systex | 07265e313cddd249cd10893848748f336fc11341d12376418da392cba93cad1d

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 11:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260708-ncf3haex4w
SHA256 07265e313cddd249cd10893848748f336fc11341d12376418da392cba93cad1d
MD5 8b4cf85bbc8f558d685f0a4dfc83ca15
SHA1 4692d34e31afee452adddf8c89fdfc6820568c0c
SHA512 7255a4aca67743e7cc57f649e3fae561cf1e3f10630c4596487867ddbd16a6bd1dcd41f6a57bdb2ddc13bcd709583ac008bc34fdce42c4b612b5d937fc86aa5f
SSDEEP 3072:B9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:LctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F7847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
1576	upmhezxrpjhczurm.exe
2932	upmhezxrpjhczurm.sys
2944	CreateProcess.exe
5072	urpjhczusm.exe
2728	CreateProcess.exe
5308	CreateProcess.exe
3332	i_urpjhczusm.exe
3804	uomgezwuom.sys
5536	CreateProcess.exe
1484	omgecwuomj.exe
4892	CreateProcess.exe
3272	CreateProcess.exe
6008	i_omgecwuomj.exe
3920	bztrljdbzt.sys
1168	CreateProcess.exe
808	wqojgeywro.exe
5424	CreateProcess.exe
3516	CreateProcess.exe
2532	i_wqojgeywro.exe
4700	vtrljgeyvt.sys
5680	CreateProcess.exe
2068	qolgdywqoi.exe
3224	CreateProcess.exe
4344	CreateProcess.exe
3160	i_qolgdywqoi.exe
4156	qlidbvtnlj.sys
5908	CreateProcess.exe
1716	idywqoigay.exe
5812	CreateProcess.exe
4112	CreateProcess.exe
5280	i_idywqoigay.exe
240	vsnifdxvtq.sys
3920	CreateProcess.exe
3396	sqnigaysqk.exe
5676	CreateProcess.exe
728	CreateProcess.exe
4676	i_sqnigaysqk.exe
3088	sqkicausqk.sys
3504	CreateProcess.exe
5808	pnhfzxspki.exe
1108	CreateProcess.exe
1928	CreateProcess.exe
2752	i_pnhfzxspki.exe
5428	upnkfzxvpn.sys
2676	CreateProcess.exe
4968	nhecaxrpnk.exe
5980	CreateProcess.exe
2492	CreateProcess.exe
5948	i_nhecaxrpnk.exe
2612	wusmkecwus.sys
1996	CreateProcess.exe
1356	pmhecwupmh.exe
1988	CreateProcess.exe
5412	CreateProcess.exe
1976	i_pmhecwupmh.exe
2860	hezwrpjhez.sys
3912	CreateProcess.exe
1972	ezxrpmgecz.exe
3664	CreateProcess.exe
2532	CreateProcess.exe
5832	i_ezxrpmgecz.exe
3720	gezwrojhbz.sys
2840	CreateProcess.exe
1348	bztrljhbzt.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5924_1447489955\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5924_1998258706\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5924_1998258706\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5924_1998258706\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5924_1998258706\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5924_1447489955\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5924_2044331631\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5924_2044331631\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5924_1817738798\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezxrpmgecz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezxrpmgecz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqojgbytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igdyvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfcxupkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhecwupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrljhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigaywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmhezxrpjhczurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgecwuomj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfzxspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfzusmkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idywqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhecaxrpnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvpnhfaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzwromhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qolgdywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urpjhczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urpjhczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrljhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igdyvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qolgdywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfzusmkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhecwupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgecwuomj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqojgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqnigaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfcxupkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrmjhbwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhecaxrpnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqojgbytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigaywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrmjhbwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idywqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvpnhfaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzwromhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqojgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqnigaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfzxspki.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5148	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5840	ipconfig.exe
2812	ipconfig.exe
2084	ipconfig.exe
1740	ipconfig.exe
2456	ipconfig.exe
2764	ipconfig.exe
4524	ipconfig.exe
4812	ipconfig.exe
1596	ipconfig.exe
