systex | 94233f4d71a3531b893ef77e890261ee7fb9cfab712e519ecebe5dfdcb281b0c

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 09:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260930-k6hawass4m
SHA256 94233f4d71a3531b893ef77e890261ee7fb9cfab712e519ecebe5dfdcb281b0c
MD5 9d8cd3c9c58d2ef7e5c3117c572fe72c
SHA1 2b4fa415c22681df514e54f1e5f0a14716027d96
SHA512 951144bb524fbbf75b6c99a5406464cecfb3b59563a65aa4c0722f431e962343ba2127ef30d2190ec2528e5d374315710569d198c1cee90afcbf86b33318bc94
SSDEEP 3072:8btF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:8btt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T19C847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3788	fzxspkicausmkfcx.exe
5348	fzxspkicausmkfcx.sys
5224	CreateProcess.exe
3028	kicausnkfx.exe
4168	CreateProcess.exe
1868	CreateProcess.exe
3960	i_kicausnkfx.exe
1308	cxupnhfzpj.sys
2528	CreateProcess.exe
1956	pkhczumkec.exe
3160	CreateProcess.exe
4748	CreateProcess.exe
4256	i_pkhczumkec.exe
716	czrpjhbzur.sys
3756	CreateProcess.exe
6016	upezwuomhe.exe
4712	CreateProcess.exe
756	CreateProcess.exe
1336	i_upezwuomhe.exe
3012	rljhbztrmj.sys
1308	CreateProcess.exe
2404	ojhezwromg.exe
5256	CreateProcess.exe
2648	CreateProcess.exe
5868	i_ojhezwromg.exe
5388	jgbztqomge.sys
4596	CreateProcess.exe
2988	jdbvtoljge.exe
2772	CreateProcess.exe
2592	CreateProcess.exe
4256	i_jdbvtoljge.exe
4392	oljdbvtigb.sys
3120	CreateProcess.exe
2348	idbvtnlgdy.exe
4592	CreateProcess.exe
1732	CreateProcess.exe
3252	i_idbvtnlgdy.exe
1656	ljdbvtnlfd.sys
5472	CreateProcess.exe
2836	gdyvqoiyvq.exe
4572	CreateProcess.exe
2484	CreateProcess.exe
5952	i_gdyvqoiyvq.exe
1684	icaxvtnlid.sys
5524	CreateProcess.exe
1412	ifdavsqkic.exe
3188	CreateProcess.exe
5504	CreateProcess.exe
3420	i_ifdavsqkic.exe
3520	spnhfdxvsn.sys
3772	CreateProcess.exe
2072	xspnhfaxvp.exe
4668	CreateProcess.exe
4992	CreateProcess.exe
1280	i_xspnhfaxvp.exe
5076	caxsqkicau.sys
1684	CreateProcess.exe
4884	spjhczusmk.exe
1716	CreateProcess.exe
4836	CreateProcess.exe
5380	i_spjhczusmk.exe
2020	usmkecxusm.sys
5628	CreateProcess.exe
2880	pjhczxrpmh.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4164_1082992763\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4164_21737879\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4164_570491074\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4164_1082992763\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4164_1082992763\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4164_1082992763\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4164_377485750\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4164_21737879\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4164_570491074\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspnhfaxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhczxrpmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebztrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicausnkfx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytqoigdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxspkicausmkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkhczumkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojhezwromg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idbvtnlgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spjhczusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbztrmjeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicausmkhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdyvqoiyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhczxrpmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdywqolgdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upezwuomhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdyvqoiyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdywqolgdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davtqlidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davtqlidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xsqkicxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicausmkhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkhcaupmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifdavsqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifdavsqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spjhczusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebztrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbzxusmjeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicausnkfx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upezwuomhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbvtoljge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspnhfaxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbztrmjeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bytqoigdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xsqkicxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idbvtnlgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkhcaupmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkhczumkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojhezwromg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbvtoljge.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3796	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3668	ipconfig.exe
4632	ipconfig.exe
2848	ipconfig.exe
2072	ipconfig.exe
4692	ipconfig.exe
3420	ipconfig.exe
5076	ipconfig.exe
3304	ipconfig.exe
2492	ipconfig.exe
1496	ipconfig.exe
4896	ipconfig.exe
4192	ipconfig.exe
4828	ipconfig.exe
3200	ipconfig.exe
5384	ipconfig.exe
5516	ipconfig.exe
1752	ipconfig.exe
3764	ipconfig.exe
4636	ipconfig.exe
