systex | 1c69762d2bbb1f2ebb699ef4c286d74fa2043c3e8ec1a9182ebe7dbc5af27f8d

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 03:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260629-d8mvtact8x
SHA256 1c69762d2bbb1f2ebb699ef4c286d74fa2043c3e8ec1a9182ebe7dbc5af27f8d
MD5 b4c860d744c7d848bb23901c3d96bf0c
SHA1 0bef4dfa0afd912f49aee0541528e4d0eb520de1
SHA512 5630c67cb41760572e7c983ec0cb4a2e44eabeb23044a766cca8b01bee647c395747209979accdeb5d51615e4396cfa16182ba1bb8f8071927aa3680e62df02d
SSDEEP 3072:GT6L7HYaMj4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:c6LI9IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A6847B04BAA4F0F6D995043800EBAF36967EB4242726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3740	mkfcxupnhfzxspkh.exe
2740	mkfcxupnhfzxspkh.sys
2660	CreateProcess.exe
2200	pnkfcaupkh.exe
2880	CreateProcess.exe
4540	CreateProcess.exe
1100	i_pnkfcaupkh.exe
932	fcxvpnhfzx.sys
4420	CreateProcess.exe
4448	mjhfzxrpmk.exe
972	CreateProcess.exe
5864	CreateProcess.exe
4580	i_mjhfzxrpmk.exe
5764	ecwupmhezx.sys
1116	CreateProcess.exe
1384	czurmkecwu.exe
1260	CreateProcess.exe
3592	CreateProcess.exe
5280	i_czurmkecwu.exe
4980	rpjgecwuom.sys
2744	CreateProcess.exe
3572	urpjheywro.exe
2444	CreateProcess.exe
4272	CreateProcess.exe
3284	i_urpjheywro.exe
5184	rojgbztrlj.sys
2716	CreateProcess.exe
5520	jgbwtomgey.exe
3392	CreateProcess.exe
3016	CreateProcess.exe
2584	i_jgbwtomgey.exe
3044	oigbytqolj.sys
1136	CreateProcess.exe
1524	dbytqoigdb.exe
2196	CreateProcess.exe
2128	CreateProcess.exe
3416	i_dbytqoigdb.exe
1964	oigaysqlid.sys
2472	CreateProcess.exe
3408	gaytqljdbv.exe
4564	CreateProcess.exe
708	CreateProcess.exe
4752	i_gaytqljdbv.exe
1456	ysqkicavsq.sys
4712	CreateProcess.exe
3912	vsqkicaxvt.exe
4400	CreateProcess.exe
5048	CreateProcess.exe
5524	i_vsqkicaxvt.exe
3896	auspkhfcau.sys
4072	CreateProcess.exe
3436	snkfcausnk.exe
1096	CreateProcess.exe
2852	CreateProcess.exe
2616	i_snkfcausnk.exe
2324	usnkfcxvpn.sys
824	CreateProcess.exe
2804	khcausmkfc.exe
2624	CreateProcess.exe
5512	CreateProcess.exe
5912	i_khcausmkfc.exe
3520	mkecxuspjh.sys
5096	CreateProcess.exe
1472	jhecaurpjh.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_584714296\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_584714296\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_260066234\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_260066234\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1825718479\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1825718479\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1825718479\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_897557411\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3644_1825718479\llm_user_input_extractor_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czurmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkfcausnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomgezwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigbytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtqligdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daysqkiday.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kecxupnhfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khcausmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caxspnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbytqoigdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaytqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaytqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsqkicaxvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigbytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_caxspnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khcausmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomgezwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqomgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtqligdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_daysqkiday.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecxupnhfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnkfcaupkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnkfcaupkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjhfzxrpmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjhfzxrpmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czurmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhecaurpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgbwtomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbytqoigdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsqkicaxvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkfcausnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdavsnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdavsnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzxromjebz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkfcxupnhfzxspkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urpjheywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urpjheywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgbwtomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhecaurpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqomgeywro.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5164	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4116	ipconfig.exe
1252	ipconfig.exe
1820	ipconfig.exe
3748	ipconfig.exe
4996	ipconfig.exe
4736	ipconfig.exe
984	ipconfig.exe
4860	ipconfig.exe
4776	ipconfig.exe
2052	ipconfig.exe
1956	ipconfig.exe
5764	ipconfig.exe
3544	ipconfig.exe
960	ipconfig.exe
1448	ipconfig.exe
5704	ipconfig.exe
5632	ipconfig.exe
6048	ipconfig.exe
2684	ipconfig.exe
1628	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134271780610873561"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3226024100-3888324339-2736661264-1000\{7BECB1EB-C04B-4C8F-B152-F4F5E1F1E725}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3740	mkfcxupnhfzxspkh.exe
3740	mkfcxupnhfzxspkh.exe
3740	mkfcxupnhfzxspkh.exe
3740	mkfcxupnhfzxspkh.exe
3740	mkfcxupnhfzxspkh.exe
3740	mkfcxupnhfzxspkh.exe
3740	mkfcxupnhfzxspkh.exe
3740	mkfcxupnhfzxspkh.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1100	i_pnkfcaupkh.exe
Token: SeDebugPrivilege	4580	i_mjhfzxrpmk.exe
Token: SeDebugPrivilege	5280	i_czurmkecwu.exe
Token: SeDebugPrivilege	3284	i_urpjheywro.exe
Token: SeDebugPrivilege	2584	i_jgbwtomgey.exe
Token: SeDebugPrivilege	3416	i_dbytqoigdb.exe
Token: SeDebugPrivilege	4752	i_gaytqljdbv.exe
Token: SeDebugPrivilege	5524	i_vsqkicaxvt.exe
Token: SeDebugPrivilege	2616	i_snkfcausnk.exe
Token: SeDebugPrivilege	5912	i_khcausmkfc.exe
Token: SeDebugPrivilege	5484	i_jhecaurpjh.exe
Token: SeDebugPrivilege	5392	i_uomgezwrpj.exe
Token: SeDebugPrivilege	2052	i_wqomgeywro.exe
Token: SeDebugPrivilege	3400	i_qoigbytrlj.exe
Token: SeDebugPrivilege	5832	i_dbvtqligdy.exe
Token: SeDebugPrivilege	1668	i_daysqkiday.exe
Token: SeDebugPrivilege	2768	i_fdavsnlfdx.exe
Token: SeDebugPrivilege	2960	i_caxspnhfzx.exe
Token: SeDebugPrivilege	1280	i_kecxupnhfc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3644	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5696 wrote to memory of 3740	5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 5696 wrote to memory of 3492	5696	2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 3492 wrote to memory of 3644	3492	iexplore.exe	91
PID 3644 wrote to memory of 6016	3644	msedge.exe	92
PID 3644 wrote to memory of 5164	3644	msedge.exe	94
PID 3644 wrote to memory of 3476	3644	msedge.exe	95
PID 3644 wrote to memory of 3476	3644	msedge.exe	95
PID 3644 wrote to memory of 3476	3644	msedge.exe	95
PID 3644 wrote to memory of 3332	3644	msedge.exe	96
PID 3644 wrote to memory of 3332	3644	msedge.exe	96
PID 3644 wrote to memory of 5896	3644	msedge.exe	97
PID 3644 wrote to memory of 5876	3644	msedge.exe	98
PID 3644 wrote to memory of 5896	3644	msedge.exe	97
PID 3644 wrote to memory of 5896	3644	msedge.exe	97
PID 3644 wrote to memory of 5876	3644	msedge.exe	98
PID 3644 wrote to memory of 5876	3644	msedge.exe	98
PID 3644 wrote to memory of 5320	3644	msedge.exe	99
PID 3644 wrote to memory of 5320	3644	msedge.exe	99
PID 3644 wrote to memory of 5320	3644	msedge.exe	99
PID 3644 wrote to memory of 5176	3644	msedge.exe	100
PID 3644 wrote to memory of 5176	3644	msedge.exe	100
PID 3644 wrote to memory of 5176	3644	msedge.exe	100
PID 3644 wrote to memory of 1084	3644	msedge.exe	101
PID 3644 wrote to memory of 1084	3644	msedge.exe	101
PID 3644 wrote to memory of 5684	3644	msedge.exe	105
PID 3644 wrote to memory of 2828	3644	msedge.exe	106
PID 3644 wrote to memory of 5684	3644	msedge.exe	105
PID 3644 wrote to memory of 2828	3644	msedge.exe	106
PID 3644 wrote to memory of 5532	3644	msedge.exe	108
PID 3740 wrote to memory of 2660	3740	mkfcxupnhfzxspkh.exe	109
PID 2200 wrote to memory of 2880	2200	pnkfcaupkh.exe	114
PID 3644 wrote to memory of 1312	3644	msedge.exe	117
PID 3644 wrote to memory of 1312	3644	msedge.exe	117
PID 3644 wrote to memory of 2056	3644	msedge.exe	118
PID 3644 wrote to memory of 2056	3644	msedge.exe	118
PID 3740 wrote to memory of 4540	3740	mkfcxupnhfzxspkh.exe	119
PID 3740 wrote to memory of 4420	3740	mkfcxupnhfzxspkh.exe	123
PID 4448 wrote to memory of 972	4448	mjhfzxrpmk.exe	125
