrote to memory of 1432	1504	ecwupmhfzxrpjhbz.exe	147
PID 2468 wrote to memory of 3840	2468	msedge.exe	149
PID 2468 wrote to memory of 5876	2468	msedge.exe	150
PID 2468 wrote to memory of 756	2468	msedge.exe	151
PID 1504 wrote to memory of 1088	1504	ecwupmhfzxrpjhbz.exe	154
PID 4200 wrote to memory of 4332	4200	kidaysnlid.exe	156
PID 1504 wrote to memory of 4548	1504	ecwupmhfzxrpjhbz.exe	159
PID 1504 wrote to memory of 1768	1504	ecwupmhfzxrpjhbz.exe	163
PID 2016 wrote to memory of 432	2016	nifdxvpnif.exe	165
PID 1504 wrote to memory of 4800	1504	ecwupmhfzxrpjhbz.exe	168
PID 1504 wrote to memory of 5152	1504	ecwupmhfzxrpjhbz.exe	172
PID 6124 wrote to memory of 2476	6124	axsqkicaus.exe	174
PID 1504 wrote to memory of 3404	1504	ecwupmhfzxrpjhbz.exe	177
PID 1504 wrote to memory of 4636	1504	ecwupmhfzxrpjhbz.exe	181
PID 5544 wrote to memory of 3088	5544	uspjhecxup.exe	183
PID 1504 wrote to memory of 720	1504	ecwupmhfzxrpjhbz.exe	186
PID 2468 wrote to memory of 4896	2468	msedge.exe	188
PID 2468 wrote to memory of 4896	2468	msedge.exe	188
PID 1504 wrote to memory of 1524	1504	ecwupmhfzxrpjhbz.exe	194
PID 572 wrote to memory of 3312	572	frpjhbzxrp.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-17_3e43ff4fef37c711fa6de8f83db7e8d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:880
- C:\Temp\ecwupmhfzxrpjhbz.exe
  C:\Temp\ecwupmhfzxrpjhbz.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhczuomkez.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4104
  - - C:\Temp\jhczuomkez.exe
      C:\Temp\jhczuomkez.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3476
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4920
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3220
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhczuomkez.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5988
  - - C:\Temp\i_jhczuomkez.exe
      C:\Temp\i_jhczuomkez.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uomgeywuom.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1380
  - - C:\Temp\uomgeywuom.exe
      C:\Temp\uomgeywuom.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4884
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:632
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4976
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uomgeywuom.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3248
  - - C:\Temp\i_uomgeywuom.exe
      C:\Temp\i_uomgeywuom.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wqojgbztrl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2576
  - - C:\Temp\wqojgbztrl.exe
      C:\Temp\wqojgbztrl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3024
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6084
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wqojgbztrl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4700
  - - C:\Temp\i_wqojgbztrl.exe
      C:\Temp\i_wqojgbztrl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqljdbvtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:264
  - - C:\Temp\tqljdbvtnl.exe
      C:\Temp\tqljdbvtnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3816
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6032
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3412
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqljdbvtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1432
  - - C:\Temp\i_tqljdbvtnl.exe
      C:\Temp\i_tqljdbvtnl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kidaysnlid.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1088
  - - C:\Temp\kidaysnlid.exe
      C:\Temp\kidaysnlid.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4200
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4332
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2904
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kidaysnlid.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4548
  - - C:\Temp\i_kidaysnlid.exe
      C:\Temp\i_kidaysnlid.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2580
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nifdxvpnif.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1768
  - - C:\Temp\nifdxvpnif.exe
      C:\Temp\nifdxvpnif.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2016
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:432
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4672
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nifdxvpnif.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4800
  - - C:\Temp\i_nifdxvpnif.exe
      C:\Temp\i_nifdxvpnif.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\axsqkicaus.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5152
  - - C:\Temp\axsqkicaus.exe
      C:\Temp\axsqkicaus.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6124
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2476
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3520
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_axsqkicaus.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3404
  - - C:\Temp\i_axsqkicaus.exe
      C:\Temp\i_axsqkicaus.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3412
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uspjhecxup.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4636
  - - C:\Temp\uspjhecxup.exe
      C:\Temp\uspjhecxup.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5544
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3088
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:988
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uspjhecxup.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:720
  - - C:\Temp\i_uspjhecxup.exe
      C:\Temp\i_uspjhecxup.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1832
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\frpjhbzxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1524
  - - C:\Temp\frpjhbzxrp.exe
      C:\Temp\frpjhbzxrp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:572
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3312
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3712
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_frpjhbzxrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4808
  - - C:\Temp\i_frpjhbzxrp.exe
      C:\Temp\i_frpjhbzxrp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wurpjhbztr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4164
  - - C:\Temp\wurpjhbztr.exe
      C:\Temp\wurpjhbztr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3292
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4860
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3244
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wurpjhbztr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4888
  - - C:\Temp\i_wurpjhbztr.exe
      C:\Temp\i_wurpjhbztr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1500
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywrojhbztr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4876
  - - C:\Temp\ywrojhbztr.exe
      C:\Temp\ywrojhbztr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4624
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:860
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5728
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywrojhbztr.exe ups_ins
    3⤵
    PID:2676
  - - C:\Temp\i_ywrojhbztr.exe
      C:\Temp\i_ywrojhbztr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4376
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bvtroigdyv.exe ups_run
    3⤵
    PID:5312
  - - C:\Temp\bvtroigdyv.exe
      C:\Temp\bvtroigdyv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2128
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6100
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bvtroigdyv.exe ups_ins
    3⤵
    PID:2864
  - - C:\Temp\i_bvtroigdyv.exe
      C:\Temp\i_bvtroigdyv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jdbytqligb.exe ups_run
    3⤵
    PID:3788
  - - C:\Temp\jdbytqligb.exe
      C:\Temp\jdbytqligb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2992
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5140
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6116
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jdbytqligb.exe ups_ins
    3⤵
    PID:5976
  - - C:\Temp\i_jdbytqligb.exe
      C:\Temp\i_jdbytqligb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3444
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdavtnlfdx.exe ups_run
    3⤵
    PID:5264
  - - C:\Temp\fdavtnlfdx.exe
      C:\Temp\fdavtnlfdx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1520
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4192
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4852
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdavtnlfdx.exe ups_ins
    3⤵
    PID:1988
  - - C:\Temp\i_fdavtnlfdx.exe
      C:\Temp\i_fdavtnlfdx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fcaxvpnhfc.exe ups_run
    3⤵
