systex | 10548b829d9eb1f0bfd2525d3b2ac3e8b4e1108843e2d88dc9572d465f302c5b

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 15:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260705-tbsb2ag18p
SHA256 10548b829d9eb1f0bfd2525d3b2ac3e8b4e1108843e2d88dc9572d465f302c5b
MD5 c38ab9568633875032b7e5e8111cf1ba
SHA1 208bb1296b86cb84eb4026db24689955d69f701a
SHA512 bcc95ad3e93617ce0619d33afffceb28d2d6e06c6d11f93607c66fa11c28b90251069880aa4b2b24630fd25dd416dbf2270105459ca9080de6e6a5d2165e1576
SSDEEP 3072:JViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:JViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T171847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3208	sqkhcaxvpnkfcaxv.exe
5932	sqkhcaxvpnkfcaxv.sys
2672	CreateProcess.exe
980	axspkhfaus.exe
2600	CreateProcess.exe
2472	CreateProcess.exe
1348	i_axspkhfaus.exe
3812	icauspkhfz.sys
2124	CreateProcess.exe
4968	smkecxupnh.exe
2016	CreateProcess.exe
1572	CreateProcess.exe
5832	i_smkecxupnh.exe
2568	zurmkecwus.sys
3272	CreateProcess.exe
2428	rpmheczurp.exe
2792	CreateProcess.exe
1680	CreateProcess.exe
3328	i_rpmheczurp.exe
2588	rpjhezwrom.sys
2500	CreateProcess.exe
2552	romgeywroj.exe
2316	CreateProcess.exe
1384	CreateProcess.exe
1240	i_romgeywroj.exe
3244	olgeywtomg.sys
3544	CreateProcess.exe
5624	jgewtolgey.exe
3232	CreateProcess.exe
1300	CreateProcess.exe
3008	i_jgewtolgey.exe
2324	ojgeywtrlj.sys
5284	CreateProcess.exe
4948	gdaywqoljd.exe
5216	CreateProcess.exe
4660	CreateProcess.exe
4276	i_gdaywqoljd.exe
696	tnlfdyvqoi.sys
428	CreateProcess.exe
1672	qnlgdywqoi.exe
5496	CreateProcess.exe
3832	CreateProcess.exe
6104	i_qnlgdywqoi.exe
976	tnlfdxvpni.sys
4908	CreateProcess.exe
5276	kicaysqkid.exe
1972	CreateProcess.exe
5352	CreateProcess.exe
3012	i_kicaysqkid.exe
1060	fdxvpnhfzx.sys
5884	CreateProcess.exe
3032	axsqkicaus.exe
5880	CreateProcess.exe
2120	CreateProcess.exe
2728	i_axsqkicaus.exe
1640	faxspkicax.sys
4684	CreateProcess.exe
5976	spkecausmk.exe
1696	CreateProcess.exe
5972	CreateProcess.exe
1200	i_spkecausmk.exe
752	uspkhfzxrp.sys
868	CreateProcess.exe
1256	xrpmhezwup.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1772_1727005793\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1772_1459148990\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1772_1459148990\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khcaxrpkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnlgdywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkecausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpmhezwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khcaukecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgewtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgewtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axsqkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bywtnljgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lidavtnlfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkecxupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdaywqoljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicaysqkid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgezwrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpmheczurp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bywtnljgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khcaxrpkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khcaukecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpmheczurp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	romgeywroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axsqkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpmhezwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebwuomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davsnkicxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicaysqkid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkecausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lidavtnlfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkhcaxvpnkfcaxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axspkhfaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axspkhfaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_romgeywroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdaywqoljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnlgdywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebwuomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkecxupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgezwrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoljdbvqol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoljdbvqol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davsnkicxv.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2452	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3588	ipconfig.exe
2408	ipconfig.exe
2568	ipconfig.exe
4508	ipconfig.exe
6016	ipconfig.exe
6048	ipconfig.exe
2300	ipconfig.exe
2828	ipconfig.exe
1436	ipconfig.exe
5376	ipconfig.exe
3376	ipconfig.exe
5952	ipconfig.exe
4072	ipconfig.exe
2684	ipconfig.exe
5388	ipconfig.exe
3184	ipconfig.exe
1732	ipconfig.exe
2744	ipconfig.exe