4680	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1704430598-3087477806-3297458608-1000\{C826C654-0E06-4F94-82C3-759A28AB16F9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
3788	fzxspkicausmkfcx.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
3788	fzxspkicausmkfcx.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
3788	fzxspkicausmkfcx.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
3788	fzxspkicausmkfcx.exe
3788	fzxspkicausmkfcx.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
3788	fzxspkicausmkfcx.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
3788	fzxspkicausmkfcx.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
3788	fzxspkicausmkfcx.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
3788	fzxspkicausmkfcx.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
3788	fzxspkicausmkfcx.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
3788	fzxspkicausmkfcx.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
3788	fzxspkicausmkfcx.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3960	i_kicausnkfx.exe
Token: SeDebugPrivilege	4256	i_pkhczumkec.exe
Token: SeDebugPrivilege	1336	i_upezwuomhe.exe
Token: SeDebugPrivilege	5868	i_ojhezwromg.exe
Token: SeDebugPrivilege	4256	i_jdbvtoljge.exe
Token: SeDebugPrivilege	3252	i_idbvtnlgdy.exe
Token: SeDebugPrivilege	5952	i_gdyvqoiyvq.exe
Token: SeDebugPrivilege	3420	i_ifdavsqkic.exe
Token: SeDebugPrivilege	1280	i_xspnhfaxvp.exe
Token: SeDebugPrivilege	5380	i_spjhczusmk.exe
Token: SeDebugPrivilege	5680	i_pjhczxrpmh.exe
Token: SeDebugPrivilege	3328	i_jhbztrmjeb.exe
Token: SeDebugPrivilege	4544	i_ebztrljdbw.exe
Token: SeDebugPrivilege	4552	i_bytqoigdbw.exe
Token: SeDebugPrivilege	2624	i_gdywqolgdb.exe
Token: SeDebugPrivilege	5128	i_davtqlidav.exe
Token: SeDebugPrivilege	1336	i_xsqkicxvpn.exe
Token: SeDebugPrivilege	4316	i_kicausmkhf.exe
Token: SeDebugPrivilege	796	i_nkhcaupmkf.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4164	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 3788	4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe	89
PID 4456 wrote to memory of 4252	4456	2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe	90
PID 4252 wrote to memory of 4164	4252	iexplore.exe	91
PID 4164 wrote to memory of 1896	4164	msedge.exe	92
PID 4164 wrote to memory of 960	4164	msedge.exe	94
PID 4164 wrote to memory of 3796	4164	msedge.exe	95
PID 4164 wrote to memory of 960	4164	msedge.exe	94
PID 4164 wrote to memory of 960	4164	msedge.exe	94
PID 4164 wrote to memory of 2864	4164	msedge.exe	96
PID 4164 wrote to memory of 2864	4164	msedge.exe	96
PID 4164 wrote to memory of 2828	4164	msedge.exe	97
PID 4164 wrote to memory of 2828	4164	msedge.exe	97
PID 4164 wrote to memory of 5860	4164	msedge.exe	98
PID 4164 wrote to memory of 2828	4164	msedge.exe	97
PID 4164 wrote to memory of 5860	4164	msedge.exe	98
PID 4164 wrote to memory of 5860	4164	msedge.exe	98
PID 4164 wrote to memory of 4704	4164	msedge.exe	99
PID 4164 wrote to memory of 5188	4164	msedge.exe	100
PID 4164 wrote to memory of 4704	4164	msedge.exe	99
PID 4164 wrote to memory of 4704	4164	msedge.exe	99
PID 4164 wrote to memory of 5188	4164	msedge.exe	100
PID 4164 wrote to memory of 5188	4164	msedge.exe	100
PID 4164 wrote to memory of 3240	4164	msedge.exe	101
PID 4164 wrote to memory of 3240	4164	msedge.exe	101
PID 4164 wrote to memory of 6016	4164	msedge.exe	103
PID 4164 wrote to memory of 6016	4164	msedge.exe	103
PID 4164 wrote to memory of 6016	4164	msedge.exe	103
PID 4164 wrote to memory of 5172	4164	msedge.exe	105
PID 4164 wrote to memory of 5172	4164	msedge.exe	105
PID 4164 wrote to memory of 5172	4164	msedge.exe	105
PID 3788 wrote to memory of 5224	3788	fzxspkicausmkfcx.exe	107
PID 4164 wrote to memory of 4460	4164	msedge.exe	110
PID 3028 wrote to memory of 4168	3028	kicausnkfx.exe	112
PID 4164 wrote to memory of 5236	4164	msedge.exe	117
PID 4164 wrote to memory of 5236	4164	msedge.exe	117
PID 4164 wrote to memory of 5240	4164	msedge.exe	118
PID 4164 wrote to memory of 4588	4164	msedge.exe	119
PID 4164 wrote to memory of 5240	4164	msedge.exe	118
PID 4164 wrote to memory of 4588	4164	msedge.exe	119
PID 4164 wrote to memory of 6048	4164	msedge.exe	120
PID 4164 wrote to memory of 6048	4164	msedge.exe	120
PID 3788 wrote to memory of 1868	3788	fzxspkicausmkfcx.exe	121
PID 4164 wrote to memory of 4376	4164	msedge.exe	123
PID 4164 wrote to memory of 4376	4164	msedge.exe	123
PID 4164 wrote to memory of 4376	4164	msedge.exe	123
PID 3788 wrote to memory of 2528	3788	fzxspkicausmkfcx.exe	126
PID 1956 wrote to memory of 3160	1956	pkhczumkec.exe	128
PID 3788 wrote to memory of 4748	3788	fzxspkicausmkfcx.exe	131
PID 3788 wrote to memory of 3756	3788	fzxspkicausmkfcx.exe	135
PID 6016 wrote to memory of 4712	6016	upezwuomhe.exe	137
PID 3788 wrote to memory of 756	3788	fzxspkicausmkfcx.exe	140
PID 3788 wrote to memory of 1308	3788	fzxspkicausmkfcx.exe	145
PID 2404 wrote to memory of 5256	2404	ojhezwromg.exe	147
PID 3788 wrote to memory of 2648	3788	fzxspkicausmkfcx.exe	150
PID 4164 wrote to memory of 672	4164	msedge.exe	152
PID 4164 wrote to memory of 4276	4164	msedge.exe	153
PID 4164 wrote to memory of 3328	4164	msedge.exe	154
PID 3788 wrote to memory of 4596	3788	fzxspkicausmkfcx.exe	157
PID 2988 wrote to memory of 2772	2988	jdbvtoljge.exe	159
PID 3788 wrote to memory of 2592	3788	fzxspkicausmkfcx.exe	162
PID 4164 wrote to memory of 1876	4164	msedge.exe	166
PID 4164 wrote to memory of 1876	4164	msedge.exe	166
PID 4164 wrote to memory of 1876	4164	msedge.exe	166
PID 3788 wrote to memory of 3120	3788	fzxspkicausmkfcx.exe	167

