systex | a17598459d9706285ed9697e1ac924c72a23e140e0b10ec93b626dedde44d85d

Analysis

max time kernel
149s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 00:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260629-adnbbahy4p
SHA256 a17598459d9706285ed9697e1ac924c72a23e140e0b10ec93b626dedde44d85d
MD5 1bd2f19d65dd0d378e418f566da9a853
SHA1 b5fcc82ce09bf44dfa9a404bc46a77f3214b99f6
SHA512 9fa9c43c17ce77356549e02fc19ef8d1b6a2fb2cdd24a05d23d62ea5868bfc5652fb16ece051bde23beaa7feb29f8938220457b0b96167e02d3aeb939e65a161
SSDEEP 3072:l9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:HctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T10B847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
1408	fcxupnhfzxspkhca.exe
4100	fcxupnhfzxspkhca.sys
5984	CreateProcess.exe
1256	hfzxrpnkfc.exe
4204	CreateProcess.exe
5936	CreateProcess.exe
5856	i_hfzxrpnkfc.exe
5388	zxrpkhczus.sys
6088	CreateProcess.exe
5716	usmkhczurm.exe
1568	CreateProcess.exe
5376	CreateProcess.exe
696	i_usmkhczurm.exe
2804	jeczurmhez.sys
4772	CreateProcess.exe
3936	hbztrljhbz.exe
1856	CreateProcess.exe
2996	CreateProcess.exe
992	i_hbztrljhbz.exe
1520	jebztromje.sys
4516	CreateProcess.exe
4408	bywqoljdby.exe
2888	CreateProcess.exe
2848	CreateProcess.exe
4672	i_bywqoljdby.exe
5860	jgbztrljdb.sys
5608	CreateProcess.exe
3272	dbztrljdbw.exe
5668	CreateProcess.exe
6112	CreateProcess.exe
5216	i_dbztrljdbw.exe
5932	bytqljdbvt.sys
3392	CreateProcess.exe
3356	bvqoigaytq.exe
1332	CreateProcess.exe
2640	CreateProcess.exe
5004	i_bvqoigaytq.exe
1140	vtqlidaxvq.sys
1044	CreateProcess.exe
1864	qnifaysqki.exe
1548	CreateProcess.exe
1184	CreateProcess.exe
3096	i_qnifaysqki.exe
2296	vsqkidxvtn.sys
1180	CreateProcess.exe
608	hfaxsqkica.exe
752	CreateProcess.exe
2400	CreateProcess.exe
5048	i_hfaxsqkica.exe
5240	sqkicauspn.sys
4372	CreateProcess.exe
5604	nhfzxspnhf.exe
2832	CreateProcess.exe
1040	CreateProcess.exe
3684	i_nhfzxspnhf.exe
2508	mkhcausmke.sys
1668	CreateProcess.exe
5928	khcausmkec.exe
1248	CreateProcess.exe
4288	CreateProcess.exe
3608	i_khcausmkec.exe
1540	hczurpmkec.sys
1616	CreateProcess.exe
3064	ezwurmjhez.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5424_1487966970\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5424_339899220\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5424_339899220\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5424_622826482\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5424_1357627898\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5424_622826482\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5424_1357627898\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5424_1357627898\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5424_1357627898\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcxupnhfzxspkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbztrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qlgdywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkigaysqda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezxuspkhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkhczurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbztrljhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfaxsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgeywqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qlidbvtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifausqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhbzurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxrpnkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bywqoljdby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfzxspnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwurmjhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezxuspkhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgeywqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbztrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khcausmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khcausmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tjebwtrmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxrpnkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvqoigaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfaxsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfzxspnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tjebwtrmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifausqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbztrljhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvqoigaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qlgdywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qlidbvtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkigaysqda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkhczurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bywqoljdby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwurmjhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khfzxsmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khfzxsmkec.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3376	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2832	ipconfig.exe
1228	ipconfig.exe
5388	ipconfig.exe
4812	ipconfig.exe
1128	ipconfig.exe
3228	ipconfig.exe
1876	ipconfig.exe
4568	ipconfig.exe
3756	ipconfig.exe
608	ipconfig.exe
3244	ipconfig.exe
3076	ipconfig.exe
5720	ipconfig.exe
5696	ipconfig.exe
2592	ipconfig.exe
4212	ipconfig.exe
3740	ipconfig.exe
4092	ipconfig.exe
5968	ipconfig.exe
4864	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134271651648234872"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-487906980-2895880840-1957110281-1000\{21FB17C4-B79C-42FF-ACD9-CF54F6C33FAF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
1408	fcxupnhfzxspkhca.exe
1408	fcxupnhfzxspkhca.exe
1408	fcxupnhfzxspkhca.exe
1408	fcxupnhfzxspkhca.exe
1408	fcxupnhfzxspkhca.exe
1408	fcxupnhfzxspkhca.exe
1408	fcxupnhfzxspkhca.exe
1408	fcxupnhfzxspkhca.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5424	msedge.exe
5424	msedge.exe
5424	msedge.exe
5424	msedge.exe
5424	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5856	i_hfzxrpnkfc.exe
Token: SeDebugPrivilege	696	i_usmkhczurm.exe
Token: SeDebugPrivilege	992	i_hbztrljhbz.exe
Token: SeDebugPrivilege	4672	i_bywqoljdby.exe
Token: SeDebugPrivilege	5216	i_dbztrljdbw.exe
Token: SeDebugPrivilege	5004	i_bvqoigaytq.exe
Token: SeDebugPrivilege	3096	i_qnifaysqki.exe
Token: SeDebugPrivilege	5048	i_hfaxsqkica.exe
Token: SeDebugPrivilege	3684	i_nhfzxspnhf.exe
Token: SeDebugPrivilege	3608	i_khcausmkec.exe
Token: SeDebugPrivilege	5548	i_ezwurmjhez.exe
Token: SeDebugPrivilege	760	i_tjebwtrmje.exe
Token: SeDebugPrivilege	5648	i_olgeywqojg.exe
Token: SeDebugPrivilege	1296	i_qlgdywqoig.exe
Token: SeDebugPrivilege	2256	i_qlidbvtnlf.exe
Token: SeDebugPrivilege	4796	i_qkigaysqda.exe
Token: SeDebugPrivilege	1608	i_ifausqkica.exe
Token: SeDebugPrivilege	2064	i_ezxuspkhfz.exe
Token: SeDebugPrivilege	1812	i_khfzxsmkec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5424	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 1408	3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe	89
PID 3052 wrote to memory of 1472	3052	2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe	90
PID 1472 wrote to memory of 5424	1472	iexplore.exe	91
PID 5424 wrote to memory of 5280	5424	msedge.exe	92
PID 5424 wrote to memory of 704	5424	msedge.exe	93
PID 5424 wrote to memory of 3376	5424	msedge.exe	95
PID 5424 wrote to memory of 704	5424	msedge.exe	93
PID 5424 wrote to memory of 704	5424	msedge.exe	93
PID 5424 wrote to memory of 700	5424	msedge.exe	96
PID 5424 wrote to memory of 700	5424	msedge.exe	96
PID 5424 wrote to memory of 5712	5424	msedge.exe	98
PID 5424 wrote to memory of 2280	5424	msedge.exe	97
PID 5424 wrote to memory of 5712	5424	msedge.exe	98
PID 5424 wrote to memory of 5712	5424	msedge.exe	98
PID 5424 wrote to memory of 2280	5424	msedge.exe	97
PID 5424 wrote to memory of 2280	5424	msedge.exe	97
PID 5424 wrote to memory of 5496	5424	msedge.exe	99
PID 5424 wrote to memory of 5496	5424	msedge.exe	99
PID 5424 wrote to memory of 5788	5424	msedge.exe	100
PID 5424 wrote to memory of 5496	5424	msedge.exe	99
PID 5424 wrote to memory of 5788	5424	msedge.exe	100
PID 5424 wrote to memory of 5788	5424	msedge.exe	100
PID 5424 wrote to memory of 5504	5424	msedge.exe	101
PID 5424 wrote to memory of 5504	5424	msedge.exe	101
PID 5424 wrote to memory of 4464	5424	msedge.exe	105
PID 5424 wrote to memory of 4464	5424	msedge.exe	105
PID 5424 wrote to memory of 1504	5424	msedge.exe	106
PID 5424 wrote to memory of 1504	5424	msedge.exe	106
PID 5424 wrote to memory of 1768	5424	msedge.exe	108
PID 1408 wrote to memory of 5984	1408	fcxupnhfzxspkhca.exe	109
PID 1256 wrote to memory of 4204	1256	hfzxrpnkfc.exe	113
PID 5424 wrote to memory of 3540	5424	msedge.exe	117
PID 5424 wrote to memory of 3540	5424	msedge.exe	117
PID 5424 wrote to memory of 3468	5424	msedge.exe	118
PID 5424 wrote to memory of 3468	5424	msedge.exe	118
PID 1408 wrote to memory of 5936	1408	fcxupnhfzxspkhca.exe	119
PID 1408 wrote to memory of 6088	1408	fcxupnhfzxspkhca.exe	123
