systex | a94848bf61ec0843845107ffe6adb6f3d2c96716a1e7f349ab134549fdcebc3d

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 07:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260629-jetddsgs7v
SHA256 a94848bf61ec0843845107ffe6adb6f3d2c96716a1e7f349ab134549fdcebc3d
MD5 4e4ed544225537d6ba96bb41fbdd6925
SHA1 957cf4d476ec3ca64fe9518a793c2a0751d0cfa3
SHA512 8d75c1fb8098861101fb395f5805ed6942dca0c4edc12ba7ade6236e9e0177815e71b63f3e24508ddb1b6c84de985b2427dfe1de0cc03d3c0d5c8d2de3c7c55a
SSDEEP 3072:AO6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:R6QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T153847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
2832	qkidavsnlfdxvpni.exe
1464	qkidavsnlfdxvpni.sys
4764	CreateProcess.exe
1764	vqnifaxsqn.exe
3456	CreateProcess.exe
6064	CreateProcess.exe
4076	i_vqnifaxsqn.exe
1120	nhfcavsnlf.sys
3172	CreateProcess.exe
1336	uspkifaxvp.exe
5456	CreateProcess.exe
2548	CreateProcess.exe
5952	i_uspkifaxvp.exe
2368	spnkfcxupn.sys
708	CreateProcess.exe
1960	smkecxupnh.exe
4704	CreateProcess.exe
5144	CreateProcess.exe
2808	i_smkecxupnh.exe
5096	mhfzxrpjhc.sys
6068	CreateProcess.exe
4460	jhfcwuomjh.exe
5940	CreateProcess.exe
5500	CreateProcess.exe
2280	i_jhfcwuomjh.exe
1212	kebztromge.sys
1472	CreateProcess.exe
712	jecwrpjeyw.exe
6128	CreateProcess.exe
1792	CreateProcess.exe
4536	i_jecwrpjeyw.exe
3680	ebztrljebw.sys
6056	CreateProcess.exe
2604	ywqojdbztr.exe
5664	CreateProcess.exe
1172	CreateProcess.exe
5676	i_ywqojdbztr.exe
2612	ytrljgeyvt.sys
2060	CreateProcess.exe
1748	bywtoljgbv.exe
2928	CreateProcess.exe
2052	CreateProcess.exe
4796	i_bywtoljgbv.exe
4772	gaywqolgdy.sys
3020	CreateProcess.exe
2712	bytqlidbvt.exe
3420	CreateProcess.exe
2964	CreateProcess.exe
2816	i_bytqlidbvt.exe
5864	vsnkidavsq.sys
4928	CreateProcess.exe
504	sqnlfdyvpn.exe
1584	CreateProcess.exe
3400	CreateProcess.exe
5676	i_sqnlfdyvpn.exe
1832	qnkicaxvpn.sys
4280	CreateProcess.exe
5464	nhfaxvpnic.exe
2924	CreateProcess.exe
5324	CreateProcess.exe
968	i_nhfaxvpnic.exe
2340	dxvpnifaxs.sys
436	CreateProcess.exe
1772	xvpnhfaxsp.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_1620236849\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_13904197\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_13904197\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_856570759\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_1620236849\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_146727503\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_146727503\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_13904197\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2776_13904197\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkidavsnlfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqnifaxsqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhfcwuomjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqojdbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytqlidbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrmjeczur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgayvqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdavqfaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uspkifaxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnhfaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnhfaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztromgebzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigbytqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxusnhfaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqnlfdyvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztromgebzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigbytqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpkhczusp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqnifaxsqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uspkifaxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jecwrpjeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrmjeczur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpkhczusp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkecxupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqojdbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfaxvpnic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdavqfaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkecxupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bywtoljgbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bytqlidbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfaxvpnic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smjhczxrpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smjhczxrpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgayvqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jecwrpjeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bywtoljgbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhfcwuomjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqnlfdyvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxusnhfaxs.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3696	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5584	ipconfig.exe
5660	ipconfig.exe
1380	ipconfig.exe
5788	ipconfig.exe
5920	ipconfig.exe
5004	ipconfig.exe
3232	ipconfig.exe
1952	ipconfig.exe
4900	ipconfig.exe
3984	ipconfig.exe
5028	ipconfig.exe
5108	ipconfig.exe
3144	ipconfig.exe
1276	ipconfig.exe
2500	ipconfig.exe
1684	ipconfig.exe
1192	ipconfig.exe
1784	ipconfig.exe
5752	ipconfig.exe
3232	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-487906980-2895880840-1957110281-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134271921299207068"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-487906980-2895880840-1957110281-1000\{CB16A096-BA34-4C1A-AB16-A1163A542A8D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2832	qkidavsnlfdxvpni.exe
2832	qkidavsnlfdxvpni.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2832	qkidavsnlfdxvpni.exe
2832	qkidavsnlfdxvpni.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2832	qkidavsnlfdxvpni.exe
2832	qkidavsnlfdxvpni.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2832	qkidavsnlfdxvpni.exe
2832	qkidavsnlfdxvpni.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4076	i_vqnifaxsqn.exe
Token: SeDebugPrivilege	5952	i_uspkifaxvp.exe
Token: SeDebugPrivilege	2808	i_smkecxupnh.exe
Token: SeDebugPrivilege	2280	i_jhfcwuomjh.exe
Token: SeDebugPrivilege	4536	i_jecwrpjeyw.exe
Token: SeDebugPrivilege	5676	i_ywqojdbztr.exe
Token: SeDebugPrivilege	4796	i_bywtoljgbv.exe
Token: SeDebugPrivilege	2816	i_bytqlidbvt.exe
Token: SeDebugPrivilege	5676	i_sqnlfdyvpn.exe
Token: SeDebugPrivilege	968	i_nhfaxvpnic.exe
Token: SeDebugPrivilege	4800	i_xvpnhfaxsp.exe
Token: SeDebugPrivilege	4076	i_smjhczxrpk.exe
Token: SeDebugPrivilege	1700	i_ztrmjeczur.exe
Token: SeDebugPrivilege	5096	i_ztromgebzt.exe
Token: SeDebugPrivilege	1476	i_jhbywqojgb.exe
Token: SeDebugPrivilege	1628	i_oigbytqljd.exe
Token: SeDebugPrivilege	6076	i_lgayvqniga.exe
Token: SeDebugPrivilege	2276	i_fdavqfaxsq.exe
Token: SeDebugPrivilege	1908	i_dxusnhfaxs.exe
Token: SeDebugPrivilege	4832	i_xrpkhczusp.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2776	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 2832	2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe	89
PID 2948 wrote to memory of 6060	2948	2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe	90
PID 6060 wrote to memory of 2776	6060	iexplore.exe	91
PID 2776 wrote to memory of 1448	2776	msedge.exe	92
PID 2776 wrote to memory of 916	2776	msedge.exe	93
PID 2776 wrote to memory of 3696	2776	msedge.exe	94
PID 2776 wrote to memory of 916	2776	msedge.exe	93
PID 2776 wrote to memory of 916	2776	msedge.exe	93
PID 2776 wrote to memory of 2768	2776	msedge.exe	95
PID 2776 wrote to memory of 2768	2776	msedge.exe	95
PID 2776 wrote to memory of 5880	2776	msedge.exe	97
PID 2776 wrote to memory of 5880	2776	msedge.exe	97
PID 2776 wrote to memory of 5880	2776	msedge.exe	97
PID 2776 wrote to memory of 2876	2776	msedge.exe	98
PID 2776 wrote to memory of 2876	2776	msedge.exe	98
PID 2776 wrote to memory of 2876	2776	msedge.exe	98
PID 2776 wrote to memory of 5544	2776	msedge.exe	99
PID 2776 wrote to memory of 5544	2776	msedge.exe	99
PID 2776 wrote to memory of 5544	2776	msedge.exe	99
PID 2776 wrote to memory of 5044	2776	msedge.exe	100
PID 2776 wrote to memory of 5044	2776	msedge.exe	100
PID 2776 wrote to memory of 5044	2776	msedge.exe	100
PID 2776 wrote to memory of 5004	2776	msedge.exe	101
PID 2776 wrote to memory of 5004	2776	msedge.exe	101
PID 2832 wrote to memory of 4764	2832	qkidavsnlfdxvpni.exe	105
PID 1764 wrote to memory of 3456	1764	vqnifaxsqn.exe	108
PID 2776 wrote to memory of 5864	2776	msedge.exe	111
PID 2776 wrote to memory of 5668	2776	msedge.exe	112
PID 2776 wrote to memory of 5864	2776	msedge.exe	111
PID 2776 wrote to memory of 5668	2776	msedge.exe	112
PID 2776 wrote to memory of 1276	2776	msedge.exe	114
PID 2776 wrote to memory of 4792	2776	msedge.exe	115
PID 2776 wrote to memory of 4792	2776	msedge.exe	115
PID 2776 wrote to memory of 4440	2776	msedge.exe	116
PID 2776 wrote to memory of 4440	2776	msedge.exe	116
PID 2832 wrote to memory of 6064	2832	qkidavsnlfdxvpni.exe	119
PID 2832 wrote to memory of 3172	2832	qkidavsnlfdxvpni.exe	123
PID 1336 wrote to memory of 5456	1336	uspkifaxvp.exe	125