2972	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134277404130951072"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3047816590-610495838-277027736-1000\{BF650479-3FCD-4AC6-8866-ECF0122DB86D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3208	sqkhcaxvpnkfcaxv.exe
3208	sqkhcaxvpnkfcaxv.exe
3208	sqkhcaxvpnkfcaxv.exe
3208	sqkhcaxvpnkfcaxv.exe
3208	sqkhcaxvpnkfcaxv.exe
3208	sqkhcaxvpnkfcaxv.exe
3208	sqkhcaxvpnkfcaxv.exe
3208	sqkhcaxvpnkfcaxv.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1348	i_axspkhfaus.exe
Token: SeDebugPrivilege	5832	i_smkecxupnh.exe
Token: SeDebugPrivilege	3328	i_rpmheczurp.exe
Token: SeDebugPrivilege	1240	i_romgeywroj.exe
Token: SeDebugPrivilege	3008	i_jgewtolgey.exe
Token: SeDebugPrivilege	4276	i_gdaywqoljd.exe
Token: SeDebugPrivilege	6104	i_qnlgdywqoi.exe
Token: SeDebugPrivilege	3012	i_kicaysqkid.exe
Token: SeDebugPrivilege	2728	i_axsqkicaus.exe
Token: SeDebugPrivilege	1200	i_spkecausmk.exe
Token: SeDebugPrivilege	3156	i_xrpmhezwup.exe
Token: SeDebugPrivilege	2036	i_omgezwrpjh.exe
Token: SeDebugPrivilege	2756	i_jebwuomgey.exe
Token: SeDebugPrivilege	1512	i_bywtnljgey.exe
Token: SeDebugPrivilege	4508	i_qoljdbvqol.exe
Token: SeDebugPrivilege	1204	i_lidavtnlfa.exe
Token: SeDebugPrivilege	3760	i_davsnkicxv.exe
Token: SeDebugPrivilege	1032	i_khcaxrpkhc.exe
Token: SeDebugPrivilege	5560	i_khcaukecxu.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1772	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 3208	3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 3116 wrote to memory of 5876	3116	2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 5876 wrote to memory of 1772	5876	iexplore.exe	90
PID 1772 wrote to memory of 2904	1772	msedge.exe	91
PID 1772 wrote to memory of 4128	1772	msedge.exe	92
PID 1772 wrote to memory of 2452	1772	msedge.exe	93
PID 1772 wrote to memory of 4128	1772	msedge.exe	92
PID 1772 wrote to memory of 4128	1772	msedge.exe	92
PID 1772 wrote to memory of 2708	1772	msedge.exe	94
PID 1772 wrote to memory of 2708	1772	msedge.exe	94
PID 1772 wrote to memory of 1700	1772	msedge.exe	96
PID 1772 wrote to memory of 1700	1772	msedge.exe	96
PID 1772 wrote to memory of 1700	1772	msedge.exe	96
PID 1772 wrote to memory of 1840	1772	msedge.exe	97
PID 1772 wrote to memory of 1840	1772	msedge.exe	97
PID 1772 wrote to memory of 1840	1772	msedge.exe	97
PID 1772 wrote to memory of 5432	1772	msedge.exe	98
PID 1772 wrote to memory of 5432	1772	msedge.exe	98
PID 1772 wrote to memory of 3908	1772	msedge.exe	99
PID 1772 wrote to memory of 5432	1772	msedge.exe	98
PID 1772 wrote to memory of 3908	1772	msedge.exe	99
PID 1772 wrote to memory of 3908	1772	msedge.exe	99
PID 1772 wrote to memory of 4968	1772	msedge.exe	100
PID 1772 wrote to memory of 4968	1772	msedge.exe	100
PID 3208 wrote to memory of 2672	3208	sqkhcaxvpnkfcaxv.exe	104
PID 980 wrote to memory of 2600	980	axspkhfaus.exe	107
PID 1772 wrote to memory of 2704	1772	msedge.exe	110
PID 1772 wrote to memory of 5372	1772	msedge.exe	111
PID 1772 wrote to memory of 2704	1772	msedge.exe	110
PID 1772 wrote to memory of 5372	1772	msedge.exe	111
PID 1772 wrote to memory of 5920	1772	msedge.exe	113
PID 1772 wrote to memory of 2976	1772	msedge.exe	116
PID 1772 wrote to memory of 2976	1772	msedge.exe	116
PID 1772 wrote to memory of 5352	1772	msedge.exe	117
PID 1772 wrote to memory of 5352	1772	msedge.exe	117
PID 3208 wrote to memory of 2472	3208	sqkhcaxvpnkfcaxv.exe	118
PID 3208 wrote to memory of 2124	3208	sqkhcaxvpnkfcaxv.exe	122
PID 4968 wrote to memory of 2016	4968	smkecxupnh.exe	124
PID 3208 wrote to memory of 1572	3208	sqkhcaxvpnkfcaxv.exe	127
PID 3208 wrote to memory of 3272	3208	sqkhcaxvpnkfcaxv.exe	131
PID 2428 wrote to memory of 2792	2428	rpmheczurp.exe	133
PID 3208 wrote to memory of 1680	3208	sqkhcaxvpnkfcaxv.exe	136
PID 3208 wrote to memory of 2500	3208	sqkhcaxvpnkfcaxv.exe	141
PID 2552 wrote to memory of 2316	2552	romgeywroj.exe	143
PID 3208 wrote to memory of 1384	3208	sqkhcaxvpnkfcaxv.exe	146
PID 1772 wrote to memory of 1052	1772	msedge.exe	148
PID 1772 wrote to memory of 4876	1772	msedge.exe	149
PID 1772 wrote to memory of 5136	1772	msedge.exe	150
PID 3208 wrote to memory of 3544	3208	sqkhcaxvpnkfcaxv.exe	153
PID 5624 wrote to memory of 3232	5624	jgewtolgey.exe	155
PID 3208 wrote to memory of 1300	3208	sqkhcaxvpnkfcaxv.exe	158
PID 3208 wrote to memory of 5284	3208	sqkhcaxvpnkfcaxv.exe	162
PID 4948 wrote to memory of 5216	4948	gdaywqoljd.exe	164
PID 3208 wrote to memory of 4660	3208	sqkhcaxvpnkfcaxv.exe	167
PID 3208 wrote to memory of 428	3208	sqkhcaxvpnkfcaxv.exe	171
PID 1672 wrote to memory of 5496	1672	qnlgdywqoi.exe	173
PID 3208 wrote to memory of 3832	3208	sqkhcaxvpnkfcaxv.exe	176
PID 3208 wrote to memory of 4908	3208	sqkhcaxvpnkfcaxv.exe	180
PID 5276 wrote to memory of 1972	5276	kicaysqkid.exe	182
PID 3208 wrote to memory of 5352	3208	sqkhcaxvpnkfcaxv.exe	185
PID 1772 wrote to memory of 5408	1772	msedge.exe	187
PID 1772 wrote to memory of 5408	1772	msedge.exe	187
PID 3208 wrote to memory of 5884	3208	sqkhcaxvpnkfcaxv.exe	193
PID 3032 wrote to memory of 5880	3032	axsqkicaus.exe	195