PID 5716 wrote to memory of 1568	5716	usmkhczurm.exe	125
PID 1408 wrote to memory of 5376	1408	fcxupnhfzxspkhca.exe	128
PID 1408 wrote to memory of 4772	1408	fcxupnhfzxspkhca.exe	132
PID 3936 wrote to memory of 1856	3936	hbztrljhbz.exe	134
PID 1408 wrote to memory of 2996	1408	fcxupnhfzxspkhca.exe	137
PID 1408 wrote to memory of 4516	1408	fcxupnhfzxspkhca.exe	142
PID 4408 wrote to memory of 2888	4408	bywqoljdby.exe	144
PID 1408 wrote to memory of 2848	1408	fcxupnhfzxspkhca.exe	147
PID 5424 wrote to memory of 3364	5424	msedge.exe	149
PID 5424 wrote to memory of 1160	5424	msedge.exe	150
PID 5424 wrote to memory of 4676	5424	msedge.exe	151
PID 1408 wrote to memory of 5608	1408	fcxupnhfzxspkhca.exe	154
PID 3272 wrote to memory of 5668	3272	dbztrljdbw.exe	156
PID 1408 wrote to memory of 6112	1408	fcxupnhfzxspkhca.exe	159
PID 1408 wrote to memory of 3392	1408	fcxupnhfzxspkhca.exe	163
PID 3356 wrote to memory of 1332	3356	bvqoigaytq.exe	165
PID 1408 wrote to memory of 2640	1408	fcxupnhfzxspkhca.exe	168
PID 1408 wrote to memory of 1044	1408	fcxupnhfzxspkhca.exe	172
PID 1864 wrote to memory of 1548	1864	qnifaysqki.exe	174
PID 1408 wrote to memory of 1184	1408	fcxupnhfzxspkhca.exe	177
PID 1408 wrote to memory of 1180	1408	fcxupnhfzxspkhca.exe	181
PID 608 wrote to memory of 752	608	hfaxsqkica.exe	183
PID 1408 wrote to memory of 2400	1408	fcxupnhfzxspkhca.exe	186
PID 5424 wrote to memory of 4716	5424	msedge.exe	188
PID 5424 wrote to memory of 4716	5424	msedge.exe	188
PID 1408 wrote to memory of 4372	1408	fcxupnhfzxspkhca.exe	194
PID 5604 wrote to memory of 2832	5604	nhfzxspnhf.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_1bd2f19d65dd0d378e418f566da9a853_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Temp\fcxupnhfzxspkhca.exe
  C:\Temp\fcxupnhfzxspkhca.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfzxrpnkfc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5984
  - - C:\Temp\hfzxrpnkfc.exe
      C:\Temp\hfzxrpnkfc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1256
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4204
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2832
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfzxrpnkfc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5936
  - - C:\Temp\i_hfzxrpnkfc.exe
      C:\Temp\i_hfzxrpnkfc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usmkhczurm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6088
  - - C:\Temp\usmkhczurm.exe
      C:\Temp\usmkhczurm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5716
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1568
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:608
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usmkhczurm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5376
  - - C:\Temp\i_usmkhczurm.exe
      C:\Temp\i_usmkhczurm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hbztrljhbz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4772
  - - C:\Temp\hbztrljhbz.exe
      C:\Temp\hbztrljhbz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3936
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1856
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2592
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hbztrljhbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2996
  - - C:\Temp\i_hbztrljhbz.exe
      C:\Temp\i_hbztrljhbz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:992
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bywqoljdby.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4516
  - - C:\Temp\bywqoljdby.exe
      C:\Temp\bywqoljdby.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4408
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2888
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1228
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bywqoljdby.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2848
  - - C:\Temp\i_bywqoljdby.exe
      C:\Temp\i_bywqoljdby.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4672
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbztrljdbw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5608
  - - C:\Temp\dbztrljdbw.exe
      C:\Temp\dbztrljdbw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3272
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5668
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3228
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbztrljdbw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6112
  - - C:\Temp\i_dbztrljdbw.exe
      C:\Temp\i_dbztrljdbw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5216
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bvqoigaytq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3392
  - - C:\Temp\bvqoigaytq.exe
      C:\Temp\bvqoigaytq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3356
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1332
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1876
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bvqoigaytq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2640
  - - C:\Temp\i_bvqoigaytq.exe
      C:\Temp\i_bvqoigaytq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5004
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnifaysqki.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1044
  - - C:\Temp\qnifaysqki.exe
      C:\Temp\qnifaysqki.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1864
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1548
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5388
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnifaysqki.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1184
  - - C:\Temp\i_qnifaysqki.exe
      C:\Temp\i_qnifaysqki.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3096
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfaxsqkica.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1180
  - - C:\Temp\hfaxsqkica.exe
      C:\Temp\hfaxsqkica.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:608
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:752
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4568
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfaxsqkica.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2400
  - - C:\Temp\i_hfaxsqkica.exe
      C:\Temp\i_hfaxsqkica.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5048
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nhfzxspnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4372
  - - C:\Temp\nhfzxspnhf.exe
      C:\Temp\nhfzxspnhf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5604
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2832
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3244
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nhfzxspnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1040
  - - C:\Temp\i_nhfzxspnhf.exe
      C:\Temp\i_nhfzxspnhf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3684
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\khcausmkec.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1668
  - - C:\Temp\khcausmkec.exe
      C:\Temp\khcausmkec.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5928
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1248
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4212
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_khcausmkec.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4288
  - - C:\Temp\i_khcausmkec.exe
      C:\Temp\i_khcausmkec.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3608
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ezwurmjhez.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1616
  - - C:\Temp\ezwurmjhez.exe
      C:\Temp\ezwurmjhez.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3064
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2396
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ezwurmjhez.exe ups_ins
    3⤵
    PID:4300
  - - C:\Temp\i_ezwurmjhez.exe
      C:\Temp\i_ezwurmjhez.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5548
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tjebwtrmje.exe ups_run
    3⤵
    PID:3712
  - - C:\Temp\tjebwtrmje.exe
      C:\Temp\tjebwtrmje.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3344
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5824
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3076
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tjebwtrmje.exe ups_ins
    3⤵
    PID:932
  - - C:\Temp\i_tjebwtrmje.exe
      C:\Temp\i_tjebwtrmje.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:760
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\olgeywqojg.exe ups_run
    3⤵
    PID:5404
  - - C:\Temp\olgeywqojg.exe
      C:\Temp\olgeywqojg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1540
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2576
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1128
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_olgeywqojg.exe ups_ins
    3⤵
    PID:2080
  - - C:\Temp\i_olgeywqojg.exe
      C:\Temp\i_olgeywqojg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5648