PID 2832 wrote to memory of 2548	2832	qkidavsnlfdxvpni.exe	128
PID 2832 wrote to memory of 708	2832	qkidavsnlfdxvpni.exe	132
PID 1960 wrote to memory of 4704	1960	smkecxupnh.exe	134
PID 2832 wrote to memory of 5144	2832	qkidavsnlfdxvpni.exe	137
PID 2832 wrote to memory of 6068	2832	qkidavsnlfdxvpni.exe	141
PID 4460 wrote to memory of 5940	4460	jhfcwuomjh.exe	143
PID 2832 wrote to memory of 5500	2832	qkidavsnlfdxvpni.exe	147
PID 2776 wrote to memory of 1908	2776	msedge.exe	149
PID 2776 wrote to memory of 2712	2776	msedge.exe	150
PID 2776 wrote to memory of 3952	2776	msedge.exe	151
PID 2832 wrote to memory of 1472	2832	qkidavsnlfdxvpni.exe	154
PID 712 wrote to memory of 6128	712	jecwrpjeyw.exe	156
PID 2832 wrote to memory of 1792	2832	qkidavsnlfdxvpni.exe	159
PID 2832 wrote to memory of 6056	2832	qkidavsnlfdxvpni.exe	163
PID 2604 wrote to memory of 5664	2604	ywqojdbztr.exe	165
PID 2832 wrote to memory of 1172	2832	qkidavsnlfdxvpni.exe	168
PID 2832 wrote to memory of 2060	2832	qkidavsnlfdxvpni.exe	172
PID 1748 wrote to memory of 2928	1748	bywtoljgbv.exe	174
PID 2832 wrote to memory of 2052	2832	qkidavsnlfdxvpni.exe	177
PID 2832 wrote to memory of 3020	2832	qkidavsnlfdxvpni.exe	181
PID 2712 wrote to memory of 3420	2712	bytqlidbvt.exe	183
PID 2832 wrote to memory of 2964	2832	qkidavsnlfdxvpni.exe	186
PID 2776 wrote to memory of 1548	2776	msedge.exe	188
PID 2776 wrote to memory of 1548	2776	msedge.exe	188
PID 2832 wrote to memory of 4928	2832	qkidavsnlfdxvpni.exe	194
PID 504 wrote to memory of 1584	504	sqnlfdyvpn.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_4e4ed544225537d6ba96bb41fbdd6925_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Temp\qkidavsnlfdxvpni.exe
  C:\Temp\qkidavsnlfdxvpni.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2832
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vqnifaxsqn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4764
  - - C:\Temp\vqnifaxsqn.exe
      C:\Temp\vqnifaxsqn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1764
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3456
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vqnifaxsqn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6064
  - - C:\Temp\i_vqnifaxsqn.exe
      C:\Temp\i_vqnifaxsqn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4076
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uspkifaxvp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3172
  - - C:\Temp\uspkifaxvp.exe
      C:\Temp\uspkifaxvp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1336
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5456
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1684
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uspkifaxvp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2548
  - - C:\Temp\i_uspkifaxvp.exe
      C:\Temp\i_uspkifaxvp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5952
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\smkecxupnh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:708
  - - C:\Temp\smkecxupnh.exe
      C:\Temp\smkecxupnh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1960
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4704
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1192
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_smkecxupnh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5144
  - - C:\Temp\i_smkecxupnh.exe
      C:\Temp\i_smkecxupnh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhfcwuomjh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6068
  - - C:\Temp\jhfcwuomjh.exe
      C:\Temp\jhfcwuomjh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4460
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5940
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5660
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhfcwuomjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5500
  - - C:\Temp\i_jhfcwuomjh.exe
      C:\Temp\i_jhfcwuomjh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2280
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jecwrpjeyw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1472
  - - C:\Temp\jecwrpjeyw.exe
      C:\Temp\jecwrpjeyw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:712
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6128
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5028
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jecwrpjeyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1792
  - - C:\Temp\i_jecwrpjeyw.exe
      C:\Temp\i_jecwrpjeyw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4536
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywqojdbztr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6056
  - - C:\Temp\ywqojdbztr.exe
      C:\Temp\ywqojdbztr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2604
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5664
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5108
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywqojdbztr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1172
  - - C:\Temp\i_ywqojdbztr.exe
      C:\Temp\i_ywqojdbztr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5676
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bywtoljgbv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2060
  - - C:\Temp\bywtoljgbv.exe
      C:\Temp\bywtoljgbv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1748
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2928
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bywtoljgbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2052
  - - C:\Temp\i_bywtoljgbv.exe
      C:\Temp\i_bywtoljgbv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bytqlidbvt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3020
  - - C:\Temp\bytqlidbvt.exe
      C:\Temp\bytqlidbvt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2712
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3420
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1784
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bytqlidbvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2964
  - - C:\Temp\i_bytqlidbvt.exe
      C:\Temp\i_bytqlidbvt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqnlfdyvpn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4928
  - - C:\Temp\sqnlfdyvpn.exe
      C:\Temp\sqnlfdyvpn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:504
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1584
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3232
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqnlfdyvpn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3400
  - - C:\Temp\i_sqnlfdyvpn.exe
      C:\Temp\i_sqnlfdyvpn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5676
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nhfaxvpnic.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4280
  - - C:\Temp\nhfaxvpnic.exe
      C:\Temp\nhfaxvpnic.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5464
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2924
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3144
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nhfaxvpnic.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5324
  - - C:\Temp\i_nhfaxvpnic.exe
      C:\Temp\i_nhfaxvpnic.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:968
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvpnhfaxsp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:436
  - - C:\Temp\xvpnhfaxsp.exe
      C:\Temp\xvpnhfaxsp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1772
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1668
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1952
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvpnhfaxsp.exe ups_ins
    3⤵
    PID:5952
  - - C:\Temp\i_xvpnhfaxsp.exe
      C:\Temp\i_xvpnhfaxsp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4800
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\smjhczxrpk.exe ups_run
    3⤵
    PID:3044
  - - C:\Temp\smjhczxrpk.exe
      C:\Temp\smjhczxrpk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4404
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2960
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5752
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_smjhczxrpk.exe ups_ins
    3⤵
    PID:4316
  - - C:\Temp\i_smjhczxrpk.exe
      C:\Temp\i_smjhczxrpk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4076
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ztrmjeczur.exe ups_run
    3⤵
    PID:568
  - - C:\Temp\ztrmjeczur.exe
      C:\Temp\ztrmjeczur.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2816
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5828
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1276
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ztrmjeczur.exe ups_ins
    3⤵
    PID:4508
  - - C:\Temp\i_ztrmjeczur.exe
      C:\Temp\i_ztrmjeczur.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1700
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ztromgebzt.exe ups_run
    3⤵
    PID:4976
  - - C:\Temp\ztromgebzt.exe
      C:\Temp\ztromgebzt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5932
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6044
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3232