C:\Users\Admin\AppData\Local\Temp\2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-05_c38ab9568633875032b7e5e8111cf1ba_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Temp\sqkhcaxvpnkfcaxv.exe
  C:\Temp\sqkhcaxvpnkfcaxv.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3208
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\axspkhfaus.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2672
  - - C:\Temp\axspkhfaus.exe
      C:\Temp\axspkhfaus.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:980
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2600
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_axspkhfaus.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2472
  - - C:\Temp\i_axspkhfaus.exe
      C:\Temp\i_axspkhfaus.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1348
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\smkecxupnh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2124
  - - C:\Temp\smkecxupnh.exe
      C:\Temp\smkecxupnh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4968
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2016
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4072
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_smkecxupnh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1572
  - - C:\Temp\i_smkecxupnh.exe
      C:\Temp\i_smkecxupnh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5832
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpmheczurp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3272
  - - C:\Temp\rpmheczurp.exe
      C:\Temp\rpmheczurp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2428
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2792
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1436
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpmheczurp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1680
  - - C:\Temp\i_rpmheczurp.exe
      C:\Temp\i_rpmheczurp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3328
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\romgeywroj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2500
  - - C:\Temp\romgeywroj.exe
      C:\Temp\romgeywroj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2552
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2316
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3588
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_romgeywroj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1384
  - - C:\Temp\i_romgeywroj.exe
      C:\Temp\i_romgeywroj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgewtolgey.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3544
  - - C:\Temp\jgewtolgey.exe
      C:\Temp\jgewtolgey.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5624
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3232
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5376
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgewtolgey.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1300
  - - C:\Temp\i_jgewtolgey.exe
      C:\Temp\i_jgewtolgey.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3008
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gdaywqoljd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5284
  - - C:\Temp\gdaywqoljd.exe
      C:\Temp\gdaywqoljd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4948
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5216
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2744
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gdaywqoljd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4660
  - - C:\Temp\i_gdaywqoljd.exe
      C:\Temp\i_gdaywqoljd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4276
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnlgdywqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:428
  - - C:\Temp\qnlgdywqoi.exe
      C:\Temp\qnlgdywqoi.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1672
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5496
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2408
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnlgdywqoi.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3832
  - - C:\Temp\i_qnlgdywqoi.exe
      C:\Temp\i_qnlgdywqoi.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6104
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kicaysqkid.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4908
  - - C:\Temp\kicaysqkid.exe
      C:\Temp\kicaysqkid.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5276
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1972
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2684
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kicaysqkid.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5352
  - - C:\Temp\i_kicaysqkid.exe
      C:\Temp\i_kicaysqkid.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3012
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\axsqkicaus.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5884
  - - C:\Temp\axsqkicaus.exe
      C:\Temp\axsqkicaus.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3032
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5880
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3376
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_axsqkicaus.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2120
  - - C:\Temp\i_axsqkicaus.exe
      C:\Temp\i_axsqkicaus.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2728
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spkecausmk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4684
  - - C:\Temp\spkecausmk.exe
      C:\Temp\spkecausmk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5976
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1696
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2568
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spkecausmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5972
  - - C:\Temp\i_spkecausmk.exe
      C:\Temp\i_spkecausmk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpmhezwup.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:868
  - - C:\Temp\xrpmhezwup.exe
      C:\Temp\xrpmhezwup.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1256
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3204
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5388
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpmhezwup.exe ups_ins
    3⤵
    PID:4656
  - - C:\Temp\i_xrpmhezwup.exe
      C:\Temp\i_xrpmhezwup.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3156
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omgezwrpjh.exe ups_run
    3⤵
    PID:5428
  - - C:\Temp\omgezwrpjh.exe
      C:\Temp\omgezwrpjh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5012
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4252
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4508
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omgezwrpjh.exe ups_ins
    3⤵
    PID:1768
  - - C:\Temp\i_omgezwrpjh.exe
      C:\Temp\i_omgezwrpjh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2036
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jebwuomgey.exe ups_run
    3⤵
    PID:5240
  - - C:\Temp\jebwuomgey.exe
      C:\Temp\jebwuomgey.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6140
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5368
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2972
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jebwuomgey.exe ups_ins
    3⤵
    PID:624
  - - C:\Temp\i_jebwuomgey.exe
      C:\Temp\i_jebwuomgey.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2756
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bywtnljgey.exe ups_run
    3⤵
    PID:2824
  - - C:\Temp\bywtnljgey.exe
      C:\Temp\bywtnljgey.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4408
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2264
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6016
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bywtnljgey.exe ups_ins
    3⤵
    PID:4840
  - - C:\Temp\i_bywtnljgey.exe
      C:\Temp\i_bywtnljgey.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoljdbvqol.exe ups_run
    3⤵
    PID:2496
  - - C:\Temp\qoljdbvqol.exe
      C:\Temp\qoljdbvqol.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1164
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1112
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5952
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoljdbvqol.exe ups_ins
    3⤵
    PID:3160
  - - C:\Temp\i_qoljdbvqol.exe
      C:\Temp\i_qoljdbvqol.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4508
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lidavtnlfa.exe ups_run
    3⤵
    PID:1932
  - - C:\Temp\lidavtnlfa.exe
      C:\Temp\lidavtnlfa.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5380
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5892
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3184
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lidavtnlfa.exe ups_ins
    3⤵
    PID:2568
  - - C:\Temp\i_lidavtnlfa.exe
      C:\Temp\i_lidavtnlfa.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1204
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\davsnkicxv.exe ups_run
    3⤵
    PID:1328
  - - C:\Temp\davsnkicxv.exe
      C:\Temp\davsnkicxv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5268
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5916
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6048
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_davsnkicxv.exe ups_ins
    3⤵
    PID:3308
  - - C:\Temp\i_davsnkicxv.exe
      C:\Temp\i_davsnkicxv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3760
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\khcaxrpkhc.exe ups_run
    3⤵
    PID:5952
  - - C:\Temp\khcaxrpkhc.exe
      C:\Temp\khcaxrpkhc.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5848
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4184
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2300
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_khcaxrpkhc.exe ups_ins
    3⤵
    PID:5228
  - - C:\Temp\i_khcaxrpkhc.exe
      C:\Temp\i_khcaxrpkhc.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1032
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\khcaukecxu.exe ups_run
    3⤵
    PID:616
  - - C:\Temp\khcaukecxu.exe
      C:\Temp\khcaukecxu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4348
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3184
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1732
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_khcaukecxu.exe ups_ins
    3⤵
    PID:3100
  - - C:\Temp\i_khcaukecxu.exe
      C:\Temp\i_khcaukecxu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5560
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x35c,0x7fff30a5c188,0x7fff30a5c194,0x7fff30a5c1a0
      4⤵
      PID:2904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,2054281314021997921,9273106184714015856,262144 --field-trial-handle=2428,i,796685814405459755,7902744545926958307,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:2
      4⤵
      PID:4128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,18046280717607963676,17590328843836013783,524288 --field-trial-handle=2428,i,796685814405459755,7902744545926958307,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:11
      4⤵
      System Time Discovery
      PID:2452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2108,i,17567476204636859207,14261842611858801285,524288 --field-trial-handle=2428,i,796685814405459755,7902744545926958307,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:13
      4⤵
      PID:2708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,9767485671173440628,4260062431925660728,2097152 --field-trial-handle=2428,i,796685814405459755,7902744545926958307,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:1700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,11603540700357668546,18283522868658742845,2097152 --field-trial-handle=2428,i,796685814405459755,7902744545926958307,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
      4⤵
      PID:1840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,11083707404330599939,14190430553691426380,2097152 --field-trial-handle=2428,i,796685814405459755,7902744545926958307,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:1
      4⤵
      PID:5432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,11978664832947148199,18211102979613539667,2097152 --field-trial-handle=2428,i,796685814405459755,7902744545926958307,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:9
      4⤵
      PID:3908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,12438669178428675920,9186409238543663908,524288 --field-trial-handle=2428,i,796685814405459755,7902744545926958307,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:14
      4⤵
      PID:4968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,4746290421848586934,11487438536292321555,524288 --field-trial-handle=2428,i,796685814405459755,7902744545926958307,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
      4⤵
      PID:2704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3692,i,6402065773245110260,16360184243880814949,524288 --field-trial-handle=2428,i,796685814405459755,7902744545926958307,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
      4⤵
      PID:5372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,12122202476589838232,15708006531290435322,524288 --field-trial-handle=2428,i,796685814405459755,7902744545926958307,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
      4⤵
      PID:5912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,12122202476589838232,15708006531290435322,524288 --field-trial-handle=2428,i,796685814405459755,7902744545926958307,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
      4⤵
      PID:5920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,13763632276092287842,16442652277803682655,524288 --field-trial-handle=2428,i,796685814405459755,7902744545926958307,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
      4⤵
      PID:2976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,9489513841127932176,13426700608673497848,524288 --field-trial-handle=2428,i,796685814405459755,7902744545926958307,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:14
      4⤵
      PID:5352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4276,i,9411698426552820078,5510010631744871325,524288 --field-trial-handle=2428,i,796685814405459755,7902744545926958307,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:14
      4⤵
      PID:1052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,12010312140253910329,12310080806725104839,524288 --field-trial-handle=2428,i,796685814405459755,7902744545926958307,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
      4⤵
      PID:4876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,9855099708085932121,10361275538601506649,524288 --field-trial-handle=2428,i,796685814405459755,7902744545926958307,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:14
      4⤵
      PID:5136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,280072972690352807,14355384440341030470,524288 --field-trial-handle=2428,i,796685814405459755,7902744545926958307,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:14
      4⤵
      PID:5408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,2002880298018812145,3040918092120550608,524288 --field-trial-handle=2428,i,796685814405459755,7902744545926958307,262144 --variations-seed-version --mojo-platform-channel-handle=940 /prefetch:14
      4⤵
      PID:3908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6108,i,3442257763159675073,7020628102645789678,262144 --field-trial-handle=2428,i,796685814405459755,7902744545926958307,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:10
      4⤵
      PID:3380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,15766638406865322472,15465581009962460524,524288 --field-trial-handle=2428,i,796685814405459755,7902744545926958307,262144 --variations-seed-version --mojo-platform-channel-handle=940 /prefetch:14
      4⤵
      PID:1348

