systex | 05c6762f004de66c8acd6f287bc34b0aea7a2406ba3103ae7616d374eec5f498

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/11/2026, 22:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 365KB
Sample261114-2eqavaes6s
SHA256 05c6762f004de66c8acd6f287bc34b0aea7a2406ba3103ae7616d374eec5f498
MD5 f55e4346e0dd34d3ce7b14643e829848
SHA1 731bc91de27c23841ecc87a9b8953e2b5dfe57b5
SHA512 fcd08691c45182c60071da75a2fde0921520332ca8f0b117be50757f5e1fb6190ddd829192d3f74101ed8f30e51ae6bc97c80d92c077f4664176f5eb0ef626f2
SSDEEP 3072:tuxIxtcBOaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:tuxIxtdlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T10C847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
2956	zuojdbwtomgeywto.exe
2488	zuojdbwtomgeywto.sys
5792	CreateProcess.exe
4272	bwtoljgezt.exe
4036	CreateProcess.exe
5856	CreateProcess.exe
5616	i_bwtoljgezt.exe
4252	gaytqoigby.sys
3196	CreateProcess.exe
2500	vtnljgeywq.exe
124	CreateProcess.exe
2644	CreateProcess.exe
2260	i_vtnljgeywq.exe
2560	vqoigaysql.sys
4336	CreateProcess.exe
3100	tqkidavtnl.exe
4828	CreateProcess.exe
5112	CreateProcess.exe
5076	i_tqkidavtnl.exe
2976	nlfdaysqni.sys
1240	CreateProcess.exe
4656	fdxvsqnhfa.exe
5912	CreateProcess.exe
5744	CreateProcess.exe
2400	i_fdxvsqnhfa.exe
4112	kicaxspnif.sys
3748	CreateProcess.exe
4060	fdxsqkifax.exe
3520	CreateProcess.exe
3436	CreateProcess.exe
3092	i_fdxsqkifax.exe
860	hczxspkhcz.sys
2552	CreateProcess.exe
1236	fcxuspkhfc.exe
4696	CreateProcess.exe
5628	CreateProcess.exe
3336	i_fcxuspkhfc.exe
3764	keczurpmhe.sys
5492	CreateProcess.exe
4224	mkhbzwurmh.exe
2544	CreateProcess.exe
5500	CreateProcess.exe
1120	i_mkhbzwurmh.exe
4716	cwurmkecwu.sys
4544	CreateProcess.exe
3372	ljebztrmje.exe
5732	CreateProcess.exe
4936	CreateProcess.exe
5064	i_ljebztrmje.exe
4196	ztrljebywr.sys
3700	CreateProcess.exe
772	ztrljdbwto.exe
1584	CreateProcess.exe
5068	CreateProcess.exe
5396	i_ztrljdbwto.exe
3460	tqoigbywro.sys
2604	CreateProcess.exe
3784	qljdbytrli.exe
1900	CreateProcess.exe
3288	CreateProcess.exe
3296	i_qljdbytrli.exe
4848	vtnljdbvtn.sys
4760	CreateProcess.exe
4456	tqljdavtnl.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5336_1804292302\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5336_1052786492\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5336_1780292765\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5336_1780292765\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5336_1247076001\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5336_1247076001\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5336_1247076001\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5336_1052786492\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5336_1247076001\llm_user_input_extractor_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcxuspkhfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrljdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsmhfcxvpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wupmhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecomgeczur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qljdbytrli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztomgeywt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtoljgezt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtoljgezt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvsqnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kifayvqnig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kifayvqnig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzwrpjhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zuojdbwtomgeywto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnljgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvsqnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxsqkifax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wupmhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlidbytqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnljgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkhbzwurmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qljdbytrli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqljdavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzwrpjhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eyvtnligby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqkidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxsqkifax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkhbzwurmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsmhfcxvpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eyvtnligby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlidbytqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljebztrmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljebztrmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqkidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcxuspkhfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrljdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqljdavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecomgeczur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztomgeywt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4688	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5408	ipconfig.exe
4692	ipconfig.exe
4052	ipconfig.exe
4788	ipconfig.exe
4276	ipconfig.exe
204	ipconfig.exe
5092	ipconfig.exe
3668	ipconfig.exe
2692	ipconfig.exe
4452	ipconfig.exe
3888	ipconfig.exe
4332	ipconfig.exe
3016	ipconfig.exe
1256	ipconfig.exe
5796	ipconfig.exe
4196	ipconfig.exe
2456	ipconfig.exe
5496	ipconfig.exe
2556	ipconfig.exe
4016	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4154726816-2055034831-2297277433-1000\{069A9E16-5742-43FD-B5C1-52BDC6DAE2E2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2956	zuojdbwtomgeywto.exe
2956	zuojdbwtomgeywto.exe
2956	zuojdbwtomgeywto.exe
2956	zuojdbwtomgeywto.exe
2956	zuojdbwtomgeywto.exe
2956	zuojdbwtomgeywto.exe
2956	zuojdbwtomgeywto.exe
2956	zuojdbwtomgeywto.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5336	msedge.exe
5336	msedge.exe
5336	msedge.exe
5336	msedge.exe
5336	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	5616	i_bwtoljgezt.exe
Token: SeDebugPrivilege	2260	i_vtnljgeywq.exe
Token: SeDebugPrivilege	5076	i_tqkidavtnl.exe
Token: SeDebugPrivilege	2400	i_fdxvsqnhfa.exe
Token: SeDebugPrivilege	3092	i_fdxsqkifax.exe
Token: SeDebugPrivilege	3336	i_fcxuspkhfc.exe
Token: SeDebugPrivilege	1120	i_mkhbzwurmh.exe
Token: SeDebugPrivilege	5064	i_ljebztrmje.exe
Token: SeDebugPrivilege	5396	i_ztrljdbwto.exe
Token: SeDebugPrivilege	3296	i_qljdbytrli.exe
Token: SeDebugPrivilege	4428	i_tqljdavtnl.exe
Token: SeDebugPrivilege	3268	i_kifayvqnig.exe
Token: SeDebugPrivilege	620	i_xspnlfdxvq.exe
Token: SeDebugPrivilege	5352	i_vsmhfcxvpk.exe
Token: SeDebugPrivilege	712	i_wupmhfzxrp.exe
Token: SeDebugPrivilege	5160	i_ecomgeczur.exe
Token: SeDebugPrivilege	3868	i_bzwrpjhbzt.exe
Token: SeDebugPrivilege	1120	i_bztomgeywt.exe
Token: SeDebugPrivilege	5380	i_eyvtnligby.exe
Token: SeDebugPrivilege	4956	i_nlidbytqli.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5336	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6112 wrote to memory of 2956	6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	88
PID 6112 wrote to memory of 5128	6112	2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	89
PID 5128 wrote to memory of 5336	5128	iexplore.exe	90
PID 5336 wrote to memory of 2320	5336	msedge.exe	91
PID 5336 wrote to memory of 4688	5336	msedge.exe	93
PID 5336 wrote to memory of 4904	5336	msedge.exe	95
PID 5336 wrote to memory of 4904	5336	msedge.exe	95
PID 5336 wrote to memory of 3048	5336	msedge.exe	96
PID 5336 wrote to memory of 3048	5336	msedge.exe	96
PID 5336 wrote to memory of 1432	5336	msedge.exe	97
PID 5336 wrote to memory of 3048	5336	msedge.exe	96
PID 5336 wrote to memory of 1432	5336	msedge.exe	97
PID 5336 wrote to memory of 1432	5336	msedge.exe	97
PID 5336 wrote to memory of 5604	5336	msedge.exe	94
PID 5336 wrote to memory of 5604	5336	msedge.exe	94
PID 5336 wrote to memory of 5604	5336	msedge.exe	94
PID 5336 wrote to memory of 2028	5336	msedge.exe	98
PID 5336 wrote to memory of 4540	5336	msedge.exe	99
PID 5336 wrote to memory of 2028	5336	msedge.exe	98
PID 5336 wrote to memory of 2028	5336	msedge.exe	98
PID 5336 wrote to memory of 4540	5336	msedge.exe	99
PID 5336 wrote to memory of 4540	5336	msedge.exe	99
PID 5336 wrote to memory of 1320	5336	msedge.exe	100
PID 5336 wrote to memory of 1320	5336	msedge.exe	100
PID 5336 wrote to memory of 1576	5336	msedge.exe	103
PID 5336 wrote to memory of 3948	5336	msedge.exe	104
PID 5336 wrote to memory of 1576	5336	msedge.exe	103
PID 5336 wrote to memory of 3948	5336	msedge.exe	104
PID 2956 wrote to memory of 5792	2956	zuojdbwtomgeywto.exe	106
PID 4272 wrote to memory of 4036	4272	bwtoljgezt.exe	109
PID 5336 wrote to memory of 772	5336	msedge.exe	113
PID 5336 wrote to memory of 5628	5336	msedge.exe	116
PID 5336 wrote to memory of 5628	5336	msedge.exe	116
PID 5336 wrote to memory of 4608	5336	msedge.exe	117
PID 5336 wrote to memory of 4608	5336	msedge.exe	117
PID 2956 wrote to memory of 5856	2956	zuojdbwtomgeywto.exe	119