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ztromgebzt.exe ups_ins
    3⤵
    PID:2304
  - - C:\Temp\i_ztromgebzt.exe
      C:\Temp\i_ztromgebzt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5096
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhbywqojgb.exe ups_run
    3⤵
    PID:2672
  - - C:\Temp\jhbywqojgb.exe
      C:\Temp\jhbywqojgb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6008
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1220
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5788
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhbywqojgb.exe ups_ins
    3⤵
    PID:4604
  - - C:\Temp\i_jhbywqojgb.exe
      C:\Temp\i_jhbywqojgb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1476
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oigbytqljd.exe ups_run
    3⤵
    PID:3216
  - - C:\Temp\oigbytqljd.exe
      C:\Temp\oigbytqljd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5460
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4464
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5920
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oigbytqljd.exe ups_ins
    3⤵
    PID:2792
  - - C:\Temp\i_oigbytqljd.exe
      C:\Temp\i_oigbytqljd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1628
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lgayvqniga.exe ups_run
    3⤵
    PID:5504
  - - C:\Temp\lgayvqniga.exe
      C:\Temp\lgayvqniga.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5992
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5892
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5004
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lgayvqniga.exe ups_ins
    3⤵
    PID:2576
  - - C:\Temp\i_lgayvqniga.exe
      C:\Temp\i_lgayvqniga.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6076
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdavqfaxsq.exe ups_run
    3⤵
    PID:2584
  - - C:\Temp\fdavqfaxsq.exe
      C:\Temp\fdavqfaxsq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5448
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4564
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5584
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdavqfaxsq.exe ups_ins
    3⤵
    PID:4440
  - - C:\Temp\i_fdavqfaxsq.exe
      C:\Temp\i_fdavqfaxsq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2276
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dxusnhfaxs.exe ups_run
    3⤵
    PID:1348
  - - C:\Temp\dxusnhfaxs.exe
      C:\Temp\dxusnhfaxs.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5916
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5384
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4900
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dxusnhfaxs.exe ups_ins
    3⤵
    PID:4820
  - - C:\Temp\i_dxusnhfaxs.exe
      C:\Temp\i_dxusnhfaxs.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpkhczusp.exe ups_run
    3⤵
    PID:3544
  - - C:\Temp\xrpkhczusp.exe
      C:\Temp\xrpkhczusp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5844
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3520
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2500
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpkhczusp.exe ups_ins
    3⤵
    PID:1844
  - - C:\Temp\i_xrpkhczusp.exe
      C:\Temp\i_xrpkhczusp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4832
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:6060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x368,0x7ffa2a3dc188,0x7ffa2a3dc194,0x7ffa2a3dc1a0
      4⤵
      PID:1448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,8737148053861425606,5042647276057859106,262144 --field-trial-handle=2572,i,10934800776019131230,2906849627573956191,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:2
      4⤵
      PID:916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,17165644559786519280,15000904505480521298,524288 --field-trial-handle=2572,i,10934800776019131230,2906849627573956191,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:11
      4⤵
      System Time Discovery
      PID:3696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2264,i,16902728860384653956,10563232394800473956,524288 --field-trial-handle=2572,i,10934800776019131230,2906849627573956191,262144 --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:13
      4⤵
      PID:2768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,8002452271836575336,2655810927331723026,2097152 --field-trial-handle=2572,i,10934800776019131230,2906849627573956191,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
      4⤵
      PID:5880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,17597395097948865315,8419794995302297586,2097152 --field-trial-handle=2572,i,10934800776019131230,2906849627573956191,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      PID:2876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,7430545232110217279,17514137576392288889,2097152 --field-trial-handle=2572,i,10934800776019131230,2906849627573956191,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:1
      4⤵
      PID:5544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,6679800844728458888,15153036664337985620,2097152 --field-trial-handle=2572,i,10934800776019131230,2906849627573956191,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:9
      4⤵
      PID:5044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,604787362421865019,6172645387091285219,524288 --field-trial-handle=2572,i,10934800776019131230,2906849627573956191,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
      4⤵
      PID:5004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3708,i,1822910243796527563,8704354678473130682,524288 --field-trial-handle=2572,i,10934800776019131230,2906849627573956191,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:14
      4⤵
      PID:5864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,2966590493827082491,17542670964828196522,524288 --field-trial-handle=2572,i,10934800776019131230,2906849627573956191,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
      4⤵
      PID:5668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,5400897933839470524,17674198724075668121,524288 --field-trial-handle=2572,i,10934800776019131230,2906849627573956191,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:14
      4⤵
      PID:5448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,5400897933839470524,17674198724075668121,524288 --field-trial-handle=2572,i,10934800776019131230,2906849627573956191,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:14
      4⤵
      PID:1276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,9937340451125983576,15003741854791127696,524288 --field-trial-handle=2572,i,10934800776019131230,2906849627573956191,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
      4⤵
      PID:4792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,18135620740567781482,11732683360886364925,524288 --field-trial-handle=2572,i,10934800776019131230,2906849627573956191,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:14
      4⤵
      PID:4440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,6994740839777364294,4640129603703541208,524288 --field-trial-handle=2572,i,10934800776019131230,2906849627573956191,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:14
      4⤵
      PID:1908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,2635579885108233622,8052338602789370487,524288 --field-trial-handle=2572,i,10934800776019131230,2906849627573956191,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:14
      4⤵
      PID:2712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,4841903260090892717,8237498679999191807,524288 --field-trial-handle=2572,i,10934800776019131230,2906849627573956191,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
      4⤵
      PID:3952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5588,i,8249079877945655688,8886663865379254432,524288 --field-trial-handle=2572,i,10934800776019131230,2906849627573956191,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:14
      4⤵
      PID:1548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,1885261186660208104,9261059400873351200,524288 --field-trial-handle=2572,i,10934800776019131230,2906849627573956191,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:14
      4⤵
      PID:1908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,12666024555092726179,18417633054830271840,524288 --field-trial-handle=2572,i,10934800776019131230,2906849627573956191,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:14
      4⤵
      PID:3984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,441249355916941029,3137722131251559075,524288 --field-trial-handle=2572,i,10934800776019131230,2906849627573956191,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:14
      4⤵
      PID:1796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6560,i,7887957135600454429,9859600917977335543,262144 --field-trial-handle=2572,i,10934800776019131230,2906849627573956191,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:10
      4⤵
      PID:6036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3884,i,12545178070953630929,6967485783372911345,524288 --field-trial-handle=2572,i,10934800776019131230,2906849627573956191,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:14
      4⤵
      PID:5880