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:712

C:\Temp\sqkhcaxvpnkfcaxv.sys
C:\Temp\sqkhcaxvpnkfcaxv.sys
1⤵
- Executes dropped EXE
PID:5932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:868

C:\Temp\icauspkhfz.sys
C:\Temp\icauspkhfz.sys
1⤵
- Executes dropped EXE
PID:3812

C:\Temp\zurmkecwus.sys
C:\Temp\zurmkecwus.sys
1⤵
- Executes dropped EXE
PID:2568

C:\Temp\rpjhezwrom.sys
C:\Temp\rpjhezwrom.sys
1⤵
- Executes dropped EXE
PID:2588

C:\Temp\olgeywtomg.sys
C:\Temp\olgeywtomg.sys
1⤵
- Executes dropped EXE
PID:3244

C:\Temp\ojgeywtrlj.sys
C:\Temp\ojgeywtrlj.sys
1⤵
- Executes dropped EXE
PID:2324

C:\Temp\tnlfdyvqoi.sys
C:\Temp\tnlfdyvqoi.sys
1⤵
- Executes dropped EXE
PID:696

C:\Temp\tnlfdxvpni.sys
C:\Temp\tnlfdxvpni.sys
1⤵
- Executes dropped EXE
PID:976

C:\Temp\fdxvpnhfzx.sys
C:\Temp\fdxvpnhfzx.sys
1⤵
- Executes dropped EXE
PID:1060

C:\Temp\faxspkicax.sys
C:\Temp\faxspkicax.sys
1⤵
- Executes dropped EXE
PID:1640

C:\Temp\uspkhfzxrp.sys
C:\Temp\uspkhfzxrp.sys
1⤵
- Executes dropped EXE
PID:752

C:\Temp\wuomhezxrp.sys
C:\Temp\wuomhezxrp.sys
1⤵
PID:4068

C:\Temp\bzwqoljhby.sys
C:\Temp\bzwqoljhby.sys
1⤵
PID:244

C:\Temp\gebwtoljdb.sys
C:\Temp\gebwtoljdb.sys
1⤵
PID:4760

C:\Temp\rligdyvtnl.sys
C:\Temp\rligdyvtnl.sys
1⤵
PID:1308

C:\Temp\idaysqnlid.sys
C:\Temp\idaysqnlid.sys
1⤵
PID:5888

C:\Temp\nhfaxsqkic.sys
C:\Temp\nhfaxsqkic.sys
1⤵
PID:5388

C:\Temp\xvpnkfvpnh.sys
C:\Temp\xvpnkfvpnh.sys
1⤵
PID:4068

C:\Temp\pmkecxupkh.sys
C:\Temp\pmkecxupkh.sys
1⤵
PID:948

C:\Temp\ecwusmjhez.sys
C:\Temp\ecwusmjhez.sys
1⤵
PID:3508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