    PID:5668
  - - C:\Temp\fcaxvpnhfc.exe
      C:\Temp\fcaxvpnhfc.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2796
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5564
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fcaxvpnhfc.exe ups_ins
    3⤵
    PID:5904
  - - C:\Temp\i_fcaxvpnhfc.exe
      C:\Temp\i_fcaxvpnhfc.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3244
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uspkicausm.exe ups_run
    3⤵
    PID:2484
  - - C:\Temp\uspkicausm.exe
      C:\Temp\uspkicausm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2920
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4144
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3280
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uspkicausm.exe ups_ins
    3⤵
    PID:6104
  - - C:\Temp\i_uspkicausm.exe
      C:\Temp\i_uspkicausm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wupmkhcaus.exe ups_run
    3⤵
    PID:4344
  - - C:\Temp\wupmkhcaus.exe
      C:\Temp\wupmkhcaus.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3128
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5684
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5616
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wupmkhcaus.exe ups_ins
    3⤵
    PID:1984
  - - C:\Temp\i_wupmkhcaus.exe
      C:\Temp\i_wupmkhcaus.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omhezwrpmh.exe ups_run
    3⤵
    PID:1796
  - - C:\Temp\omhezwrpmh.exe
      C:\Temp\omhezwrpmh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5012
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4308
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2472
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omhezwrpmh.exe ups_ins
    3⤵
    PID:3564
  - - C:\Temp\i_omhezwrpmh.exe
      C:\Temp\i_omhezwrpmh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3452
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omgeywrojg.exe ups_run
    3⤵
    PID:236
  - - C:\Temp\omgeywrojg.exe
      C:\Temp\omgeywrojg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2188
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3184
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omgeywrojg.exe ups_ins
    3⤵
    PID:4496
  - - C:\Temp\i_omgeywrojg.exe
      C:\Temp\i_omgeywrojg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3424
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trojgeyvtr.exe ups_run
    3⤵
    PID:4848
  - - C:\Temp\trojgeyvtr.exe
      C:\Temp\trojgeyvtr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2632
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2392
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3780
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x320,0x7ffeafd8c188,0x7ffeafd8c194,0x7ffeafd8c1a0
      4⤵
      PID:4008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1576,i,5505825692373190188,5357679771033243819,262144 --field-trial-handle=2084,i,6101721281940436946,4247746939618369422,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:2
      4⤵
      PID:1120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,4873513889724544245,6177678702306286809,524288 --field-trial-handle=2084,i,6101721281940436946,4247746939618369422,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:11
      4⤵
      System Time Discovery
      PID:5784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2336,i,16094023149227487192,17646558112588154022,524288 --field-trial-handle=2084,i,6101721281940436946,4247746939618369422,262144 --variations-seed-version --mojo-platform-channel-handle=3308 /prefetch:13
      4⤵
      PID:5768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,6132388079131694862,7407337482824659218,2097152 --field-trial-handle=2084,i,6101721281940436946,4247746939618369422,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
      4⤵
      PID:124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,1632110650799775557,17909005711806200109,2097152 --field-trial-handle=2084,i,6101721281940436946,4247746939618369422,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      PID:244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,6019205820325349002,11502890879675014280,2097152 --field-trial-handle=2084,i,6101721281940436946,4247746939618369422,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:1
      4⤵
      PID:4420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,14174748876577211993,11028627805230705861,2097152 --field-trial-handle=2084,i,6101721281940436946,4247746939618369422,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:9
      4⤵
      PID:1948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3756,i,7507850666954742263,6056826306806591127,524288 --field-trial-handle=2084,i,6101721281940436946,4247746939618369422,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:14
      4⤵
      PID:1500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,3967971700277971301,2418583585896432657,524288 --field-trial-handle=2084,i,6101721281940436946,4247746939618369422,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
      4⤵
      PID:2484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,13050795644890884460,1858183579350359148,524288 --field-trial-handle=2084,i,6101721281940436946,4247746939618369422,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:14
      4⤵
      PID:3040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,6434075601150171308,244094340060785031,524288 --field-trial-handle=2084,i,6101721281940436946,4247746939618369422,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
      4⤵
      PID:2064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,6434075601150171308,244094340060785031,524288 --field-trial-handle=2084,i,6101721281940436946,4247746939618369422,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
      4⤵
      PID:3312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,3634972290405310009,6924720155360078501,524288 --field-trial-handle=2084,i,6101721281940436946,4247746939618369422,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
      4⤵
      PID:1996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,9398221066682709366,9306675741406484248,524288 --field-trial-handle=2084,i,6101721281940436946,4247746939618369422,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:14
      4⤵
      PID:1904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,10693527547596989772,14190312625608475053,524288 --field-trial-handle=2084,i,6101721281940436946,4247746939618369422,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:14
      4⤵
      PID:3840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,10646508372509163342,7870969139265854148,524288 --field-trial-handle=2084,i,6101721281940436946,4247746939618369422,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
      4⤵
      PID:5876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3716,i,16876236413992579477,7543169928583421058,524288 --field-trial-handle=2084,i,6101721281940436946,4247746939618369422,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:14
      4⤵
      PID:756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3704,i,15179622507249231980,9133813570384863238,524288 --field-trial-handle=2084,i,6101721281940436946,4247746939618369422,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:14
      4⤵
      PID:4896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6732,i,12145552252357229664,9213884681091031321,524288 --field-trial-handle=2084,i,6101721281940436946,4247746939618369422,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:14
      4⤵
      PID:2380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,17558464133386980482,18319131769916628285,524288 --field-trial-handle=2084,i,6101721281940436946,4247746939618369422,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
      4⤵
      PID:1612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,13117950253463080383,15404428236075498680,524288 --field-trial-handle=2084,i,6101721281940436946,4247746939618369422,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:14
      4⤵
      PID:5440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,8776166682006034688,7749936586010131026,524288 --field-trial-handle=2084,i,6101721281940436946,4247746939618369422,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:14
      4⤵
      PID:2424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5604,i,1888471731924558248,18117260350966147451,262144 --field-trial-handle=2084,i,6101721281940436946,4247746939618369422,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:10
      4⤵
      PID:6004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,2007486701026352530,9728431903152882876,524288 --field-trial-handle=2084,i,6101721281940436946,4247746939618369422,262144 --variations-seed-version --mojo-platform-channel-handle=1204 /prefetch:14
      4⤵
      PID:2424