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2712

C:\Temp\qkidavsnlfdxvpni.sys
C:\Temp\qkidavsnlfdxvpni.sys
1⤵
- Executes dropped EXE
PID:1464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4520

C:\Temp\nhfcavsnlf.sys
C:\Temp\nhfcavsnlf.sys
1⤵
- Executes dropped EXE
PID:1120

C:\Temp\spnkfcxupn.sys
C:\Temp\spnkfcxupn.sys
1⤵
- Executes dropped EXE
PID:2368

C:\Temp\mhfzxrpjhc.sys
C:\Temp\mhfzxrpjhc.sys
1⤵
- Executes dropped EXE
PID:5096

C:\Temp\kebztromge.sys
C:\Temp\kebztromge.sys
1⤵
- Executes dropped EXE
PID:1212

C:\Temp\ebztrljebw.sys
C:\Temp\ebztrljebw.sys
1⤵
- Executes dropped EXE
PID:3680

C:\Temp\ytrljgeyvt.sys
C:\Temp\ytrljgeyvt.sys
1⤵
- Executes dropped EXE
PID:2612

C:\Temp\gaywqolgdy.sys
C:\Temp\gaywqolgdy.sys
1⤵
- Executes dropped EXE
PID:4772

C:\Temp\vsnkidavsq.sys
C:\Temp\vsnkidavsq.sys
1⤵
- Executes dropped EXE
PID:5864

C:\Temp\qnkicaxvpn.sys
C:\Temp\qnkicaxvpn.sys
1⤵
- Executes dropped EXE
PID:1832

C:\Temp\dxvpnifaxs.sys
C:\Temp\dxvpnifaxs.sys
1⤵
- Executes dropped EXE
PID:2340

C:\Temp\spnheczurp.sys
C:\Temp\spnheczurp.sys
1⤵
PID:1628

C:\Temp\xrpmhezxrp.sys
C:\Temp\xrpmhezxrp.sys
1⤵
PID:4860

C:\Temp\hbztrmjhbz.sys
C:\Temp\hbztrmjhbz.sys
1⤵
PID:4440

C:\Temp\jgeywtrljg.sys
C:\Temp\jgeywtrljg.sys
1⤵
PID:5104

C:\Temp\oigaytqljd.sys
C:\Temp\oigaytqljd.sys
1⤵
PID:4968

C:\Temp\wqoigdyoig.sys
C:\Temp\wqoigdyoig.sys
1⤵
PID:3408

C:\Temp\lfdxvqnlga.sys
C:\Temp\lfdxvqnlga.sys
1⤵
PID:2608

C:\Temp\faxsqkifdx.sys
C:\Temp\faxsqkifdx.sys
1⤵
PID:1888

C:\Temp\auspkhczxr.sys
C:\Temp\auspkhczxr.sys
1⤵
PID:3952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CreateProcess.exe