axspkhfaus.exe

Path C:\Temp\axspkhfaus.exe
Size 376KB
SHA256 b8ba4ecbc93724cf67846934a636a7e5a53ad5e065e79da286019a6063be331e
MD5 d18bc0129b2fd8a70ac1470cecb5d3b0
SHA1 9e12498b7821b982e9a59cc6ce1bbb39a893aed5
SHA512 252d9b4c71acde6aa6032f118e94fd822ef746f9c98f3e1eb914c40c16485f6ba62bee025b2dacf97fb4b0066ac2418eb52c5a24e3baf02399cee877b7bdb0c0
SSDEEP 3072:bViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:bViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T199847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdaywqoljd.exe

Path C:\Temp\gdaywqoljd.exe
Size 376KB
SHA256 e37c0b20d35c39b2d943820ae8456dd7d2d69d19760a8e6cdea84df6db07a77a
MD5 e91d3e9c4749269d3633646a5ce1db1f
SHA1 197f7eeb1aa39c3f1c860584594f155823449128
SHA512 493c1474190b8a6116b9cf8b9be3576dcb6d772df955d88279f85bc23de9f2c1d10f2361dd47e2ac1408fa25aeaba19c70c8d5b3018dd1352054661c4c2d65b1
SSDEEP 3072:6ViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:6ViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T144847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_axspkhfaus.exe

Path C:\Temp\i_axspkhfaus.exe
Size 376KB
SHA256 28ce94e326976b5e6528c4591e1d329abb35c2d839aeebfb330279287fdf8e84
MD5 936eb84f9b5eae0edf4d4f0c69c28441
SHA1 a8373d99c2cb3f7116bc418bd8b1f28492113260
SHA512 71fc5c756e37eb6cd3a4c6b834c64e9e1ee9cdcf680095080677b94f7ff592943794a95c0b9427fd2cbe7ae27783c04a6dd52d0f0b3f600024aea1e1b73a1d6d
SSDEEP 3072:dViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:dViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1BC847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jgewtolgey.exe

Path C:\Temp\i_jgewtolgey.exe
Size 376KB
SHA256 b99ec8850aa37f04263fd88106d0cdaba50e9063adc6345fe3b2b812006c5941
MD5 991d8db81723826681e98b38e2f412f4
SHA1 5dc1bceb223e50437604ba8741a50d40b1e3d062
SHA512 0466834fc89edbeeec849a7f1f845286ddace7bd6679d5a4fde588be1c12a1660fe17d49cd2dcdeab8a14fc4092ed9f540c8741153279c28662051a990178d38
SSDEEP 3072:GViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:GViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T160847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_romgeywroj.exe

Path C:\Temp\i_romgeywroj.exe
Size 376KB
SHA256 2a62559f32d13e78144a86826f558754545247471cf731cbb782dae41e70b72e
MD5 3d2c7ced3c0b8359bade19191d9f82ad
SHA1 5a065952d23510a610795284d0d918ec5f41bb26
SHA512 78efdae795233e2df57cf28ad926324a57085194c317d00b170fca43e0d375360b77181c038e06dc13a0f6e6fde69d7118c5081e58fd630385d8547d27df7e2e
SSDEEP 3072:8ViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:8ViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T180847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rpmheczurp.exe

Path C:\Temp\i_rpmheczurp.exe
Size 376KB
SHA256 86bcbd0e48169efe280604cd80f2ca6bf105609160b09d963d56998bf9a355b9
MD5 11ae89497b7990fbcf640aa42bacf905
SHA1 2ef7df367479205b05dde07747d911109a30f30c
SHA512 7a2d8e41b8cbfdb53dec302f18247074851016203b88737273dba7723fbeb30c414c40d5fe9b199916893b2e5eb47de640eeb0e7b2de7a60a1594537324b0437
SSDEEP 3072:HViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:HViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T167847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_smkecxupnh.exe

Path C:\Temp\i_smkecxupnh.exe
Size 376KB
SHA256 d9e5981f367e27df2a121da398ebaf0765c1fb0d33861e2972293e85328336fb
MD5 2171de2070b2376aac67803e590b10e7
SHA1 cb1a64f64c0454e05934da92298f354cbc22fcd3
SHA512 d5585b7bcb2a5fcde26d412bda3260410e03137a9398d8fec6a96317a6ce18b5c3002e58a6b171b4d953e9ded144ab21daa4f304a434ce601485f8984f9ec550
SSDEEP 3072:xViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:xViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T155847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icauspkhfz.sys

Path C:\Temp\icauspkhfz.sys
Size 293KB
SHA256 c26d6c1194fa67446a789367b0bdb726026dcbb8d9ae0d9079f677af6d44ffb0
MD5 3e8ea19de4c93174571d2f3bb303cdb6
SHA1 a014bd6f78bbbe65331b5bedf883c1acf5430476
SHA512 b25af4fdf1398ab588c63ebc626c9da917149c6853477dca403e516053e47ad3b6910b7dc5494e061feb2ace23bfdc3bf896f61b2d561d451b1670d3feef6f3f
SSDEEP 3072:AtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:AIJjiJcbI03GBc3ucY5DCSj
TLSH
T101545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgewtolgey.exe

Path C:\Temp\jgewtolgey.exe
Size 376KB
SHA256 ca81daff39bb36d55a79a395b4eaa5ff3b5b4edfb9368d1ba86bd91c3db89248
MD5 4bc641110d1bbf8b6714c3fab8bca1a0
SHA1 a0345010a0d62fe67363a6eef9d76a4533a16557
SHA512 443b7adf36de3ab22ef619b3e1ce6cb8990af68abdf72a72923c32091b81900cb35bb541bf3270b2f12837c49ef83896227d638cf99cab52c1f9826a862711f1
SSDEEP 3072:6ViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:6ViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T163847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ojgeywtrlj.sys