PID 2956 wrote to memory of 3196	2956	zuojdbwtomgeywto.exe	123
PID 2500 wrote to memory of 124	2500	vtnljgeywq.exe	125
PID 2956 wrote to memory of 2644	2956	zuojdbwtomgeywto.exe	128
PID 2956 wrote to memory of 4336	2956	zuojdbwtomgeywto.exe	132
PID 3100 wrote to memory of 4828	3100	tqkidavtnl.exe	134
PID 2956 wrote to memory of 5112	2956	zuojdbwtomgeywto.exe	137
PID 2956 wrote to memory of 1240	2956	zuojdbwtomgeywto.exe	141
PID 4656 wrote to memory of 5912	4656	fdxvsqnhfa.exe	143
PID 2956 wrote to memory of 5744	2956	zuojdbwtomgeywto.exe	147
PID 5336 wrote to memory of 5952	5336	msedge.exe	149
PID 5336 wrote to memory of 3396	5336	msedge.exe	150
PID 5336 wrote to memory of 3260	5336	msedge.exe	151
PID 2956 wrote to memory of 3748	2956	zuojdbwtomgeywto.exe	154
PID 4060 wrote to memory of 3520	4060	fdxsqkifax.exe	156
PID 2956 wrote to memory of 3436	2956	zuojdbwtomgeywto.exe	159
PID 2956 wrote to memory of 2552	2956	zuojdbwtomgeywto.exe	163
PID 1236 wrote to memory of 4696	1236	fcxuspkhfc.exe	165
PID 2956 wrote to memory of 5628	2956	zuojdbwtomgeywto.exe	168
PID 2956 wrote to memory of 5492	2956	zuojdbwtomgeywto.exe	172
PID 4224 wrote to memory of 2544	4224	mkhbzwurmh.exe	174
PID 2956 wrote to memory of 5500	2956	zuojdbwtomgeywto.exe	177
PID 2956 wrote to memory of 4544	2956	zuojdbwtomgeywto.exe	181
PID 3372 wrote to memory of 5732	3372	ljebztrmje.exe	183
PID 2956 wrote to memory of 4936	2956	zuojdbwtomgeywto.exe	186
PID 5336 wrote to memory of 2296	5336	msedge.exe	188
PID 5336 wrote to memory of 2296	5336	msedge.exe	188
PID 2956 wrote to memory of 3700	2956	zuojdbwtomgeywto.exe	194
PID 772 wrote to memory of 1584	772	ztrljdbwto.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-14_f55e4346e0dd34d3ce7b14643e829848_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6112
- C:\Temp\zuojdbwtomgeywto.exe
  C:\Temp\zuojdbwtomgeywto.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bwtoljgezt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5792
  - - C:\Temp\bwtoljgezt.exe
      C:\Temp\bwtoljgezt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4272
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4036
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5496
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bwtoljgezt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5856
  - - C:\Temp\i_bwtoljgezt.exe
      C:\Temp\i_bwtoljgezt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5616
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnljgeywq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3196
  - - C:\Temp\vtnljgeywq.exe
      C:\Temp\vtnljgeywq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2500
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:124
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4276
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnljgeywq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2644
  - - C:\Temp\i_vtnljgeywq.exe
      C:\Temp\i_vtnljgeywq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqkidavtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4336
  - - C:\Temp\tqkidavtnl.exe
      C:\Temp\tqkidavtnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3100
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4828
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2556
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqkidavtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5112
  - - C:\Temp\i_tqkidavtnl.exe
      C:\Temp\i_tqkidavtnl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5076
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdxvsqnhfa.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1240
  - - C:\Temp\fdxvsqnhfa.exe
      C:\Temp\fdxvsqnhfa.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4656
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5912
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4016
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdxvsqnhfa.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5744
  - - C:\Temp\i_fdxvsqnhfa.exe
      C:\Temp\i_fdxvsqnhfa.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2400
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdxsqkifax.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3748
  - - C:\Temp\fdxsqkifax.exe
      C:\Temp\fdxsqkifax.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4060
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3520
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3888
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdxsqkifax.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3436
  - - C:\Temp\i_fdxsqkifax.exe
      C:\Temp\i_fdxsqkifax.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fcxuspkhfc.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2552
  - - C:\Temp\fcxuspkhfc.exe
      C:\Temp\fcxuspkhfc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1236
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4696
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:204
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fcxuspkhfc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5628
  - - C:\Temp\i_fcxuspkhfc.exe
      C:\Temp\i_fcxuspkhfc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3336
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkhbzwurmh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5492
  - - C:\Temp\mkhbzwurmh.exe
      C:\Temp\mkhbzwurmh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4224
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2544
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5408
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkhbzwurmh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5500
  - - C:\Temp\i_mkhbzwurmh.exe
      C:\Temp\i_mkhbzwurmh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljebztrmje.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4544
  - - C:\Temp\ljebztrmje.exe
      C:\Temp\ljebztrmje.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3372
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5732
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljebztrmje.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4936
  - - C:\Temp\i_ljebztrmje.exe
      C:\Temp\i_ljebztrmje.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ztrljdbwto.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3700
  - - C:\Temp\ztrljdbwto.exe
      C:\Temp\ztrljdbwto.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:772
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1584
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4692
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ztrljdbwto.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5068
  - - C:\Temp\i_ztrljdbwto.exe
      C:\Temp\i_ztrljdbwto.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5396
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qljdbytrli.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2604
  - - C:\Temp\qljdbytrli.exe
      C:\Temp\qljdbytrli.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3784
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1900
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qljdbytrli.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3288
  - - C:\Temp\i_qljdbytrli.exe
      C:\Temp\i_qljdbytrli.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3296
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqljdavtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4760
  - - C:\Temp\tqljdavtnl.exe
      C:\Temp\tqljdavtnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4456
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5668
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3016
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqljdavtnl.exe ups_ins
    3⤵
    PID:1324
  - - C:\Temp\i_tqljdavtnl.exe
      C:\Temp\i_tqljdavtnl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4428
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kifayvqnig.exe ups_run
    3⤵
    PID:1608
  - - C:\Temp\kifayvqnig.exe
      C:\Temp\kifayvqnig.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2892
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5896
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kifayvqnig.exe ups_ins
    3⤵
    PID:120
  - - C:\Temp\i_kifayvqnig.exe
      C:\Temp\i_kifayvqnig.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3268
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xspnlfdxvq.exe ups_run
    3⤵
    PID:4140
  - - C:\Temp\xspnlfdxvq.exe
      C:\Temp\xspnlfdxvq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2284
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4020
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2456
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xspnlfdxvq.exe ups_ins
    3⤵
    PID:5796
  - - C:\Temp\i_xspnlfdxvq.exe
      C:\Temp\i_xspnlfdxvq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:620
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vsmhfcxvpk.exe ups_run
    3⤵
    PID:5172
  - - C:\Temp\vsmhfcxvpk.exe
      C:\Temp\vsmhfcxvpk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4492