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4244

C:\Temp\ecwupmhfzxrpjhbz.sys
C:\Temp\ecwupmhfzxrpjhbz.sys
1⤵
- Executes dropped EXE
PID:5848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5712

C:\Temp\ztrmjebztr.sys
C:\Temp\ztrmjebztr.sys
1⤵
- Executes dropped EXE
PID:4636

C:\Temp\wtoljgbywt.sys
C:\Temp\wtoljgbywt.sys
1⤵
- Executes dropped EXE
PID:4392

C:\Temp\tqljdbvtnl.sys
C:\Temp\tqljdbvtnl.sys
1⤵
- Executes dropped EXE
PID:2856

C:\Temp\ytqlidaysq.sys
C:\Temp\ytqlidaysq.sys
1⤵
- Executes dropped EXE
PID:4916

C:\Temp\qkidavtnlf.sys
C:\Temp\qkidavtnlf.sys
1⤵
- Executes dropped EXE
PID:3948

C:\Temp\ifaxsqkica.sys
C:\Temp\ifaxsqkica.sys
1⤵
- Executes dropped EXE
PID:2608

C:\Temp\uspkhczxrp.sys
C:\Temp\uspkhczxrp.sys
1⤵
- Executes dropped EXE
PID:4820

C:\Temp\hczxrpkhca.sys
C:\Temp\hczxrpkhca.sys
1⤵
- Executes dropped EXE
PID:2676

C:\Temp\wurmkebztr.sys
C:\Temp\wurmkebztr.sys
1⤵
- Executes dropped EXE
PID:5932

C:\Temp\ezwqojgbwu.sys
C:\Temp\ezwqojgbwu.sys
1⤵
- Executes dropped EXE
PID:3444

C:\Temp\jgbztrlbvt.sys
C:\Temp\jgbztrlbvt.sys
1⤵
PID:5820

C:\Temp\lgdbywqolg.sys
C:\Temp\lgdbywqolg.sys
1⤵
PID:3244

C:\Temp\kidavtnlfd.sys
C:\Temp\kidavtnlfd.sys
1⤵
PID:5808

C:\Temp\fdxvpnhfda.sys
C:\Temp\fdxvpnhfda.sys
1⤵
PID:4576

C:\Temp\nhfaxsqnif.sys
C:\Temp\nhfaxsqnif.sys
1⤵
PID:704

C:\Temp\axrpnhfzxu.sys
C:\Temp\axrpnhfzxu.sys
1⤵
PID:1216

C:\Temp\pmkeczurmk.sys
C:\Temp\pmkeczurmk.sys
1⤵
PID:1156

C:\Temp\uomgeywroj.sys
C:\Temp\uomgeywroj.sys
1⤵
PID:4572

C:\Temp\ywtomjebzt.sys
C:\Temp\ywtomjebzt.sys
1⤵
PID:3084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ecwupmhfzxrpjhbz.exe

Path C:\Temp\ecwupmhfzxrpjhbz.exe
Size 361KB
SHA256 2b90e5a8ab561e6cdace3079ced0676e945585ee0e8fb6d926c7a9f596d6a556
MD5 b11bbd05bac67e9c6d9c3a727683272b
SHA1 b6c2643f379ec7f1acfe54398ba752a75df655a1
SHA512 fedee7469c492c0ea54de0d983b98a0789ae510fd5d364ab4539a337e1730aaed8e06690154a51f06d6cd80241acaa2cf7c130f4c781572eb507db5ac5d091cb
SSDEEP 6144:EflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:EflfAsiVGjSGecvX
TLSH
T145747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwupmhfzxrpjhbz.sys

Path C:\Temp\ecwupmhfzxrpjhbz.sys
Size 293KB
SHA256 f36bcb4f95d31ed13e7842ab75b2d3cd683c602028fc0e267f1ceb6386966f36
MD5 851f1f810c1e37ea9fbec3fd8eac0a16
SHA1 66e950b9412c73810ba1a7d0d8ff87f5525dbfb8
SHA512 2c84ff6f8415076b18fc85d420886a2ac5811a92032223840e29ce52c32b285f3eaef1afcbe0bb095f1bdf0412881b2c50a3774d9b1400069b8a33d7564cae03
SSDEEP 3072:EtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:EIJjiJcbI03GBc3ucY5DCSj
TLSH
T14D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jhczuomkez.exe