5188	ipconfig.exe
5704	ipconfig.exe
4516	ipconfig.exe
796	ipconfig.exe
5920	ipconfig.exe
2328	ipconfig.exe
2380	ipconfig.exe
4516	ipconfig.exe
5056	ipconfig.exe
4348	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134279829057162446"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-515251955-468707340-1782030364-1000\{B114B200-9687-4A72-B8F6-641D41E764F2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
1576	upmhezxrpjhczurm.exe
1576	upmhezxrpjhczurm.exe
1576	upmhezxrpjhczurm.exe
1576	upmhezxrpjhczurm.exe
1576	upmhezxrpjhczurm.exe
1576	upmhezxrpjhczurm.exe
1576	upmhezxrpjhczurm.exe
1576	upmhezxrpjhczurm.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3332	i_urpjhczusm.exe
Token: SeDebugPrivilege	6008	i_omgecwuomj.exe
Token: SeDebugPrivilege	2532	i_wqojgeywro.exe
Token: SeDebugPrivilege	3160	i_qolgdywqoi.exe
Token: SeDebugPrivilege	5280	i_idywqoigay.exe
Token: SeDebugPrivilege	4676	i_sqnigaysqk.exe
Token: SeDebugPrivilege	2752	i_pnhfzxspki.exe
Token: SeDebugPrivilege	5948	i_nhecaxrpnk.exe
Token: SeDebugPrivilege	1976	i_pmhecwupmh.exe
Token: SeDebugPrivilege	5832	i_ezxrpmgecz.exe
Token: SeDebugPrivilege	1488	i_bztrljhbzt.exe
Token: SeDebugPrivilege	4824	i_ywqojgbytr.exe
Token: SeDebugPrivilege	5652	i_oigaywqoig.exe
Token: SeDebugPrivilege	3036	i_igdyvqoiga.exe
Token: SeDebugPrivilege	1464	i_dxvpnhfaxs.exe
Token: SeDebugPrivilege	5912	i_pnhfcxupkh.exe
Token: SeDebugPrivilege	5416	i_pnhfzusmkh.exe
Token: SeDebugPrivilege	2804	i_hfzwromhez.exe
Token: SeDebugPrivilege	4556	i_ztrmjhbwuo.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5924	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5176 wrote to memory of 1576	5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe	88
PID 5176 wrote to memory of 1152	5176	2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe	89
PID 1152 wrote to memory of 5924	1152	iexplore.exe	90
PID 5924 wrote to memory of 2128	5924	msedge.exe	91
PID 5924 wrote to memory of 2528	5924	msedge.exe	92
PID 5924 wrote to memory of 5148	5924	msedge.exe	93
PID 5924 wrote to memory of 2528	5924	msedge.exe	92
PID 5924 wrote to memory of 2528	5924	msedge.exe	92
PID 5924 wrote to memory of 5180	5924	msedge.exe	94
PID 5924 wrote to memory of 5180	5924	msedge.exe	94
PID 5924 wrote to memory of 4092	5924	msedge.exe	97
PID 5924 wrote to memory of 1368	5924	msedge.exe	96
PID 5924 wrote to memory of 4092	5924	msedge.exe	97
PID 5924 wrote to memory of 4092	5924	msedge.exe	97
PID 5924 wrote to memory of 1368	5924	msedge.exe	96
PID 5924 wrote to memory of 1368	5924	msedge.exe	96
PID 5924 wrote to memory of 4608	5924	msedge.exe	98
PID 5924 wrote to memory of 4608	5924	msedge.exe	98
PID 5924 wrote to memory of 4608	5924	msedge.exe	98
PID 5924 wrote to memory of 2892	5924	msedge.exe	99
PID 5924 wrote to memory of 2892	5924	msedge.exe	99
PID 5924 wrote to memory of 2892	5924	msedge.exe	99
PID 5924 wrote to memory of 1524	5924	msedge.exe	100
PID 5924 wrote to memory of 1524	5924	msedge.exe	100
PID 5924 wrote to memory of 6080	5924	msedge.exe	104
PID 5924 wrote to memory of 6080	5924	msedge.exe	104
PID 5924 wrote to memory of 3600	5924	msedge.exe	105
PID 5924 wrote to memory of 3600	5924	msedge.exe	105
PID 1576 wrote to memory of 2944	1576	upmhezxrpjhczurm.exe	106
PID 5072 wrote to memory of 2728	5072	urpjhczusm.exe	109
PID 5924 wrote to memory of 4528	5924	msedge.exe	113
PID 5924 wrote to memory of 2880	5924	msedge.exe	114
PID 5924 wrote to memory of 2880	5924	msedge.exe	114
PID 5924 wrote to memory of 1680	5924	msedge.exe	117
PID 5924 wrote to memory of 1680	5924	msedge.exe	117
PID 1576 wrote to memory of 5308	1576	upmhezxrpjhczurm.exe	118
PID 1576 wrote to memory of 5536	1576	upmhezxrpjhczurm.exe	122
PID 1484 wrote to memory of 4892	1484	omgecwuomj.exe	124
PID 1576 wrote to memory of 3272	1576	upmhezxrpjhczurm.exe	127
PID 1576 wrote to memory of 1168	1576	upmhezxrpjhczurm.exe	131
PID 808 wrote to memory of 5424	808	wqojgeywro.exe	133
PID 1576 wrote to memory of 3516	1576	upmhezxrpjhczurm.exe	136
PID 1576 wrote to memory of 5680	1576	upmhezxrpjhczurm.exe	141
PID 2068 wrote to memory of 3224	2068	qolgdywqoi.exe	143
PID 1576 wrote to memory of 4344	1576	upmhezxrpjhczurm.exe	146
PID 5924 wrote to memory of 4916	5924	msedge.exe	148
PID 5924 wrote to memory of 4952	5924	msedge.exe	149
PID 5924 wrote to memory of 2456	5924	msedge.exe	150
PID 1576 wrote to memory of 5908	1576	upmhezxrpjhczurm.exe	153
PID 1716 wrote to memory of 5812	1716	idywqoigay.exe	155
PID 1576 wrote to memory of 4112	1576	upmhezxrpjhczurm.exe	158
PID 1576 wrote to memory of 3920	1576	upmhezxrpjhczurm.exe	162
PID 3396 wrote to memory of 5676	3396	sqnigaysqk.exe	164
PID 1576 wrote to memory of 728	1576	upmhezxrpjhczurm.exe	167
PID 1576 wrote to memory of 3504	1576	upmhezxrpjhczurm.exe	171
PID 5808 wrote to memory of 1108	5808	pnhfzxspki.exe	173
PID 1576 wrote to memory of 1928	1576	upmhezxrpjhczurm.exe	176
PID 1576 wrote to memory of 2676	1576	upmhezxrpjhczurm.exe	180
PID 4968 wrote to memory of 5980	4968	nhecaxrpnk.exe	182
PID 1576 wrote to memory of 2492	1576	upmhezxrpjhczurm.exe	185
PID 5924 wrote to memory of 2960	5924	msedge.exe	187
PID 5924 wrote to memory of 2960	5924	msedge.exe	187
PID 1576 wrote to memory of 1996	1576	upmhezxrpjhczurm.exe	193
PID 1356 wrote to memory of 1988	1356	pmhecwupmh.exe	195