C:\Users\Admin\AppData\Local\Temp\2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_9d8cd3c9c58d2ef7e5c3117c572fe72c_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Temp\fzxspkicausmkfcx.exe
  C:\Temp\fzxspkicausmkfcx.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3788
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kicausnkfx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5224
  - - C:\Temp\kicausnkfx.exe
      C:\Temp\kicausnkfx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3028
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4168
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kicausnkfx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1868
  - - C:\Temp\i_kicausnkfx.exe
      C:\Temp\i_kicausnkfx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3960
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pkhczumkec.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2528
  - - C:\Temp\pkhczumkec.exe
      C:\Temp\pkhczumkec.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1956
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3160
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1752
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pkhczumkec.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4748
  - - C:\Temp\i_pkhczumkec.exe
      C:\Temp\i_pkhczumkec.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\upezwuomhe.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3756
  - - C:\Temp\upezwuomhe.exe
      C:\Temp\upezwuomhe.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6016
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4712
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_upezwuomhe.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:756
  - - C:\Temp\i_upezwuomhe.exe
      C:\Temp\i_upezwuomhe.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1336
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ojhezwromg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1308
  - - C:\Temp\ojhezwromg.exe
      C:\Temp\ojhezwromg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2404
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5256
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4632
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ojhezwromg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2648
  - - C:\Temp\i_ojhezwromg.exe
      C:\Temp\i_ojhezwromg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5868
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jdbvtoljge.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4596
  - - C:\Temp\jdbvtoljge.exe
      C:\Temp\jdbvtoljge.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2988
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2772
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2848
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jdbvtoljge.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2592
  - - C:\Temp\i_jdbvtoljge.exe
      C:\Temp\i_jdbvtoljge.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\idbvtnlgdy.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3120
  - - C:\Temp\idbvtnlgdy.exe
      C:\Temp\idbvtnlgdy.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2348
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4592
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2072
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_idbvtnlgdy.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1732
  - - C:\Temp\i_idbvtnlgdy.exe
      C:\Temp\i_idbvtnlgdy.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gdyvqoiyvq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5472
  - - C:\Temp\gdyvqoiyvq.exe
      C:\Temp\gdyvqoiyvq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2836
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4572
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5076
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gdyvqoiyvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2484
  - - C:\Temp\i_gdyvqoiyvq.exe
      C:\Temp\i_gdyvqoiyvq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5952
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ifdavsqkic.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5524
  - - C:\Temp\ifdavsqkic.exe
      C:\Temp\ifdavsqkic.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1412
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3188
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3764
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ifdavsqkic.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5504
  - - C:\Temp\i_ifdavsqkic.exe
      C:\Temp\i_ifdavsqkic.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3420
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xspnhfaxvp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3772
  - - C:\Temp\xspnhfaxvp.exe
      C:\Temp\xspnhfaxvp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2072
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4668
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4192
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xspnhfaxvp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4992
  - - C:\Temp\i_xspnhfaxvp.exe
      C:\Temp\i_xspnhfaxvp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1280
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spjhczusmk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1684
  - - C:\Temp\spjhczusmk.exe
      C:\Temp\spjhczusmk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4884
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1716
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3304
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spjhczusmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4836
  - - C:\Temp\i_spjhczusmk.exe
      C:\Temp\i_spjhczusmk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhczxrpmh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5628
  - - C:\Temp\pjhczxrpmh.exe
      C:\Temp\pjhczxrpmh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2880
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3868
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjhczxrpmh.exe ups_ins
    3⤵
    PID:1432
  - - C:\Temp\i_pjhczxrpmh.exe
      C:\Temp\i_pjhczxrpmh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5680
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhbztrmjeb.exe ups_run
    3⤵
    PID:1752
  - - C:\Temp\jhbztrmjeb.exe
      C:\Temp\jhbztrmjeb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5756
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2812
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhbztrmjeb.exe ups_ins
    3⤵
    PID:1948
  - - C:\Temp\i_jhbztrmjeb.exe
      C:\Temp\i_jhbztrmjeb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3328
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ebztrljdbw.exe ups_run
    3⤵
    PID:4864
  - - C:\Temp\ebztrljdbw.exe
      C:\Temp\ebztrljdbw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1532
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5420
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4636
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ebztrljdbw.exe ups_ins
    3⤵
    PID:5900
  - - C:\Temp\i_ebztrljdbw.exe
      C:\Temp\i_ebztrljdbw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bytqoigdbw.exe ups_run
    3⤵
    PID:4920
  - - C:\Temp\bytqoigdbw.exe
      C:\Temp\bytqoigdbw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1280
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1560
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4692
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bytqoigdbw.exe ups_ins
    3⤵
    PID:2068
  - - C:\Temp\i_bytqoigdbw.exe
      C:\Temp\i_bytqoigdbw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4552
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gdywqolgdb.exe ups_run
    3⤵
    PID:1200
  - - C:\Temp\gdywqolgdb.exe
      C:\Temp\gdywqolgdb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4568
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1408
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gdywqolgdb.exe ups_ins
    3⤵
    PID:4120
  - - C:\Temp\i_gdywqolgdb.exe
      C:\Temp\i_gdywqolgdb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2624
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\davtqlidav.exe ups_run
    3⤵
    PID:6036
  - - C:\Temp\davtqlidav.exe
      C:\Temp\davtqlidav.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2200
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1364
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4680
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_davtqlidav.exe ups_ins
    3⤵
    PID:3200
  - - C:\Temp\i_davtqlidav.exe
      C:\Temp\i_davtqlidav.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5128
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xsqkicxvpn.exe ups_run
    3⤵
    PID:3008
  - - C:\Temp\xsqkicxvpn.exe
      C:\Temp\xsqkicxvpn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5292