Path C:\Temp\i_jhczuomkez.exe
Size 361KB
SHA256 1896610c4625764028d0935ac6d29211cc613576fd75b46ac02e05a54797ff94
MD5 f218903878d8f60fc83e20a4229a774f
SHA1 f706ed24c811a854a31a54ac67a829d9d0f83c3a
SHA512 89752e1a676e807f81c7cdc9b8a84c37d1b072dfbb11da3bd5f1ad76ad1ce9bb20a1860bf598a549a581138f095df039308e99fefb10529bff5d76d83aa3bfd7
SSDEEP 6144:PflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:PflfAsiVGjSGecvX
TLSH
T136747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kidaysnlid.exe

Path C:\Temp\i_kidaysnlid.exe
Size 361KB
SHA256 7403bbe34690658dabca95465fdb98217ee0cbd8ffc95ad3475ae99eb2114619
MD5 0807d8a15ef57d201284c8c63bc7cff0
SHA1 2b08622d1b7afed27648a6fcb165dc13722269a4
SHA512 893d425a4d4d32b5a7be8e343cfeea1074be99a40220323205a4668ce9ca515aa31b273aaa4e7dca232beea757f40f862b4830e4e8da28bc37cc82c6dc9f8342
SSDEEP 6144:tflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:tflfAsiVGjSGecvX
TLSH
T1B7747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tqljdbvtnl.exe

Path C:\Temp\i_tqljdbvtnl.exe
Size 361KB
SHA256 78d4688f30a2ed5ea0523248fd55e33a4fd51949ae4d9c1cfe9ec780addd0084
MD5 bc95df2998d47682e87a19781415c1a4
SHA1 02300ba4dcb525ae27636e21567ed4b4f85e3aad
SHA512 2b1a0d8d17dd6c9b98e3813ecb647d3683dec9d57d68a011f277ffe47d720d792af6461fab2ab234cf73aee43ffe4b58dbde423e4ac1ba59c13bfb82d84a84e6
SSDEEP 6144:xflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:xflfAsiVGjSGecvX
TLSH
T126747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_uomgeywuom.exe

Path C:\Temp\i_uomgeywuom.exe
Size 361KB
SHA256 43ae1a1d6ce3607c44abaa8a93090308a06628b1106d4047d5d4c8da94a17bda
MD5 dd18214a460f6cef2ad2958bad709d50
SHA1 33fc9206389edc58bab3f6433158b09b218f90ec
SHA512 2be55dd07bede436732320795695c74ef52bfd4b0e01722b7ac4a07a78509732ed35739f69583ed575b83b38b3d97fb04a4e9e6d149be4bee4b1790e8fdebd9e
SSDEEP 6144:jflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:jflfAsiVGjSGecvX
TLSH
T195747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wqojgbztrl.exe

Path C:\Temp\i_wqojgbztrl.exe
Size 361KB
SHA256 a590234006dcae817f8bdc94c778cf0e6db1c74652fd598c20a4cabf1304d5dd
MD5 151181ccd9681b5522412cb6ea55aee5
SHA1 a649be11966356311ad3969fdcde8f0a1387aca3
SHA512 23a21fe1b415575366df2413cb8eda0f938b277d43772450a34615c847905ebc002caf5e65d8c9a90112baa51bf89ed9ed04f6897d8bdcee0cc6e8f635be4dc1
SSDEEP 6144:3flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:3flfAsiVGjSGecvX
TLSH
T19A747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhczuomkez.exe

Path C:\Temp\jhczuomkez.exe
Size 361KB
SHA256 b2fd96bb11f5d786eee2fbde8daa22f47c581e32af76fd93aae8dd1b87486829
MD5 04347a77c4e4892ea1cccad5eae73abc
SHA1 0871a26cd466ce3236c30eafbd1f3a4097bc8515
SHA512 e3e3eb0b848607098ae90b662f753c7d07ddf39aac3cd1edb6be85d856c0f5c74df684762b297abe49416154247c451ead0d8d8b47ab81f0be3dd0f5c4a7ad87
SSDEEP 6144:CflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:CflfAsiVGjSGecvX
TLSH
T139747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kidaysnlid.exe

Path C:\Temp\kidaysnlid.exe
Size 361KB
SHA256 e61817cc75ce167cee0538077fbe52d4b98e18eb8589fd1a40f6d29332c6be91
MD5 1dce7b31487ea76183ebac8d8545178b
SHA1 90948ef70fa51875a369c880993de9de0422d21f
SHA512 37936000c07747792e6e5a92b7b58742b0ba706c84373edb1a57513e35e58de630175230b0907e6bc306f8b4133dd9e4949b66fe989476057bf338012f212615
SSDEEP 6144:oflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:oflfAsiVGjSGecvX
TLSH
T13A747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nifdxvpnif.exe

Path C:\Temp\nifdxvpnif.exe
Size 361KB
SHA256 21823e8f4afdcde0a708039fd44a09f399de1b1c6ec6403ed6b43ef629f210f9
MD5 b9757446c29f6af773257f55cb185fc5
SHA1 bf2b443da8b666e09aa609cf1767cd3717106c95
SHA512 2ab50de99ccd3112615a9200d31d2c26eb97ee75f35907009d88c1cf0510961ecdaba8ff3f7e72f0306e68b6fbe7bf06ad88898a1cff1be9c42b2c58bfa4030f
SSDEEP 6144:VflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:VflfAsiVGjSGecvX
TLSH
T1BC747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkidavtnlf.sys