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qlgdywqoig.exe ups_run
    3⤵
    PID:3292
  - - C:\Temp\qlgdywqoig.exe
      C:\Temp\qlgdywqoig.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1776
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4628
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3740
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qlgdywqoig.exe ups_ins
    3⤵
    PID:3800
  - - C:\Temp\i_qlgdywqoig.exe
      C:\Temp\i_qlgdywqoig.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1296
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qlidbvtnlf.exe ups_run
    3⤵
    PID:3096
  - - C:\Temp\qlidbvtnlf.exe
      C:\Temp\qlidbvtnlf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:468
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:792
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3756
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qlidbvtnlf.exe ups_ins
    3⤵
    PID:3608
  - - C:\Temp\i_qlidbvtnlf.exe
      C:\Temp\i_qlidbvtnlf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qkigaysqda.exe ups_run
    3⤵
    PID:3940
  - - C:\Temp\qkigaysqda.exe
      C:\Temp\qkigaysqda.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1152
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4168
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5720
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qkigaysqda.exe ups_ins
    3⤵
    PID:1360
  - - C:\Temp\i_qkigaysqda.exe
      C:\Temp\i_qkigaysqda.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ifausqkica.exe ups_run
    3⤵
    PID:460
  - - C:\Temp\ifausqkica.exe
      C:\Temp\ifausqkica.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4424
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1684
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ifausqkica.exe ups_ins
    3⤵
    PID:5344
  - - C:\Temp\i_ifausqkica.exe
      C:\Temp\i_ifausqkica.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1608
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ezxuspkhfz.exe ups_run
    3⤵
    PID:2256
  - - C:\Temp\ezxuspkhfz.exe
      C:\Temp\ezxuspkhfz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5648
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3840
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ezxuspkhfz.exe ups_ins
    3⤵
    PID:2632
  - - C:\Temp\i_ezxuspkhfz.exe
      C:\Temp\i_ezxuspkhfz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\khfzxsmkec.exe ups_run
    3⤵
    PID:1216
  - - C:\Temp\khfzxsmkec.exe
      C:\Temp\khfzxsmkec.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3508
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4700
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5968
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_khfzxsmkec.exe ups_ins
    3⤵
    PID:4900
  - - C:\Temp\i_khfzxsmkec.exe
      C:\Temp\i_khfzxsmkec.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpjhbzurmk.exe ups_run
    3⤵
    PID:2376
  - - C:\Temp\rpjhbzurmk.exe
      C:\Temp\rpjhbzurmk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2588
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4148
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4864
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7fffc734c188,0x7fffc734c194,0x7fffc734c1a0
      4⤵
      PID:5280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,7496954855063234663,1274830753348234594,262144 --field-trial-handle=2432,i,16091863707382629545,14896967431087308867,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:2
      4⤵
      PID:704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,6568373257123177454,2199320400886742372,524288 --field-trial-handle=2432,i,16091863707382629545,14896967431087308867,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:11
      4⤵
      System Time Discovery
      PID:3376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2388,i,10440438103898832115,10848319024040564299,524288 --field-trial-handle=2432,i,16091863707382629545,14896967431087308867,262144 --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:13
      4⤵
      PID:700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,1655404407078959790,4541102391185795299,2097152 --field-trial-handle=2432,i,16091863707382629545,14896967431087308867,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      PID:2280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,919871677280784347,4582839573798378812,2097152 --field-trial-handle=2432,i,16091863707382629545,14896967431087308867,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
      4⤵
      PID:5712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,13043778251978156864,4724914536270767704,2097152 --field-trial-handle=2432,i,16091863707382629545,14896967431087308867,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:1
      4⤵
      PID:5496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,11361436901193833728,2672664722907784509,2097152 --field-trial-handle=2432,i,16091863707382629545,14896967431087308867,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:9
      4⤵
      PID:5788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,302110363789602826,7423629232033306078,524288 --field-trial-handle=2432,i,16091863707382629545,14896967431087308867,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:14
      4⤵
      PID:5504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,2390481558620871649,18158095190608479382,524288 --field-trial-handle=2432,i,16091863707382629545,14896967431087308867,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
      4⤵
      PID:4464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,11782674997322105033,17298405071864067334,524288 --field-trial-handle=2432,i,16091863707382629545,14896967431087308867,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
      4⤵
      PID:1504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,5784766753267601919,10621963761668500017,524288 --field-trial-handle=2432,i,16091863707382629545,14896967431087308867,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
      4⤵
      PID:1180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,5784766753267601919,10621963761668500017,524288 --field-trial-handle=2432,i,16091863707382629545,14896967431087308867,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
      4⤵
      PID:1768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,14763824688239748637,13576842307002750230,524288 --field-trial-handle=2432,i,16091863707382629545,14896967431087308867,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:14
      4⤵
      PID:3540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,7584847748059866913,5642974941671214475,524288 --field-trial-handle=2432,i,16091863707382629545,14896967431087308867,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:14
      4⤵
      PID:3468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,9488386605913031393,10173487267995992988,524288 --field-trial-handle=2432,i,16091863707382629545,14896967431087308867,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:14
      4⤵
      PID:3364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,16066680298443782141,6965370807584105567,524288 --field-trial-handle=2432,i,16091863707382629545,14896967431087308867,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:14
      4⤵
      PID:1160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,7876036907029753180,5423361035014872144,524288 --field-trial-handle=2432,i,16091863707382629545,14896967431087308867,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:14
      4⤵
      PID:4676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,14853165084405374625,1246812291673530293,524288 --field-trial-handle=2432,i,16091863707382629545,14896967431087308867,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:14
      4⤵
      PID:4716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,3374538554670514335,8605542752986931996,524288 --field-trial-handle=2432,i,16091863707382629545,14896967431087308867,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
      4⤵
      PID:3756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,7858275198636509634,17428762313116255077,524288 --field-trial-handle=2432,i,16091863707382629545,14896967431087308867,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:14
      4⤵
      PID:4092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,16286318606200589615,12668339530435950224,524288 --field-trial-handle=2432,i,16091863707382629545,14896967431087308867,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:14
      4⤵
      PID:2796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6372,i,528423509895681409,12404855052175344139,262144 --field-trial-handle=2432,i,16091863707382629545,14896967431087308867,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:10
      4⤵
      PID:2896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,7558319761628488346,198825229929409191,524288 --field-trial-handle=2432,i,16091863707382629545,14896967431087308867,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:14
      4⤵
      PID:3168