Path C:\Temp\CreateProcess.exe
Size 3KB
SHA256 fb21cdab3ed2f7511645d2c630f50d45086ffe200744b0fe7f40655be90382b9
MD5 a7c9300b590af06d9995c477cdb69604
SHA1 94ef162283bd3ff05fe3e887c6059dc8e44add69
SHA512 1c66161fbfefc46306525dd2adf9e5a1efc10d7e6552699228c046ff417bc35cca6059d23638e5c483c2d34d54f47026423325c791266a9f4c36d40771952241
TLSH
T15271239356A9C9B3C2DE5FF902835648F2FF23380B23702007955587AB70A3A54B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

ebztrljebw.sys

Path C:\Temp\ebztrljebw.sys
Size 293KB
SHA256 df6eeddad5026f16c37b0dcf0b47f6cb89e271da3b2fac67b21b541f75b16503
MD5 10f402322a299c474eebffbc9f742619
SHA1 5eb150281cfeb7c44faabbb0cffeba1472c21f1f
SHA512 0fcc765b63bef87566a3fd63dd32e1bda1281ab67ab0b31660224687bc48409a6686619a49489d1eb39adbe0741768b7e55ae763dc8038080054f0a211d1142f
SSDEEP 3072:btKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:bIJjiJcbI03GBc3ucY5DCSj
TLSH
T168545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jecwrpjeyw.exe

Path C:\Temp\i_jecwrpjeyw.exe
Size 384KB
SHA256 e3c45c2e24bf286ccd4a60d699c095250388eeaeda8a48481c0966bdab3ba5ae
MD5 b3f757501b9473eeed94a33ac32d4051
SHA1 3f57f74fff878620d5354fbc0b05acb99190e8c6
SHA512 ee12e310bf42083f554d352983c20c6985093ddb1e95fed34fc37b47c1a07770fccb720f4d488bc40db50d50292b717316ea6866c3a4851d81f8da7e017f3565
SSDEEP 3072:cO6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:N6QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A5847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jhfcwuomjh.exe

Path C:\Temp\i_jhfcwuomjh.exe
Size 384KB
SHA256 9a9e86c70b177c1c57f652b8f507bebc1c4c80c7b0f780ab5654334eac0740bc
MD5 e26845b8df76dde36a0fd387751938cf
SHA1 10185885e419c3e1f2176c2192406e8186ab2d44
SHA512 fbfc0ab5679f461e1fbab8af5696b89c95f1f69a397cbdc536130b19d1e9fc29a0f3c05a3e088da24bf3e18cdbc6224f7f39f8b77b1d8b51daeb9b691ddca737
SSDEEP 3072:wO6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:h6QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T137847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_smkecxupnh.exe

Path C:\Temp\i_smkecxupnh.exe
Size 384KB
SHA256 8cb4c3fb4ba9128f482e46f626177e795cbe10273964f534b983a6356754e72c
MD5 4f4a2a52db4a1e663c8575aede8949e6
SHA1 bd665b3c469abe3dc0c5d53de63c0b674f97c945
SHA512 a819c32b0da52e7afe32b300991c3f6099115eecb5b7ba33caa7bb822e9c148ee6dc41b7ecd7a22ef5890c835db3c2b16c1f098e80b5a77a40bea7498832b192
SSDEEP 3072:bO6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:C6QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T167847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_uspkifaxvp.exe

Path C:\Temp\i_uspkifaxvp.exe
Size 384KB
SHA256 4f6eda01a1b6f816f8a75997cafd2d0db3fda8c232c4cbbfdb78bc24300e07b3
MD5 865bf9dfaa39fb94612180aabc0961af
SHA1 198fba7708de2a66ad62d4bffd875ccb08aa5087
SHA512 dc13e3e958c15b878a952882189c09316cc9f467b68d7a202c495941859afd86bb102ac3e7eb3fb9b04fec917782c472aa07a6e13508cb1a8f3622da9893cc78
SSDEEP 3072:JO6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:Q6QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F3847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vqnifaxsqn.exe

Path C:\Temp\i_vqnifaxsqn.exe
Size 384KB
SHA256 f1644051dbf9429d18955ca84983166661699d90a8c90850760a66550e70889d
MD5 e1e69cb31d5510845c2732517cb240ce
SHA1 2c6318948c118f127c45e3641b283da042627521
SHA512 480221a5c7cc8b81516464b51d04697642df395e6175cb59b129a6357979ea63ac2f11dba92d02d2a44ccbbe554cf16da5c67429d79b74ac0772aa7a886d986a
SSDEEP 3072:MO6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:d6QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T129847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jecwrpjeyw.exe

Path C:\Temp\jecwrpjeyw.exe
Size 384KB
SHA256 1b0c80d7ed4611a9544600edf0f52c2f372ba1b42932851ff6aae9fcaefb3c7a
MD5 4020a34525daf35cf0fd33aa0d7c1317
SHA1 62e1e1201b080e3d9bc74c3a77b12024ef5e6be1
SHA512 d6fe5064146537cf31452357dcb8a82eb4199a7faffde6d1512cbd1c8902c0943cc8de64d7064bdd313c32d3f4a385f4644a3f71203e06469d7d0ab36a85b068
SSDEEP 3072:+O6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:36QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F3847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhfcwuomjh.exe