PID 3740 wrote to memory of 5864	3740	mkfcxupnhfzxspkh.exe	128
PID 3740 wrote to memory of 1116	3740	mkfcxupnhfzxspkh.exe	132
PID 1384 wrote to memory of 1260	1384	czurmkecwu.exe	134
PID 3740 wrote to memory of 3592	3740	mkfcxupnhfzxspkh.exe	137
PID 3740 wrote to memory of 2744	3740	mkfcxupnhfzxspkh.exe	142
PID 3572 wrote to memory of 2444	3572	urpjheywro.exe	144
PID 3740 wrote to memory of 4272	3740	mkfcxupnhfzxspkh.exe	147
PID 3644 wrote to memory of 3760	3644	msedge.exe	149
PID 3644 wrote to memory of 5944	3644	msedge.exe	150
PID 3644 wrote to memory of 2400	3644	msedge.exe	151
PID 3740 wrote to memory of 2716	3740	mkfcxupnhfzxspkh.exe	154
PID 5520 wrote to memory of 3392	5520	jgbwtomgey.exe	156
PID 3740 wrote to memory of 3016	3740	mkfcxupnhfzxspkh.exe	159
PID 3740 wrote to memory of 1136	3740	mkfcxupnhfzxspkh.exe	163
PID 1524 wrote to memory of 2196	1524	dbytqoigdb.exe	165
PID 3740 wrote to memory of 2128	3740	mkfcxupnhfzxspkh.exe	168
PID 3740 wrote to memory of 2472	3740	mkfcxupnhfzxspkh.exe	172
PID 3408 wrote to memory of 4564	3408	gaytqljdbv.exe	174
PID 3740 wrote to memory of 708	3740	mkfcxupnhfzxspkh.exe	177
PID 3740 wrote to memory of 4712	3740	mkfcxupnhfzxspkh.exe	181
PID 3912 wrote to memory of 4400	3912	vsqkicaxvt.exe	183
PID 3740 wrote to memory of 5048	3740	mkfcxupnhfzxspkh.exe	186
PID 3644 wrote to memory of 5888	3644	msedge.exe	188
PID 3644 wrote to memory of 5888	3644	msedge.exe	188
PID 3740 wrote to memory of 4072	3740	mkfcxupnhfzxspkh.exe	194
PID 3436 wrote to memory of 1096	3436	snkfcausnk.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_b4c860d744c7d848bb23901c3d96bf0c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5696
- C:\Temp\mkfcxupnhfzxspkh.exe
  C:\Temp\mkfcxupnhfzxspkh.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3740
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnkfcaupkh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2660
  - - C:\Temp\pnkfcaupkh.exe
      C:\Temp\pnkfcaupkh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2200
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2880
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4776
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnkfcaupkh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4540
  - - C:\Temp\i_pnkfcaupkh.exe
      C:\Temp\i_pnkfcaupkh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1100
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mjhfzxrpmk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4420
  - - C:\Temp\mjhfzxrpmk.exe
      C:\Temp\mjhfzxrpmk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4448
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:972
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2052
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mjhfzxrpmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5864
  - - C:\Temp\i_mjhfzxrpmk.exe
      C:\Temp\i_mjhfzxrpmk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4580
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\czurmkecwu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1116
  - - C:\Temp\czurmkecwu.exe
      C:\Temp\czurmkecwu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1384
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1260
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4116
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_czurmkecwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3592
  - - C:\Temp\i_czurmkecwu.exe
      C:\Temp\i_czurmkecwu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5280
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urpjheywro.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2744
  - - C:\Temp\urpjheywro.exe
      C:\Temp\urpjheywro.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3572
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2444
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1820
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urpjheywro.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4272
  - - C:\Temp\i_urpjheywro.exe
      C:\Temp\i_urpjheywro.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3284
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgbwtomgey.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2716
  - - C:\Temp\jgbwtomgey.exe
      C:\Temp\jgbwtomgey.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5520
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3392
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1956
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgbwtomgey.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3016
  - - C:\Temp\i_jgbwtomgey.exe
      C:\Temp\i_jgbwtomgey.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2584
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbytqoigdb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1136
  - - C:\Temp\dbytqoigdb.exe
      C:\Temp\dbytqoigdb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1524
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2196
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3748
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbytqoigdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2128
  - - C:\Temp\i_dbytqoigdb.exe
      C:\Temp\i_dbytqoigdb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gaytqljdbv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2472
  - - C:\Temp\gaytqljdbv.exe
      C:\Temp\gaytqljdbv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3408
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4564
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gaytqljdbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:708
  - - C:\Temp\i_gaytqljdbv.exe
      C:\Temp\i_gaytqljdbv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4752
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vsqkicaxvt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4712
  - - C:\Temp\vsqkicaxvt.exe
      C:\Temp\vsqkicaxvt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3912
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4400
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vsqkicaxvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5048
  - - C:\Temp\i_vsqkicaxvt.exe
      C:\Temp\i_vsqkicaxvt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\snkfcausnk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4072
  - - C:\Temp\snkfcausnk.exe
      C:\Temp\snkfcausnk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3436
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1096
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5632
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_snkfcausnk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2852
  - - C:\Temp\i_snkfcausnk.exe
      C:\Temp\i_snkfcausnk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2616
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\khcausmkfc.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:824
  - - C:\Temp\khcausmkfc.exe
      C:\Temp\khcausmkfc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2804
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2624
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4996
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_khcausmkfc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5512
  - - C:\Temp\i_khcausmkfc.exe
      C:\Temp\i_khcausmkfc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5912
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhecaurpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5096
  - - C:\Temp\jhecaurpjh.exe
      C:\Temp\jhecaurpjh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1472
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1884
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5764
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhecaurpjh.exe ups_ins
    3⤵
    PID:1900
  - - C:\Temp\i_jhecaurpjh.exe
      C:\Temp\i_jhecaurpjh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5484
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uomgezwrpj.exe ups_run
    3⤵
    PID:560
  - - C:\Temp\uomgezwrpj.exe
      C:\Temp\uomgezwrpj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3404
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5180
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uomgezwrpj.exe ups_ins
    3⤵
    PID:5800
  - - C:\Temp\i_uomgezwrpj.exe
      C:\Temp\i_uomgezwrpj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5392
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wqomgeywro.exe ups_run
    3⤵
    PID:1140
  - - C:\Temp\wqomgeywro.exe
      C:\Temp\wqomgeywro.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2976
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4764
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:960
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wqomgeywro.exe ups_ins
    3⤵
    PID:3284
  - - C:\Temp\i_wqomgeywro.exe
      C:\Temp\i_wqomgeywro.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2052
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoigbytrlj.exe ups_run
    3⤵
    PID:5528
  - - C:\Temp\qoigbytrlj.exe