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3336
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4452
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vsmhfcxvpk.exe ups_ins
    3⤵
    PID:1520
  - - C:\Temp\i_vsmhfcxvpk.exe
      C:\Temp\i_vsmhfcxvpk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wupmhfzxrp.exe ups_run
    3⤵
    PID:4080
  - - C:\Temp\wupmhfzxrp.exe
      C:\Temp\wupmhfzxrp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1412
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:984
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wupmhfzxrp.exe ups_ins
    3⤵
    PID:4184
  - - C:\Temp\i_wupmhfzxrp.exe
      C:\Temp\i_wupmhfzxrp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:712
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecomgeczur.exe ups_run
    3⤵
    PID:6036
  - - C:\Temp\ecomgeczur.exe
      C:\Temp\ecomgeczur.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2688
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5328
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4052
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecomgeczur.exe ups_ins
    3⤵
    PID:5460
  - - C:\Temp\i_ecomgeczur.exe
      C:\Temp\i_ecomgeczur.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5160
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bzwrpjhbzt.exe ups_run
    3⤵
    PID:3348
  - - C:\Temp\bzwrpjhbzt.exe
      C:\Temp\bzwrpjhbzt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5540
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3992
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4788
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bzwrpjhbzt.exe ups_ins
    3⤵
    PID:1604
  - - C:\Temp\i_bzwrpjhbzt.exe
      C:\Temp\i_bzwrpjhbzt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3868
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bztomgeywt.exe ups_run
    3⤵
    PID:3432
  - - C:\Temp\bztomgeywt.exe
      C:\Temp\bztomgeywt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2248
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3400
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bztomgeywt.exe ups_ins
    3⤵
    PID:1304
  - - C:\Temp\i_bztomgeywt.exe
      C:\Temp\i_bztomgeywt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eyvtnligby.exe ups_run
    3⤵
    PID:1408
  - - C:\Temp\eyvtnligby.exe
      C:\Temp\eyvtnligby.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2128
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4872
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eyvtnligby.exe ups_ins
    3⤵
    PID:4984
  - - C:\Temp\i_eyvtnligby.exe
      C:\Temp\i_eyvtnligby.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlidbytqli.exe ups_run
    3⤵
    PID:1404
  - - C:\Temp\nlidbytqli.exe
      C:\Temp\nlidbytqli.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2460
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3064
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2692
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlidbytqli.exe ups_ins
    3⤵
    PID:5892
  - - C:\Temp\i_nlidbytqli.exe
      C:\Temp\i_nlidbytqli.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4956
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffb4c7ec188,0x7ffb4c7ec194,0x7ffb4c7ec1a0
      4⤵
      PID:2320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2152,i,17451033840213801424,6726967097737019259,524288 --field-trial-handle=2884,i,6096035474670596078,11852714662255446374,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:11
      4⤵
      System Time Discovery
      PID:4688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1960,i,8082334863011229441,16391096721248813601,262144 --field-trial-handle=2884,i,6096035474670596078,11852714662255446374,262144 --variations-seed-version --mojo-platform-channel-handle=2820 /prefetch:2
      4⤵
      PID:5604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,4088857156050009190,12396310347378361893,524288 --field-trial-handle=2884,i,6096035474670596078,11852714662255446374,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:13
      4⤵
      PID:4904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,10969171645092784875,7495572019080222819,2097152 --field-trial-handle=2884,i,6096035474670596078,11852714662255446374,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
      4⤵
      PID:3048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,13100602988782404161,5004619807510874343,2097152 --field-trial-handle=2884,i,6096035474670596078,11852714662255446374,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
      4⤵
      PID:1432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,17605310751327279524,9181790176810214388,2097152 --field-trial-handle=2884,i,6096035474670596078,11852714662255446374,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:9
      4⤵
      PID:2028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,11496796708490610002,7329013168536001219,2097152 --field-trial-handle=2884,i,6096035474670596078,11852714662255446374,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
      4⤵
      PID:4540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,6005980792472438391,16609426197987722336,524288 --field-trial-handle=2884,i,6096035474670596078,11852714662255446374,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:14
      4⤵
      PID:1320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,13852527972387304276,13709028958354685482,524288 --field-trial-handle=2884,i,6096035474670596078,11852714662255446374,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
      4⤵
      PID:1576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,4650937980495164859,2398818343478272736,524288 --field-trial-handle=2884,i,6096035474670596078,11852714662255446374,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:14
      4⤵
      PID:3948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,9389411720755730186,3202540375038385467,524288 --field-trial-handle=2884,i,6096035474670596078,11852714662255446374,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
      4⤵
      PID:2596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,9389411720755730186,3202540375038385467,524288 --field-trial-handle=2884,i,6096035474670596078,11852714662255446374,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
      4⤵
      PID:772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,9702929168424029549,10998128277698622880,524288 --field-trial-handle=2884,i,6096035474670596078,11852714662255446374,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
      4⤵
      PID:5628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,16421257456267976518,13910116904281660349,524288 --field-trial-handle=2884,i,6096035474670596078,11852714662255446374,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
      4⤵
      PID:4608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4584,i,8306890347484548016,9703504699306542436,524288 --field-trial-handle=2884,i,6096035474670596078,11852714662255446374,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:14
      4⤵
      PID:5952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4664,i,6624497501274799257,2244832675882056372,524288 --field-trial-handle=2884,i,6096035474670596078,11852714662255446374,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:14
      4⤵
      PID:3396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4668,i,6393594237759679726,17154400911031330127,524288 --field-trial-handle=2884,i,6096035474670596078,11852714662255446374,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:14
      4⤵
      PID:3260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4256,i,7160731378705197162,2088379946386619460,524288 --field-trial-handle=2884,i,6096035474670596078,11852714662255446374,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
      4⤵
      PID:2296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,8154772578738553666,13185468819353518723,524288 --field-trial-handle=2884,i,6096035474670596078,11852714662255446374,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:14
      4⤵
      PID:5172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,3729146289177797896,4942686329259367916,524288 --field-trial-handle=2884,i,6096035474670596078,11852714662255446374,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
      4⤵
      PID:5160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,1396572553499783501,5631218920513333040,524288 --field-trial-handle=2884,i,6096035474670596078,11852714662255446374,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
      4⤵
      PID:3180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5556,i,5639251053011394950,14914853276361115046,262144 --field-trial-handle=2884,i,6096035474670596078,11852714662255446374,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:10
      4⤵
      PID:3320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3488,i,8550837200417366722,18202412078112719882,524288 --field-trial-handle=2884,i,6096035474670596078,11852714662255446374,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:14
      4⤵
      PID:4240