Path C:\Temp\jhfcwuomjh.exe
Size 384KB
SHA256 8691fd265cc2180490c806874a291bfeec54a53d98cf5fec2742e14016c64a7f
MD5 7e7b7807257e9c4361ddfb50a4640400
SHA1 193e9ac2c1fb8e338f3b29f1c6bb52dfd260890b
SHA512 fb523a29926285e2aaf545c3a50a7858ca0036571c5dedfe892cfb6ee9b43d00b8c2d90607f2c8f4ffe3454d445f22d8f6b9be153855c2e3b2d4add2e9dc0b79
SSDEEP 3072:jO6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:q6QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T18C847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kebztromge.sys

Path C:\Temp\kebztromge.sys
Size 293KB
SHA256 a8210e3babef2a9c8d8f9b0937344800e972feee567ad1e0c0d7ba68ad50ccd4
MD5 d15a54206f681ed77b7b97edfc9081ab
SHA1 5e88a424195be86006a8ea0f57fd19b04096dffb
SHA512 7a04edf510d21481d06a62e6ac8ce95e49c06e47658c2703f974391d5e0fea71c994f938f8ce69f71e35dfb351c8aa145c04ab2af3ada34564abc37895e4d91e
SSDEEP 3072:ytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:yIJjiJcbI03GBc3ucY5DCSj
TLSH
T1B3545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhfzxrpjhc.sys

Path C:\Temp\mhfzxrpjhc.sys
Size 293KB
SHA256 2095e037d090f8321bdc5f08dd7c84cd62bf296828a5684ba4870fc00abd8377
MD5 8511e3b868169c718c5c100c0a8bd3db
SHA1 488e2048957fbbbeecf1d7436c75ff8ae59dbfb2
SHA512 9dd87dd3a7cdb2c67395d1062490b0966ca84917a0dcd6ab878688c9bdf52162e5be1cf0cc23645d66cca62a0de8bf179d9165f783488e4b3a3d0e9f778d0b8f
SSDEEP 3072:ytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:yIJjiJcbI03GBc3ucY5DCSj
TLSH
T19E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfcavsnlf.sys

Path C:\Temp\nhfcavsnlf.sys
Size 293KB
SHA256 8385816ceeb45d3e49a00b30564efb9766b14b0ed32c3e9867fc00a09233839f
MD5 af54b92d11af2c3c294b3a09d9c118af
SHA1 a6974c4959623c43ca341c9d8ba7b64e8a2eeb85
SHA512 344abd8ac2490f6331c6224beffdd98a4b440f7e0f325412c47a9b256a2784935c56c5abc7ac07dfec7f99bd787e289b8ef2817030eaaf036d29157df3b3731a
SSDEEP 3072:NtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:NIJjiJcbI03GBc3ucY5DCSj
TLSH
T164545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkidavsnlfdxvpni.exe

Path C:\Temp\qkidavsnlfdxvpni.exe
Size 384KB
SHA256 75e5a809f8d2e4f54bc8a36d7b7d26e430d7472d8843e6bcf5a1ede35891ccd4
MD5 2f85f6aaa395bbce5ef2defd6b032338
SHA1 c5b25b50f45fbd4f1b573ff623674238a47c20d9
SHA512 b426b706b37fa205b5d811723201536c38143757d112ff21d0e1bb9087dd4805e5fea44847138f0ee975a1db97542cb97f4ba0d52bbe40e19847433abed5c3da
SSDEEP 3072:0O6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:F6QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D6847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkidavsnlfdxvpni.sys

Path C:\Temp\qkidavsnlfdxvpni.sys
Size 293KB
SHA256 a04afd95786de6620edeb8d942b47b9b57c726c403583dd42a144a907a46cdf6
MD5 3befe156657af01f1a38610f1727e3a9
SHA1 59b542babd99e9631a8e5d19a09c58cc9f546db9
SHA512 56596711d2d786588e33a396cd3845ed3e66fe31d03b475e374821e6da97d325a2675f40ccb69a1ae4710d4372a1d569138e2598f0c850bbc4319601f927933f
SSDEEP 3072:2tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:2IJjiJcbI03GBc3ucY5DCSj
TLSH
T1BC545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smkecxupnh.exe

Path C:\Temp\smkecxupnh.exe
Size 384KB
SHA256 d172faaded7542fff26e5f1ced319f6cb124085bd7f8aa9233a3b94eb53d4eef
MD5 8b100673326acde786be22f2bd174151
SHA1 dc99f5d75bc311544f2369a0cb5a8fd3f4631de0
SHA512 a654896ee7c07e4a98819e8888729f9483d7ce3f1c26c9e48285a367b03533606b64da538277bc14cb8d4af0d4c06f03c7d7efb7b94252027bec3152b4f1cd68
SSDEEP 3072:IO6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:Z6QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T125847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spnkfcxupn.sys

Path C:\Temp\spnkfcxupn.sys
Size 293KB
SHA256 58606453e1e78f95e75bbc00012ce83ae9dc0aea57cc9d6496c4a051c1de11f3
MD5 f98867e575f3d9e2b0cfa3401a153605
SHA1 e433562569a7b034daab19358b2bf238e2e6a49f
SHA512 5b51b0469f90af5291b7ce0a9df5d07d01daba9d7a9056aca2967ba7d8767da4289b9dab7cc3ccf3e7020c9470670defa21197ca7e8e6a57cc22959f82477f67
SSDEEP 3072:YtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:YIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D6545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uspkifaxvp.exe

Path C:\Temp\uspkifaxvp.exe
Size 384KB
SHA256 903ef1f110807e64792c6701815f5071bf838ee1b789072f4e47a8d1f23f0b9a
MD5 bb4440fdc8bf431899d9284a466ca38b
SHA1 73938a2860a2cf9ce8a8c76a33260583f7c52cf2
SHA512 266e44276ce24332f37eec927b5c150f8852e95b59defa1c6b0a470fe0db79a42c9e5412292e48affdc6a941d677f6a70446912d98267877cb39168266d3f074
SSDEEP 3072:UO6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:l6QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T149847B00BAA4F0F6C995047800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqnifaxsqn.exe