C:\Users\Admin\AppData\Local\Temp\2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_8b4cf85bbc8f558d685f0a4dfc83ca15_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5176
- C:\Temp\upmhezxrpjhczurm.exe
  C:\Temp\upmhezxrpjhczurm.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1576
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urpjhczusm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2944
  - - C:\Temp\urpjhczusm.exe
      C:\Temp\urpjhczusm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5072
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2728
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urpjhczusm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5308
  - - C:\Temp\i_urpjhczusm.exe
      C:\Temp\i_urpjhczusm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omgecwuomj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5536
  - - C:\Temp\omgecwuomj.exe
      C:\Temp\omgecwuomj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1484
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4892
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4516
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omgecwuomj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3272
  - - C:\Temp\i_omgecwuomj.exe
      C:\Temp\i_omgecwuomj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6008
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wqojgeywro.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1168
  - - C:\Temp\wqojgeywro.exe
      C:\Temp\wqojgeywro.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:808
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5424
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wqojgeywro.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3516
  - - C:\Temp\i_wqojgeywro.exe
      C:\Temp\i_wqojgeywro.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2532
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qolgdywqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5680
  - - C:\Temp\qolgdywqoi.exe
      C:\Temp\qolgdywqoi.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2068
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3224
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5056
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qolgdywqoi.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4344
  - - C:\Temp\i_qolgdywqoi.exe
      C:\Temp\i_qolgdywqoi.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3160
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\idywqoigay.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5908
  - - C:\Temp\idywqoigay.exe
      C:\Temp\idywqoigay.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1716
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5812
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4348
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_idywqoigay.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4112
  - - C:\Temp\i_idywqoigay.exe
      C:\Temp\i_idywqoigay.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5280
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqnigaysqk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3920
  - - C:\Temp\sqnigaysqk.exe
      C:\Temp\sqnigaysqk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3396
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5676
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5920
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqnigaysqk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:728
  - - C:\Temp\i_sqnigaysqk.exe
      C:\Temp\i_sqnigaysqk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4676
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnhfzxspki.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3504
  - - C:\Temp\pnhfzxspki.exe
      C:\Temp\pnhfzxspki.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5808
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1108
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2764
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnhfzxspki.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1928
  - - C:\Temp\i_pnhfzxspki.exe
      C:\Temp\i_pnhfzxspki.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2752
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nhecaxrpnk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2676
  - - C:\Temp\nhecaxrpnk.exe
      C:\Temp\nhecaxrpnk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4968
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5980
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nhecaxrpnk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2492
  - - C:\Temp\i_nhecaxrpnk.exe
      C:\Temp\i_nhecaxrpnk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5948
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmhecwupmh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1996
  - - C:\Temp\pmhecwupmh.exe
      C:\Temp\pmhecwupmh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1356
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1988
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmhecwupmh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5412
  - - C:\Temp\i_pmhecwupmh.exe
      C:\Temp\i_pmhecwupmh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1976
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ezxrpmgecz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3912
  - - C:\Temp\ezxrpmgecz.exe
      C:\Temp\ezxrpmgecz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1972
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3664
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1596
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ezxrpmgecz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2532
  - - C:\Temp\i_ezxrpmgecz.exe
      C:\Temp\i_ezxrpmgecz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5832
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bztrljhbzt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2840
  - - C:\Temp\bztrljhbzt.exe
      C:\Temp\bztrljhbzt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1348
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5840
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2084
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bztrljhbzt.exe ups_ins
    3⤵
    PID:5292
  - - C:\Temp\i_bztrljhbzt.exe
      C:\Temp\i_bztrljhbzt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1488
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywqojgbytr.exe ups_run
    3⤵
    PID:5600
  - - C:\Temp\ywqojgbytr.exe
      C:\Temp\ywqojgbytr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:628
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3696
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywqojgbytr.exe ups_ins
    3⤵
    PID:4544
  - - C:\Temp\i_ywqojgbytr.exe
      C:\Temp\i_ywqojgbytr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4824
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oigaywqoig.exe ups_run
    3⤵
    PID:3088
  - - C:\Temp\oigaywqoig.exe
      C:\Temp\oigaywqoig.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4700
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5032
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1740
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oigaywqoig.exe ups_ins
    3⤵
    PID:2144
  - - C:\Temp\i_oigaywqoig.exe
      C:\Temp\i_oigaywqoig.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5652
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igdyvqoiga.exe ups_run
    3⤵
    PID:5012
  - - C:\Temp\igdyvqoiga.exe
      C:\Temp\igdyvqoiga.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5056
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:200
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2456
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igdyvqoiga.exe ups_ins
    3⤵
    PID:2072
  - - C:\Temp\i_igdyvqoiga.exe
      C:\Temp\i_igdyvqoiga.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3036
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dxvpnhfaxs.exe ups_run
    3⤵
    PID:2196
  - - C:\Temp\dxvpnhfaxs.exe
      C:\Temp\dxvpnhfaxs.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4132
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5352
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2328
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dxvpnhfaxs.exe ups_ins
    3⤵
    PID:240
  - - C:\Temp\i_dxvpnhfaxs.exe
      C:\Temp\i_dxvpnhfaxs.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1464
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnhfcxupkh.exe ups_run
    3⤵
    PID:1312
  - - C:\Temp\pnhfcxupkh.exe
      C:\Temp\pnhfcxupkh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:576
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2684
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnhfcxupkh.exe ups_ins
    3⤵
    PID:2712
  - - C:\Temp\i_pnhfcxupkh.exe
      C:\Temp\i_pnhfcxupkh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5912
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnhfzusmkh.exe ups_run
    3⤵
    PID:6060
  - - C:\Temp\pnhfzusmkh.exe
      C:\Temp\pnhfzusmkh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5272
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3328
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnhfzusmkh.exe ups_ins
    3⤵
    PID:5016
  - - C:\Temp\i_pnhfzusmkh.exe
      C:\Temp\i_pnhfzusmkh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfzwromhez.exe ups_run
    3⤵
    PID:632
  - - C:\Temp\hfzwromhez.exe
      C:\Temp\hfzwromhez.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4456
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4936
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4516
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfzwromhez.exe ups_ins
    3⤵
    PID:5948
  - - C:\Temp\i_hfzwromhez.exe
      C:\Temp\i_hfzwromhez.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ztrmjhbwuo.exe ups_run
    3⤵
    PID:2812
  - - C:\Temp\ztrmjhbwuo.exe
      C:\Temp\ztrmjhbwuo.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3228
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2076
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5188
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ztrmjhbwuo.exe ups_ins
    3⤵
    PID:5988
  - - C:\Temp\i_ztrmjhbwuo.exe
      C:\Temp\i_ztrmjhbwuo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4556
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff944fbc188,0x7ff944fbc194,0x7ff944fbc1a0
      4⤵
      PID:2128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1576,i,7730265670488527356,2869895316880521955,262144 --field-trial-handle=2156,i,7187844889984027952,17551259549726166851,262144 --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:2
      4⤵
      PID:2528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,5341209784563632374,13822011885156300790,524288 --field-trial-handle=2156,i,7187844889984027952,17551259549726166851,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:11
      4⤵
      System Time Discovery
      PID:5148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2404,i,14656713780727297244,8824914520487532869,524288 --field-trial-handle=2156,i,7187844889984027952,17551259549726166851,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:13
      4⤵
      PID:5180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3616,i,2567865091163546805,5357870782668195438,2097152 --field-trial-handle=2156,i,7187844889984027952,17551259549726166851,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
      4⤵
      PID:1368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3620,i,3662704175768774153,12978197799122874099,2097152 --field-trial-handle=2156,i,7187844889984027952,17551259549726166851,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
      4⤵
      PID:4092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,6923269683855013093,9029859188340776405,2097152 --field-trial-handle=2156,i,7187844889984027952,17551259549726166851,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:1
      4⤵
      PID:4608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,14449696203543555268,10974344369186889944,2097152 --field-trial-handle=2156,i,7187844889984027952,17551259549726166851,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:9
      4⤵
      PID:2892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,1001174884131943538,18047257308153125699,524288 --field-trial-handle=2156,i,7187844889984027952,17551259549726166851,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:14
      4⤵
      PID:1524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,13382721073964693129,1718568786353091615,524288 --field-trial-handle=2156,i,7187844889984027952,17551259549726166851,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
      4⤵
      PID:6080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,1602388843264275543,10555930423755008853,524288 --field-trial-handle=2156,i,7187844889984027952,17551259549726166851,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:14
      4⤵
      PID:3600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,3581081381076595531,14274068422791853168,524288 --field-trial-handle=2156,i,7187844889984027952,17551259549726166851,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
      4⤵
      PID:4684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,3581081381076595531,14274068422791853168,524288 --field-trial-handle=2156,i,7187844889984027952,17551259549726166851,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
      4⤵
      PID:4528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,9358199128531179173,6620037476144488781,524288 --field-trial-handle=2156,i,7187844889984027952,17551259549726166851,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
      4⤵
      PID:2880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,6192309473246205470,1189103602726461051,524288 --field-trial-handle=2156,i,7187844889984027952,17551259549726166851,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:14
      4⤵
      PID:1680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,16105835943267221057,17116203554468681548,524288 --field-trial-handle=2156,i,7187844889984027952,17551259549726166851,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:14
      4⤵
      PID:4916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,11746600228407828509,15269470905031124634,524288 --field-trial-handle=2156,i,7187844889984027952,17551259549726166851,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
      4⤵
      PID:4952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,14552196069492702392,4027850663333713374,524288 --field-trial-handle=2156,i,7187844889984027952,17551259549726166851,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
      4⤵
      PID:2456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,17049881730079059921,18034377795218701443,524288 --field-trial-handle=2156,i,7187844889984027952,17551259549726166851,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:14
      4⤵
      PID:2960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3324,i,2274629346522189326,11890721096095926469,524288 --field-trial-handle=2156,i,7187844889984027952,17551259549726166851,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
      4⤵
      PID:5000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,18426204451884010484,1425392115186219326,524288 --field-trial-handle=2156,i,7187844889984027952,17551259549726166851,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:14
      4⤵
      PID:1276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,14884494249394505689,10735828581651110991,524288 --field-trial-handle=2156,i,7187844889984027952,17551259549726166851,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
      4⤵
      PID:1728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6044,i,12740328823446726802,17251815321108579271,262144 --field-trial-handle=2156,i,7187844889984027952,17551259549726166851,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:10
      4⤵
      PID:5652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3432,i,13682811427721072850,5833205629762763111,524288 --field-trial-handle=2156,i,7187844889984027952,17551259549726166851,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:14
      4⤵
      PID:2324