      C:\Temp\qoigbytrlj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5376
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4832
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6048
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoigbytrlj.exe ups_ins
    3⤵
    PID:1224
  - - C:\Temp\i_qoigbytrlj.exe
      C:\Temp\i_qoigbytrlj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3400
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbvtqligdy.exe ups_run
    3⤵
    PID:2448
  - - C:\Temp\dbvtqligdy.exe
      C:\Temp\dbvtqligdy.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1536
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2864
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbvtqligdy.exe ups_ins
    3⤵
    PID:800
  - - C:\Temp\i_dbvtqligdy.exe
      C:\Temp\i_dbvtqligdy.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5832
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\daysqkiday.exe ups_run
    3⤵
    PID:5868
  - - C:\Temp\daysqkiday.exe
      C:\Temp\daysqkiday.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3896
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2492
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4736
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_daysqkiday.exe ups_ins
    3⤵
    PID:5488
  - - C:\Temp\i_daysqkiday.exe
      C:\Temp\i_daysqkiday.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdavsnlfdx.exe ups_run
    3⤵
    PID:5360
  - - C:\Temp\fdavsnlfdx.exe
      C:\Temp\fdavsnlfdx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4996
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:976
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2684
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdavsnlfdx.exe ups_ins
    3⤵
    PID:5156
  - - C:\Temp\i_fdavsnlfdx.exe
      C:\Temp\i_fdavsnlfdx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2768
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\caxspnhfzx.exe ups_run
    3⤵
    PID:4428
  - - C:\Temp\caxspnhfzx.exe
      C:\Temp\caxspnhfzx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4300
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5272
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1628
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_caxspnhfzx.exe ups_ins
    3⤵
    PID:5188
  - - C:\Temp\i_caxspnhfzx.exe
      C:\Temp\i_caxspnhfzx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2960
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kecxupnhfc.exe ups_run
    3⤵
    PID:5340
  - - C:\Temp\kecxupnhfc.exe
      C:\Temp\kecxupnhfc.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1752
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:712
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kecxupnhfc.exe ups_ins
    3⤵
    PID:4188
  - - C:\Temp\i_kecxupnhfc.exe
      C:\Temp\i_kecxupnhfc.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1280
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bzxromjebz.exe ups_run
    3⤵
    PID:5856
  - - C:\Temp\bzxromjebz.exe
      C:\Temp\bzxromjebz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2524
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1268
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4860
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x320,0x7ff8286bc188,0x7ff8286bc194,0x7ff8286bc1a0
      4⤵
      PID:6016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,17561594586641256111,1598730284629694356,524288 --field-trial-handle=2600,i,2362614824911220153,17590232584478052879,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:11
      4⤵
      System Time Discovery
      PID:5164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,15465385810137634537,15218348415746229923,262144 --field-trial-handle=2600,i,2362614824911220153,17590232584478052879,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:2
      4⤵
      PID:3476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2352,i,6781702148045814585,5561939078991568846,524288 --field-trial-handle=2600,i,2362614824911220153,17590232584478052879,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:13
      4⤵
      PID:3332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,1279286324381431947,286740998331314338,2097152 --field-trial-handle=2600,i,2362614824911220153,17590232584478052879,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
      4⤵
      PID:5896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,11542521448333083258,4735691998052403749,2097152 --field-trial-handle=2600,i,2362614824911220153,17590232584478052879,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
      4⤵
      PID:5876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4332,i,1805485935462853557,10961550917749257800,2097152 --field-trial-handle=2600,i,2362614824911220153,17590232584478052879,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:1
      4⤵
      PID:5320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4356,i,4201560192430773037,5945210957276259127,2097152 --field-trial-handle=2600,i,2362614824911220153,17590232584478052879,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:9
      4⤵
      PID:5176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,9549327026171736346,2399613878365677286,524288 --field-trial-handle=2600,i,2362614824911220153,17590232584478052879,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:14
      4⤵
      PID:1084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,5037359926788470589,3570111134712027294,524288 --field-trial-handle=2600,i,2362614824911220153,17590232584478052879,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
      4⤵
      PID:5684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,9494855810546919353,3036164799004367249,524288 --field-trial-handle=2600,i,2362614824911220153,17590232584478052879,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
      4⤵
      PID:2828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,5865476305593521750,9134243596950003688,524288 --field-trial-handle=2600,i,2362614824911220153,17590232584478052879,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
      4⤵
      PID:2212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,5865476305593521750,9134243596950003688,524288 --field-trial-handle=2600,i,2362614824911220153,17590232584478052879,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
      4⤵
      PID:5532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,11129568610712637618,10991975236719089527,524288 --field-trial-handle=2600,i,2362614824911220153,17590232584478052879,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
      4⤵
      PID:1312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,8316830577824670899,14656959711121634729,524288 --field-trial-handle=2600,i,2362614824911220153,17590232584478052879,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
      4⤵
      PID:2056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4816,i,3803169651718582446,15803086941546395973,524288 --field-trial-handle=2600,i,2362614824911220153,17590232584478052879,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
      4⤵
      PID:3760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3800,i,11972724246840594803,13408753229842612109,524288 --field-trial-handle=2600,i,2362614824911220153,17590232584478052879,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:14
      4⤵
      PID:5944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,16228412527655604693,7633911542201708088,524288 --field-trial-handle=2600,i,2362614824911220153,17590232584478052879,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:14
      4⤵
      PID:2400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,17602070988625887796,2633842083092431827,524288 --field-trial-handle=2600,i,2362614824911220153,17590232584478052879,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
      4⤵
      PID:5888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,4692337079254484141,1107562993003219273,524288 --field-trial-handle=2600,i,2362614824911220153,17590232584478052879,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
      4⤵
      PID:5952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4352,i,14057157184950347315,13384339986643058666,524288 --field-trial-handle=2600,i,2362614824911220153,17590232584478052879,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
      4⤵
      PID:1536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,5252533061354801680,18162389081370202555,524288 --field-trial-handle=2600,i,2362614824911220153,17590232584478052879,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:14
      4⤵
      PID:5184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5864,i,1832964901180420408,13771876013940911394,262144 --field-trial-handle=2600,i,2362614824911220153,17590232584478052879,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:10
      4⤵
      PID:3120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,2264864520081998465,6155355316070429148,524288 --field-trial-handle=2600,i,2362614824911220153,17590232584478052879,262144 --variations-seed-version --mojo-platform-channel-handle=1192 /prefetch:14
      4⤵
      PID:3396