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5448

C:\Temp\fcxupnhfzxspkhca.sys
C:\Temp\fcxupnhfzxspkhca.sys
1⤵
- Executes dropped EXE
PID:4100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1896

C:\Temp\zxrpkhczus.sys
C:\Temp\zxrpkhczus.sys
1⤵
- Executes dropped EXE
PID:5388

C:\Temp\jeczurmhez.sys
C:\Temp\jeczurmhez.sys
1⤵
- Executes dropped EXE
PID:2804

C:\Temp\jebztromje.sys
C:\Temp\jebztromje.sys
1⤵
- Executes dropped EXE
PID:1520

C:\Temp\jgbztrljdb.sys
C:\Temp\jgbztrljdb.sys
1⤵
- Executes dropped EXE
PID:5860

C:\Temp\bytqljdbvt.sys
C:\Temp\bytqljdbvt.sys
1⤵
- Executes dropped EXE
PID:5932

C:\Temp\vtqlidaxvq.sys
C:\Temp\vtqlidaxvq.sys
1⤵
- Executes dropped EXE
PID:1140

C:\Temp\vsqkidxvtn.sys
C:\Temp\vsqkidxvtn.sys
1⤵
- Executes dropped EXE
PID:2296

C:\Temp\sqkicauspn.sys
C:\Temp\sqkicauspn.sys
1⤵
- Executes dropped EXE
PID:5240

C:\Temp\mkhcausmke.sys
C:\Temp\mkhcausmke.sys
1⤵
- Executes dropped EXE
PID:2508

C:\Temp\hczurpmkec.sys
C:\Temp\hczurpmkec.sys
1⤵
- Executes dropped EXE
PID:1540

C:\Temp\rpjgecwuom.sys
C:\Temp\rpjgecwuom.sys
1⤵
PID:2988

C:\Temp\omgeywqojg.sys
C:\Temp\omgeywqojg.sys
1⤵
PID:5040

C:\Temp\oigdyvtqli.sys
C:\Temp\oigdyvtqli.sys
1⤵
PID:5276

C:\Temp\ytqljdboif.sys
C:\Temp\ytqljdboif.sys
1⤵
PID:4572

C:\Temp\xvqoigaysq.sys
C:\Temp\xvqoigaysq.sys
1⤵
PID:2092

C:\Temp\ifaxvpnhfa.sys
C:\Temp\ifaxvpnhfa.sys
1⤵
PID:2976

C:\Temp\czxspkicax.sys
C:\Temp\czxspkicax.sys
1⤵
PID:4316

C:\Temp\pmkeczxrpm.sys
C:\Temp\pmkeczxrpm.sys
1⤵
PID:2024

C:\Temp\urmjhbzurp.sys
C:\Temp\urmjhbzurp.sys
1⤵
PID:688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bvqoigaytq.exe