Path C:\Temp\qkidavtnlf.sys
Size 293KB
SHA256 9af2ab3520e2483cf54d7b198310fe443fc52f77804efc477d55325c458d5183
MD5 bef1285c7f0d5a7a1be97f65f35be97b
SHA1 a87bbd4a0e106093f8b26a0ab40c6586151ca917
SHA512 2477ff24a47d406f7483127c476b9a807fcda938ad04c964af941566e0ae805a6ef7c1c423436fb09814f7181b3465eb657598b769f4243686c706bba2feded3
SSDEEP 3072:ftKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:fIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C9545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqljdbvtnl.exe

Path C:\Temp\tqljdbvtnl.exe
Size 361KB
SHA256 785793e81ad55648643c48a0242ddbf0de932a031bd7e75044f9b80d5906159c
MD5 50ea416bf1fc0e0eb909a4ce1ff9d90c
SHA1 1d065cc53fc73350848c12f9177dc04c2a339e9e
SHA512 f04553c247ae6b9318034603c8f04ec28b489238a542630f025b35bcfd2ae2b7a2fbe04f001aacf5be87cb3f37da332d959aba2c91f00ba8d6f89b7dd0f84459
SSDEEP 6144:ZflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:ZflfAsiVGjSGecvX
TLSH
T188747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqljdbvtnl.sys

Path C:\Temp\tqljdbvtnl.sys
Size 293KB
SHA256 d0d86b51bc38509a2ded563bdd5570cf0815f21ed695eb13e93a14d7030ee995
MD5 a339b3e6ac295a919e3443a55b507997
SHA1 811bc51a780662c9fe8209f6caf963fb6845fbd1
SHA512 9e51afd44f8fb94abad1307fd2b6ee369666df0c5ee1fe0118afa8b667a72d2246fc5a578778d8fc8bdbac0e167dada7c9e52fbfc80c585cadd08af17d47d0ab
SSDEEP 3072:qtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:qIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C0545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uomgeywuom.exe

Path C:\Temp\uomgeywuom.exe
Size 361KB
SHA256 7805446398c2b79fc97a1d994d97fe0b79568d83edd6df8d39a5c2bff1d0834f
MD5 77c918f581b9474a4dccccd99a0f7d4e
SHA1 c10fd1d3a76b96ecb6216166640ea843f4e07cd5
SHA512 2f4b1d12f6f07713a74c34d96b9b943bdc0c64cdcf2143be5c396ca4954343c0242e69b41261ca98281f9159f24cd0384f9f8a5845892ad3d176d8bf585665af
SSDEEP 6144:PflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:PflfAsiVGjSGecvX
TLSH
T12E747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqojgbztrl.exe

Path C:\Temp\wqojgbztrl.exe
Size 361KB
SHA256 55ad02c07d44c7991a03e378da1a766a4c052137b2a4c1ff2c84a3aeed191464
MD5 73587a7b45139c852e2cecd2fc523799
SHA1 fcb66597728afa959396365f5a32f89d91e72ee6
SHA512 99be42c1306e22533265b527ada9472f40cc2fef3a697858fc5dcf4413b7c9fe8808b5d992f0b2fc01078936ac76b52f3ea240e22d1053a5fba4014cc790cc3f
SSDEEP 6144:jflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:jflfAsiVGjSGecvX
TLSH
T1EB747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtoljgbywt.sys

Path C:\Temp\wtoljgbywt.sys
Size 293KB
SHA256 2fe934007caa411e49b954e0a05a312d82324f4a0c79a3295c070945b8b0a773
MD5 65327118da259b0bfc535ff20219b67a
SHA1 bd1d11391c5ef53b74d7cdf5b67c61f792fb1ec4
SHA512 63b17406cf204ae69f8c586e8348d3e954e486cfac6ddd6be81e32ae4b3e563e2aea6f7e90a2034d5c16e78f48980044f09285aebb922a04e96c487a06a08293
SSDEEP 3072:NtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:NIJjiJcbI03GBc3ucY5DCSj
TLSH
T136545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytqlidaysq.sys

Path C:\Temp\ytqlidaysq.sys
Size 293KB
SHA256 418837854b7a60f790e047d6aaf9c230629d22f22facaf034f50abd0929b117b
MD5 9cea98f04023b92e644ee9087a9392fd
SHA1 41190367db9ec5e888763521948cec878bf5512c
SHA512 021928bc219009a669ff468ceccfcda2f759635fb82658d418ed459f10f6fea3591608458840a45ee5c43206359d800cbf4e10d44a0734e0b7dd1c93251bc14f
SSDEEP 3072:UtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:UIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D6545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrmjebztr.sys

Path C:\Temp\ztrmjebztr.sys
Size 293KB
SHA256 d6c20fc8c8f754c0eb3bc05317abe94153cabfc1353792e28713b06161ca59a8
MD5 fe0dc78186cc63aecc6df9ccc3a27656
SHA1 bb87a166e74f69970ab6b2e5eb21445052d558e9
SHA512 a2f47af10b03ed734e58a712d124738b7d08c75ebae4740608a3e40da252f77df1de61bf8818d61ce03cd3636a2f8730cfb50c5be3a4a49acbc638c6100e5cfb
SSDEEP 3072:ZtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:ZIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E5545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