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2744

C:\Temp\zuojdbwtomgeywto.sys
C:\Temp\zuojdbwtomgeywto.sys
1⤵
- Executes dropped EXE
PID:2488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:928

C:\Temp\gaytqoigby.sys
C:\Temp\gaytqoigby.sys
1⤵
- Executes dropped EXE
PID:4252

C:\Temp\vqoigaysql.sys
C:\Temp\vqoigaysql.sys
1⤵
- Executes dropped EXE
PID:2560

C:\Temp\nlfdaysqni.sys
C:\Temp\nlfdaysqni.sys
1⤵
- Executes dropped EXE
PID:2976

C:\Temp\kicaxspnif.sys
C:\Temp\kicaxspnif.sys
1⤵
- Executes dropped EXE
PID:4112

C:\Temp\hczxspkhcz.sys
C:\Temp\hczxspkhcz.sys
1⤵
- Executes dropped EXE
PID:860

C:\Temp\keczurpmhe.sys
C:\Temp\keczurpmhe.sys
1⤵
- Executes dropped EXE
PID:3764

C:\Temp\cwurmkecwu.sys
C:\Temp\cwurmkecwu.sys
1⤵
- Executes dropped EXE
PID:4716

C:\Temp\ztrljebywr.sys
C:\Temp\ztrljebywr.sys
1⤵
- Executes dropped EXE
PID:4196

C:\Temp\tqoigbywro.sys
C:\Temp\tqoigbywro.sys
1⤵
- Executes dropped EXE
PID:3460

C:\Temp\vtnljdbvtn.sys
C:\Temp\vtnljdbvtn.sys
1⤵
- Executes dropped EXE
PID:4848

C:\Temp\vtqkigdyvq.sys
C:\Temp\vtqkigdyvq.sys
1⤵
PID:2984

C:\Temp\ysqkicavsn.sys
C:\Temp\ysqkicavsn.sys
1⤵
PID:672

C:\Temp\axsqkicaus.sys
C:\Temp\axsqkicaus.sys
1⤵
PID:1556

C:\Temp\xrpjhfzxrp.sys
C:\Temp\xrpjhfzxrp.sys
1⤵
PID:4968

C:\Temp\eczupmhecw.sys
C:\Temp\eczupmhecw.sys
1⤵
PID:5380

C:\Temp\bzwrpjhbzw.sys
C:\Temp\bzwrpjhbzw.sys
1⤵
PID:204

C:\Temp\dbztrljebw.sys
C:\Temp\dbztrljebw.sys
1⤵
PID:4452

C:\Temp\ljdbvtroig.sys
C:\Temp\ljdbvtroig.sys
1⤵
PID:5696

C:\Temp\qoigdyvtqo.sys
C:\Temp\qoigdyvtqo.sys
1⤵
PID:4712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bwtoljgezt.exe

Path C:\Temp\bwtoljgezt.exe
Size 365KB
SHA256 ea9af9f0b9c2279d6f22e848039858b3e54832b7e52b260e90c95862f0a34996
MD5 4786d9ef0d83ecc7d1d001b82650feb1
SHA1 c34ede2c6f3f4f3d64899c7a0237cfe0b24ab7fb
SHA512 29735c5b9594580ef6e4f2dc76d48b1760b2cfc81c616465e5e29bdc33bcf931e502b458453beb84c27c36f5d85887ec840656ecdd587b4e09e62f6dfbbc34f9
SSDEEP 3072:fuxIxtcBOaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:fuxIxtdlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D9847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcxuspkhfc.exe

Path C:\Temp\fcxuspkhfc.exe
Size 365KB
SHA256 14a19d192a84f3ac6f15d053823ed9d7ae8e676af3b8da72e714426313456c41
MD5 6bd0bd83df1e78e3afd579e04aafed80
SHA1 bdba59c6f6a6c553d56061cd49776bdc19591c58
SHA512 d75e72f32dc87d06deadfc66987bbda8cdb3dfe7639528515397e8d3e38f156df563726ab8f9ec463046aee1220535c531cc9a0f3de57b800a17eed182d6d80e
SSDEEP 3072:auxIxtcBOaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:auxIxtdlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T18D847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxsqkifax.exe

Path C:\Temp\fdxsqkifax.exe
Size 365KB
SHA256 9114203c78731b07fa32fcc80b0916230ca2bcf3db086e92022f79402b417d91
MD5 6b67b4d34008b25c945b5f599f8c3fc7
SHA1 9003a565bb60fd8a45475b0ac39f1615a8390478
SHA512 5d915d32e65068b57de674dfbf863e81512cf61b253f6f25d8514ee544dcd637a91a58d5dfccfd397bbbbfe0f61de2f7fe7b1f8dce3e60c4a46f03cee9143b6f
SSDEEP 3072:vuxIxtcBOaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:vuxIxtdlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T14E847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvsqnhfa.exe