Path C:\Temp\bvqoigaytq.exe
Size 384KB
SHA256 ae0f3aaed6d96ff2e6870cafe101d206e627223922782cc695bac6948f1e5613
MD5 ad37c7998dcc380e744f1bf4ec88cac6
SHA1 ba2314802ad9401895a3581f27513be3ca40a72a
SHA512 c91034dd3438439503be15267ae179a0c0767c13225adf28cf8944a8449bdcf2c9001ca2e523b3a4fa62723b2ba2c7a131be9c9ffe1b14d5369cec29cb737487
SSDEEP 3072:f9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:lctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T128847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bytqljdbvt.sys

Path C:\Temp\bytqljdbvt.sys
Size 293KB
SHA256 c5868c1261e2c3fe23be45d00e7385a38a828bf56338b6f97749cbc7905c6ee7
MD5 0f188b3fdccd7a693358159fbb32b2f4
SHA1 fcc2c1fc340786536e9a17679f28c108b7c390e8
SHA512 f6ac9d041658341248df1b29d1d958b24f1f51b63883a2c3f2c10f1c6549f7d1aed3d9eef757ff8a571621a3dc35c7ef360e8a06ec8c1ab94fb485c746c5faa0
SSDEEP 3072:+tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:+IJjiJcbI03GBc3ucY5DCSj
TLSH
T13F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bywqoljdby.exe

Path C:\Temp\bywqoljdby.exe
Size 384KB
SHA256 caaf74a54a7d3d95f1f038d33646b861b1d6610ba74ac1e2fb2b8b0c5ecc29eb
MD5 62296c62a2854ac9be0b528e3d410897
SHA1 20f53e74ebdc8a9de11a25588e96d11dd032e28e
SHA512 f89689c6a3d242bdab3e5be2e25c1e165b189f49bf52d536f5d80a9b431f4174d71734ad31f33d75c6224c4fd0f850d8f8a1b75ad8b2fc75d2b17ed9a62090c2
SSDEEP 3072:w9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:CctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T152847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbztrljdbw.exe

Path C:\Temp\dbztrljdbw.exe
Size 384KB
SHA256 6ddd0daf793d2fed829a5748067d267a38a64da84fe7fb059c11752291309c5b
MD5 71186544f56954a92d48c2c028fa63b8
SHA1 0cdaf061fe460fa06e606f7d8341b04539a51d01
SHA512 ffd962763d4d42f3cd41c64f9473cb9f18615c0f3a0e23af4853eb4cc99d0132275ddf0bb23fe1499a12718b906912610771453e5311165009331499d4d10f96
SSDEEP 3072:/9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:FctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T130847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcxupnhfzxspkhca.exe

Path C:\Temp\fcxupnhfzxspkhca.exe
Size 384KB
SHA256 af694da7141fb06f4dd5ef9b96c664ca48e4c49a27866070ef83be60b0b4f862
MD5 5f98c19b15faffdc6b45f540641cd9f3
SHA1 fffdab8b8bfd23a8ef6d7ec605a92e675c67c46e
SHA512 b421634b917462fbde9488d464d2075b699e63026c23ab251b350a58f99cefd1c5e6a6c19eaf3f5d18bc2aee3e371a947b066d23fce7a724d844bb07e73bb35a
SSDEEP 3072:l9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:HctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T169847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcxupnhfzxspkhca.sys

Path C:\Temp\fcxupnhfzxspkhca.sys
Size 293KB
SHA256 65d2a362339490a937d0b5a02cb6ad0d00162c180e8390b8124fa40427927068
MD5 c66327e666a39b6ac8dd5b99118b5051
SHA1 c7523f9b5365d2966e93fa1be8b57d791b6b5fbc
SHA512 b6253f84e2ba8d1ffb63cf4be12feb7f0aee66a9bfda1d7cd41132ac6baebb34be86d36df6e2c698bebc16324c6a49cb1be28b8358464e1e785ce2a5ca7db3ff
SSDEEP 3072:QtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:QIJjiJcbI03GBc3ucY5DCSj
TLSH
T150545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbztrljhbz.exe

Path C:\Temp\hbztrljhbz.exe
Size 384KB
SHA256 462540779e2433d02f780013ee5bfff1551728d81388062824b9cde051982920
MD5 4a59fc488585737f6daf8c67124f4878
SHA1 09cf55985a172b2e4835a36087f8e46912bb2db7
SHA512 05dbda7393b33a0b1cacb7ca14b98d504265aadb3fc0f0981aa88f867f4a1588798405b3f694e8d477383dcb84a47b8f9b6b8b4714cd1723bd62b0c359d0fec0
SSDEEP 3072:F9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:nctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T166847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfzxrpnkfc.exe

Path C:\Temp\hfzxrpnkfc.exe
Size 384KB
SHA256 ee8c45c9912db18f45cbf24e1679ad3d2ccdf994b0d713ed001f5f386b8aa53b
MD5 a227dcdd87c83fd4d9ed08b8ef9a9a47
SHA1 c2450765758414fceac5fb84b38af06ad073f096
SHA512 4ea76199e234c347397678ffd7b01e0b27dee8cde44396f1e00841eedb6c03ff7e297b95fd0c675c4f3a7a32a6c89282c5235a91d0426579d910711a9ed4c8d6
SSDEEP 3072:G9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:0ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T116847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bywqoljdby.exe

Path C:\Temp\i_bywqoljdby.exe
Size 384KB
SHA256 59cd9602e8d6e5216ad8a7b7db6a5b9b521c1e12964a5ea8116474d2d0ff597a
MD5 8dd72fd799abeff97336c6ec5eba6298
SHA1 af4ce532960d29b47ceb51cf7f6cedce8b807619
SHA512 07e91b58aad07342d182d94f1153b1cb50aadfefc1391ff7ad3d06f140c8413735ac67606fbe98148a68df6ea8f6d490d708310f9f4432c8648fb875fbb2511b
SSDEEP 3072:R9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:bctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T183847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbztrljdbw.exe