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3320

C:\Temp\mkfcxupnhfzxspkh.sys
C:\Temp\mkfcxupnhfzxspkh.sys
1⤵
- Executes dropped EXE
PID:2740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1956

C:\Temp\fcxvpnhfzx.sys
C:\Temp\fcxvpnhfzx.sys
1⤵
- Executes dropped EXE
PID:932

C:\Temp\ecwupmhezx.sys
C:\Temp\ecwupmhezx.sys
1⤵
- Executes dropped EXE
PID:5764

C:\Temp\rpjgecwuom.sys
C:\Temp\rpjgecwuom.sys
1⤵
- Executes dropped EXE
PID:4980

C:\Temp\rojgbztrlj.sys
C:\Temp\rojgbztrlj.sys
1⤵
- Executes dropped EXE
PID:5184

C:\Temp\oigbytqolj.sys
C:\Temp\oigbytqolj.sys
1⤵
- Executes dropped EXE
PID:3044

C:\Temp\oigaysqlid.sys
C:\Temp\oigaysqlid.sys
1⤵
- Executes dropped EXE
PID:1964

C:\Temp\ysqkicavsq.sys
C:\Temp\ysqkicavsq.sys
1⤵
- Executes dropped EXE
PID:1456

C:\Temp\auspkhfcau.sys
C:\Temp\auspkhfcau.sys
1⤵
- Executes dropped EXE
PID:3896

C:\Temp\usnkfcxvpn.sys
C:\Temp\usnkfcxvpn.sys
1⤵
- Executes dropped EXE
PID:2324

C:\Temp\mkecxuspjh.sys
C:\Temp\mkecxuspjh.sys
1⤵
- Executes dropped EXE
PID:3520

C:\Temp\urmkecwuom.sys
C:\Temp\urmkecwuom.sys
1⤵
PID:1556

C:\Temp\wqojgbywtr.sys
C:\Temp\wqojgbywtr.sys
1⤵
PID:1284

C:\Temp\geywtrljdb.sys
C:\Temp\geywtrljdb.sys
1⤵
PID:5176

C:\Temp\dywqoigdbv.sys
C:\Temp\dywqoigdbv.sys
1⤵
PID:2056

C:\Temp\gayvtnlfdy.sys
C:\Temp\gayvtnlfdy.sys
1⤵
PID:5764

C:\Temp\ifaxsqkica.sys
C:\Temp\ifaxsqkica.sys
1⤵
PID:1968

C:\Temp\kfdxvsmkhf.sys
C:\Temp\kfdxvsmkhf.sys
1⤵
PID:5184

C:\Temp\pkhczusmke.sys
C:\Temp\pkhczusmke.sys
1⤵
PID:2052

C:\Temp\czusmkebzx.sys
C:\Temp\czusmkebzx.sys
1⤵
PID:5264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

czurmkecwu.exe

Path C:\Temp\czurmkecwu.exe
Size 376KB
SHA256 d78752b7cf62a29be913f7a578fa17bcad5bf3d2d64effa10879b41bcc22efc6
MD5 62b92e6c18430e65cda28ddc151535e9
SHA1 247e61a4fdd0ce035e1d77df62eb475366a09ee4
SHA512 87c2f6699b4d13750b01390ecbf4b46a497b7f234c548873a61ff9ded4290b801143bb989e8f03edc0195c9ab20660e4427e1e3cc0e49ad94d276951733e273a
SSDEEP 3072:zT6L7HYaMj4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:v6LI9IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C2847B04BAA4F0F6D995043800EBAF36967EB4242726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbytqoigdb.exe