Path C:\Temp\fdxvsqnhfa.exe
Size 365KB
SHA256 35dd9952f0599b56c04a202e007b1c5ef5202d39ccce37ebf179c326c65e2fe8
MD5 0d8d1f17f0f6d669a8f03f4e75f9c0fb
SHA1 67919a9b5204c2b88587b0d528082567edf44e8b
SHA512 196e470702605eba834ac41abc874c2676be93b2f581d53a5fa5683afc3f1bad8b1ea7903a07c868239e34f8381c63330daa0afda290b424750553c74e9d6b13
SSDEEP 3072:SuxIxtcBOaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:SuxIxtdlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T131847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaytqoigby.sys

Path C:\Temp\gaytqoigby.sys
Size 293KB
SHA256 f2e72cfd9a703d3c3437c3829848ce0ae81524e3c3d143d35735bba428380eea
MD5 95c9a31fd3aa1ddf87ecc48df98c792a
SHA1 7a90530e67396d37e3d6c9350485a0809ce013e8
SHA512 45d33da4ce53d92d67b3ff8c4d17346baa21d9434b7041ee72a1681304a839820694934a2e5a735768959ae7217e67ae54deca853fef79d4e5d569b73f88ce55
SSDEEP 3072:ztKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:zIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A9545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hczxspkhcz.sys

Path C:\Temp\hczxspkhcz.sys
Size 293KB
SHA256 bd726e8d3afd04c6bee24b5d025bfa064541a90d09317bab75779b71020373c4
MD5 e6295402a661e53178661fabb02beb76
SHA1 aa65501b1cf2914362e2e0fd361c8e72c1c9bba3
SHA512 16a89d4d119e66cf1a2c74e5f8014e231e7c350c552cdb4a3f48b534366ecfb8ac12a4f7605229793f11e337f0d95292f7c84ed963c6ac46edb912aaa9ab04f2
SSDEEP 3072:KtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:KIJjiJcbI03GBc3ucY5DCSj
TLSH
T19C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bwtoljgezt.exe

Path C:\Temp\i_bwtoljgezt.exe
Size 365KB
SHA256 2be37823eb474bfe94cf4e0d45b8291b3de00ef8063999811f98b7e60dcb4862
MD5 d96fd2a6b0cff22b750463ec6c72ec0d
SHA1 f23b81c23467e3a2ac9eb6a4753a484909bf96e7
SHA512 345e7b387bb9001b05f25f7459b9ddb7a77251c8c2f8f59b7f203930e04b61428530afb67cfd24204fa644beee78a831e85d14d8b2947e40922f41d120f62147
SSDEEP 3072:vuxIxtcBOaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:vuxIxtdlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T171847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fdxsqkifax.exe

Path C:\Temp\i_fdxsqkifax.exe
Size 365KB
SHA256 684176396f2400e0e8ef5e16bbb3409641b0391282c521e867f4b3850eab068c
MD5 26906a68894dc947cc95a36910ecd16d
SHA1 100250d0fcf49b9a4f628ffc07adf8ef85b58213
SHA512 f3bc8cf64d40bbf4cd1b744793abd3dd616b46bdbfec0eaf169c511590ac8888561cb5df6311c5e92e858cc15e7f53bbcac7ef47bdd56ac281cf9112ff560e1d
SSDEEP 3072:wuxIxtcBOaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:wuxIxtdlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D8847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fdxvsqnhfa.exe

Path C:\Temp\i_fdxvsqnhfa.exe
Size 365KB
SHA256 9442977786f3e17c56629be9bce353b954ef5774e571fd2104e5ff169b118ca2
MD5 53604f7ed1addf9535f09b909a6523fd
SHA1 ad83ea1f2b63bb1ce360f93e2fa60f0d66a8454a
SHA512 6905749e692547ddb2d0643c87ff5fad28dc27aa787b033cb7d34432cb14b70eeb9287495f3b099d1f9b70526fdc5b7f45051ff279e3c3458569d0f986cd11a1
SSDEEP 3072:iuxIxtcBOaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:iuxIxtdlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E0847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tqkidavtnl.exe

Path C:\Temp\i_tqkidavtnl.exe
Size 365KB
SHA256 cff3ed3cee0744314e001d255b4134ad68919040ed5782bd22071e2939c41f98
MD5 d6e0c897ea8075876b5a5cae3c32261e
SHA1 16826134eeeeabfb9c820e5475b162a532fbb92e
SHA512 d21dc0777cb2bad5e49f7c90737d444fe5d3f4f6a10545a7147b28d7b8449daa779c5d3444271ac4fd07adc6330e856665dd75058001383551ff41f3ada8e952
SSDEEP 3072:0uxIxtcBOaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:0uxIxtdlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C3847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtnljgeywq.exe

Path C:\Temp\i_vtnljgeywq.exe
Size 365KB
SHA256 111cd6d699919eecbdaca933a6fcae0c9b5fcf81e6e6dde5c2887c6bbe660dd4
MD5 527ddd81b54fef83d784a5fcfd373eb7
SHA1 1ed2eaad3db6298410fc8ceec6e95607be08d3c3
SHA512 65cc602214441b2cf48b69df09ae18ff61d46018fd49fdb76fe6145b92a17be45bf6b0d031a06a1352c6c0007b6e65e555921f6d966c5badf91efeb6f99ccf61
SSDEEP 3072:1uxIxtcBOaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:1uxIxtdlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T142847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicaxspnif.sys

Path C:\Temp\kicaxspnif.sys
Size 293KB
SHA256 942757e7c7e7e29ead1749439df7735c54b48e895bbc59f6083d23604c74220f
MD5 0049a36972ca90d74259b20874da29e9
SHA1 7b5e5500913f93d0b6d9422dac9d7f091a3b873e
SHA512 50692bd3bd7e79420e7db572d91668fdd08762c4854a4c664848d76fd87c645a3655db19073809ac3bc3f23d76a6c6b718b42553f2d078dfd077699aa05f4d11
SSDEEP 3072:3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:3IJjiJcbI03GBc3ucY5DCSj
TLSH
T1CF545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlfdaysqni.sys

Path C:\Temp\nlfdaysqni.sys
Size 293KB
SHA256 53f5071168a31a6a192831f5d747c5b8a75e5409d09ccbcfeed83071f0788934
MD5 b5120940754d2e1c8b1ccc24edf5d9fa
SHA1 ab8b8ef17186852a413cc2237f8dd10dac4f1e7b
SHA512 ffd5b9d34f089147f47853f8d257bf7806593e76cbc3c73e8e392907c7ce45043eb9d00e5afd61c12d66ab6f5954b2166156b9fc0d6a73999e3a4a0502cc0933
SSDEEP 3072:4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:4IJjiJcbI03GBc3ucY5DCSj
TLSH
T171545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqkidavtnl.exe