Path C:\Temp\i_dbztrljdbw.exe
Size 384KB
SHA256 7f876913a013798f43f72d18c600bef5bcf24d72480e3de2f6caf2fce932a44a
MD5 d89453b8944e7f47f2485a2109ac92a0
SHA1 31cab524c72470a5b5a2dee7bb843243d0484145
SHA512 fe00399930a38cf49b26fed5c4ff6b997b317df52a465bf10d257eb94b104885837cddc2c1cbdb9f659c5196ef8bce5bce3457dad72103e67e3b741972cef642
SSDEEP 3072:o9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:qctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T16D847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hbztrljhbz.exe

Path C:\Temp\i_hbztrljhbz.exe
Size 384KB
SHA256 e050282fbf17899d2d3accc8db0912f270a5891b689aa004738431088b2a1c94
MD5 cbb49f4a287a709af67ac27e5803ae46
SHA1 8c2c6d6ac18bbadd9223baaa90301a68e5609dfd
SHA512 8b5176c30fc0f6dfb256d04f4678aa5ebfdf5f5c36158a4b6c210ca9ea451d26423fa577181e60b903351e3611e91f566d9304862dc6937b2060cf2256bccd6c
SSDEEP 3072:/9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:FctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AE847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hfzxrpnkfc.exe

Path C:\Temp\i_hfzxrpnkfc.exe
Size 384KB
SHA256 56e789683b20ced53593c3062b3f941c9f37edf1b406957609069288691c3ab8
MD5 c968b07c7fc57c3c39e2268f3e84890e
SHA1 1b006c57ca860738e276cdb34c0495b629ae7be1
SHA512 6a62153b66d3d5ea4a4b20330c31f10264ce170d48bbe9b8dbf61b1a7c2e5d750585f5475fc8b8129ce111969b10361352538ecaa9def4a59d0daeed6cf8ace2
SSDEEP 3072:A9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:SctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T10C847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_usmkhczurm.exe

Path C:\Temp\i_usmkhczurm.exe
Size 384KB
SHA256 3bffea766827206d4fcaaabc3cc1da0e86b3d4b47f97870ee3863c86a3018346
MD5 50eeb0c36b53764b20ca10011b2f26ac
SHA1 c56b49bab920b7a30f37924d63cb2ae2c88d4e56
SHA512 68454faef7868ded29bd54d3fe0103cc99185baa06108f16682f8404c3cf782919bedeb3383150d278d476e6cc7e7270ee3082f30322450ab9c6b4eda159ac8a
SSDEEP 3072:b9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:JctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A3847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jebztromje.sys

Path C:\Temp\jebztromje.sys
Size 293KB
SHA256 19c5448e7457c5107be6c1d5e8c253ee43462a89407059b5f1f4e44adbb181cb
MD5 a8ada0ed68ab4b37b2b47b9fa557244a
SHA1 62c5edfe3e6713dbb540a6993868eeeb53c8fd3f
SHA512 4a741f76666093505f600035d4847b3393c22d8e6b2c6efe9bd4933013e452da3fe5f3d0930bc10aebff07128e6cb13a2ed1f75b889bba822f443ca58617d9d5
SSDEEP 3072:wtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:wIJjiJcbI03GBc3ucY5DCSj
TLSH
T16E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jeczurmhez.sys

Path C:\Temp\jeczurmhez.sys
Size 293KB
SHA256 9bc96ec7eb9919ba6e9851c3bc75c18cecbd8b3879a5cb66a55ffa18170deb71
MD5 c2c324a4ba4a0cd103cc3cc83a9791f3
SHA1 bd3a4a317a4eea3c4a1d05986f40d91d8a9e2c2d
SHA512 0bcfb5a5188b814d3a24d7fa1bbf6963002d060e1f1f890c58cdae1b6de5bcd1331f7fd939b5c5dec749e9895ef95326113e110789ee300f849cbe4c6266eaa5
SSDEEP 3072:rtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:rIJjiJcbI03GBc3ucY5DCSj
TLSH
T180545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgbztrljdb.sys

Path C:\Temp\jgbztrljdb.sys
Size 293KB
SHA256 3f5e569e618e8aeb229438cb64a69de0cf037382ee80ef28562363cb96f6ea04
MD5 e94637e8ee76dcbc91fc8d915935fb38
SHA1 49bd5f7b00e3a40881d4098b9081cf25d10ab880
SHA512 f8968892dcdc0a930cf579f6bd1fe28d638923f019f9d384e5d201f8548a23e2529fc516c82a0810625de5d243cd735d538b9274577f3e1875d80f3e7e264074
SSDEEP 3072:WtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:WIJjiJcbI03GBc3ucY5DCSj
TLSH
T111545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmkhczurm.exe

Path C:\Temp\usmkhczurm.exe
Size 384KB
SHA256 00dcb6958ad860f87529e0439f7eb6c50133ff007c9ec4c457cea9048471c00c
MD5 abe4c2ffa328e68548ac9b0e46b4eca1
SHA1 48e73bc537a1f7ac614bc9aa94842db84547c981
SHA512 dbf85e8f70d978e820e10173456dee53c64b0f4672514d39626787fb4416a65d9fdc97280b838d2de400099952961a2cc10680689ddd18bba488ac0fc2741a5e
SSDEEP 3072:Wz9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9L:WRctFtIJjiJcbI03GBc3ucY5DCSjXJ
TLSH
T18D847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxrpkhczus.sys