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1480

C:\Temp\upmhezxrpjhczurm.sys
C:\Temp\upmhezxrpjhczurm.sys
1⤵
- Executes dropped EXE
PID:2932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5056

C:\Temp\uomgezwuom.sys
C:\Temp\uomgezwuom.sys
1⤵
- Executes dropped EXE
PID:3804

C:\Temp\bztrljdbzt.sys
C:\Temp\bztrljdbzt.sys
1⤵
- Executes dropped EXE
PID:3920

C:\Temp\vtrljgeyvt.sys
C:\Temp\vtrljgeyvt.sys
1⤵
- Executes dropped EXE
PID:4700

C:\Temp\qlidbvtnlj.sys
C:\Temp\qlidbvtnlj.sys
1⤵
- Executes dropped EXE
PID:4156

C:\Temp\vsnifdxvtq.sys
C:\Temp\vsnifdxvtq.sys
1⤵
- Executes dropped EXE
PID:240

C:\Temp\sqkicausqk.sys
C:\Temp\sqkicausqk.sys
1⤵
- Executes dropped EXE
PID:3088

C:\Temp\upnkfzxvpn.sys
C:\Temp\upnkfzxvpn.sys
1⤵
- Executes dropped EXE
PID:5428

C:\Temp\wusmkecwus.sys
C:\Temp\wusmkecwus.sys
1⤵
- Executes dropped EXE
PID:2612

C:\Temp\hezwrpjhez.sys
C:\Temp\hezwrpjhez.sys
1⤵
- Executes dropped EXE
PID:2860

C:\Temp\gezwrojhbz.sys
C:\Temp\gezwrojhbz.sys
1⤵
- Executes dropped EXE
PID:3720

C:\Temp\geywqojgey.sys
C:\Temp\geywqojgey.sys
1⤵
PID:4392

C:\Temp\tqljdbytql.sys
C:\Temp\tqljdbytql.sys
1⤵
PID:3988

C:\Temp\fdavqnliga.sys
C:\Temp\fdavqnliga.sys
1⤵
PID:3716

C:\Temp\fdxvpnhfax.sys
C:\Temp\fdxvpnhfax.sys
1⤵
PID:4376

C:\Temp\xusqkifaxs.sys
C:\Temp\xusqkifaxs.sys
1⤵
PID:6008

C:\Temp\upmhfzxupk.sys
C:\Temp\upmhfzxupk.sys
1⤵
PID:1844

C:\Temp\hezxrpmhec.sys
C:\Temp\hezxrpmhec.sys
1⤵
PID:1012

C:\Temp\ezwrpjhbzt.sys
C:\Temp\ezwrpjhbzt.sys
1⤵
PID:2956

C:\Temp\bztrljhbzt.sys
C:\Temp\bztrljhbzt.sys
1⤵
PID:5708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bztrljdbzt.sys