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1400
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3420
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xsqkicxvpn.exe ups_ins
    3⤵
    PID:3452
  - - C:\Temp\i_xsqkicxvpn.exe
      C:\Temp\i_xsqkicxvpn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1336
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kicausmkhf.exe ups_run
    3⤵
    PID:3240
  - - C:\Temp\kicausmkhf.exe
      C:\Temp\kicausmkhf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3928
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5364
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2492
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kicausmkhf.exe ups_ins
    3⤵
    PID:3876
  - - C:\Temp\i_kicausmkhf.exe
      C:\Temp\i_kicausmkhf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4316
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkhcaupmkf.exe ups_run
    3⤵
    PID:4944
  - - C:\Temp\nkhcaupmkf.exe
      C:\Temp\nkhcaupmkf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3844
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3184
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1496
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkhcaupmkf.exe ups_ins
    3⤵
    PID:4692
  - - C:\Temp\i_nkhcaupmkf.exe
      C:\Temp\i_nkhcaupmkf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hbzxusmjeb.exe ups_run
    3⤵
    PID:4204
  - - C:\Temp\hbzxusmjeb.exe
      C:\Temp\hbzxusmjeb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2204
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4268
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5516
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x300,0x7ffaa173c188,0x7ffaa173c194,0x7ffaa173c1a0
      4⤵
      PID:1896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1984,i,11361682301114906869,16339395508200567150,262144 --field-trial-handle=2516,i,15960260274018508301,8900088812835461936,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:2
      4⤵
      PID:960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2168,i,15461311198155354192,17641957042699459556,524288 --field-trial-handle=2516,i,15960260274018508301,8900088812835461936,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:11
      4⤵
      System Time Discovery
      PID:3796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2652,i,13770586958274105995,7714757964266286851,524288 --field-trial-handle=2516,i,15960260274018508301,8900088812835461936,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:13
      4⤵
      PID:2864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,10800803928983998044,4746240286323704264,2097152 --field-trial-handle=2516,i,15960260274018508301,8900088812835461936,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:2828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,11490017840121636773,17407404413011349854,2097152 --field-trial-handle=2516,i,15960260274018508301,8900088812835461936,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
      4⤵
      PID:5860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,12163407187144837615,11533457193766323576,2097152 --field-trial-handle=2516,i,15960260274018508301,8900088812835461936,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:1
      4⤵
      PID:4704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,16983646489242616566,9074030368777933521,2097152 --field-trial-handle=2516,i,15960260274018508301,8900088812835461936,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:9
      4⤵
      PID:5188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3644,i,7237728172042901868,6619986632923777126,524288 --field-trial-handle=2516,i,15960260274018508301,8900088812835461936,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
      4⤵
      PID:3240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3616,i,4613029680670286773,331358047408240052,2097152 --field-trial-handle=2516,i,15960260274018508301,8900088812835461936,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:1
      4⤵
      PID:6016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5100,i,4510967153439356970,16674750369084775444,2097152 --field-trial-handle=2516,i,15960260274018508301,8900088812835461936,262144 --variations-seed-version --mojo-platform-channel-handle=3880 /prefetch:1
      4⤵
      PID:5172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,8283815132987024399,456098913032560242,524288 --field-trial-handle=2516,i,15960260274018508301,8900088812835461936,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
      4⤵
      PID:1236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,8283815132987024399,456098913032560242,524288 --field-trial-handle=2516,i,15960260274018508301,8900088812835461936,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
      4⤵
      PID:4460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,4207990846656596631,1151075566747749545,524288 --field-trial-handle=2516,i,15960260274018508301,8900088812835461936,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
      4⤵
      PID:5236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,644797171864492971,2992395395740720510,524288 --field-trial-handle=2516,i,15960260274018508301,8900088812835461936,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:14
      4⤵
      PID:5240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,139102317338400935,8044742511370328362,524288 --field-trial-handle=2516,i,15960260274018508301,8900088812835461936,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:14
      4⤵
      PID:4588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,11488756588432569304,13298807312682124590,524288 --field-trial-handle=2516,i,15960260274018508301,8900088812835461936,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:14
      4⤵
      PID:6048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6580,i,521029607557566770,7551444624075422820,2097152 --field-trial-handle=2516,i,15960260274018508301,8900088812835461936,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:1
      4⤵
      PID:4376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1284,i,18391195161622914722,9939395276057246865,524288 --field-trial-handle=2516,i,15960260274018508301,8900088812835461936,262144 --variations-seed-version --mojo-platform-channel-handle=1448 /prefetch:14
      4⤵
      PID:672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1432,i,15741188912990423164,8797044242022226671,524288 --field-trial-handle=2516,i,15960260274018508301,8900088812835461936,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
      4⤵
      PID:4276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1404,i,1119850132719543987,11726248971944298395,524288 --field-trial-handle=2516,i,15960260274018508301,8900088812835461936,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:14
      4⤵
      PID:3328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=3792,i,1922684865319447818,6865573233176218595,2097152 --field-trial-handle=2516,i,15960260274018508301,8900088812835461936,262144 --variations-seed-version --mojo-platform-channel-handle=1484 /prefetch:1
      4⤵
      PID:1876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,3698048628737566602,15472405988934667810,524288 --field-trial-handle=2516,i,15960260274018508301,8900088812835461936,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:14
      4⤵
      PID:1172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1284,i,2308894113263169142,2578031132370675703,524288 --field-trial-handle=2516,i,15960260274018508301,8900088812835461936,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
      4⤵
      PID:3784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=948,i,2121936123216736702,934707128165330134,524288 --field-trial-handle=2516,i,15960260274018508301,8900088812835461936,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
      4⤵
      PID:1192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=944,i,14493976348457706716,13348602994819918642,2097152 --field-trial-handle=2516,i,15960260274018508301,8900088812835461936,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:1
      4⤵
      PID:5284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,17242208037408492715,1303409759645146597,524288 --field-trial-handle=2516,i,15960260274018508301,8900088812835461936,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:14
      4⤵
      PID:5364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1252,i,12544591908120032163,7325582971888499599,262144 --field-trial-handle=2516,i,15960260274018508301,8900088812835461936,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:10
      4⤵
      PID:4432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,15094499008238718944,8755929342276831498,524288 --field-trial-handle=2516,i,15960260274018508301,8900088812835461936,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:14
      4⤵
      PID:4872