17ee2fe2-8a85-4378-bba8-660c7a87f66a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\17ee2fe2-8a85-4378-bba8-660c7a87f66a.tmp
Size 38KB
SHA256 5c6589d2ec2d4316b63e6245ee750e4d3d0c75466ffd883457751a0910b9491d
MD5 8d4300ad522dc63a48b1c908e93f4adc
SHA1 55daab8c22ac6b9b7d5f7d70ce307654976876f8
SHA512 228ff5eefc2ca6ebab53381a58252dd73c4d61c32fdee42d518fddd625f71cfbe331301bfda1cb85b0eb39a70ee77ad31178c6fc27f74958a8249aa8d05a21a6
SSDEEP 768:P/UxvxjgC+H3L0TOySBo/9OA9at01j0iq00+IaXHSHxRz:iZj3+H3L3DCHq00Na3STz
TLSH
T1F503C030ECB5DD63ADE6B284730A63C79FF41563C5C65A908AF92A0D05476AD270B863
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2134bd9b-9474-4b97-b363-688e21d37ecc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2134bd9b-9474-4b97-b363-688e21d37ecc.tmp
Size 39KB
SHA256 88a8bf6ab6c4801d138375f53ae8c6a75e1d69742dd6c9d287926b5d0ac13f53
MD5 86055f4724056a64246c615fb68c7ffc
SHA1 140139392c004df3b26ecae88d680df5d43273fe
SHA512 d9390431aae6cb7fcf7e5e1da17f09fdf77ff50c25104c4644068102ad5032b299cda42aa39bdda27896e374bcd45688fd9ba30e44acc678ef0def4f61e2d26c
SSDEEP 768:I/UxvxjgC+B3Nx1OySBe/9OA9at01j0iq00+IaiHPn:VZj3+B3NYdCHq00NawPn
TLSH
T17103BF31BCB59D63ACE6B295730A2387AFF81563C5C95E9089E91E0D05473DE2B0BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

44521b61-1b17-4b02-96bf-dc9cefae007a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\44521b61-1b17-4b02-96bf-dc9cefae007a.tmp
Size 37KB
SHA256 9f512a24302efcfe4605b01c5f37c69526bb3e99b49b1db51a68f073688bb009
MD5 ac68a6f28f8986b326ab2b107599889a
SHA1 4543164c8d78d68d62351a1805a0a6c2e044e339
SHA512 45449b5633602778d36bb4e032f0d00fd5a3ecd22547c26b25332fcd62ae50d3ca0a7da1c21859263c7b0badae68a97fc840da911f875f20c598a6e6c73c993e
SSDEEP 768:X/UxvxjgC+H3FdGOySR/9OA9at01j0iq00+Ia2cSHxRz:KZj3+H3Fp+CHq00NaPSTz
TLSH
T13103C031ECA49D779CF7B384730A63979FF44663C6C96A904AED2A0E01876AD1307C67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8dcb1203-d429-4ee0-9e33-0c9282216342.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8dcb1203-d429-4ee0-9e33-0c9282216342.tmp
Size 42KB
SHA256 6654b4c6bb7e62d01b2d07c8ae4f19699442c5fdd0e56fe54521b1fbda270069
MD5 ace2c887dd361028cde4e5573d785f96
SHA1 333c96a922b89ea84472840517f9d22965f5ec32
SHA512 4798132d3c8ed720d33bf301ebd34efacb5582af04c006c6ded9f934c06ce0e8108fa8417600b166b271d78854a26f587fb98fcc22dddb4fb7af3c3a91f45875
SSDEEP 768:iFdT3Iwgwb7IOySBr/9OA9at01j0iq00+IaiHGJCbETcL8:yT3/VuCHq00NawICbzY
TLSH
T1E11318F198E3CA77E9AE5783633D2E469EBCD153B5885980BB951D0CCC421BFD70A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9d43b3fc-ec2d-4a05-841a-478efebc2f6b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9d43b3fc-ec2d-4a05-841a-478efebc2f6b.tmp
Size 34KB
SHA256 49110256c55736cb0a0a45497b1f0dde0cbce3ff8f8a74403c2937c6a79df866
MD5 6144606a0b29c5f805c0a5bd433c8c1d
SHA1 a098fe4be431f49fabc776b37d12639ca31f7df7
SHA512 7eac4920cc3041432761542365622744d3083a4028cf55b81eb05b8f34e270ab8cdca567f142340dc904bf025b75fc33f3eed8af284b5c62e6fa057c4f188f44
SSDEEP 768:it31n1OySBe/9OA9at01j0iq00+IaiHGJCbETcL8:it312dCHq00NawICbzY
TLSH
T1DEF2AF70ECB5DE639DE7B685B31A33869FE45127C5C94F80C9EA5A1D004729E2B0BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fc0a38b9bd67def6f8a6da7a4a5956bc201e5aac4ba6f906946e52f5b14e13c2
MD5 1f96c275206494cbaa7386b7e675b940
SHA1 e11ab12226c05e6b54c67a266c2f75cfeb24b04a
SHA512 a117c9e9ceb3447431daa46611f5c54ed75796456b4251af5e1ed3f62b5c6cbe9ebccf949569237178ca2ca7feba8c9acb69940a8457c36a9156ef8fd98eb09c
TLSH
T188D02B3671684D13E0805278007111613882F405DF0601C01322982609902483010180
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0d0352bb5f4b47f3d1ca8042212dfbae37957031d48d7789bd6cd7b4b6cbbe31
MD5 32b3e4b238ee2f76e0152ca1b1ff9944
SHA1 78d56bdababf57c069ac4ad713ad9cdc3e3f04a0
SHA512 3e7b72969f35c769b07f0760fb1a06022e37e68e88be1bff45e02463b5358a671e4f84f6bad11b043a01370573d062084b864866961ee86cb12eceb980874f69
TLSH
T178D02B3A71584E13E0805274007011613892F405EF0601C01322581609902483011184
MD5 SHA1 SHA512 TLSH