Path C:\Temp\bztrljdbzt.sys
Size 293KB
SHA256 3cf4d00018555e952b1ff688ace00c75ee891b7b43964040f8e39a277652c84a
MD5 9e58a2407098c6551f9e4c7bfadceb8a
SHA1 ade6f833f348b85076d04a3b1cf06397f8262e9f
SHA512 342c0b6914711e3d6f19466f5ab090d8a579282b36a87e1d29b29a3cbf0aa0d2ad7324df4bc1bf591130ecff3120e93b34f33d428f46af95216de9355c8fe8ae
SSDEEP 3072:htKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:hIJjiJcbI03GBc3ucY5DCSj
TLSH
T1B7545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_idywqoigay.exe

Path C:\Temp\i_idywqoigay.exe
Size 384KB
SHA256 d142e875729665cc6d1dfa19d7627e735fe93675ed4ba36b0930a28168116e41
MD5 95a9f60a5ad4aa7d78c0742597c410e6
SHA1 89d665b7ee5413cb24d31669c3cde11a35afd7bd
SHA512 5e5944a74af6ed0e91f9945ae772e48af5507a9a529c1d7c33564be5c6993a413dcb59d3b3b9d1eec542e54dbe8eb3bf805a57a2472ef2a13184ab0b2dc87552
SSDEEP 3072:D9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:hctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T140847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_omgecwuomj.exe

Path C:\Temp\i_omgecwuomj.exe
Size 384KB
SHA256 0eea37c2c8092715090cfa3a3521fbde229d2293dbab35b562968b80464ad436
MD5 8b7a46d6a0c4adbadbea562c50b2829d
SHA1 05c8bfb49834ea49cf0672719c544c6c0f2748a3
SHA512 e3c34b078b4d364f4991543722f961b2014b3e9b0636ea677adcc9b5c9a2fabac68fcf2f74fc0c20ad5954591371168f6b823ae20a07d36166f82fcc88d038ef
SSDEEP 3072:G9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:0ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T144847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qolgdywqoi.exe

Path C:\Temp\i_qolgdywqoi.exe
Size 384KB
SHA256 faf60d4b2797dfd18a1bf193009217fbb5d27f508a4c3411b24c226176780db9
MD5 ae903c75ed4228cceeae70695946d07b
SHA1 a5ac554644631f21bdc814a3bb26d7f57d96ac45
SHA512 0b1cd34502ad641315dfea344c783b0f63e928577f79167fbb0cae27ed4dcb9de254780f8a31f0457018e04dd8c1a31513f285b972082bd19198dc64653bccae
SSDEEP 3072:A9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:SctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T199846A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_urpjhczusm.exe

Path C:\Temp\i_urpjhczusm.exe
Size 384KB
SHA256 dc7223441d02650195a80873a2e0ab04ab0e6d36d5155c2bc978d3051bc4c293
MD5 80f02e402b5ffff3c3fcdad266acf1f1
SHA1 b0f0f1b5b34cb0bbbea23cdb51970a980b678a8c
SHA512 4bca7fdba01ad5821e55ee7877377af88d9da584a0a0591cb23a4b2ebf74a41e0c15bbfe867bfb8401e9ad8dc4a1b79bac6bfe09dd59ba9d6977ebe2f338b7dd
SSDEEP 3072:i9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:4ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T155847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wqojgeywro.exe

Path C:\Temp\i_wqojgeywro.exe
Size 384KB
SHA256 76f24a50a29c246073a43d1e44da8d5e40288b5ea823b55a76fd4fb6f09a1829
MD5 38785b793e1a719197b6c91002305488
SHA1 792097fc4542bd5340b19e9ce4d8031a335d5aa5
SHA512 e4a87d72b392451a1269d5196380f1aca899dcab3f2a2bc73c51bd6d4b7d24e77eadddc2e2ec3f66d057f18f199320367dc9700044cff1590c792d1f1b8cba60
SSDEEP 3072:j9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:BctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T108847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idywqoigay.exe

Path C:\Temp\idywqoigay.exe
Size 384KB
SHA256 39c463279ca19e959348c74be662c2515a914bc8c11018c8f4e0e279d9e1ef85
MD5 cbd927b88e3a67d30b9f5697afbfdcce
SHA1 2758084ada5baaa1d0c9b14bcaff11c2260df84d
SHA512 724e487fc3b7eaf9dfd21c25f5966467dcf52c8bddde63bffcf7cb4e4cff71291e263de646cd9d89f8b44146e10c1988d2138f67ae55ace53adefc9de452a6d7
SSDEEP 3072:K9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:wctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T102847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgecwuomj.exe

Path C:\Temp\omgecwuomj.exe
Size 384KB
SHA256 ad7dc8ebb12dd4b73d7b60c91ae603febf4069e34155635163ee636b9704db8f
MD5 9ae02f27844d399363dd83e2f36cda0f
SHA1 6fc3e2a157871048985bb6a9cb43d27ee99ed317
SHA512 f02f3d7d28c750db156229836625ef410dcdc7e163a300a199561562aa95bc5b255315cf0e3a58f4539b33720e09d8ee8e8c8f56bf0af949bce6db21a4ad4286
SSDEEP 3072:G9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:0ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T143847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qlidbvtnlj.sys