Path C:\Temp\dbytqoigdb.exe
Size 376KB
SHA256 82ad2310327c7a78fa30d1e4c95b279d30674ddcdc7e46e6e3af358b24adbd15
MD5 86c69136d725905392bc3e480ff30c73
SHA1 b928627564ee9fce00ff1c728e6e422c546068dc
SHA512 16d6e94fc4a417e5abb64fe4c1a371b72b9c33ae8e1a9a91f3363b4c721263ce82f51417d23ac0a63e7d5f3415375ea0928c52590bbe2c1900ddc1ca93f38a14
SSDEEP 3072:7T6L7HYaMj4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:36LI9IJjiJcbI03GBc3ucY5DCSjX
TLSH
T191847B04BAA4F0F6D995043800EBAF36967EB4242726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwupmhezx.sys

Path C:\Temp\ecwupmhezx.sys
Size 293KB
SHA256 99294cb5572e2c57efb31f5996f48c162a0546cc0a27db8179de8b56d04a7b76
MD5 2bd2ab8f541bc7b4041be89cb161e8a1
SHA1 dca1c3fd28694f3d3efa3fa6d8a7bb57f74ba743
SHA512 174d98dfb3ff87b6286d65c4f576b010f6f449ee4dfe48efba4da7eb6c09aede020028c289d132bbb9bce8ea9255ec82ad9f262b825881111c4e8727f5817ddc
SSDEEP 3072:utKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:uIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E4545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcxvpnhfzx.sys

Path C:\Temp\fcxvpnhfzx.sys
Size 293KB
SHA256 ae555f6034688e0a155300234f8ee26e1ba81c4fb21ceb2bfb79ac847b18d6fa
MD5 58147e44887216e3210a5b3adf744cae
SHA1 12d92dc01060c6b7cbfa5e4f9a22edf8734d7177
SHA512 c85ad5aa00072d232c2c2653c6549d07f3d43db7b5e98ab0fcd2352d65cd3a5df988f977673fe82591390500b36aa508db816e91ffd63a7682a47c18236c4c26
SSDEEP 3072:NtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:NIJjiJcbI03GBc3ucY5DCSj
TLSH
T164545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_czurmkecwu.exe

Path C:\Temp\i_czurmkecwu.exe
Size 376KB
SHA256 4cdf6ade69d18cfd0382d424f3e592ace98239a91b29603aa11658797fc76383
MD5 fb42be9dcbc0582d30a245366d4dc151
SHA1 9bdfcd75bc1c92615a66df68a0e6b752807f1c4f
SHA512 5c23018d2269a46c830ad6fe92b85d76385d9f8a6d542c261929d83da47ae4c03b15172e6f28745d13d3521c82fb60c708357360996359663ac78f8b70adc494
SSDEEP 3072:TT6L7HYaMj4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:P6LI9IJjiJcbI03GBc3ucY5DCSjX
TLSH
T13F847B04BAA4F0F6D995043800EBAF36967EB4242726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jgbwtomgey.exe

Path C:\Temp\i_jgbwtomgey.exe
Size 376KB
SHA256 bbee1709823ec00bbc8225ea2c8e624b9f486cadcfc0ff0e530653597d1f7234
MD5 f8bafb5fdd96bc47619368f4c82e6c0a
SHA1 102e53f0a77823e9547bb1463aa7e26e80a524fe
SHA512 86b694e09567c0eed6bea7dd780d074cbd95060621991cf13eecd06612fccd9fe4b0ed4ae356c1e084fb9793a0c65d41aab42bb2820b1f300f998066439746e1
SSDEEP 3072:qT6L7HYaMj4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:Q6LI9IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B2847B04BAA4F0F6D995043800EBAF36967EB4242726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mjhfzxrpmk.exe

Path C:\Temp\i_mjhfzxrpmk.exe
Size 376KB
SHA256 776b98dfcc8c5d64cb518563a32c491b973c504577f30e77c5b5230aca1376dd
MD5 c24dc627627b6df602e896a9b7f83490
SHA1 e39dd835c4366b84eb51365c0a319a7d18ff470d
SHA512 9251a07612bbd4e539f82544111c205ddfc5b407dcb912c5b5a3ba8896ab20baa3c48ceba467abd4b22c0a791ba2b08baf0b7c2e69e4e5de36f20c37112729a7
SSDEEP 3072:JT6L7HYaMj4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:d6LI9IJjiJcbI03GBc3ucY5DCSjX
TLSH
T116847B04BAA4F0F6D995043800EBAF36967EB4242726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pnkfcaupkh.exe

Path C:\Temp\i_pnkfcaupkh.exe
Size 376KB
SHA256 53ceca01ee1803e2b2bcbb9bcadd83e9ece86b69d47dad6b968ee4fec039dbcf
MD5 e7401828a504e3433ef379a60a021925
SHA1 be3e58198cff145468d688d4504968bfc5f2d563
SHA512 f6af08e05cfc026dc01a96fa9c4f971023c779eadc58ab9a0de1229f050dbd612b738715a239df3bfed6f8b37565d4247a01c2afd44f1d32d614e06e5d1ae02a
SSDEEP 3072:+T6L7HYaMj4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:06LI9IJjiJcbI03GBc3ucY5DCSjX
TLSH
T182847B04BAA4F0F6D995043800EBAF36967EB4242726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_urpjheywro.exe

Path C:\Temp\i_urpjheywro.exe
Size 376KB
SHA256 e1ca59babe336fa513bbe177acff7e29b8fa3d2fb06528248dd903df8a91caea
MD5 4a1ea320ac6118128d6219b34da2b264
SHA1 82772cae3ca1b67e65e13e9c65ed94037285338a
SHA512 8e1904f800e562957a67e7d68e4e5e8fa2efe6cfe9702b5f87052e88010369f11da7fde279761a01cb60d04da4fbe374f103bb10fc3938fad1aa2f00ab918c23
SSDEEP 3072:dT6L7HYaMj4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:h6LI9IJjiJcbI03GBc3ucY5DCSjX
TLSH
T11B847B04BAA4F0F6D995043800EBAF36967EB4242726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgbwtomgey.exe