Path C:\Temp\zxrpkhczus.sys
Size 293KB
SHA256 b39796ae4fd9537e8440e537806f8fbcc9555013169b4b0032124ebfa4f4fa29
MD5 b9e828c693ff3be042a05f24cdc03972
SHA1 e45d9eac55e7eee62750ef1ec9e39a5eadd6d4e1
SHA512 04cc082f9162cbb20803ef781c02f451f6ae0fcefc360b625c952f6536283571cecc34031d01d0ba363a2c27d795c4a4800d54ffa293c7f901f2a28fa83e64ed
SSDEEP 3072:GtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:GIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D4545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 be05b8d7f0bed3c8d0e89a1a49e4bae1f45619d94149f9abd8291f558897f2f2
MD5 e02c579c3ab95f9c3a77f9c2199a30f0
SHA1 f96c7c58830f56a993117d75a3b0f9e30bfc93a7
SHA512 264a83561849b0e2a1c42c3e478b7d5a3b3fa31f901f29440fc853108e9046e73ba21a692d0dbdef7d9fd76e9b6aac64489fb603c47ab551280df09d26d7e2a4
TLSH
T140D080613B05A516D54B19729C19E7117237844224E3D9097171D11EDABD3C4F3C51E3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 86bd3a0f7328ff17cf8f5c348bd8ac04b7d41c52ef238ad0b048b09e5a964859
MD5 c6e3af776b1f4463a76e29cca079d5e5
SHA1 19b7f1bc72393d7717302ee15e0e4afa431cea45
SHA512 b15ef012a17356e47acc81e1922c433a19e6e554795a46fdf0ae05df1e9abbc87a47b05bc831bac2c6c32faad3f39c7a7cb21ae65ceb4f96f3deb3ea0d83e9c6
TLSH
T1D7D080613B05A616D54B19729C18E7117237844234E3D9097171D10EDABD3C4F3C51F7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 ae9c996e584de005a1885656d2ac400b629bdb663a5019765c453f9d599a86be
MD5 4678f1185ff588b4b5170e8f0fcde5c2
SHA1 61fd1b72a483b408346e1750e74f609fe3ac638e
SHA512 babb259b3c28acfb61b43fbda759de231406e0f87397eb9b2cfce0cbcfcc2f44108e7fa94363eeea7a70e6d911a94fc7b1037a9beb7f48077a4e9a1ad280ad4b
TLSH
T15541B2D2427108F1DB18567AA0E0278F3BF2BD36A01FFF02E9A06C74BE84F861171195
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5949a2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5949a2.TMP
Size 2KB
SHA256 e886046cea68255eda31fc27c55432999df0de7bb70a0372dfa92331ff9ab27b
MD5 1b90c97a6743b67671677c194f9309d1
SHA1 6fd08e1d337674cc788327d50f1a361ac6bf3ff6
SHA512 acbed89f61b14bd2ed1300e907b9145e8f6847c25c3acb695e522f7ed7343e06ec0f579f48dca82a1a1e59f2ba4b2e921f480e850ad329803cfda28b07712d45
TLSH
T12D41B2D2467108F5DB285A7AA0E0278F3BF2BD76901FFF02E9A45C74BE85F861072194
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 9053b04ff939d353796b39d667aee180c74863713ce17b280a52454cbc6c1ea6
MD5 38a019cf92063aa23f19fb46dcf65036
SHA1 c580e9ee423312012f5b89178489d543158eb8e5
SHA512 e94b5949e19dffcf8c459d577c5683f4c19220a1f281082606db64acc8f6ee167dc71c01835453587049db496550b08751b342313162931174bff4556ed7e2a2
TLSH
T11851BCF7C3E8866E8A0186F0BA147E2BDE1D0915832C3D5AC9E4AF1B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 18fae2b72aaddb23fdc79b029bce377fca75143b97195d6092e2d7d60358b5b8
MD5 d08c61f3f55f0a10edbed3c79e2a7acf
SHA1 d2629dcb06a49c0f15c1fe6a13f7f2bfb2c6d1d3
SHA512 6a25036d890c635573b9d0f1683a86e882511dbd40ac280a9b0c835de5786554aa13969cc90ca9e1ca8ffeac6261f2236adb34c6f66948986f636e2e65565ad4
SSDEEP 192:sxR2RIyM/jK1Ml8wc//fvsT45ZrKBVzoA8p9U/g6+WNCHl/YAbzwWgYYGfIgtJ:sxR2mC//fvsT4XWB4G/58/rwWgYj3
TLSH
T14262FB166A349977CCDBD209FA957B53D2F81573A2901E44AAFCCB0C05E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 188a2b04d472e46d62f101ea6948488b1b313a47e7769b9804535d6693211ec9
MD5 b53a98426c4dadf255724c8147b24c92
SHA1 67e98cd2815b2dd460afb7e5c67c83a8c8dc1ad8
SHA512 cf25350c5a8100dd12edd216ec728bbd03ad48bd5b52579eca03aa28351e26d26d3b241bbaf6d0b70511e084f3bb6fdcbecca6628d614a0d0e04c99e8ebb9b64
SSDEEP 192:sxRNRIyM/jK1Ml8wc//fvsH45ZrKBVzoA8p9U/g6+WNCHl/YAbzwWgYYGfIgDYJ:sxRNmC//fvsH4XWB4G/58/rwWgYjI
TLSH
T1FF62EA166A349977CCDBD209FA957B53D2F80573A2901E44AAFCCB0C05E7ADC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 866856d9dda0ac869154c782453489c7a8be1ce58da3f3f85362f294f4f68c28
MD5 c1ce94fbc0360fa9ac797ee564f1a134
SHA1 decf0a17e9145526c322c58ff36247e19ce7d8ef
SHA512 0d5ec048f607c4cef26b684779500ad8f0ae690a8b1e4b0d2239fb833a9e3c73abeb6ab4604e3451ab6e5b0b5419d3a88d1455555a36ea4b35d701ab2c6f81ba
SSDEEP 192:sxRNRIyM/jK1Ml8UQ7c//fvsHa5ZrKBVzoA8prU/g6+WNCHl/YA/zwWgYYGfIgDq:sxRNmqg//fvsHaXWB4A/58/PwWgYjm
TLSH
T1F862E916A9349977CCDBD209FA917B53D2F85573A2940E44AAFCCB0C01E7ADD621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 76651b85a5c9c246baabf73621e7120c8b1bed2abd6267140d347f90498400c7
MD5 6e75a9adfb1ef56de1b6e653c6f12a2f
SHA1 6f6b08d31a054b76dbdf4040a5bde8bffb14197a
SHA512 d08952c0b68f68737f7d377359b5852502d11e1fec4ac3b0dab88cef26125d33130d81fe2d733ac4d97a83fb019dd369ef7b517cf9b49794cc43fedb15ecec9e
SSDEEP 768:l1AvbY7pLuL7j+WgI+f2z8F1+UoAYDCx9Tuqh0VfUC9xbog/OV4lD7zVvro9sVg:l1AvbEE7j+WgI+f2zu1ja3lD/V8SVg
TLSH
T126E2FC3B680CCB7E4F84499CEC29BE9F6DA801CF96988D5447EA840C03C67EF551A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6ff3b8192770d4c592feb453b631a09d48f36f3f73ef33ce599774895fae3fcb
MD5 b89c767a40a109761528bef00f0e9ac8
SHA1 c2247afaa778aa557871e9b330dc024a5ea2c750
SHA512 2f2d59912a8f85109ac3eea0617a2b43f138f0f6a64dd38949305382df0e155a8b92f7e134772605efbdf18f01b84379df8e91d50f3f53661da5fa68ce496858