Path C:\Temp\qlidbvtnlj.sys
Size 293KB
SHA256 2380b4c16d4edb2915369cc79629e3a078c25fcc6d3cae1db076c8e1d395fbfa
MD5 4511f49261432912c0e380204be62501
SHA1 028af914c7445a85f7229f6199361ba25ea24ec6
SHA512 4ecaa926911155cde9f34c9b18879d0b8b2cc71bd5df5d0844a6b8412a46d5118991359dfca1890f71e6b7e557ab1a3deb93e658a235bcf6ebc0dda821fba98f
SSDEEP 3072:etKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:eIJjiJcbI03GBc3ucY5DCSj
TLSH
T170545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qolgdywqoi.exe

Path C:\Temp\qolgdywqoi.exe
Size 384KB
SHA256 294d210f40643c09a7be36d9eab72f83b3770dc2d881310bc708a3cc7ddf85cd
MD5 1a724eeaccedd204f4c070f4e9febf67
SHA1 313beb83794e1c304bac488ab981917cea8cf58e
SHA512 5f278b748373875aeff3d188dd5f1ae63449c7b19e50e0eef52117fc8edaa99d5f9e2ec2d7b37bdc4f8542ce79d54a467cf509b1712e1bb3082de5f0f7bef645
SSDEEP 3072:N9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:fctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T10E847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqnigaysqk.exe

Path C:\Temp\sqnigaysqk.exe
Size 384KB
SHA256 9d73d16db86ba1bc924875550262f905d85fdf880f02def52b2a74256485fba1
MD5 e07997575031acf891b7304c6cf2f2d3
SHA1 d097f9a15d258a17f90e60a26d7389f2494da3fa
SHA512 4711236ad750d50f76d2c04c49e189414b6f88173fe9c45bd413646cc93213a53058e84ca59e0a347d286905831f7c7bb2e9df6137a914fcd0ca7e9717f04687
SSDEEP 3072:t9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:/ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T18A847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uomgezwuom.sys

Path C:\Temp\uomgezwuom.sys
Size 293KB
SHA256 bc469d4cf55cd88ab954b1ff22dc587f878c5b5288bff601ee71a1dc6572c27b
MD5 f0303efb853b72e972a545f2c9532149
SHA1 2b50cfaa85e177ed08aad353951d68da75b28e2b
SHA512 72ae298594745db6b8540116ae72420d4df5accbad6b0a636682d3432ec3f9e31fdbb37eed425cc7100751d827fee8d6f45ab04e6979c00e7df924df3cd1a13a
SSDEEP 3072:ctKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:cIJjiJcbI03GBc3ucY5DCSj
TLSH
T1BC545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

upmhezxrpjhczurm.exe

Path C:\Temp\upmhezxrpjhczurm.exe
Size 384KB
SHA256 8944dcfb15c1220881fc0c67e38a48ea9239c3e9760b18e91efce62ebb40c808
MD5 a1496e95c0e063ff0017a9f120cb4b90
SHA1 41b06d98a5f48fadbe88715ab094761cd337fa4b
SHA512 9a19c5b5ff3390e9cc00bea7bccf6015b533f4b0860ba8eb5875fc37e99b8e3aec3360baacb419382682b75294b0d5494d207f5e7cdaa81b33f24c11e767aad2
SSDEEP 3072:39ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:NctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B1847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

upmhezxrpjhczurm.sys

Path C:\Temp\upmhezxrpjhczurm.sys
Size 293KB
SHA256 0449690e8ec9edb679fd0dba9dacfe02d0e57402f4720ef46739cef4bb6d9195
MD5 37b36b69a6a4db9d4aaed5b1e70509f0
SHA1 1ea81cf03d988ce6f10e739e262298019035a4c9
SHA512 825396673a0749f4090e3b3f46175e747fc3457753fdf107ebac209d134978f1e7565dfebf75401e8476bd0dcef009315cb4d888f401b5b96e683874c5b1dfb7
SSDEEP 3072:CtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:CIJjiJcbI03GBc3ucY5DCSj
TLSH
T128545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urpjhczusm.exe

Path C:\Temp\urpjhczusm.exe
Size 384KB
SHA256 3a650b94e7f0fc5a3999338b153e18bd98cc37ee479ed1a26ffad69e12eaa172
MD5 3878a3d6e9244845c82a86d21dd602a8
SHA1 50155bfd93474ea4846443d1b2bf8816b2fc0e95
SHA512 df83366eb708d57f1db64777fcb92b4915703a4f97e8c4e44105e88fb90f50b3bab927d8101efb88b0183b65ef60648c93ff8e8ec479be3cde8d9ef7c25eae05
SSDEEP 3072:S9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:octFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AF847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsnifdxvtq.sys

Path C:\Temp\vsnifdxvtq.sys
Size 293KB
SHA256 7a938ed024f7aecc8b1f6f91f130d4016d7ccc748ded95c33fb920b5b4a014b2
MD5 494bcb56d8defeac39119f1b4661a729
SHA1 f479236b45ec37dfd34faedd10d689741a986c25
SHA512 5ce24b35598733645340a2f996240e922acd52dc08571617e43821c608f8d52b36150ece4e6e35048d4525745cc45ae89687ea993c9dbc12c5472ce2038be83f
SSDEEP 3072:htKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:hIJjiJcbI03GBc3ucY5DCSj
TLSH
T158545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtrljgeyvt.sys

Path C:\Temp\vtrljgeyvt.sys
Size 293KB
SHA256 276943c0af9e2b44b43996f4009ad4db0ce01f1676973a3034a2478877da03d4
MD5 032ae4009aa794355d7144267f2b3037
SHA1 41497654d1d6472ffbdc67aa170415699b36a5fc
SHA512 25316115cdb5a8a729b73e74cf07d4e4cda4c71a8204448171661cc7e0dadbec0c8d27125c6f8e17f6fb433359272be79d909f34a45a922bae59d7cd25f2da68
SSDEEP 3072:CtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:CIJjiJcbI03GBc3ucY5DCSj
TLSH
T135545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqojgeywro.exe