Path C:\Temp\ojgeywtrlj.sys
Size 293KB
SHA256 920b35e076cc6bc12ff99add0a01b0a669b44037a220c8f1a3f1285bafb5d01b
MD5 7b7f4cb16afcb089ba9a1fced65ed997
SHA1 39965287e75f593a41b5c7b5f57c6644c9e7f9e9
SHA512 1febf529a9eeb2bca5aee8a88752277fb2b8de8265be53adfc03e6aea08460137e64fd484f7eb68cc470492fe526b5493fff395929c6a03e955b13930470bcb6
SSDEEP 3072:VtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:VIJjiJcbI03GBc3ucY5DCSj
TLSH
T153545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olgeywtomg.sys

Path C:\Temp\olgeywtomg.sys
Size 293KB
SHA256 17dca30372c63efb40223f93f63f1efdff49ad307cbe40f1d820941d526f76bf
MD5 9b191fe37c3228054715329afeead611
SHA1 874cf988c08b465567d2bd414c946d296cb36aaf
SHA512 eff58446df1d44bac6695afbaaf5f9badb29788f5786fb52147357c06180a14e5d2b6eb9a0ccab41f80e0de756356e5339a43bf348337726334c9c423d1bf689
SSDEEP 3072:utKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:uIJjiJcbI03GBc3ucY5DCSj
TLSH
T1EC545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

romgeywroj.exe

Path C:\Temp\romgeywroj.exe
Size 376KB
SHA256 67ce255561f60d2e69964a758ba4314326f1d3d47e3ade2e9a3264ce7df3d696
MD5 448f06db27ea8084ac70dbfc1b4ef683
SHA1 d6971e4493090b768cd26c4d1fdab974341f1f19
SHA512 5d00e5558f4bec87cbfb3ccc06eb2fcd536c69f65e5bdda4a2b06d9308f5e9aac3f06c531f06e17ca7ff39205df4b7e4f4f993f8565d2f281b999925512981d1
SSDEEP 3072:XViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:XViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T198847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpjhezwrom.sys

Path C:\Temp\rpjhezwrom.sys
Size 293KB
SHA256 34f75a029ebec716a2a1ad5b1357b6b068cac66be2de412f908dae80d8f3ba58
MD5 c54606f0675f223e9359f5e0b6bfc552
SHA1 74a930a589150510844383aa82957e4c03ce6b9c
SHA512 e4e686d6c7b98f75452d1025cf000516e4c42be2d24eb87a37970f2bec6b82bef100d96f08467aac9b03b22d375df3979d7a59fe81fcddf82649d28e78ba89b2
SSDEEP 3072:ytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:yIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C6545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpmheczurp.exe

Path C:\Temp\rpmheczurp.exe
Size 376KB
SHA256 cf8dc9d704e48e896b4ed47bb7e177b2a8f7709b8878659756b7adbc1a8635ad
MD5 23dd8784d869be16a708f4893f34b1bd
SHA1 48da86f7965b1d1209de1c3fcabb85d6147939c5
SHA512 18b916dad849765f8fd3d29148738f080fa4064b34eddc8da4b834f3c2f8e03c114284ec6623cfea39d7af08f480064d04110969c4e8e53fb6b1dde8c4101e70
SSDEEP 3072:zViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:zViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T13F847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smkecxupnh.exe

Path C:\Temp\smkecxupnh.exe
Size 376KB
SHA256 b88f8431550f8e3c599e3a5716edba611d667ec6a4abcabbc87147da04a4be98
MD5 1af188ce3ee56d29b248208a678f9c2a
SHA1 ecf05047d13dd27c1d969457eb1d178b74a725c2
SHA512 a0e1fc4866baa37f205bcb24cb76efa22738766dd973211f3ab8c1e0fbf4fcf6bc0a6c377e2b6333695298ef721d0d46b13123d6d82674be22f0f21aab3b9bd6
SSDEEP 3072:RViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:RViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T168847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkhcaxvpnkfcaxv.exe

Path C:\Temp\sqkhcaxvpnkfcaxv.exe
Size 376KB
SHA256 d194e9cf073e32a40f6aa1798c7cf5ee443c7fce4603ee9cab2a00bd3c0fea25
MD5 7d24c3d5be0defb0b9428bdcbfeb5537
SHA1 a8001fbca05440b10e78813c004d9739f2209d9f
SHA512 427f06de63f2911a26623e9607fc66d4e95a565d74f3f1c23637712d83d007901f30cd4067f340e48ebf8983a9973b834cab325d994dafbc14daff799c91ebb2
SSDEEP 3072:fViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:fViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1FF847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkhcaxvpnkfcaxv.sys

Path C:\Temp\sqkhcaxvpnkfcaxv.sys
Size 293KB
SHA256 c22cbb3787bb8e3e2fc34e803d14f2340bbfc2713550da3d9ce3a2e84af7a536
MD5 700ad98fb8f59afd5e7cdf1bb0a04fc4
SHA1 6200b7ac73de9c2b9c040efb6e370c518ebbe11b
SHA512 7422330c32936635c5152eb8078d0ab178f73d42c5e161f2a682cf35bf73bde952dd3d7b84ce241feea12d5ca27c26c095980f1b3155ba543de5af6b4ea85aa4
SSDEEP 3072:ttKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:tIJjiJcbI03GBc3ucY5DCSj
TLSH
T125545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zurmkecwus.sys