Path C:\Temp\tqkidavtnl.exe
Size 365KB
SHA256 030eca8051b4f97aa5f3d78fd5db82f579eaa8214d09d456a4346bb1d1bcfdaa
MD5 297338a4778596753dcb2b3143ef6c32
SHA1 be26f8cd1ef9cf34db1fcc19d12601a0cd1e47b3
SHA512 2b75e3e22e1899d8dda6b2c31116fe7dfadb371bcad17705ded00169d14cd8db8872f20ddaf81a5ba395d34a9d4810a98da9ac4b97e83119ce07435d4228af42
SSDEEP 3072:euxIxtcBOaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:euxIxtdlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T144847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqoigaysql.sys

Path C:\Temp\vqoigaysql.sys
Size 293KB
SHA256 7c76e121f5719fa1a4f029d299327a708abc28d69317516077d31fb62f95ca41
MD5 e2a45eac4a789d411590ec29dbbd7bf5
SHA1 643e0a2f625dcc1e817753b66304dcff309d68bf
SHA512 f7f74b6f0da55ddd780de8ee8aa94b421ccc33ebd6da16d0e3aa204104a3f8e59b4b02a966605b44df1eeab7e6e8598daadfa41e8059a3482126f49667c5c2c4
SSDEEP 3072:StKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:SIJjiJcbI03GBc3ucY5DCSj
TLSH
T185545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnljgeywq.exe

Path C:\Temp\vtnljgeywq.exe
Size 365KB
SHA256 5fc45f18560d5efaacb328a571c54b31cb1a70a6356b2d6ffaab9763fc4a813e
MD5 d983c2f19dbb12e60e8478eb4a0c6439
SHA1 86a6a55d56ad5a554fdb46d09190e5e720c66145
SHA512 21d2b1a8c8a3b5a1d5442e899537638b58bede11a73876b9b192aa654b96210c113dab589f80891915906f92ce21223ef394b3755dfca87d8e2208b1acfb1f14
SSDEEP 3072:xuxIxtcBOaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:xuxIxtdlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T118847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zuojdbwtomgeywto.exe

Path C:\Temp\zuojdbwtomgeywto.exe
Size 365KB
SHA256 77cd0b2491ab64dd3821810495f7768c346313774c2fc9313f5216b06b1fa7a5
MD5 1c9873055661d9951c1cc53820fae7a8
SHA1 fed7eac70bd7f0368338fcd14e45424402d9b52c
SHA512 e9ece47df30d214b7fdb621357e623dd7219ed0f5ef84a254f21a4b623b819e3d8f940050fcd7d6673e2293f66b36f104f1642520d318498760a0ee29873edd0
SSDEEP 3072:DuxIxtcBOaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:DuxIxtdlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C2847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zuojdbwtomgeywto.sys

Path C:\Temp\zuojdbwtomgeywto.sys
Size 293KB
SHA256 c5826e57481fefa4d87b891da12c39152adc7b63760d98b6be5822d79eacec0c
MD5 0d207cd20c50c3c73c555bb1e45e531f
SHA1 db98f2a66bb0d8cff53b013c200a7390d9c80d62
SHA512 ae7e2b8a27a26b63851b82f8483e7a584ec8249c6d7bb0946c81b6ee5718bb974a1e9578c63fbd314ad4f808e13465b648837a29f0a7a3057778287fe6586eca
SSDEEP 3072:FtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:FIJjiJcbI03GBc3ucY5DCSj
TLSH
T16A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

23945af9-1ecc-4afe-8403-c6b4ac71f3f6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\23945af9-1ecc-4afe-8403-c6b4ac71f3f6.tmp
Size 33KB
SHA256 ecae65d6fe23342e08d413c00df87c7294d2f5377413136c78b71ba607431b49
MD5 a7777bb4fa92e006a07d37614a173033
SHA1 1c431077f04102f139417d949ae47bf20f7ebd6b
SHA512 1af1ecf9eca6c2e3c291aeb865398114f99f52307313499480df2e644420b6f9a44a7d64ca5ad88beced9f7e583e728dae71733b3052e04eb23c1e04bd53dcfa
SSDEEP 768:Da3B2p63pybNbhamt8d2OeRFZD1fTos7RjjE75E+LE:Da3B2untY1fT/RnkpI
TLSH
T1EBF2AF35F8A49D335CFAE244F2493A87BEF451A3CDD90988D5C95E1D04C7B9E234B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

279c25f5-69cb-49f7-8645-c1c8840fd5db.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\279c25f5-69cb-49f7-8645-c1c8840fd5db.tmp
Size 37KB
SHA256 ff5fff507d4718cbedec117c415cbccb5dd21fb0b55643b0076b3589ae0ea4ac
MD5 bfe1ac8fc30b5d562f170f1e6450474a
SHA1 c23780a33a073f61fd76445996d03b3e1efd10dc
SHA512 e86f819e1a2023fdddf7f8fcf7e5cf2db8ac3e4a2117c01e0a1840a9cfd67e660ed4aee6680b638a3484ae4a2c7d136a1d9148b5c43f06b2d9beca1c4427504c
SSDEEP 768:z/UxvxjgC+k3hBWybNbhamtKOeRFZD1fTos7Rzy/+Pu:GZj3+k3h8+Y1fT/ReKu
TLSH
T13B03CF3AF8D46C338CF6E244B24A764BBFF415B395C91A9809ED2F0E158BB9C1307856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65151d60-0c71-4535-be70-21480189bcb2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\65151d60-0c71-4535-be70-21480189bcb2.tmp
Size 38KB
SHA256 29423d6f708968dd4d67e6f7cc0aef4f4e5e842364321e4c8090854499fe0179
MD5 e27d67c1150111f63b76c28407ad6b72
SHA1 cbf886f66b765e721887a5a88bd2a042fb364de0
SHA512 34786d2a3135b5ae8e1de50c47adb332b82db7e5de4b96c7704dfc63e89604dde3f57ca4945877cdd8a85e6865811742a37badb93f59beec09dac319d39bb1bd
SSDEEP 768:D/UxvxjgC+k3MoC37ybNbhamt8cOeRFZD1fTos7RCj/+Pu:WZj3+k3MPpY1fT/RYKu
TLSH
T17A03C039F8985C339CF6E244B24A778BBFF415B389CA1D9849D95F0E0587B9D130B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9437adde-8c26-484d-b072-300e3e27b257.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9437adde-8c26-484d-b072-300e3e27b257.tmp
Size 42KB
SHA256 6306ceb8d13a15e3d5de4b7304d2793717dde0aa905f1cf04bfdae7adce43609
MD5 e321016c41288a79bffb3dbef4151997
SHA1 cd1b9348ac9a61b952f3b4d7832d1df08b1bf70e
SHA512 42ff22c0f97496462e4e048c43783c4b844ca68ddf1f65d9c94a1b287a28b82afe4edd78e5184693d7eb59c8698959b15b9e9895f7d72cc96e4a259696b28d77
SSDEEP 768:KFdK3ZwgE2pK3VShamt852OeRFZD1fTos7RjjE75E+LE:qK3M2stY1fT/RnkpI
TLSH
T1131307F5A8D79937D8AE9743A33D3D46ADBCD153B9894884B7884D0CCC826BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4123fa2cc2e73053b7602d1d53a57b01f3a6cd8872729fcd7ed66886082b1b99
MD5 5100dc5469c5151f9ac793573116a7fa
SHA1 a8ffca7210c348bef0d710a66e334809b7f58988
SHA512 ead3d81382dc13f1d89e928af9189e5eec6cf3fabfb91ed18d73f1fe38b5e9f76e77fae594633baf6da19747d70fbb17eb97a8a36df60510a930f6006986acfc
TLSH
T1F4D02B75E7EC8412C0C2207C015911A231A37E00D70802C00A05801C18001C20322F09
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a201096456be1e380b7687844e70aa8e2d987a06740acf66db0d56e000a3b50d
MD5 36c9bdf74494657a1636bbc59af48eb0
SHA1 aea8177ffde7e43fa1b4cc5ce6c7cf68c2431306
SHA512 2cf6da34ccb1c58e4f6d50681952d27ffc828c4ede6f38ca0a5e429a4f520e426913b04469e4272eed54102a541263bbb54c2628f542fbe357a4afac921bb49e
TLSH
T143D02B79E7DC8512C0C2207C015811A231B37E00EB0802C00905400C18001C20323F0D
MD5 SHA1 SHA512 TLSH