Path C:\Temp\wqojgeywro.exe
Size 384KB
SHA256 3f06d36bc671998ccfc7d634bbd0da71e51f70719d14c8e073ae4e90afe74a88
MD5 85f8214c8bbce93e5f586a1f2d13d286
SHA1 67fe7af0c2ef3c961dcd7803c1beb45595b2c013
SHA512 4ed7c35771353abd0f38791398ace7b7a7da187ed1b68a5751cdb10d2ebe202a07b63d6b912e8093840c5af731148afa13a251b49ec165dbec703cc751677bbf
SSDEEP 3072:w9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:CctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T152847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b2d903efec8d558eba6ee4ac12873ce1439014705e9d819ff4dfcffa10c4b270
MD5 d9964ad138b9b56ea7891b8576b8a6ce
SHA1 e8153c0a553b8b81a07f1bbc77037f1700b79956
SHA512 7028c8597edeb715bb44be72ae48ceb181161e73b5380897f449df22a8c2b5302f664d632f2373c4c7a712d85a4b0ca70a4a062d6af265eefcac45dd99a660f1
TLSH
T1FCD092A4BB40EC0ECA91287B25B69A19B6409831BC56061A8966B0F88C517831A1B0EE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c1d0eccd9de1dbbf6cbedcb541fa52903c78d66d4d260136bc73243b056beb74
MD5 12c06f300a4b88646d6fda378a48455e
SHA1 86d58840d0666ad8999198dad1983a8cfd61fd18
SHA512 76e813720fc8cd4d829570b1b32d711d2d751540dea1fcac581dd9a5963c4e3161cffa07350cc8d5477fa02d0eb7b1c29b8ffb567f85b5a94259654ff2af3928
TLSH
T118D092A8BB40ED0ECA91287B25B59A19B6509831FC56061A8866B0E88C517831A1B0FE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 f1db82629da2f7e07b67029b20b5de03d11b50f8d1140f3d276d0eebceed6c29
MD5 12d72dafab1049dfedd5e206d6fea49d
SHA1 2190e8d589cf99dced4bb054a9e6b3c8639ef42c
SHA512 62de9166cfd6f6c6f8b48a079260d325dbe1f638fb3aeeba42d40bc076ffacd1e31d7d9b4f013266031b249b932de2008d449eedf6580f89c4794cb0519ebf73
TLSH
T11A411E5803F613CDC7968CB213F20697F6F459AA05677E633382A13E088AB48D441C3F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59718c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59718c.TMP
Size 1KB
SHA256 3b33ead6d8703f544c97c5cf64a60275cdfd5d230c621618308bd069a630fa37
MD5 3e2435fcafa31b1ad0d6eaa28eb85bab
SHA1 1c9a6d890fdd755833e0096e609a98ba416d1e99
SHA512 4d3698a011870a8628073d9add29565c4dedbbfe5ea560e9ff3934918b479b33e284b325a59fc33fd8a524a9e0184322f1091f3615f51ead04102032489d6d28
TLSH
T1BF41206803F613CDC7968CB213F20697F6F499AA05677E633382613E088AB48D441C3F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 624bdf18067dc3b6e428e96e45ee6f9dda1198320a2a967e52c7c5874a65bb72
MD5 67b911a66a8b3687a425eff3ae5b5fcc
SHA1 7964d83e6d513495380fcfaa1e9e8e61d1f6089d
SHA512 1413a27b3cbc2d69e31a4b83e46571c50be0135931850eea08c1950e606664218996aa3e631b4570ffafb7f677d6e13993393ede820dc20eac240d6550a6b1aa
TLSH
T12841CEF3C3E4866DC91146F0AA147E2BCE1C0915432C3D5AC9E4AF5BA3E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 eba72dec40635ca8673bdf6f9d7a61dc2c67dfd834cc8c6b9099805a93f6199b
MD5 73027793b0c695efc9e173ef07b7bd79
SHA1 ccfb322710a93a046ee451ec15ef9d7bcb033c1b
SHA512 ed28d2f4f2d788363cc61a2a2071930c2bf34e0cb099d85029f98af412cf083f7a94ee9b74568a3e15b2cbb0b251e4e14bb5497898108817dda2b028e1139f83
SSDEEP 192:sxRTR/yM/jK1Ml8wCV/fus9l3KZxczoA8p9l/g6+WNCu8/YnWt2GHIgtJ:sxRTP8V/fus9RcDr/50/DB3
TLSH
T11762D916AA345977CCDBD209FA557F63D6F91562A2900E44AAFCCA0C01E76ED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c6eedfd9b0b08af95bf1a6e732133de46a69b914455144001967b1c48ee94a8e
MD5 fb1d3f6439ba40693e21e73cc19ee820
SHA1 56caafe00c49f454d940f4130f56821d8acbbd84
SHA512 6e88af51aa7157a39f236bb6be371406d879af3865e2065abeb340241da0d5c33c2655e84bb4b8398f889d44e5206e13ac7fd48e4c848db7e0983f14dd610643
SSDEEP 192:sxR0R/yM/jK1Ml8UQKCV/fusglfKZxczoA8prl/g6+WNCu8/Yn+t2GHIgDZJ:sxR0PqtV/fusglcDB/50/VBP
TLSH
T12662C816AA345977CCDBD20DFA557F63D6F91462A2900E44AAFCCA0C01E76ED6213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e0b4f36ce1d6fab38dc53a04f740f0931781527ef91ddb0b226611d4961fc140
MD5 8f0cb78a050c09e31a7d0e920a24b9b2
SHA1 29a5a86ee00c49cb51b51c90a33a54afee2ae822
SHA512 26f202b071f2823b640b911b6bca6e4e638d2c3466905edcb8061b90faf9867a394b80fa1eef746c85ebdc0b9731cbdb9664e3bd4f1fc32daded08b06640dc95
SSDEEP 192:sxR0R/yM/jK1Ml8wCV/fusgl3KZxczoA8p9l/g6+WNCu8/YnWt2GHIgDTJ:sxR0P8V/fusgRcDr/50/DBB
TLSH
T14862D916AA345D77CCDBD20DFA557F63D6F91462A2900E44AAFC8A0C01E76ED6213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 d4662f18e9467aa075f9e54bc04a8cfa411de9082a763fcf9c23495923973d2c
MD5 095ba6eacc09269287c6d7d3708e6406
SHA1 b4ddaac53fc4371f56cd9d5652ec483d119f1ea9
SHA512 cf5e5888b098091971fabe17c91c341b5fade6f0692e0e5df51beadf3109b8dc1cf80a322dc41bf3ddaa3cceb25750915e32bf3819ca81369ed03ac8ccecad91
SSDEEP 768:Jl6hhs7pLuL7b2WgqcfHw8F1+UoAYDCx9Tuqh0VfUC9xbog/OVWx3XguOroMazX6:Jl6hhQE7b2WgqcfHwu1jaJx3QuFM4q
TLSH