Path C:\Temp\zurmkecwus.sys
Size 293KB
SHA256 3b6b297ee78de01759a120970723d2301ffe402b6e15c92808068a056af880ec
MD5 1d4a6980d4bf5ab4610a36c663280585
SHA1 17e1e4fd0768b832fec95ae95302c718c8689f18
SHA512 c0efb07be87c77c2b0dbd3cc8391f3a27f15efc57c2d5aaf69a8d5a1cc84f67f42e44908138db2c963441c3345bccc1150a7b51cea0743eb73ef071641ab20dd
SSDEEP 3072:atKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:aIJjiJcbI03GBc3ucY5DCSj
TLSH
T14A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 233c07bfff48b5fbad30cd7d90579abd0886400017cd6e7fb037e5626abb1a4d
MD5 71fa6328268340b183c55defa643c474
SHA1 7c004defb21dc2981b3091495c900e02b34e3a86
SHA512 e5b634d358633981cd343c3da26ee18738fb6c54b2334814637e0a9a45343d14770fed7a09c63d55dd190bf7ef111664ba5872f5d5ce925e6bee783e166c75b7
TLSH
T1D4D080F437A5F505C786617357D0574173650872101647095151D02CCC645DD63DB1DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2fd9384e79508a77111bb6310e9414898358885ca508610502ff6f1a15ad704f
MD5 714e68787bb5a6d2fd82139f833a5d0d
SHA1 f7a22adc92641d05515b3ae096da910924f11c1a
SHA512 b133f27abfa4ed5bdbd3eaf997e0664f0627537d4882fdaa63c0b1b301219d07f8ba46857db9a196b1210c29ed9f79e6cfd8c688d502b118a21640805665f762
TLSH
T16DD080F43795F605C786617357D0574173750872241647095051D01CCC645DD63DB1EF
MD5 SHA1 SHA512 TLSH

Submit Download

7b639d2a-290b-4594-8827-9936765fa1d8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7b639d2a-290b-4594-8827-9936765fa1d8.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 65666f0b3b1e1b1a22ef1d6abba175f17818b86725a95c0e7299d0f921c432ea
MD5 6fd3b57822cb50ceb7d6d20431f0f5f0
SHA1 2c65d73ee8cba4bfeaf12ee18875a5b7eff3b88a
SHA512 6a5255e73b925982de70962ce95d751bc602921ee72b0fb0531ee91b59223b1bb4855488ff17a70617a6f9d95b0ca6b59fd826c6c13466bc54caa418de6566d3
TLSH
T15061306F146749B5C73D4BF987E161AA77F8CD990E2F6E11049F947B58EE384A013830
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7b63407930125677ba6caadb6c922ea118aa9c34d8292da3ed056026d1a25fb1
MD5 f3944062f3fe389d56125d5b4ccd303d
SHA1 79fb9e71ef4905550a3ec0c22e6ebe23de2fd4bc
SHA512 5c7bc23a9224d4225cb4ce203a4f736f0584f5c31c1a023dca408e4dd7f3032ae2425f0ca6740100c2257d0ef72ca20c6392a71b32a5cbfe91381124067e6802
TLSH
T15F51ACF7C3E8856DCA1156F4BB186E2BCE1D0914832C3D9AC9E4AF1B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7334e2013e9648708dbc8897267f2fef2db7839c6b4a9ed32a69da897b3c54d8
MD5 c9f857e2e0b9b4a9dd8525071580a5f6
SHA1 dfcd784ae152af2da1adc6de0175d3639a1287e0
SHA512 3c3026af33faf05695f5f84e549e5c867265b3793dc1eb31298489b27577c703f2d88047f2d4910b0d7185ffe144a18b174ec9674382c8b93c88183fd8824f7f
SSDEEP 192:sxRWRDyM/jK1Ml8wcj/fbsYQAqTTZgzezoA8pi/g6+WNIYyBJ2GbIgtJ:sxRW3Cj/fbsYVUdCDi/5IFV3
TLSH
T11E52EA15AA28597BCCDBD20DFA517F53D6F91473A2940E48A9FCCA1C01E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 008eb0eeba7d538378e283adaa85745dd27872e80e9d57915f624c3b08c5031f
MD5 bc91cd4420d5e160d5eef0844eae2817
SHA1 a0bd2a17a3443559fb4c0c1612071222ef21e1b3
SHA512 950b7a55b637338bee1e616b7fa5b0bf4b0149f9ff9049bc952f46d30509cc926e4ed6aae3290302218db4841309950d96925431290d72efbdc7abdc0efce955
SSDEEP 192:sxR5RDyM/jK1Ml8wcj/fbs9QAqTTZgzGzoA8p9g/g6+WNCek/YyNJ2GbIgDnJ:sxR5hCj/fbs9VUdC7+/5U/JV9
TLSH
T19462E916AA285D7B8CDBD20DFA557F53D6F91472E2940E48A9FC8A0C01E77DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e38d58cf5a867e09afd4df1a5b947948b0a51b941b87b29e76f25d80b82b67a8
MD5 cf0dd16cf4dc0a81bc26eb585599caf1
SHA1 3e277aae91c655b240d02564f70d8a8c15053960
SHA512 13666ce2fe5ebc1a79a835fdd3517ded6f8cf3dba82e99a6ac3b40075bada875accff1998f2f2db9851f40220815a8289c4a397b1a3d51360877ce51cb39d22a
SSDEEP 192:sxR5RDyM/jK1Ml8UQlcj/fbs9QAZTTZgzGzoA8prg/g6+WNCek/YyVJ2GbIgDdJ:sxR5hqKj/fbs9VtdC78/5U/1Vr
TLSH
T19562D916AA285D778CDBD20DFA517F53D6F91472A2940E48AAFCCB0C01E76DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 f933f16d84ec3b93a6c946eef24e0b4351795d3b2b4092eb19397d04905979d1
MD5 3a83f4a4db4976422e57579b072e72d0
SHA1 29b71eacf2066a949cdeac4d809e4d64651333fb
SHA512 336e1fc4072b74fb055a4f6be6adea15aa6db05b0b40dd7bd96cc9d20325af4073275e10d1d1da35f0758ca48cbaeeee03c8c888fed164d86872330bcf3bd239
SSDEEP 768:AIox/O7pLuL7p0WguMfnA8F1+UoAYDCx9Tuqh0VfUC9xbog/OVbCgcciXro5wlS1:AIox/OE7p0WguMfnAu1ja0CgXiE5wa
TLSH
T1B7E2EC3B680CCB7F4F804A9CEC297E9A6DE801CF96D8CD9447FA841C03C66EB55165DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 fc9867a268f0e67a0978d343331d8c2d48cc464fba569baf71c1711465f7e881
MD5 45efffcbb41b5d0657001bede9317892
SHA1 6d1a36a67bb41b10af9b6de4a750dd10b29b81d8
SHA512 0f96b27dc2c006bbdbaf42fa2e1154edde78e03d8adef3b43aac1dba02c729f820ca41989e6e75ce6fb7f364218fea73ccc417c27ed695ae2976adf40fda1441
SSDEEP 96:Kntgj/tzTxufes4nxKw44NxUVdGnTSOBWKiM6B+PrZ7/LWPM6gTLK4ygdLcBpk38:OPhxB+PrZ7/KPMrTxygd4Bpk3/4HHQ1G