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1432

C:\Temp\fzxspkicausmkfcx.sys
C:\Temp\fzxspkicausmkfcx.sys
1⤵
- Executes dropped EXE
PID:5348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4864

C:\Temp\cxupnhfzpj.sys
C:\Temp\cxupnhfzpj.sys
1⤵
- Executes dropped EXE
PID:1308

C:\Temp\czrpjhbzur.sys
C:\Temp\czrpjhbzur.sys
1⤵
- Executes dropped EXE
PID:716

C:\Temp\rljhbztrmj.sys
C:\Temp\rljhbztrmj.sys
1⤵
- Executes dropped EXE
PID:3012

C:\Temp\jgbztqomge.sys
C:\Temp\jgbztqomge.sys
1⤵
- Executes dropped EXE
PID:5388

C:\Temp\oljdbvtigb.sys
C:\Temp\oljdbvtigb.sys
1⤵
- Executes dropped EXE
PID:4392

C:\Temp\ljdbvtnlfd.sys
C:\Temp\ljdbvtnlfd.sys
1⤵
- Executes dropped EXE
PID:1656

C:\Temp\icaxvtnlid.sys
C:\Temp\icaxvtnlid.sys
1⤵
- Executes dropped EXE
PID:1684

C:\Temp\spnhfdxvsn.sys
C:\Temp\spnhfdxvsn.sys
1⤵
- Executes dropped EXE
PID:3520

C:\Temp\caxsqkicau.sys
C:\Temp\caxsqkicau.sys
1⤵
- Executes dropped EXE
PID:5076

C:\Temp\usmkecxusm.sys
C:\Temp\usmkecxusm.sys
1⤵
- Executes dropped EXE
PID:2020

C:\Temp\jhbzwuomhe.sys
C:\Temp\jhbzwuomhe.sys
1⤵
PID:2668

C:\Temp\hbztrmjdbw.sys
C:\Temp\hbztrmjdbw.sys
1⤵
PID:5380

C:\Temp\bytromgebw.sys
C:\Temp\bytromgebw.sys
1⤵
PID:2764

C:\Temp\gaywqoigay.sys
C:\Temp\gaywqoigay.sys
1⤵
PID:2848

C:\Temp\dxvqnlidav.sys
C:\Temp\dxvqnlidav.sys
1⤵
PID:1776

C:\Temp\ysqkicausn.sys
C:\Temp\ysqkicausn.sys
1⤵
PID:4268

C:\Temp\xsqkifaxsq.sys
C:\Temp\xsqkifaxsq.sys
1⤵
PID:936

C:\Temp\khfcxupnhf.sys
C:\Temp\khfcxupnhf.sys
1⤵
PID:5768

C:\Temp\jhczusmkec.sys
C:\Temp\jhczusmkec.sys
1⤵
PID:5488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CreateProcess.exe

Path C:\Temp\CreateProcess.exe
Size 3KB
SHA256 2b7b9ed9586ded976dab464858de7553b42bcc6c5919f6d884c3d75ec6af83cc
MD5 0919ff35701c4b372022961119ab383f
SHA1 eda78a7df4e93ffb55d9cc5bedf95bf20f72522b
SHA512 ef7de16166e877aa77673ea92f7340612b3301d6376f305f9e1deda7ce4bb977f9211287195c3b4ca9b7a92172e4180c98ccb8f7665851f25206148bb9f2f5e9
TLSH
T14671C08367ADD9B2C2DA5BF102835644F5FB22780B7370214B555586AA34A3A54B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

cxupnhfzpj.sys

Path C:\Temp\cxupnhfzpj.sys
Size 293KB
SHA256 2a989fb62a3d057de45a85dbda2302afbf4564d04dec587dfd911fcc74cb191c
MD5 0699b2cbec6e9c1e54d058fcdc4b7f78
SHA1 d6a589f860b61103f37dc3e785cba0b2b7ed34f7
SHA512 521a7db228def0e7946bf6fa52cfd2d292808a43bafbf1f857d24e8015e00207b804df550b8220539b8aa28a92f67d0e9b2cd4bba6646d6452af70d95cd217c1
SSDEEP 3072:NtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:NIJjiJcbI03GBc3ucY5DCSj
TLSH
T1BA545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

czrpjhbzur.sys

Path C:\Temp\czrpjhbzur.sys
Size 293KB
SHA256 483780adeca607cb56c36722d4eed9685b92b6f68ae6ed055dbf4b6249c9e443
MD5 7181c0f9c851ca8fa17f14ca20857b54
SHA1 51e43646ad10edf810d49e2fec55c3c83cde949e
SHA512 8830e9ec24f4566f00855b34b1bc3cdc2015670141a5dfb8ad18a2f36100378dd1b2acb643c8baa08d63b5617c6e35665ac354df7b1a9d94bf189d665f2e2b6b
SSDEEP 3072:GtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:GIJjiJcbI03GBc3ucY5DCSj
TLSH
T135545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxspkicausmkfcx.exe

Path C:\Temp\fzxspkicausmkfcx.exe
Size 384KB
SHA256 1c87c2d86cdefca46db07942e845d7322a07887a190a89d557f6c565deb824cb
MD5 fce2558fe13d67bc2aeda468b96a6508
SHA1 cbe3ca12890f041f3ab852fedaf29406423d1646
SHA512 e4ba28cbc63f157b4ef9ee7722fcfd0de11caf8f37f389ae744d22421636464b05446d9504e6713d66004cf2d74e91bccb412a9a84259ed81b0929afe334c856
SSDEEP 3072:EbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:Ebtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E9847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F754CE5D9A517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxspkicausmkfcx.sys

Path C:\Temp\fzxspkicausmkfcx.sys
Size 293KB
SHA256 8bb510052793bac384e3e957b69e997a9a930e5247aa42f3e791f45f4238c1cf
MD5 eb70964254deb7c5cfc3d2dffe15299f
SHA1 d7704aab0ff2d73abdfe4c80193bc9ea1164db63
SHA512 4824f2d0b991b5c85e4313dda94ee17be5aac6d6f341fbe060912d9f8eef7598819bd1747aa3ee8b6acba3372696244494ea9d8824055639df60d14bec6f4feb
SSDEEP 3072:utKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:uIJjiJcbI03GBc3ucY5DCSj
TLSH
T15E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jdbvtoljge.exe

Path C:\Temp\i_jdbvtoljge.exe
Size 384KB
SHA256 d74edb74661108b7448427db9c2463a493b91f729ad05d8602bab2e3ddaa775b
MD5 fa7899538a49b963986d2335033df5cb
SHA1 dcb99552954dd84d09509df45694424d19d72ff4
SHA512 29673a573e17f700b9761605f73b6921830e5927d57c867c976cfc095ab166e4d304e721f0438e6505e9c555547fa359456248b69924b0e828b6cb3087db9c33
SSDEEP 3072:zbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:zbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T143847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kicausnkfx.exe

Path C:\Temp\i_kicausnkfx.exe
Size 384KB
SHA256 69f62a7fc95e330c8ce8cd8f9f76e42e090ab11dc5eb7050b00c50e570f55f48
MD5 8ada98464ad881a3fd8a5ebde47873a6
SHA1 02de4a647cd82480e638d61a1fee40788da97ea9
SHA512 b616bc7340c432411f3042b2c26b683d5b9ceaf0edeb0519b9d8785a3e51c913b2839b80256c1afe8e2dbdec15bd37aa3fa9912edd5454ca619d0839be750120
SSDEEP 3072:ZbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:Zbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T17C847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F754CE5D9A517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ojhezwromg.exe