Path C:\Temp\vqnifaxsqn.exe
Size 384KB
SHA256 36fad5aa10e9d1a5b237263ccf8454a211eba50e80317e0b28bfd821646d2186
MD5 d91f4e2b91b70a0a11bff0e46c21b979
SHA1 26dc74ee812d94192a4d5f05b11ec7db6e269f1b
SHA512 b7fff7be60d501f53513055fd0b3738b70b8f4f69c3cc06e64ce5dbd34b6180f6b5c74fc5c43e64f5583df8d7f0daea334121222981b1a6b32f2330a0e92a3cd
SSDEEP 3072:hO6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:o6QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T16C847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqojdbztr.exe

Path C:\Temp\ywqojdbztr.exe
Size 384KB
SHA256 a80aa653fe4f9fa56c9d7836a905d9e01d3cb3c17532f1c31c6a982e67f7d231
MD5 384c858f348918840c176107e4ab2d10
SHA1 c33e08b5e5265941c02e82fe1e8842580f2a6bb3
SHA512 7fd912336c2fc6f0bcba6d9a7f41469b1b39af92846a4185aeca671b46d71b360c85dcda91fdcfe290172e9662493aa16562d72a275b45741d425f2252495994
SSDEEP 3072:ZO6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:A6QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D0847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 be05b8d7f0bed3c8d0e89a1a49e4bae1f45619d94149f9abd8291f558897f2f2
MD5 e02c579c3ab95f9c3a77f9c2199a30f0
SHA1 f96c7c58830f56a993117d75a3b0f9e30bfc93a7
SHA512 264a83561849b0e2a1c42c3e478b7d5a3b3fa31f901f29440fc853108e9046e73ba21a692d0dbdef7d9fd76e9b6aac64489fb603c47ab551280df09d26d7e2a4
TLSH
T140D080613B05A516D54B19729C19E7117237844224E3D9097171D11EDABD3C4F3C51E3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 86bd3a0f7328ff17cf8f5c348bd8ac04b7d41c52ef238ad0b048b09e5a964859
MD5 c6e3af776b1f4463a76e29cca079d5e5
SHA1 19b7f1bc72393d7717302ee15e0e4afa431cea45
SHA512 b15ef012a17356e47acc81e1922c433a19e6e554795a46fdf0ae05df1e9abbc87a47b05bc831bac2c6c32faad3f39c7a7cb21ae65ceb4f96f3deb3ea0d83e9c6
TLSH
T1D7D080613B05A616D54B19729C18E7117237844234E3D9097171D10EDABD3C4F3C51F7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 32af0ec79e033cdd61ac92bf78fb9986c770a1254d989993ba707294258c6c0a
MD5 29ca3b5eb8ef11f0000c398fbe334cad
SHA1 d4022eccbfb18c5fc4776d657a20d48c19373e25
SHA512 2fd6a8e84b69f018823a877261377248babeac1a8ee8860c22fec72c8b15977bb6d9fe63e5aaafe484819c49a9deb4c542310dc81e3a357925f63bba9f1ff634
TLSH
T1FC41E791A36D8C22EBE4073D6FE1DEB833BCA9074D0F2E1514B01CB2BF82B81C55518A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591478.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591478.TMP
Size 2KB
SHA256 a6460d80cef8905e65b60246c68bcd41d52ff38c38e6d29e90087cab42babf33
MD5 2774f91acab020892f7304500aab7999
SHA1 55c8c6d29db3338304304ea6b28c7be6bdebf482
SHA512 ea29b35717b462201d09a96a235248af873ccbe641f24e188226b331b3d93c0300546b9539ed1b3bd86debc58f9b41f82fdc356fab1395dd1de4802a440079eb
TLSH
T17641F851A36C8C62EBE4073D6FE1DEB833BCA9074D1F2E1514740CB2BF82B81C55518A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c5002d1350fe8e81e364c56446f4345a02882dd0a6e99e239a2e0a8436a11a0e
MD5 3a53427c123fff5eac0b4e04d4f09669
SHA1 0b0d2d807ffb4d9957401c88ec43dd77188fd1c3
SHA512 83f1e16a12b75d818fb48539b90e12395a1bc69e8ae7f298715f55f809da1ce2dabff2a95ac57d433484cf33faf4c484ed8f71ddd05724f58625dfe6811bdb8f
TLSH
T1C6519CF7C7E8866D9A0196F0BA147E2BCE2D0914832C3D5AC9E4EF1B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