Path C:\Temp\jgbwtomgey.exe
Size 376KB
SHA256 55f017c74413576ea504220e2e5ad181c7778e37e1e771efdff9d2cb9a497149
MD5 19f9618ea8a2048847f76b718c408134
SHA1 73f3f892e38e2e1deaadd28715f89b2e2205d340
SHA512 5670b6f18c0985851a4a0aa7742cf168cbdfdc440efa6b8e575f9a51a65b6e04d41c7ddca84e1b277d0abb09e1a7bc6b1f43166d9033f4acdbbe79407f753739
SSDEEP 3072:gT6L7HYaMj4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:e6LI9IJjiJcbI03GBc3ucY5DCSjX
TLSH
T161847B04BAA4F0F6D995043800EBAF36967EB4242726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjhfzxrpmk.exe

Path C:\Temp\mjhfzxrpmk.exe
Size 376KB
SHA256 41240f9177bb61521585c9b5968a05d32086963ae83f19656779b07cd90e50f5
MD5 3af4be41fa33b554d40e5d503c23e622
SHA1 bf1aaecdd6931f3b92bbfe019b3997cc4af49db7
SHA512 f29f3ebb7e8299b025793368beed2d93be9c0459feff7bea6482c35bfe814971d2ed203c8d5e52705654b7c8ebd1c1bab83136d399a3c9658795d00b5517154a
SSDEEP 3072:iT6L7HYaMj4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:I6LI9IJjiJcbI03GBc3ucY5DCSjX
TLSH
T193847B04BAA4F0F6D995043800EBAF36967EB4242726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkfcxupnhfzxspkh.exe

Path C:\Temp\mkfcxupnhfzxspkh.exe
Size 376KB
SHA256 b7d73b980670e999cfdc686e5f33a7a3218b7faa2ce849263a9dd3b02a8f7331
MD5 86c46a473c62d7cfd6cc81cb751fef6a
SHA1 9da8a5438b66121392b5dc8bd41ce9d183d4a08b
SHA512 76843289c426c4db121bf5d492f59fd32f207a187380f9323ae6cb9a50381d3abd76618affa86725e05132114cb9b895ec3099662af93cbe71312f356a2af5ab
SSDEEP 3072:NT6L7HYaMj4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:x6LI9IJjiJcbI03GBc3ucY5DCSjX
TLSH
T11D847B04BAA4F0F6D995043800EBAF36967EB4242726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkfcxupnhfzxspkh.sys

Path C:\Temp\mkfcxupnhfzxspkh.sys
Size 293KB
SHA256 1129a7b140bf767b2890ee29114a140f94e6fa1d8fd8e943e715fc8afb5b01fb
MD5 a3359c79e8bb0fdc7ed3dca547b5d1ee
SHA1 77203beb04a512aaa9e1df22f79050bb301323c8
SHA512 144eb8717ec68c7d6b5520cac4fb8d9273667a33a304a8667f5124e874218a61e8d478205d97852afab5643c5e1cbd9d74870c485acddcb04b0cd7b31547fb8f
SSDEEP 3072:JtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:JIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A6545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigbytqolj.sys

Path C:\Temp\oigbytqolj.sys
Size 293KB
SHA256 8548ad598654ce3a54553d540f8cc3190df3b75d55f421c0d9b5053af9665b51
MD5 bf5f31b4e563bb7732038e27256279a9
SHA1 0f07da20e29c5356814f4a9b0cc5d3e97ec09417
SHA512 7173244721de76cd32beeab979952a1b0da82584e475a9e3efc11d615e21ee8680ece43b2a1b16370b2bcdcf1e624b5611057af3f76627510255ea43e7d766c5
SSDEEP 3072:3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:3IJjiJcbI03GBc3ucY5DCSj
TLSH
T1FD545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnkfcaupkh.exe

Path C:\Temp\pnkfcaupkh.exe
Size 376KB
SHA256 b93120652092d055060e17fe28a0ef9755b089cfe896d9ae6a89687cbed64af7
MD5 2d058517591446c7086c77e54cff5bcb
SHA1 515a0f669ee5a8974b651d3579533947b645e799
SHA512 63d10b4f525914d84ffa21988a5d80e01357c83662d3890e6c98ae8544a8d2bc22b5fde95822419bf6a1f3620cef94ab9694185c08ec8c06d3e53e36ef4ba91c
SSDEEP 3072:iT6L7HYaMj4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:I6LI9IJjiJcbI03GBc3ucY5DCSjX
TLSH
T14C847B04BAA4F0F6D995043800EBAF36967EB4242726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rojgbztrlj.sys

Path C:\Temp\rojgbztrlj.sys
Size 293KB
SHA256 240d8408fae9c3e9375bd67b686d7caec6fffe9a57e382d995ae7017c3558e79
MD5 efa4cb714c26f6527ae9d2fea3894907
SHA1 4b844f1488dca5586018beb19c20c75d7c800cdf
SHA512 c82c1aa4a0be42d2e79b10c09953ae3a0fb68c79e24df9d5cbab5305c6b6d7ecea25127700350608e760e57856088d37b464b30ecc3a6d62285cbb7784afec5d
SSDEEP 3072:9tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:9IJjiJcbI03GBc3ucY5DCSj
TLSH
T1A4545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpjgecwuom.sys

Path C:\Temp\rpjgecwuom.sys
Size 293KB
SHA256 2022e4e995566bc0241c18a3e14aac7610c3da41fd1d7d47dad29e765e4e5f8d
MD5 2974377e0634fcc3016ce45bc5b526f4
SHA1 ba6f7d58fb59383bc06b6289be3e7f38789a1d72
SHA512 dd03957573c406db40dae45185f57bbe2772645326e653ff0e882b266bdf8db69a7cf7b5104ec4483ebe77bc6825383e2ced389aeb7402fa97a206ffae431525
SSDEEP 3072:ltKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:lIJjiJcbI03GBc3ucY5DCSj
TLSH
T14B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urpjheywro.exe