Submit Download

79a26764-6393-4cba-bd90-5d3fb07be0e2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\79a26764-6393-4cba-bd90-5d3fb07be0e2.tmp
Size 11KB
SHA256 9ece37ccdfeb4ae983a0b1f695b0d3832d165abac99e10395e625af0fa045e3b
MD5 d2471612db3ecb0705977a06e0c6a447
SHA1 cf44ed319d181de85d660c9b92602617b6dd401e
SHA512 09a88db70f7a16f140cac66661b5af92da05099bc91f8e7896b1a1c4a17c3eb13ae0448cf8525fa0e48449c2cefe2b81599a00365325009c9bdc9ed111536161
SSDEEP 192:sxRkRutCb/fJsZ7kQZybzoA8p9n/g6+WNCJJ/YDZMjGnIgDEDJ:sxRk0Mb/fJsOOV1/5C/0A
TLSH
T18142B919AD28A93B9CDBD21DBB55BF53D2F91032A1D01E44A6FC8B2C14EB6DD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7ca3aa1b-fac5-4cb6-8542-2c9ffcc5aedd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7ca3aa1b-fac5-4cb6-8542-2c9ffcc5aedd.tmp
Size 12KB
SHA256 c189083eeb4585a20449ed725ce3c9ba51e9b7709a6d0d04c8e985a993941188
MD5 14bef486547b9f2e2a9a8eb32bba2a77
SHA1 4c2f56e3ccece2bf04125c4a5b4bcdcef5c5d8fd
SHA512 d414eda10203e7190b034a733009f6b54c7aaf7a17df13eec8c5213c9b089df05798da20aaba5f40009dcdce946f42ac965a564f88b1f8fee1e585c36dce4db8
SSDEEP 192:sxRkRutCb/fJsZmkQZybzoA8p9n/g6+WNCJJ/YD+gjGnIgDmDJ:sxRk0Mb/fJsPOV1/5C/TW
TLSH
T1FE42C919AD28693B9CDBD20DBB55BF53D2F91032A1D01E44A6FC8B2C14EB6DD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 4f358af533a32b8a46e2fdb60ba3b9fa6fd839fcee5da443f9913431c6f6eb9e
MD5 9c8748fb5a9fcc503429daabd2a16e47
SHA1 e37c4dcd1084cf23c300f19ad2d20f3dbab0641b
SHA512 e2a69764efdb290e81b9faa21bc2ce41a695971cddb62ce73502208b2f8565cc39e622f2549d02216f6909bb79feee80c0282b88421959d46edbcd56d4f2a400
TLSH
T1AF41FB0B79B8C3B6D754897C83D623873A77C8B29AB31C020467F879877EBA65044F18
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 df0ef6a6b993d029238720c2204f03d72054451679dbf7848b7b117694c7eb51
MD5 e3959c3968dee06a6beaca95ec717de2
SHA1 1643284e4ae8c8b53716a5bec0a224313bf4a898
SHA512 c7e0e525c0550f93e533550645dcf3f8c3c14a34ffd4c2eed5916edff3b9af880230d1a9e391513e97f6f6ee5fa4e550a5d215876342c9d1b72f1509c670339d
TLSH
T1E641EA0B79B8C3B6C754487C83D623873A77D8B296B31C020467F8798B7EB965045F58
MD5 SHA1 SHA512 TLSH

Submit Download

a7c746a9-d69f-44d9-9291-0fd6466bfc66.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\a7c746a9-d69f-44d9-9291-0fd6466bfc66.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

2c8c93fa-dcf4-4d6c-ab5d-d18561c8fab5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2c8c93fa-dcf4-4d6c-ab5d-d18561c8fab5.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

a57a6d5b-f43d-4b46-9dfa-6968f4cadbb7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a57a6d5b-f43d-4b46-9dfa-6968f4cadbb7.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

f097e12a-bdc6-4b2f-bdef-46f7dd65c7dd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f097e12a-bdc6-4b2f-bdef-46f7dd65c7dd.tmp
Size 2KB
SHA256 66bcb1365bb10b31bdcf1ec39efc8e6fe14806c3e204f5970f0e7080913d2e72
MD5 d70baa5b33807eda5561b8ad81455737
SHA1 9f1fdf23af4eb9a739717cdad9bee9b96911a2ff
SHA512 64e31bc22f80a73c648568bb2ccf674610a2ee903baaaab1a8b272df2dff166b28bc7e90b9156be35389b173cbd93c47fdf244096a56517e6069b33d5872127d
TLSH
T1A141B0F783F4857D9A0159F0AB186E1FCE2D0915432C7D6AC9E0AE2B93E3471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