Path C:\Temp\i_ojhezwromg.exe
Size 384KB
SHA256 558c9d1e5fa90d35b59f714f9dae619992b7540a3b354dbdbc1be42c6f8a3690
MD5 37827127ce98d59300a6b783398d4f3a
SHA1 a8a396d8d488f9446a73d06eb6af25fda2c8a3e8
SHA512 79b9da61f7681dae1a28d790a0105bb64297d37e72f2c4a8cb940c750d52ea99bab9c00f78955df7f7169ccfd7ad2fd4f59727786cd8a96a2e747190a359a54b
SSDEEP 3072:abtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:abtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1CC847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pkhczumkec.exe

Path C:\Temp\i_pkhczumkec.exe
Size 384KB
SHA256 c82c36458742d798483f8f744d7faf2bb122b8e4b7bfc7bf057e3927346405d1
MD5 d1b29c811844d875a04f5c1b4aa8a40a
SHA1 6c4683b539d67f6effba125e4b7068a8c7936fd9
SHA512 0d547bb8c213e48b5d58adb3d04ebeefb119c0a39023facf546d2ced4f653568d6fb5c7ae80d4e95dbe764b078c7ff7a32ce7e4289390594d20f934949ba69c7
SSDEEP 3072:wbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:wbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1FA847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_upezwuomhe.exe

Path C:\Temp\i_upezwuomhe.exe
Size 384KB
SHA256 519725910e56cdc0449be5c05deede8a60c8b4668470dc30eb413204d8619488
MD5 79f0ebac9861c0ea257cd7a334e8bbd2
SHA1 9d0cdf053c924f1e53bb7f3b9b32e06f7796853c
SHA512 79b4d10905bc66ecd10a9c7d3fbd0ce38775c15c20784ad1935096fffc3caa98d667c0971986003baa88e3c3412be8c63fc4685955c3db01f9b88993b11b6582
SSDEEP 3072:mbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:mbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T199847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbvtoljge.exe

Path C:\Temp\jdbvtoljge.exe
Size 384KB
SHA256 9fa3814bc5173330a91160888b0074c5d1882003210f3a9787765e068ea8d480
MD5 0d5cde171802827a90a028b7c1b72ff0
SHA1 6ee3aeb55ee19feb532cc920df81573311f8102f
SHA512 67e981588bb50d715436913e43aa7e5c4854aef2c01869a6e0724a8c2760a5cddeecc1a95e8f3f8b56211e20bdbf1c86f6326baebea43ae6b3f250763e03594a
SSDEEP 3072:/btF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:/btt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T11F847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgbztqomge.sys

Path C:\Temp\jgbztqomge.sys
Size 293KB
SHA256 4499e41d702f89b3cc24811064047c821bb875cfffcd0e90d02c6580816e7e2a
MD5 e460227536928b62500119bed34cd71d
SHA1 c96cfaa8182d53e800cd91e4e1ff6777277ff3eb
SHA512 9e8711f4242bebf8a415e1341093c590f5bd21bb72937988b02b5304eb03532cbdc3603658ed50aeda6f3f30724ca5a4506999fb344a16f2fa2cb0d37697999c
SSDEEP 3072:3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:3IJjiJcbI03GBc3ucY5DCSj
TLSH
T16D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicausnkfx.exe

Path C:\Temp\kicausnkfx.exe
Size 384KB
SHA256 6afc3f99c4e591cf4c3cc0b2d49e1e6ebb170e97e4582cbc6a277c6a1bea274a
MD5 9b366fe0c9cd0e006201fcc654efde44
SHA1 0a8794e64160599758b6729f53e07a66b57d2a9d
SHA512 3dd348841eea7f0821b74a10a7ed74ab864dc8c4890edab715e428b5c204daafe981dc610a2d1c3b10e908aeaf900952dcb403a353f83f37a48b809fce322e20
SSDEEP 3072:5btF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:5btt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A2847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F354CE5D9A517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ojhezwromg.exe

Path C:\Temp\ojhezwromg.exe
Size 384KB
SHA256 86f726cfe553a5235a95fd9118b6b20baab3a38b5a959c631808dc55840251d3
MD5 417bad1f43669acb7d3912a3b02ec9e9
SHA1 bde044e9722c9a827fdabc7e2602cc327d3e627c
SHA512 29574eef5ea590280744054ab95005e994c826bb7731bc45ee1fa537df72271da0dd034bb5a0bf04fb98fd41bac9f18f715b92809592a98040bedf1efa620b16
SSDEEP 3072:ebtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:ebtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B4847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oljdbvtigb.sys

Path C:\Temp\oljdbvtigb.sys
Size 293KB
SHA256 203cf86943929d03c4782a33b3ab183d22b6970ab1f3fa62e7a95bc3609e0bdc
MD5 ec2eb0c9165fb7794544de2ea618f156
SHA1 28778e8f0afe9351cce6c79e221944893de91f1d
SHA512 b1a969dd54bcf8943eebe946ec267f662d9c1618d7bc7f54ee970b7d5def93c129de3eeb780cda5f8326ba848f92a41377e6bfc2de6ddb47bc075a26b39f2220
SSDEEP 3072:ytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:yIJjiJcbI03GBc3ucY5DCSj
TLSH
T17C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkhczumkec.exe

Path C:\Temp\pkhczumkec.exe
Size 384KB
SHA256 a70804e309c688f1cf7f6094e02e7f11feb95adbeeba4ca33691cb4a1b9c865c
MD5 b64c09f02146713ac4d51b83c41317f8
SHA1 a72817f4d91d44b77a5d8e890b517ea4382db2e3
SHA512 115067025ecd5e978932ca310282ca217c143c9cc9205a99d5741d088b6f5f66512f542e8dba232760454da0efe19fa69e90c9dc078ad29befc605829200bee2
SSDEEP 3072:7btF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:7btt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T152847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljhbztrmj.sys