Submit Download

4f6fdbd4-3d7c-45af-a876-57f3dff93bfd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4f6fdbd4-3d7c-45af-a876-57f3dff93bfd.tmp
Size 29KB
SHA256 cff02210fa6d1b924bced6d65bc5271421a7a80cd5bcfe942523ab2e1ed07d96
MD5 7d8e86ce876258e9774eeb4277e6884c
SHA1 6c752e72dd8f3cc444439f24d429de8e777bebad
SHA512 0389eced45153f407fbd3da5e2b36ce0b513d4de1bc381283f3b06d4108f7b79f30deb885336374730c113c1dcb4bd656bd0fb16038e8dfd544db8c7bc9d7b9b
SSDEEP 768:p/wWQO7pLuLbOnWg/Xf1p8F1+UoAYDCx9Tuqh0VfUC9xbog/OVx9XH3IrroO7jQ:p/wWQOEbOnWg/Xf1pu1jau9XXIYO7jQ
TLSH
T15FD2D97B740CCA7F4F804ADDDC197E9E6DA802CB9698CD8047FA985C02C67EA52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

69e59aa4-29d9-4a0a-b8bf-893d824995cc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\69e59aa4-29d9-4a0a-b8bf-893d824995cc.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9a812109-f7c8-4838-857c-61f401e5340f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9a812109-f7c8-4838-857c-61f401e5340f.tmp
Size 11KB
SHA256 a17fe81bafabede9b6c0bdb10c933c3ee0716bb5088d8382687b8421c8c16183
MD5 a446f1b6ab642d9a75a1539dc83e1ff2
SHA1 93b3d94ec052330f83e60f0c05bef9d26bba5ec5
SHA512 60ba071b04aeedffed0e22a4d2ed42d6b8026a3e07dd6f37c35d48f93d507e953b4f4c5f98e37e4f5f2b3fa7ec55154cb6c5f12ed88bbbbae00ece2d65c58645
SSDEEP 192:sxRcRYCs/f1sG2eZKlzoA8p9Py/g6+WNCyIf/YoEx4GvMIgVdJ:sxRcNs/f1sG2Y35y/5tM/eQ5
TLSH
T1DF32D915AD28A97B4CCBD21DFB65BF53D2FC5032A0D51E48AAFC891C14EA6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 9a5e7221d5bc51974d6b9f0486fa01eb5bba4571184515cb803a3a3cef9dd9d6
MD5 518c98ee97ac16ff91a804c8b84b1d19
SHA1 69fbe9a5a6205ba34c43f4b133ddbe26b62bd536
SHA512 dc03e4fffcf48d1e31283fad71ae499ad74a86b305997d1e79ce039e73f9b3717815ab38928d7b60c0598150e26affc2619644a380862b4e9f282d300102ee51
TLSH
T16FE0268807D8C22EB30C6497417EC34D83807A9BA2D0AE5E3749C68A7145680B6C6694
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 197730ff7379af057a6ae6970380780e2fe38db5fb00318636a6d35d67887ff7
MD5 826fc99039d710b193d1672e454a0e7a
SHA1 6a17bce77864b7f2c457aef84d4fd19a17fa29b1
SHA512 93caae8457563eeb67c4021708081db030a317bda5afcd9d6f63c2ecccac6b955b78fbcc1a7788f18e125b5e9f4f2fe65e74443cd7ead13996fb7d74c4d7d47c
TLSH
T115618447B7B4845DFF58C83065C90C933FB15E9E45A71FA327A8DA796C823617354087
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0afe5da4b594a436d17724a359d34fac66034a21d192a1de38639ace8449d893
MD5 a14175f29488b3bfed9bd849b4b191ee
SHA1 cd2679e892b5e9e6c8348bf32d3f98561ea93c2c
SHA512 7883b33e7e10ffb76cd40fde244788023d47efeab46d69a452a52af3e79ffb2fe3a71b5ac60d38134fd3942beda6f219bb299b10ea047e0412db8b5a279bfaf0
TLSH
T14961B547B7B0845DFF98C83065C90C933FB15E9E45A71FA327A8DA796C823A17354087
MD5 SHA1 SHA512 TLSH

Submit Download

dd59e2b3-4a59-43c6-bd3c-15639e44a6fa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\dd59e2b3-4a59-43c6-bd3c-15639e44a6fa.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

09a23ce9-098b-41ed-bda1-a09e3600073f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\09a23ce9-098b-41ed-bda1-a09e3600073f.tmp
Size 2KB
SHA256 c865d4f30f799d88971d0394e5a33a333aa85960308bdb91eadf69bfb08889d3
MD5 ed5d0439256cad3d13601f74bea5bc75
SHA1 634c92f897077e567ae3d04fa7e1316647d1aa19
SHA512 67e57ab59082b7ad207cf5d9c830eafab8cc16eee088d287a11d05c4c1e102839fbea9784016dc920b4aee83a868c9912e3ff0ef9022766aab5b1f50999905e6
TLSH
T1E041B0F783F8866ECA0196F0AA14AE2FCE2D0514432C7D5AC9E4AE5793E3471E141E5F
MD5 SHA1 SHA512 TLSH

Submit Download

0a2a5e9e-c4a0-46b9-afb8-47e6378ba3fd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0a2a5e9e-c4a0-46b9-afb8-47e6378ba3fd.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