a4c69b37-9dab-490e-a367-e6e72cfb2a7d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a4c69b37-9dab-490e-a367-e6e72cfb2a7d.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 59880d6d128333e4a85349782774174c0cc4fa65d3140f4787db986f60af4d7a
MD5 62a0d5fb2d60daf0c627d48702776dd3
SHA1 5c1cd71132ca30590578535f17941fd0ad00938e
SHA512 6acd390be490dacfabb7f6e03cbdec7b9fefbf266e7663037453b1fa01954a99ff519af3be1737b3dc0a6726147f1acc2fb0c55276859491fdbb2a4e2d8a3307
SSDEEP 192:sxRFRHyM/jK1Ml8wcN/fmsEeDqOZ4vvzoA8p9F/g6+WNCJO/YAJzwWgYgGSIgtJ:sxRF5CN/fmsEeeoaGj/5x/RwWgYm3
TLSH
T1DE62FB06AA349977CDDFD209FA557B63D2F81533A1901E44AAFC8B0C05E7ADC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 679dc9938319639609363c16bc7037bb78e6c3abec76fbeac45eb37454c0cfe6
MD5 eb4cc24efde6cfe742793181c3206d1f
SHA1 71793dc0ac59ceb0dc4de8d1305e51fb36a794d2
SHA512 2c3d004e6578f15ad5ce5ebd0abf3e455099518965fabdedcf47e9fbdf9382349f9ad9bfcacd1c2c83b99de4fb88ad9caa11138f05010a3a27772a5f135ed059
SSDEEP 192:sxRqRHyM/jK1Ml8UQdcN/fmskeDXOZ4vvzoA8prF/g6+WNCJO/YA0zwWgYgGSIgh:sxRq5qiN/fmskezoaGh/5x/0wWgYmh
TLSH
T1BC62EA16AA349977CDDFD209FA417B63D2F85473A1941E44AAFC8B0C05E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c0f13a9c0d2108fca6060de561e57708bcab02859e9e05d885c328c82c5b9a6c
MD5 5a4cd7a235b109fbe00fcf3aefd1670d
SHA1 d56f917c1a409c0823391669d1067caef10a28b3
SHA512 1974024dfaa25b0dbdd797d366b5abc27ef560b956e0b6aec7b6859a2abc18bf9dfe0856d75f8e14d5a8d396b51942993aa028c9fb0781329e6c8363dd3f7159
SSDEEP 192:sxRqRHyM/jK1Ml8wcN/fmskeDqOZ4vvzoA8p9F/g6+WNCJO/YAJzwWgYgGSIgDJJ:sxRq5CN/fmskeeoaGj/5x/RwWgYmH
TLSH
T19D620C05AA345977CDDFD209FA457B63D2F85473A1901E44AAFC8B0C05E7ADC221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 b01d46617b7d1797117cd0a06b11b887d307814e8858510055437b233ce2b839
MD5 534df28e804c63994e7da64d85482fa9
SHA1 fb323df5906a5f61121824a9ed13523f52d535de
SHA512 5575d10b126a3f499c355274be30d52d7471c95def81e6700429d25b2c56f42556d4c402ab043195b9c60b253917a2ddb465bf72133a7578065e606ba14efcd7
SSDEEP 768:l1AvbY7pLuL7j+WgI+f2z8F1+UoAYDCx9Tuqh0VfUC9xbog/OVqdQ7zVjro9skh:l1AvbEE7j+WgI+f2zu1jaJdQ/VQSkh
TLSH
T1F2E2FC3B680CCB7E4F84499CEC29BE9F6DA801CF96988D5447EA840C03C67EF551A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 136d50f0b81bf3f5c53a2252034804e1bf2293bbf956851a0c09a3ef726c6e55
MD5 35d077a97f92ca9187827a9059096053
SHA1 6f9c313b50a93a75afa3e78eaf30c95663bbab9e
SHA512 6af3fdfaf9c6381df7d442b2c04a2b87040252abe0bd3d722a5dac84ccd87614b3fcd9823faf5f626b74528629dca6062c9349dd3e4dd1d2f832040cce135032
SSDEEP 96:K5+/K+kM8mWslNs+mKkjsAmg2e9we32ZWKKoJ6EKziimViK2YBezMoA:K+/K+kM85sle+ujsA12e9we3lNf9Eeza
TLSH
T17FB1D3D6B476264028FEB50882A58D1BB64130F77416A53B3FB824E65A66E006FFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59afbe.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59afbe.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 92a9ebe001d7b5deb89220e32e58d23217e9321c37de666b852dc501f79ca959
MD5 84bbd874a84ab277e1ab9377fa67eb5f
SHA1 986c98d34d5cb121bdc185b2fa5d8b42e50962fe
SHA512 1c1445f055b4d517f82bd79ab9c005b01443b331dfa77123146aa0a74684073191babc896f0bc85cf96f852030b00abacd5310d4d40f3cbcc6e34afb29b859aa
SSDEEP 768:XF1j+9O3MwgF+HoXz475BwT7VWs+DoLSpG0/TIo5Kzn12bfJJeE:e9O3obVmoTiT8ByJQE
TLSH
T15D1328F5A4D7C976E89E8783673E6E425EBCC163B4881984F7885D0CCD822BFD706819
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 9114cc6dc8d8767ca3502c432267ec7301d78b2f4d97dcdf75b2b303fbaabbfd
MD5 6bfaedcc605c8f4837df42ffc5c69cf6
SHA1 312516c9a1f9447f008f352103cc9a3cbc6772d1
SHA512 166e75fa596635b80c61d4b40c37a4c75ac14c567a614616300d0a8676278233a82e662c973cce695c92fef90c00e9f62cd2afd4e8ad4b1218c0f2f327246b0b
SSDEEP 768:ojaeqD4MlshiLdMmp31I9jJ5BwT7VWs+DoLSpG0/TIoFD+ApXGFTX:oqcjhIdMC31VmoTiTt+KXi
TLSH
T19603C076A4A89DB39CA6C7C5760BB5432F740253C6D83FD8C9DD6E0D02976CD630382A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 dd3c9a02ffaf9ce08bfb7684f5fd20841b40e45d9d84ee11a959b02118fdbc4d
MD5 56ccbe25ba233b5a491a8f67819572c7
SHA1 365b7813104768c1299517c573b8c21f6c689f2f
SHA512 88b0d856bb8aac20b0f20a31640aa41ce1bbcc129cd37e28672ff2ba77f82436ea8970d49642e7b97e8d57c6b46ec298ff0c1004418c4ba7e3be8912ba1a89b1
SSDEEP 768:Bj+9036+g1jz4F5BwT7VWs+DoLSpG0/TIo5Kzn12bfJJeE:c903yvVmoTiT8ByJQE
TLSH
T16CF2AE71B8A8DDB35CDAC7C5760766836FA4526385C81E98C5DC9F0D0AC738D2B1BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 886b6f11b1fa0d2125188a77302fe64cbdbed4fc93cbe0073fbb891689b73c5f
MD5 e3a4b4958d3d9b5770c833ecad3e2d0e
SHA1 4184580cd108c4c436f056079c1471a18843e4ca
SHA512 74a7b7d41dc37df2af5e4315e41dc1b6e1675aaf398142ec627bd9f8c1395677b10fca13dfea797e1a9e95508af4c1fb90075a6defd279a0da9fef91ca45c57a
SSDEEP 768:Tj+903v+t1jz4F5BwT7VWs+DoLSpG0/TIo5Kzn12bfJJeE:2903evVmoTiT8ByJQE
TLSH
T140F2AE71B8A8DDB35CDAC7C5760766836FA4526385C42E58C9DC9F0D0AC738D271BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2776_482861348\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1120-198-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1212-285-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1464-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1628-387-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1832-346-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1888-487-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2340-375-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2368-245-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2608-475-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2612-323-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3408-454-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3680-298-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3952-504-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4440-419-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4772-327-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4860-399-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4968-450-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5096-273-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5104-439-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5864-331-0x0000000000010000-0x00000000000AB000-memory.dmp

Download