Path C:\Temp\rljhbztrmj.sys
Size 293KB
SHA256 bb2e42fbccc699b2721206eaba6064b1a39f347f9e7aae73c2841c7be774424d
MD5 fb062dd840370ec944c20e4addd1c2bf
SHA1 5410a57121184d0bdbc070d2f078c97e68db593e
SHA512 fcd02ca70585c190b6feb9d045658571cd2dbe9c8823434c3564d13d4e4ff0299f12fa3f8ef2c748e0b1cd2681efb27bcae30e4a8f4f65c8ff4d80beb7bc80d1
SSDEEP 3072:7tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:7IJjiJcbI03GBc3ucY5DCSj
TLSH
T183545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

upezwuomhe.exe

Path C:\Temp\upezwuomhe.exe
Size 384KB
SHA256 b7216745df0c3972e6ad6eb4dbebf5d6c086bbcaf35559898231f098119953c7
MD5 ff2c8fad77744a27b18a0dc202e7683b
SHA1 7291c1fb67af7ce9bf0828c0ccc201bf2ff8463a
SHA512 104559c6101bd7c00b0454f08ce069451692945b63016368a72930030cf0334ad128bc2b64db602231cf62214b407923a60ea96fe3efa42f946b88c679575431
SSDEEP 3072:BbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:Bbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1DA847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 68f353a62995fc87917d7d1eef768abe00ffab02e1d3e469100f99b6987f6488
MD5 5ba62d3fe2ddefdf87e8dd139f3e421b
SHA1 1986deda7bda2ac5b490eacb9fe2784fb6d01648
SHA512 4e6a767b24298d2e01c8dbefa41509e1bc67cf2c2f34fd0bf866fc1017e1d15a470a5a95feb8ee1cccf4b8ccf5fa9054bcbb93919c00de89eeffec199b68baf9
TLSH
T19CD02BB5DFFCCC62D54820B802518E116085B41519490040DA03FC04DD110814D03555
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 648887a89dac8888df245d8758dcd78e85ae79931c9464f19b0967fcd69c3d2f
MD5 b053e18c94ac6f6c60a9e0a281e1687b
SHA1 17ed2d8ae6844c2878132336a2fea7d044381f8b
SHA512 abf3d05979a55f573445c0c7a95529a5899c0d9f55f350b3eb35132d8502e23e6c764ffc98e92f4374754aa22e9292fd03f8e6e8113c0e919f428e797e339bfa
TLSH
T151D02BB9DFECCD62D54820B402508E116095B4156D490040D903BC04DD110814D03569
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 532d880a958298e489da1a00e1bce35cf71f3ac2cfef27790a98c27b46154ddd
MD5 751c572d9c0d38e65e161866eebad8bc
SHA1 e631404069949e93c1ce502321fd8c936ae690c4
SHA512 96c495faa7496faca499110bfbf606240948af3929eb670925e41a53aa5b73f0e293958c074b6ad78c8bf9a13eea606372a4be89ae4d89b03fae55f726d0dfdd
TLSH
T1EA616B854FA16CD5D39C87FE80C304C2B73147B51A830FF10E88C63F49C2B6DA106819
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 cfdf344ad857f7ab8199cb91a5e7c2c3856200bb49c9c88e87d3bcbc8199f96f
MD5 9bcf21c5ed7386277fe12085074579c3
SHA1 d5a9e2b2e61b25c9739800aae30bf6ca16724f4d
SHA512 ae5ce8b46ff4b2c183fb98bbf3c3cce497398bc590507387ca86dfa5c22e718689ade5ec1f816351252a88725552869a072f63bb4a99733faedef64651ba7bd7
TLSH
T1B0519CF3C6E8866D890156F4AB186E2BCE2D0954432C3D5AC8E4EF6B93E2471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 456b71c5ecef87703418a6dff3d543e786e46806c0506685c2effdbd8fdd7eca
MD5 96411494a114a0f87b258ed91a0c0ffe
SHA1 12237c8817e3db28a30828dce772baf8bb0fac19
SHA512 48e8a555644bd661acfdab1fedd52c770efd3b8d5da59fe86212f56bb6aa1ac2fbd348e8fe86264ab161cedd701ef6c72fdd35792b9c5384e0dd28a3c40c07a0
SSDEEP 192:sxRS4pRpEC5R/feeYs5aaZvQBOzoA8p9SE/g6+WNIYckXNLiTHmGXOlIgDYCIXJ:sxRfzD/fe5sAMol/5IEliT62
TLSH
T10D42B715AE68A97B8CDBD20DFB55BF53D2F85132A0D15E48A6FC8A1C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 6df06ed54fe7f6242d36e57a0a1ec5f286fc701d0d3be5058bc2b637c84eacac
MD5 730977fcd9ead31f2f937ad4a5af4be8
SHA1 6c89a7c092019d7c13442ec6b24cf4a4abe47169
SHA512 c90367e3819861ee60aeacbdd13ac284fdb18c805940a403a71deca195d7525354ced2b02346f0515e1a27e8bd1effdb343b6269f651d266767deee98a06f87c
SSDEEP 192:sxRS4pRpEC5R/feeYs5qTaZvQBOzoA8p9SE/g6+WNIYciXNLiTHmGXOlIgDYYIXJ:sxRfzD/fe5sIMol/5ICliT68
TLSH
T18A42B715AE28A97B8CCBD20DFB55BF53D2F85132A0D15E48A7FC8A1C14E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 65b722f5579e493203c3ca7a5b8ea3793f954f4178ab5d1988b062cf872ba6a5
MD5 d2d298d55d9ea9919f7e3ac358d7e869
SHA1 04c2296e93f53f53fb7ce50deb3327f3aa9b8492
SHA512 27fa00eb5570351d19ac9d47fcf4b34d7f251098e6d0fe5cfafc069e22f9bde4c27050145923e5f77adcaa8e587746e05f1ddfde3491f88180109675755a3ce5
SSDEEP 768:DFak/4yG7pLuLbs5Wg1Bf9t8F1+UoAYDCx9Tuqh0VfUC9xbog/OVY/J97gMroMxy:DFak/4ymEbs5Wg1Bf9tu1jaf/JxgXMxy
TLSH
T136D2EB3B744CCB7F4F804A9DEC197E9B6DA802CB9598C94047FD941D03C67EA521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 364538b8667cf75359c0568327b74caf28add24dc9a88534288a0cc4db38dc0c
MD5 c736ee1574f1e5eeadea30a77840862f
SHA1 df98f139580262219ee4e6a747c47074550c4af7
SHA512 cb32ff3a18f5e435facf6e448de75d6ff11bca3731ba1c569d94956200544dbe6ee40cf6411f9226a6f432bdd51caf4cf694ce158e921b3d488041adfc3aa366
SSDEEP 96:KyU9m6U2Wx3ansFyxKN4F0xpME/yWSWTiK4wnBmKCoaH:LU9m6U2WpanmyI4F0vME/yWS155H
TLSH
T12591D025713A4281383E690C91E5E71E868136A33078EA2F3FEB44554A67E188EFDDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e339a0a0-d55d-4286-a482-0b7da2d61a18.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e339a0a0-d55d-4286-a482-0b7da2d61a18.tmp
Size 11KB