6460e8b9-44ac-4160-8daf-70056d948fcd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6460e8b9-44ac-4160-8daf-70056d948fcd.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 d6dc371cc7b5f18f9b255d52127e032e7ebc0dea37590a5f25bbfbecce175264
MD5 bc501d43a156ea73c8829937546c0ad7
SHA1 9a366292a2a32bf1f53d100fbf107243c520edb5
SHA512 83e53e2c9fcbea2ac5be5c87705d58925af757d6fe3e3e8c55726e0ff918b394b7c3db01f9d3042974b053b4c227e88c598e50bf2d34a8046e3b318e9b5968e5
SSDEEP 48:KU8IbKRaMjyF9IVKGIw2HIdKsE43yp6IvKbq0xLQvr5:KU8oKRaCO9eKGIBHGKsEiq6wKbqV
TLSH
T12AB10270723A0240387D760981D5E72F864231633524EA2B77EE42A3DE7AE4A5DFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aceea5b9-7201-48d3-952f-69afc14fd7e8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\aceea5b9-7201-48d3-952f-69afc14fd7e8.tmp
Size 11KB
SHA256 9298662ae52e4a2ede992cc8314d804adc807c2dad94409b3c8ba3af8ee33618
MD5 6ddb7370c76af5011314530955182ece
SHA1 c7e87c655f4bf21fc9aee5a99371127fc1577d5f
SHA512 2215526f9b919c279b81c50273bf008fa9bcfd3492f9891ab9d81df234ace0378e32ce246460bcefe09773be10d19f21f5b2880eaf07488ef5417c6a901211f2
SSDEEP 192:sxRjRYCs/f1sh2eZKlzoA8p9Py/g6+WNCyIf/YoEx4GvMIgD2dJ:sxRjNs/f1sh2Y35y/5tM/eQQ
TLSH
T1A342D915AE24A97B4CCBD21DFB65BF53D2FC5032A1D11E48AAFC891C14EA6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c6f99e03-e437-4c4c-9709-1030bd7aab4b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c6f99e03-e437-4c4c-9709-1030bd7aab4b.tmp
Size 11KB
SHA256 35bf368575045cee4b132e903f82750266d043f120782f721a139480bb565842
MD5 b67b65e8ede1a5bcbd31be278ec8da91
SHA1 aa163e016b2fa2a4515bfeac826b913b397afaac
SHA512 666116ddc9d3e5be508fcdcf030f1662f6bbd772ecedd0e91819bbd723c758cc1502da1b8b2cc00e9c970eb0e30306806c6016b3c5ef6e5e4ef0ea2c78887606
SSDEEP 192:sxRjRYCs/f1sH2eZKlzoA8p9Py/g6+WNCyIf/Yo234GvMIgDsdJ:sxRjNs/f1sH2Y35y/5tM/YQS
TLSH
T13242D915AD28A97B5CCBD21DBB65BF53D2FC5032A1D11E48A6FC8A1C14EA6DD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e31c3d14-1cc2-4726-92a7-b9d97596f7ae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e31c3d14-1cc2-4726-92a7-b9d97596f7ae.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

a1b16ba8-5215-4994-96fc-09f649e96544.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a1b16ba8-5215-4994-96fc-09f649e96544.tmp
Size 34KB
SHA256 6823e380a998870ba8a1d9946e9f8a8f9d99d2c191b8972cf3522fcbd83db444
MD5 4f461ae3495ff3392e5a5001c75ff491
SHA1 81b502b49569360a2c5c78960a4144a45411a342
SHA512 cceaca7ecfbed94020dc0653c7bce30e2c9363368b8a330c1d0cbda0135be82d99ae5f5e9c7285d2ae47261bf332b7b82b7d881e8721e62d8645ccbb392693c9
SSDEEP 768:lt32n1OySBe/9OA9at01j0iq00+IaiHGJCbETcL8:lt322dCHq00NawICbzY
TLSH
T1A7F2AF70ECB5DE639DE7B685B31A33869FE45127C5C94F80C9EA5A1D004729E2B0BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b6c6a127-a6c0-4a1f-a917-0efe629a89e0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\b6c6a127-a6c0-4a1f-a917-0efe629a89e0.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

e40e051d-5c37-4dad-a492-c2bb04e55f96.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\e40e051d-5c37-4dad-a492-c2bb04e55f96.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

f7f0c78e-ebd2-49fb-93a4-812ee0b14fd4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\f7f0c78e-ebd2-49fb-93a4-812ee0b14fd4.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

6bab7165-dc7e-48ac-b9d4-fd24b4d7c32a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6bab7165-dc7e-48ac-b9d4-fd24b4d7c32a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

4fcbd94e-148d-4755-b2cd-3fed2be32525.tmp

Path C:\Users\Admin\AppData\Local\Temp\4fcbd94e-148d-4755-b2cd-3fed2be32525.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

9fd5c8d5-8ebe-42c0-af2a-707c1918d8fc.tmp

Path C:\Users\Admin\AppData\Local\Temp\9fd5c8d5-8ebe-42c0-af2a-707c1918d8fc.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2468_1501889933\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2468_1357750111\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2468_1486557768\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2468_1798180128\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2468_466974014\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 40370bbafdb4b9028c7c467ba7262a54c84d720ebdf182dd9528e6098ed2fe86
MD5 ac7067ef5319227c5e457ee7581f9571
SHA1 4bc01b4748d19bbbc0a2f93ed9a9740da9bd6276
SHA512 0252ba804c0161f8cff1f6aa228f4c3eca619fbaf2c7ca293a800308b45fd21ac04af5c3d9c541dca71a097120f34c5e8ad6ede8aadc2e20b04f21a3056084b0
TLSH
T1C871238357B9CAF3C1DA5BF402835248F1FB22380B6370340B555546AB30B7E28B9F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/704-449-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1156-476-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1216-455-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2608-320-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2676-331-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2856-271-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3084-498-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3244-409-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3444-366-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3444-388-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3948-296-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4392-243-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4572-480-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4576-437-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4576-451-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4636-194-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4820-333-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4916-283-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5808-417-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5820-386-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5848-62-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5932-336-0x0000000000010000-0x00000000000AB000-memory.dmp

Download