T1FFE2DB3B680CCB7F4F804A9CEC29799A6DE801CB96D8CD5447FA894C03C66EB511A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d5576e17-f20f-4dd6-86a7-c317dd8d0812.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d5576e17-f20f-4dd6-86a7-c317dd8d0812.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 8e9f77948cf20d496cf5a088e583f3ed7d8255b2e1754c151410ac7a19ab1ca4
MD5 769f94a297a222010f420341a9ac3166
SHA1 0da5743422a61e1252d0dce2c7f08347cff3ff59
SHA512 4bb7e2c4f959b0d6e28a827ff4ab28763e7700008602d277981b0c67ea0bc62f2784431bef45120508193fae75b295c4ade72bbd653161d7c489fd295a561417
SSDEEP 768:Vrv+4UNbda322YreNSLfHflX7DGFzoqPcNMCNZUeVH1SkM:Vbsb43WpfHfl3WkqPa6EH1Y
TLSH
T12103BFB5A8A449378CE3C685B75B36177FF4025746800B94D8ED2F0E879F5AD130BE2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f1d108349f27548abd37be4b412d2805264c6b0263e6055887cd77e2065d87b9
MD5 d707785974fde6ff4976b0319ef8eda8
SHA1 cef8db27f3855639aa7921aa0553b661585857db
SHA512 57b79d02b38e03828053f3eddf99cdd95bb772a5b47a7e84397ec1e9f8d4af6982ffb3eee6ea1c24bb347836541f7f13fd4366980fb454933d071a47954abec0
SSDEEP 768:Jrv+4UNbdq3iAYreNSLfHfkf/X7DGFzoqPcNMCNFpi:Jbsbo3ApfHfkf/3WkqPari
TLSH
T11903BEB0E8B859238CE7C289B71B3A43BFB4166345850B54D8D95F4E869B2AD130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 3c288b69d7738b8f492497beeeb5a5c6985a881dd4384d91fd9e42f2f21a04a6
MD5 c73a539c3743e32cbc9591dfa1278f15
SHA1 271070e94ba89dfee25ed1711951919cc0644626
SHA512 1e5e372e0ee7056a9ed8a8a17bc026ed14e470383019d1296eaca5e52311ed18aa71633e0838a37009b40235a056417a88aa2eb9af9193aba858e41d64dd4d8b
SSDEEP 768:Sj+9c3NAYreNSLfHfkfqX7DGFzoqPcNMCNFpMjP:h9c3NpfHfkfq3WkqParY
TLSH
T16EF2AFB5ACA15D274CD6C289B7173B97EFE416A345801F44D8E96E0E86CB2BD030BD29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 31d1f2baab19bc3c6853c7ae73ad0a73d5666f172f4656332e74d2201439b500
MD5 b983f9309e2212e4cf098dbf0ad2de83
SHA1 0a7ca709a1b5e2bb9852b91eedad2dd1c818a12c
SHA512 d9d702c627800ff6f9dec91280ec5acfe4df0898f796aeea8ec9b5d105136861a26ea5b57ee5d4ee2cf2dfbd5858661b25672dfd98162f104b2bca97b7df44cf
SSDEEP 768:Oj+9c34AYreNSLfHfkfqX7DGFzoqPcNMCNFpMjP:t9c3WpfHfkfq3WkqParY
TLSH
T1D2F2AFB5ACA15D274CD6C2C9B7173B97EFE016A345801F44D9E95E0E86CB2BD030BD29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 b5a0d9afa41934150ecb9e9b59ecfbe49cff7c79f4e8f776f178b9235a3cc030
MD5 79d56e363ae73c5fe1ab1f4303abbba1
SHA1 725ffbbcaecefd45faa6b625e3f2baa81597e2b9
SHA512 1d54ca3c78869b55eed7d6aed14c547dc426ec4fad77ff1cff90c9458b59115c4610e6d07835d112d00a07b9476ee101f3a1870550faa9efa39421ecadf487b2
SSDEEP 768:7F1j+9+3zwgELVfHfkfnX7DGFzoqPcNMCNFpMjP:a9+3IfHfkfn3WkqParY
TLSH
T1351328F598E38936D89E8387A73E2E469ABCC16375841984BBD81D0DCD872BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

c5f8bce0-8932-4661-9e57-58c8d6e7f171.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c5f8bce0-8932-4661-9e57-58c8d6e7f171.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5924_1298410383\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 c4339e68b4dd7de26b20f0066dd17db635b217b45d07f2838cee0beac828d6a6
MD5 472d44486f1ad969743a1f2fea59f992
SHA1 28a725b2c522380aeb550fd9b56d3617ebfc7021
SHA512 8fb49a0323fa4c60d892699496ae8ff666a666625dcd415cccc9faee98a85fc460a69df403fcd0d52c367ba106cde2895c863e155dd84dcdf4bf882ac182bb5e
TLSH
T14871E38356B9D9B3C5DA5BF102836648F5FF233C077370604B555A4AAB30A7A64B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/240-303-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/240-322-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1012-474-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1844-470-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1844-476-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2612-340-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2612-367-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2860-344-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2932-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2956-500-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3088-320-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3716-418-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3720-374-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3804-193-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3920-240-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3988-414-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4156-282-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4376-438-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4392-394-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4700-268-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5428-325-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5708-504-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6008-449-0x0000000000010000-0x00000000000AB000-memory.dmp

Download