SHA256 22fe7158b43c91763d601b9153c89664936e718bccba4746fea6aeb9c7e6c898
MD5 d7f551bf3e3b41c0513f43bec6b4705b
SHA1 37cf446292e3260cf31dbed01d3285eb00b015e0
SHA512 000fa3928b02185ee9edbc662af3e65e6c9c75090aa4b43d39125c8ae02efd3ed07739e313b98c3eb4daeb2a55eeb96f1b924365a9107675cd142be3a5eb5ae6
SSDEEP 192:sxRSLpRpEC5R/feeYsdaZvQBOzoA8p9SE/g6+WNIYckXNLiTHmGXOlIgVIXJ:sxRIzD/fe5sdMol/5IEliT6k
TLSH
T12432B615AE28A97B8CCBD20DFB55BF53D2F81132A0D15E48A6FC8A1C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59d73c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59d73c.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 e3d8d4575d399587124194f3c5fc81705b38d1988398785863c8d875a911d7fb
MD5 5386f68536e80186798de343a18771ca
SHA1 463b5ed5f22f86cc44a3e42b5714deb6d50084d5
SHA512 b01a25a8d313d0de4dd162ad661a581d682099dd6d3b1b5639351dd89e62f8e384e860fe0ceaf9f78d80933addfd204cd646ff9ecc9f575dbf0be6e5de0f9c4b
SSDEEP 768:vw/UxvxjgC+5j36VMi8fieOJNjFnUPO4Qp7cPAiSm2eo4w4cciGrTF5iAgZbCM3s:vdZj3+5j36CiIKjFwQpYoimeoR4ccFFH
TLSH
T1F903CF75A8A46E73DCF396843A0D6383FFF1416395C12994CAED2E0D42877AD530BC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 3ad8860afb4609b1690ca36ce1a3db8357e7598985eb1f72c735e9b66fa90687
MD5 a04b2f55eabe19c6b72a0c2628985e7c
SHA1 d3bf0494c5bce5e87932f7ec3f01aac6e9fbba3c
SHA512 cf17c101f4e9b1fbc76d7cbcee69b736bf5001770ef9fb3115a6cde06ce152f7c3a47d1ed1e7e322fd30081818753788c2dffda16aaee245cd6c3a0d79466f41
SSDEEP 768:F13famPieOJjEjqnUPO4Qp7cPAiSm2eo4w4cciGrTFle4YGHed:F13iyPjqwQpYoimeoR4ccFF04YUed
TLSH
T196F2CFB1E9A4AE739CF69281B915AB82BFF011639CC50D88C5D9AF0D41477AE231BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 d66d53e3ec49d997efed93479b1407909528bd87e9473bc7d9e60b171478b2eb
MD5 366052cee983011c75361c33c5386c9c
SHA1 61fe49c4587dcf875c567758b672524cecbbef91
SHA512 74071733a7d05f8f1297e4f43bb030a9d039092a3bb8154b40a319e35ec1c0ae181c867a1949686906153621469c25e65e15fc944655d26115ee4fb6e2153ce0
SSDEEP 768:3I/UxvxjgC+Y3mHkPieOJjEjqnUPO4Qp7cPAiSm2eo4w4cciGrTFle4YGHFMf:3VZj3+Y3WkPjqwQpYoimeoR4ccFF04YP
TLSH
T1F413CF75A8A8AE739CF7A681761AA7C3FFF0156398C11D98C6D95F0D028739E130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 2ba4ff72baebc501b834c80fc2bc626f5cf898e58e7cd459e112d837bc9dc96f
MD5 547beb77500d15667b0a3d39fa872694
SHA1 db29ef2c1fe833c4feeb88d86aa526bf98d49336
SHA512 83fd5306cbffd632025bdfce78b78f6348fd54bc83a257aaf8bc511827268b2e742b7eecc27de1c62c4383249fdd72f07d64bf47a35b20da192053e8612ba870
SSDEEP 768:3413KamPieOJjEjqnUPO4Qp7cPAiSm2eo4w4cciGrTFle4YGHed:3413TyPjqwQpYoimeoR4ccFF04YUed
TLSH
T1BCF2CFB1E9A4AE739CF69281B915AB82BFF011639CC50D88C5D96F0D41477AE231BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 e1ccb348094480d867f3ad3b67a6873904545f18bb73fc698444b39b11f99fda
MD5 657800fd3e4b3c50d85d381fd4786c83
SHA1 58cf3e8e7ebe423171294b1b9043acfbf7c1ee3e
SHA512 e36e5a2c6817bf6cccee3853af9a8c55569210f63c1e048419751bf22fe83134eebec01f067cf92e8a80f751709e06c87bca97bb6205c90f8d3046b01413278a
SSDEEP 768:OFQm3zwgbamNuOJjGynUPO4Qp7cPAiSm2eo4w4cciGrTFle4YGHed:lm341ywQpYoimeoR4ccFF04YUed
TLSH
T178038DB2D9A4DA77ACF797C1BA15B782EFF011A389C99CC4D6C95E4C008769E130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

866b219b-dfa7-4a4a-b06c-4ab4e672c18e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\866b219b-dfa7-4a4a-b06c-4ab4e672c18e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4164_1686569055\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/716-232-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/936-468-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/936-450-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1308-185-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1656-304-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1684-308-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1776-445-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1776-423-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2020-356-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2668-368-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2764-400-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2848-412-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3012-257-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3012-276-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3520-323-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4268-427-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4392-283-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5076-327-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5348-62-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5380-388-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5388-269-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5488-472-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5768-454-0x0000000000010000-0x00000000000AB000-memory.dmp

Download