SSDEEP 48:K2JSt5/rXknrAPIARkKVBN3kBZ0ig/Z5y8MRgsSaa+sqflIlM+K6LC2+uUuHXm9I:K8SYKnqeeXiKwMjhyKKUciS
TLSH
T1CDA17DA27A3B260139FDB94940D5976FB64230777119A42B37F924E24E6AE001EFCDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00f2b859-a92d-402c-a1ff-4e5092aab2d1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\00f2b859-a92d-402c-a1ff-4e5092aab2d1.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a0ae0838c527c9a1b8e246080db3967424e1b55f5d1fb1fc3d6f016d44281d09
MD5 0a98a99bb5a4ab3457e04a92e303e30f
SHA1 91daa0cb43505f3f3dfd4559f0ebddc79ba254c6
SHA512 96231d5a4fdd85838878857ecfce1a1be07b863214ab75844a5b3c809164eb2e2b65db8f7589438898c560d1ef68e76a4b09b821595f75afe398d225b81d5c57
SSDEEP 768:ojaeqD4MlshiLdMmp3zy5jN5BwT7VWs+DoLSpG0/TIoFeY+ApXGFTX:oqcjhIdMC3xVmoTiT0Y+KXi
TLSH
T12203B07AA8A89D739CB6C7C1764BA6432F744353C6C83FD8D9DD6A0D01972DD630382A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b307c2b8955605e591dc177462398fa0e9eab6e42659a7a64deb682d59f7eea2
MD5 18207d655b808032ff4d62762fa9dd0a
SHA1 7f20b0db8f1000981107f5939ccd3f4731d5e78c
SHA512 6834a68c8a3c7319d427ff19cbb76fd41c52a086f46daa4446beecd9f19f6176c065b8c58596b68dd0b005ac7637ec61ccf16026d5dde414b22286de0fdcaaa1
SSDEEP 768:bj+993cPOij95BwT7VWs+DoLSpG0/TIo5tzn12bfJH:O993ccVmoTiTHByJH
TLSH
T134F2AE71E4689D339CE7C7C5765B67872FA04263C5C92A88C5ECAB0E09C739D2707D2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b506ec41be59404c48de128b605ffaafe556b45d584e162d0a163be0f9ac8b10
MD5 497f217a73514d1accb1498074af87b6
SHA1 b9f0494eeffaee6763d9844a9f82a37888b422cc
SHA512 59509630756fd0b6e21929eec6fadbe55be168ca729000546de8891134abe42751b8b9a682ddb04ceef414125335e5a937b36dfc56f58acbaae8f946122c8363
SSDEEP 768:bj+993VPOij95BwT7VWs+DoLSpG0/TIo5tzn12bfJH:O993VcVmoTiTHByJH
TLSH
T1E1F2AE71F4689D339CE7C7C5765B67872FA04263C5C92A88C5EC6A0E09C739D2707C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 5212ed9dea9512c955ecb619ae6a82c244c3580fcb792b9e7d7139a20c20de7d
MD5 d503db0a01d370cbd03f07d70c85b41b
SHA1 7a72cee7a961e7729a8effa13337335f8f3dbe98
SHA512 29ef0d018492a13a973f25850356d6deca9389fd6f0b4ff9cf34764c5f948dc0ecffd3134d1b6ec8ce0965a0fcd1d47c74155c0d2eaa8edcf18fe9ffa22b3757
SSDEEP 768:EjaeqD4MlshiLdMmL3hPtij05BwT7VWs+DoLSpG0/TIo5tkTf:EqcjhIdMY3hWVmoTiTHo
TLSH
T1A903CF75B8A89C739CA7C781764776831FB00263C5C93F8CD9DD6A0D05872DE274782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 4a8ab29df4712250eda343da67b6641aed2725ca391edfa273d5a92451564994
MD5 0825193601881abe70608b2d7590a4e8
SHA1 ef161aacb7d9b993833719c116b20678bb2f3235
SHA512 9573e0f538f17f9a18fadebe2c83e0c155d08db512530100e6944c0714085f93cf2eaf12d1f4173add6f2d4aa956bb9c5096723b1e3de70cca19c91fe7b55727
SSDEEP 768:TF1j+9S3qwgVPH/Xh5BwT7VWs+DoLSpG0/TIo5tzn12bfJH:C9S3OoVmoTiTHByJH
TLSH
T1021338F194D79932E89E8783673E6E425EBCC263B4882984F7D85D0DCC822BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

235acd9b-20dc-4b26-a31a-7b79284edaf1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\235acd9b-20dc-4b26-a31a-7b79284edaf1.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5424_1365690805\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 61c2b8ee455e812b3ad6738bfa56c334f52f8fe4496d932689e03f502db48f26
MD5 e063c946a70813df7465eb1f1cc7ea6f
SHA1 29a430d5b3c85badeaf165b791fb4705fdeabf01
SHA512 07a1ec152ae2184bcf502ea4888b72db4d154f1159a7d8732209cf3f8a9fceec27c59a470f8dee8689ef60cc25c6868ec52041b745aef552cc34e1642c5d65ec
TLSH
T15A71238357ADC6F2C1DA5FF102835748F2FB2378076330204751594AAB34B3A54B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/688-513-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1140-330-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1520-276-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1540-384-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2024-496-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2092-459-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2296-335-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2508-354-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2804-247-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2804-282-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2976-464-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2988-404-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4100-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4316-484-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4572-448-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5040-424-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5240-377-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5240-350-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5276-428-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5388-253-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5388-200-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5860-289-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5860-326-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5932-304-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5932-331-0x0000000000010000-0x00000000000AB000-memory.dmp

Download