Path C:\Temp\urpjheywro.exe
Size 376KB
SHA256 dc02d0e2eaee39d3fb2385cc70de29451078c23501be668e0d18820b7e7f5c16
MD5 f82092dd1e93fd422c22ab55c80471b9
SHA1 86c72c5f55c264aecfa5e38ed37a8a37f049a32d
SHA512 48e6ba5c9dcd34a2a727e1d3f9c65169699e7fab1c39ac6937506b56c7f749135f89c1d7ff764f9b7a9df8c3b5c86ba0d875a0ea643e9be16e062e0eb115527c
SSDEEP 3072:9T6L7HYaMj4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:B6LI9IJjiJcbI03GBc3ucY5DCSjX
TLSH
T17C847B04BAA4F0F6D995043800EBAF36967EB4242726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ca5d57edbd599d2f326c973f9ea78899a33bc93603d04f5c5fc3060bb6069335
MD5 b40813b6d7a845a0e75e73df45573d20
SHA1 065e9256016c1ff5d12e5f09a43522ff134705ed
SHA512 04620591f96093c5be9d4fb65f9b83ca4d994ab596d5bba483af6363751c3afe0d9d550d0a079f304e51196ff781189761c77ec1ccc9ade982cc5d24efdfac3e
TLSH
T197D080713F567511D54514F4B414926153378C5335C2D50A7135C01EAD604D0E3C55E7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 25e3094666b1652de0c19f09d2c5a36315ff1f2b6bf4618230987e4527d887d6
MD5 6c5c69ea7db1f14597429c11acb086da
SHA1 20d287e42d0eef2300c162f279f6c1a5bef2e00b
SHA512 4670a8f1b1ff14ef0094b5f0e97add9f3a5efcd9cbac0df76bfa0fcb59e20e8d2587834ddc7e3c72278d6925836d06584fd79fb3286a9e087f9322e2b6f4b220
TLSH
T11BD080753F467511D54514F0B414926153378C5339C2D50A7135C01EAD604D0E3C55F7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f80d319ffb9fc75fc9aec090551d612d9107ac295f819cc471c486dc7d198d64
MD5 b7bf2bd5926e62e6bcc708cc07a555e7
SHA1 b4984d05ae98a69d7ad699a423270fcb20376278
SHA512 aac88be19144d5a5023718424688eb91f977eeabe7b7eaa215e794c8f58ce2c4ef701c4d1e1c6876196a9552c0be3fa3c10b53c97413e7ebdb989af1f984a87c
TLSH
T122615260A3F50665DB5B85B534DA2044F3B4C4937B372E6C1C8C927F7D96B80A14AC5F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ea1914707665b520fd1a14cd46f5100185804a6bc96ff7b96f307c2ff63a53c4
MD5 40616e2919b3bf1833fd497e58d514ac
SHA1 eb59b34cd4fab2724bd0405004948a949894f898
SHA512 6b0d101f6cc44f0bd6aaa57816541179e9bcb941d78d37179d4a200a96754785993b98f04f963d6db283823c2c1bf205020b4ad01164a1899c0b2dacdeb0de9f
TLSH
T104516DF7C2E8866DC91195F0AB146E2BCE2D0954832C3D5AC9E4AF1B93E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