a3bab808-22d2-443b-ba23-07989d4c2af0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a3bab808-22d2-443b-ba23-07989d4c2af0.tmp
Size 11KB
SHA256 4bb8c47c7752efc63beec52c8553a60aa782d9ac9c114db054262b69da0bd192
MD5 ed316b25727ac3584e47866b4fdf4e69
SHA1 f2e2be870fe74973befd4e1aaa38c5239485e1e7
SHA512 9a1ed8b5a8a597803819f0ba7db3997c43caad3a886a33c2fa4d2f2c687b060b48bcac323067131b7aab591c9eb4af1c9e0b1e4ab2b56d5c7d9b8819150c2495
SSDEEP 192:sxR7RutCb/fJsY7kQZybzoA8p9n/g6+WNCJJ/YDZMjGnIgVDJ:sxR70Mb/fJsXOV1/5C/0/
TLSH
T17342B919AD28A93B9CDBD21DBB55BF53D2F91032A1D01E44A6FC8B2C14EB6DD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b73ee515-a562-4d1f-b8b2-5156cebdc1fe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b73ee515-a562-4d1f-b8b2-5156cebdc1fe.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d7744285-a742-4687-84e6-a8ee972d76b8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d7744285-a742-4687-84e6-a8ee972d76b8.tmp
Size 29KB
SHA256 cd9b197e4afb0c96c5b665e8fe93b9b786ab5a4f148317209d062a786438f513
MD5 c8ff88c21fe913bad8fcca14ab0fb76e
SHA1 d37d8d39173c4ec7f5e77967f7c2d208636d6f59
SHA512 a297fb8bb586a4e15faba9016b69587aa4b99c7524fd86e7676062d8094dcab0e1523244cc1868c62dd81e6b32f9ecbad993c96600a9315a92e7213cd01506f6
SSDEEP 768:SzYbXR7pLuLbxUWgasfA68F1+UoAYDCx9Tuqh0VfUC9xbog/OVujw8WSLroGC4Yw:SzYbXHEbxUWgasfA6u1jaVjwtS4X4p
TLSH
T190D2DA7B640CCB7F4F804ADDEC197A9E6DA802CB95D8C98047FA941D02C67EF911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0433ccf9-d122-4b43-93c1-f7df1fd2069e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\0433ccf9-d122-4b43-93c1-f7df1fd2069e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\OriginTrials\0.0.1.7\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

a088b99d-ecae-49af-a292-c593efd29938.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a088b99d-ecae-49af-a292-c593efd29938.tmp
Size 33KB
SHA256 3edf9972e981039bf595f45236040635aa16efa519bc2087183bbe817a80b8bb
MD5 fa2944d910c16d70c725ecf7a8c8876e
SHA1 a85cece12ead96e21a9b388cb841575733613c30
SHA512 c821549f0840417c557b4cde06ee3f5ed8c17398457526197089a7f67c7f2b304a25aa3ed45ad5aa5caafde40b59c74a044426d38fedba72170ed9e69420bc95
SSDEEP 768:Za3+2p63pybNbhamt8d2OeRFZD1fTos7RjjE75E+LE:Za3+2untY1fT/RnkpI
TLSH
T148F2AE35F8949D335CFAE245F2493A87BEF061A3C9D90988D5C95F1D04C7B9E234B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a267d243-85f3-4271-ae26-cfaa5b7d4c48.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a267d243-85f3-4271-ae26-cfaa5b7d4c48.tmp
Size 38KB
SHA256 4d57a2f7f24792ba49fd3cdee01f79e91e646a99ad53cb706bdeae6a7084c076
MD5 90f625c06bba064bbe1c86becfbc684b
SHA1 90feaeb7030b36c460a1b76a1f335f556e16dc45
SHA512 f80ec0c35304ce952271640de54d541cdf92c2bb77c542eb8e3de1097cb8730c2f2d34b2026738b53a06fcf9c04b96a4cc46591fefa6f01b179321e0fc2e0284
SSDEEP 768:u/UxvxjgC++3B2pJ3pybNbhamt8JOeRFZD1fTos7RjjH2K:jZj3++3B2B+Y1fT/RnH2K
TLSH
T15B03B039B8A49C339CFAE254B24A7787BFF415A389C51D9845D85F0E09C7B9D130B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3ce54f43-f69d-44bb-bd1e-f5477a4c561f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\3ce54f43-f69d-44bb-bd1e-f5477a4c561f.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

b8b39f65-067a-4535-9857-af7e987a4a0e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\b8b39f65-067a-4535-9857-af7e987a4a0e.tmp
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

d098405a-1357-4c6e-abf0-a211ca16c0ce.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\d098405a-1357-4c6e-abf0-a211ca16c0ce.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

b31b0fcf-81ab-405d-86ae-dfc019360d45.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b31b0fcf-81ab-405d-86ae-dfc019360d45.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

a2d10b3f-9580-4edc-9d45-7301aab413fe.tmp

Path C:\Users\Admin\AppData\Local\Temp\a2d10b3f-9580-4edc-9d45-7301aab413fe.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

2d38a9b3-0d97-4076-bf32-dfef8142b9bf.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5336_1340152413\2d38a9b3-0d97-4076-bf32-dfef8142b9bf.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5336_1340152413\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5336_1052786492\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

llm_user_input_extractor_config.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5336_1247076001\llm_user_input_extractor_config.json
Size 4KB
SHA256 2056ee7ed0e7adb69344c93a024158ee4e2332ecd50d183dbad7595c4d588ed9
MD5 7736ccfaf720ef9b0db919dd01c4bf8c
SHA1 24b48ec2dee093b8e4384ad1e25ad8f12af0831e
SHA512 f044ed3b6fee483d211328df83f26b98dfe47890c05409c65c7f7333fde1fc043cd1c05d18250e8ee8731f355c13b3a0aedc0e60b82a26c42a7f209a69ad4781
SSDEEP 96:a0y3Cmyjw2w61skd7GZrlWqPZ96vOim87Ai:wyOy7k5rx0WVS1
TLSH
T11F91DF3BD8A15C2B00F3B225B87A7642F534A35B27C05C5B7A7C5A1C8FB6D312582F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5336_1247076001\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smart_switch_list.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5336_1247076001\smart_switch_list.json
Size 2KB
SHA256 d490aec3403b2daa86aa095db121c2dfee0a35c3ed0770284c0bd0e0a103c776
MD5 a55a23fcdd9af97d33302c8e6de41c18
SHA1 00d9137cdffd273ef849e1122ecbb6f27b6e8423
SHA512 647c19d83bf4db3c4b868738df3a8da0b06f666860f468a2de6863e440800bd5e4057ac03bcae4b5bfed28a8907038bca6a72785d42e7acb6f56580a6859b05d
TLSH
T1E4519EB7CA215CA005B482B16338509AF82827BF62C98AEF377D5B1C3F744B425981E8
MD5 SHA1 SHA512 TLSH

Submit Download

nav_config.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5336_1780292765\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 5c901ff098698de54ca1a006a96b44421b812ddbb3e53e2009a6cf44eea7c0ea
MD5 e169c69b5ec29ce7b7c40d4068b49fb4
SHA1 c637ef100162d44698b5f32c1410e0b58bf7a042
SHA512 ffa57e49d073b43b227f9a3a88aee39b6d8d11158968c4e91944fb7ca40bc58bb19e7e62dfe238465cb2bad4a41a6ac05211c1b67f26e21a536af6b9d917dfb6
TLSH
T10C71238357E9C5F3C1DA5BF002835644F6FB2238072330204B91558AEB30A7A24B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/204-470-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/672-427-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/860-300-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1556-431-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2488-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2560-247-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2976-275-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2984-394-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3460-382-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3764-325-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4112-287-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4196-345-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4252-198-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4452-492-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4712-519-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4716-329-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4848-381-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4968-451-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5380-466-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5696-496-0x0000000000010000-0x00000000000AB000-memory.dmp

Download