TLSH
T130913352757F17403C7F290982E8D82A528138A631D9F42B3BE851F61F6AE105FFE9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f064ba30-6045-47d4-b8a3-01d5f720988f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f064ba30-6045-47d4-b8a3-01d5f720988f.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 dd886415dc2da445ae49c12ec94dee3e17d0e1a38124348efb99e41e736eb1d2
MD5 48b0801c6f69b81c3515d1a8fcf3bfa7
SHA1 71ad8767237926bcb6ed94b36e3ba39605d63870
SHA512 bbc1bbb1cc5f1ef13f496a5c83d56ae27f7b6c49effdfe0f5ec1c9fd8a06183244035b22fb3426100f73758fc7424eb6309c9a299cf84df46e4a751f8e001e64
SSDEEP 768:vrv+4UNbdR39PngQOJIv5R/hUAFjQIMyOV3N5E9EbOb:vbsbv3fhNFUIpONNmWOb
TLSH
T19A03BE31B8A8DBB35CFBE285B61A72837FF4116748C10A84D9DE6B0D46471DE274BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 53609daaa0def978af4c5dd94d81a906d0c01855235c4a9a6fe34e1ec21f8b41
MD5 682ba3ea31e7ddf6354e060c26c2692f
SHA1 1a271ad6e8dd88d0e6bc802efe2e44e20a421251
SHA512 0a803409ff291e07bb68624474d0e68e165d3382ddf10a4c970dc8f831df84c0874f5ca53c46d1c68f94d1ebe46b1a21f0a14b72a013e35ba9eda531fcb87c55
SSDEEP 768:Kj+9D3ePkgQOJIv5R/hUAFjQIMyOV3N5E9Ebb9Mv6:p9D3nhNFUIpONNmWb+v6
TLSH
T196F2AE31BCA5DFA34CEBD285771A3293AFE0117744C11E44DADEAB0D068729D179BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7305cf6cb40eaf28afa7470f90f61e3b786cc4719f77ed77340fea93f2ec5fd4
MD5 d873c40b22f8f00a12873377018d9eeb
SHA1 53d79d8916ad86b0ae1efa7c681a9a775dece706
SHA512 93f63e48d76608907e9511047bc5a625af2a9db477bd91b898c14766dc000baf1acbb3adaaeb66be407cec650f60f9c740bbaa4a3db83d4a2bee68c47745193a
SSDEEP 768:Mj+9D39PkgQOJIv5R/hUAFjQIMyOV3N5E9Ebb9Mv6:L9D3GhNFUIpONNmWb+v6
TLSH
T130F2AE31BCA5DFA34CEBD285771A3293AFE0117744C11E44DADEAB0D068729D179BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 9e62f1666c4cd8031667ddbdc3c1267d1bcf3dbc2cc5035abecb853a3e5d7842
MD5 8717f95b8a8e3eb64c1788c17dcc3a16
SHA1 d092a1ff1c1304a75975f340fbaf20c308318d09
SHA512 12dc1da46dbfb65aafeab1659d856e3c172fdf4e316228f14e7e344b9e85c3b053269db27c2a0fcf9a43b0e5640b8503a4cf3aa87620a095f27a580b7cbd1119
SSDEEP 768:9rv+4UNbdF3Z9lQOJIvc/hUAFjQIMyOV3N5E9M75+8r0mL:9bsbf33hNFUIpONNmoDrv
TLSH
T19703BF32E8A8DAB39CE7D6C5760A72437FF4416399C10B84C9DE2B0D824B5DD231BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 c4f64d717e90a09efcd3672c7e702b99d7e0d541fcd95af5467a70b2063d682b
MD5 2ffe5a2ecd0ac16b96235ddd4e9354d4
SHA1 aac946696b2f1864bc2d05747ea763552c678c20
SHA512 86f21b133e2db75bd214e0a9eb58038963e3453e92a4d105a4052b438703e69ebb3ed0caa3a502db21ccda5b20fdae7f4abdd906e3d3202b79d008eac89f6681
SSDEEP 768:JF1j+9u3Bwg8PMtrOJIv5P/hUAFjQIMyOV3N5E9Ebb9Mv6:49u37hNFUIpONNmWb+v6
TLSH
T1911328F6A8D7CA76D8AE8787673D2E429AFCC16374845984F7C95E0CCC821BFC246815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

4d2baea2-73fc-4cd1-b6f5-1b94e8ffc22c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4d2baea2-73fc-4cd1-b6f5-1b94e8ffc22c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1772_706437305\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 e74eb11ae6812034bd5441fb113893b500fad8093659c14cb3276828e21b3cf2
MD5 a062cc766be28e97c6da88b7910a27ee
SHA1 a6eee510e938bef8e9008e53013bc0f43ba8c481
SHA512 90e6c98bb6f444768bccac62e3ac1680677a2f1858f2a2f8f627e09659464a710dd8106dfc20fc686925011b04622663a1ddc5aa14200699197542c6c21c8f25
TLSH
T11D71239367ADC9B3C2DA5FF003835604F5FB223C076330240B9555C6AB34A3A58B8F18
MD5 SHA1 SHA512 TLSH

Submit Download

memory/244-392-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/696-319-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/752-367-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/948-452-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/976-323-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1060-338-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1308-420-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1640-342-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2324-293-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2568-242-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2588-267-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2588-285-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3244-279-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3508-472-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3812-195-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4068-379-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4068-433-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4760-400-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5388-429-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5888-424-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5932-62-0x0000000000010000-0x00000000000AB000-memory.dmp

Download