c6b53afd-fe1c-45ac-be08-5de6f79e5a2e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c6b53afd-fe1c-45ac-be08-5de6f79e5a2e.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 33d8e9630fe909c660cea29c8e3a8720dc3e9f6a03379aec8f77d9cdc4b1c48b
MD5 a5551eef72ec6b6c05c5f923d3b47c24
SHA1 2cac7d77defe51bc8d59bf82e75d956e77ad9ec3
SHA512 da9e43d50d0c8632a3d2660de93791026d093025e6508ce35ae588fb8f816beaabef91189b0add4d87da1b658842faad1cf02bd1843093949e02ac75bcb2401a
SSDEEP 192:sxR4RRhyM/jK1Ml8wcg/fZNs+bZ0ZUeZkzoA8p9GY/g6+WNCHc/YZ8IGZIgVJJ:sxRixCg/fZNs+bZKUmFT/59/rR
TLSH
T1FF62FB166A349937CDDBD309FA567F53D6F81533A2511E44AAFC8A0C00E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 83543ca72ad6730bc3676df94ed823b8d9f80b5128fa794e00f919f3a35331c5
MD5 01c8f2039bd069ce0e7796bce22170f5
SHA1 91c299b7869a36e432f74225f8b85f362fb3844b
SHA512 407bc78827eef70fb84bacd64c89eafd587e5069de9dba40c0dba565a1f64a11a9985ccad0f9efa40203523736a5c40d952db7101a5467a50b6af9aacad2a1dc
SSDEEP 192:sxR4eRhyM/jK1Ml8UQ0cg/fZNsubB0ZUeZkzoA8prGY/g6+WNCHc/YZhIGZIgDrz:sxRFxqTg/fZNsubBKUmFt/59/y7
TLSH
T13C62EB16A9349937CDDBD309FA567B53D6F85473A2550E48AAFCCA0C00E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 78fde60e831143db103c1178ffb82a8c8d2278cdfe443ed25821b86e3788c124
MD5 cde4ba43bf154b48423007ef1d185c21
SHA1 4917c986fe6ed84125233883ca1ce4333b826ed2
SHA512 bfa91e79c169d3dace2244a0fc7da4e749715539f03cbad76181b0be54b86b0d363fa9a365ade8942067484dfcaa4caa7869c55729b9003e32f1184118c2266d
SSDEEP 192:sxR4eRhyM/jK1Ml8wcg/fZNsubZ0ZUeZkzoA8p9GY/g6+WNCHc/YZ8IGZIgDBJJ:sxRFxCg/fZNsubZKUmFT/59/rB
TLSH
T15F62FB166A349937CDDBD309FA567F53D6F81473A2511E48AAFC8A0C00E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 5a56a0d556e3fc93d97bfef3ce694f32225e1a3f4abb53f65d4d0c0f5bb87642
MD5 490bd5d178c25d8f8107c818fd50981a
SHA1 76907412533c77e967d2771c96e86d6fe4d3513e
SHA512 33383ad6b2f6a0fd0ba29095e9438a5eb390203f46a392ffbf9a2366d4ac0ed858905d2a760481ecabc5585284dacc6d1c228c38cf5b839c602ccf3489395ac2
SSDEEP 768:eOEtff7pLuL7ZIWgKgf168F1+UoAYDCx9Tuqh0VfUC9xbog/OVsEREkTqQ5ro7oA:eOEtfZE7ZIWgKgf16u1javE2/Qy88OS
TLSH
T17BE2EC3B680CCB7E4F804A9CED2A7E9F6DE801CB96D8C95447EA840C03C67EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7893368a5e42286e86e9a4c1934f56058c065bcbdd6ad9c39c7042fe577af3ec
MD5 b90159444d70e2adc2fe9c6e642b2e1a
SHA1 c07bd75edbc542abd1ba247631b42f904afefed6
SHA512 d9adb68d900dc178eca211d5f6cadaa0b47650f2d784632826b59fd3156a66ec2e53ec0bfd1a4da4f6100d1051507733c3b52e387bed16e7a5dc00c87230629b
SSDEEP 24:K4S9a0YINKmhs12SXYZyXUnY78jIzKfhy1ySmd0vUjAHIfKbhO1yS6d7yXayXNYP:KATINKQswPy54IzK5y01kIfKdOc/yK
TLSH
T19691704071BB274078BDBA0AA254995F92427063344EB97B3FA931E11F2BE401EFD6CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59d4ea.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59d4ea.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 e3ffaa89f5933b408ef8543313b95cc0b3516b944d90284b8932dcea8c7b2f99
MD5 9f98619864d8cf468e640bd34c8c98ae
SHA1 6552bd855cbd36edff73f1329d9cce1bb5608ab3
SHA512 9a993fe87ac50fe0304b32b260f1f03753fcb72837456b10b8c01d9de58f8aa6acb6e1594c52bc6bdc7ecad9095e49f3dbfb81430ba8422592656bce0ca0e5ad
SSDEEP 768:Uj+9R3KHFPfcO5fXJfXs+V5R4HTytYYqgHvPwWzn12bfJe:D9R3KZf1f5fnWTwJ3ByJe
TLSH
T116F2AF31EC689DA71DE2D68872163397BEE8457793C41A64CAE84F0D09CB7CE170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 5be2d2267aa90ec4afe17fdbb58af659a3681aa68e7da9f212db5a47f5b9a1c9
MD5 d75e002885dc33b9ab174029101da185
SHA1 23f5ff58ebb763659e3672d94ad02f68c1351e43
SHA512 0f7eabe4911f6de0a5b17c05484303b231879d5686d016f5cc6641578e283a628f069ab1c7fdaef8574fbc8a6717cc8d615c922314bf059d866b5a96402920ca
SSDEEP 768:xjaeqD4MlshiLdMmn3JTFPfcO5fXJfXs+V5R4HTytYYqgHvPwWOLTH:xqcjhIdMk3Jtf1f5fnWTwJ3A
TLSH
T1D103BF76ECB89CA74DA2D684721637D7AFB4016783C12A64DAD85B0D058B6CF170BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3e26e459d476032744a2481d1e44f762aa14dbca0916adf4b0beada6be62d515
MD5 26f2de78af6e42d9e8cbe2ba8fe43f9d
SHA1 b9c1314ae50dccd9994f93c4cd64053063581099
SHA512 379608a391386a72a5ef809057ab2e8248cfede5994b93b2762f4c2ab984ef36d0cfc34d2bcaaee85ca6e4a1f01139f3103c207371304c4d2edfd7df280916d5
SSDEEP 768:EjaeqD4MlshiLdMma3l3wPfcO5fXOV5R4HTytYYqgHvPgPyjWtxjTo:EqcjhIdMh3lUf1fYWTwJmyj2y
TLSH
T1CE03CF76ECB85CB74CB29684731677976EB842A7C3C12B64D9DC5A0D019BACF130781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a5f57224b26cb7d55d58c421c1f6c0d32abe14c6ca480f7c91a1c90c286ae70b
MD5 8c7c80ef7f43ed362df582ec944c89c8
SHA1 ddc147ccf296075cc2eaad16a6c8b8d2333eb3ed
SHA512 875e119f3d7e8bcf192be2de7065a88eeacc4fdc5d509f74a055424388cd5a091f93072e90b4209a62fca80ac89156a52c0b5b9b7b6cfb976d7b35fbc5d9750b
SSDEEP 768:cj+9R3THFPfcO5fXJfXs+V5R4HTytYYqgHvPwWzn12bfJe:79R3TZf1f5fnWTwJ3ByJe
TLSH
T197F2AE31EC699DA71DE2D68872163396AEE8457793C41A64CAE84F0D09CB7CE170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 10f01fea44dbe8bf010981cf5c82e2edf5fbf7e06cb6a7bd9dc80385cbe6a459
MD5 52a7f17897b329e867be0e9fd23020f5
SHA1 ea293d9f05bd81abe08cb8a824973f50e648fcc7
SHA512 ea7b21649507058f3ae192d838742c6a36b7d4f1055c9cc0e0fe44dbe5527e28f845de09f8e0c1dc3c1765f90e1998992a4a3cd009d142d339fbcb0bcebba226
SSDEEP 768:SF1j+9X3bwg+HVKfcO5fXJfXsiV5R4HTytYYqgHvPwWzn12bfJe:n9X3s0f1f5f9WTwJ3ByJe
TLSH
T19D1328F298E78976D99E8787633D2E469EBCC163B2841994F7D44E0CCC872BFC206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0ea73138-fdef-4d66-b356-95e40ea56141.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\0ea73138-fdef-4d66-b356-95e40ea56141.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

748b37a2-5930-4708-9a98-751ac060dea3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\748b37a2-5930-4708-9a98-751ac060dea3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3644_1041773049\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 c3e70390650c42719c63a6d450e23c314d2b94861cff9795239e2cad7dd148c4
MD5 c4206b269d184af1a8c618614ec929a3
SHA1 4105a797a6d9162a87e32743e39017f7eba06450
SHA512 47fe45a3a6318fd8beab9c335b55b0c5ff4ddcde8f0d75612bd6b7140298308a78b1939c90e8de59c89295145b59883c63a219a8cb0957fa6e0afdf2fd4e8eba
TLSH
T1DF71008366ADC9B2C1DA5FF103835644F5BB22780B6360254B515586AA30A3A54B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/932-195-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1284-413-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1456-325-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1556-393-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1964-321-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1968-453-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2052-485-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2056-437-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2324-344-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2740-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3044-296-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3520-373-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3896-340-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4980-267-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5176-417-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5184-280-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5184-473-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5264-502-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5764-242-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5764-448-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5764-268-0x0000000000010000-0x00000000000AB000-memory.dmp

Download