Overview

overview

10

Static

static

10

2026-04-15...op.exe

windows10-2004-x64

10

2026-04-15...op.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    147s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    15/04/2026, 08:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-15_d81691bc0e54bbd1fb86f17d2fdf3711_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
  • Size 381KB
  • Sample260415-kpy73ac12x
  • SHA256 48fa4f08185b56355a8f7b79836deeeb75967b205bd8a0a1ab1ae465eacca722
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarediscoverysystexspywaretrojan

Malware Config

Signatures

  • Family: Systex

    Systex is a trojan loader written in C++.

    trojansystex
  • Executes dropped EXE 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers network information 2 TTPs 19 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 29 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 20 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-15_d81691bc0e54bbd1fb86f17d2fdf3711_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-15_d81691bc0e54bbd1fb86f17d2fdf3711_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3240
    • C:\Temp\qkidxvpnhfaxsica.exe
      C:\Temp\qkidxvpnhfaxsica.exe run
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4448
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\nhfzxrmkec.exe ups_run
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2156
        • C:\Temp\nhfzxrmkec.exe
          C:\Temp\nhfzxrmkec.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4016
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:2972
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:2288
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_nhfzxrmkec.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:5444
        • C:\Temp\i_nhfzxrmkec.exe
          C:\Temp\i_nhfzxrmkec.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1324
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\pjhczusmke.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:5988
        • C:\Temp\pjhczusmke.exe
          C:\Temp\pjhczusmke.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3420
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:5648
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:4056
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_pjhczusmke.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:3512
        • C:\Temp\i_pjhczusmke.exe
          C:\Temp\i_pjhczusmke.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2012
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\ecwuomhecw.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:4964
        • C:\Temp\ecwuomhecw.exe
          C:\Temp\ecwuomhecw.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5000
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:4996
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:5520
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_ecwuomhecw.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:5916
        • C:\Temp\i_ecwuomhecw.exe
          C:\Temp\i_ecwuomhecw.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:5584
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\trljebwuom.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:5476
        • C:\Temp\trljebwuom.exe
          C:\Temp\trljebwuom.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1488
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:2920
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:5328
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_trljebwuom.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:3084
        • C:\Temp\i_trljebwuom.exe
          C:\Temp\i_trljebwuom.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2696
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\ywqoigbytq.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:2200
        • C:\Temp\ywqoigbytq.exe
          C:\Temp\ywqoigbytq.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4624
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:2544
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:1312
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_ywqoigbytq.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:400
        • C:\Temp\i_ywqoigbytq.exe
          C:\Temp\i_ywqoigbytq.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:5116
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\ljdtnlgdyv.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:5720
        • C:\Temp\ljdtnlgdyv.exe
          C:\Temp\ljdtnlgdyv.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1844
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:1200
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:5840
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_ljdtnlgdyv.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:2064
        • C:\Temp\i_ljdtnlgdyv.exe
          C:\Temp\i_ljdtnlgdyv.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:5204
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\vtkidyvqoi.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:3116
        • C:\Temp\vtkidyvqoi.exe
          C:\Temp\vtkidyvqoi.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:752
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:1060
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:5860
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_vtkidyvqoi.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:2820
        • C:\Temp\i_vtkidyvqoi.exe
          C:\Temp\i_vtkidyvqoi.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3928
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\icausnkfdx.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:5456
        • C:\Temp\icausnkfdx.exe
          C:\Temp\icausnkfdx.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1156
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:4836
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:1552
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_icausnkfdx.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:2528
        • C:\Temp\i_icausnkfdx.exe
          C:\Temp\i_icausnkfdx.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3736
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\zxsmkfcxup.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:3124
        • C:\Temp\zxsmkfcxup.exe
          C:\Temp\zxsmkfcxup.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2072
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:5172
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:5244
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_zxsmkfcxup.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:5980
        • C:\Temp\i_zxsmkfcxup.exe
          C:\Temp\i_zxsmkfcxup.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:572
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\mkecwupmhe.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:2128
        • C:\Temp\mkecwupmhe.exe
          C:\Temp\mkecwupmhe.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3348
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:3548
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:660
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_mkecwupmhe.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:5448
        • C:\Temp\i_mkecwupmhe.exe
          C:\Temp\i_mkecwupmhe.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3560
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\jhbzxrpjhc.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:1688
        • C:\Temp\jhbzxrpjhc.exe
          C:\Temp\jhbzxrpjhc.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1076
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
              PID:5636
              • C:\windows\system32\ipconfig.exe
                C:\windows\system32\ipconfig.exe /release
                6⤵
                • Gathers network information
                PID:2124
        • C:\temp\CreateProcess.exe
          C:\temp\CreateProcess.exe C:\Temp\i_jhbzxrpjhc.exe ups_ins
          3⤵
            PID:3516
            • C:\Temp\i_jhbzxrpjhc.exe
              C:\Temp\i_jhbzxrpjhc.exe ups_ins
              4⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:3424
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\Temp\ebwtrmgezw.exe ups_run
            3⤵
              PID:920
              • C:\Temp\ebwtrmgezw.exe
                C:\Temp\ebwtrmgezw.exe ups_run
                4⤵
                • System Location Discovery: System Language Discovery
                PID:3096
                • C:\temp\CreateProcess.exe
                  C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                  5⤵
                    PID:1620
                    • C:\windows\system32\ipconfig.exe
                      C:\windows\system32\ipconfig.exe /release
                      6⤵
                      • Gathers network information
                      PID:1564
              • C:\temp\CreateProcess.exe
                C:\temp\CreateProcess.exe C:\Temp\i_ebwtrmgezw.exe ups_ins
                3⤵
                  PID:2728
                  • C:\Temp\i_ebwtrmgezw.exe
                    C:\Temp\i_ebwtrmgezw.exe ups_ins
                    4⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5496
                • C:\temp\CreateProcess.exe
                  C:\temp\CreateProcess.exe C:\Temp\wqojgbwtrl.exe ups_run
                  3⤵
                    PID:4896
                    • C:\Temp\wqojgbwtrl.exe
                      C:\Temp\wqojgbwtrl.exe ups_run
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:5532
                      • C:\temp\CreateProcess.exe
                        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                        5⤵
                          PID:5488
                          • C:\windows\system32\ipconfig.exe
                            C:\windows\system32\ipconfig.exe /release
                            6⤵
                            • Gathers network information
                            PID:2456
                    • C:\temp\CreateProcess.exe
                      C:\temp\CreateProcess.exe C:\Temp\i_wqojgbwtrl.exe ups_ins
                      3⤵
                        PID:5684
                        • C:\Temp\i_wqojgbwtrl.exe
                          C:\Temp\i_wqojgbwtrl.exe ups_ins
                          4⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          PID:748
                      • C:\temp\CreateProcess.exe
                        C:\temp\CreateProcess.exe C:\Temp\ytjdbvtnlg.exe ups_run
                        3⤵
                          PID:5272
                          • C:\Temp\ytjdbvtnlg.exe
                            C:\Temp\ytjdbvtnlg.exe ups_run
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:4008
                            • C:\temp\CreateProcess.exe
                              C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                              5⤵
                                PID:3012
                                • C:\windows\system32\ipconfig.exe
                                  C:\windows\system32\ipconfig.exe /release
                                  6⤵
                                  • Gathers network information
                                  PID:5560
                          • C:\temp\CreateProcess.exe
                            C:\temp\CreateProcess.exe C:\Temp\i_ytjdbvtnlg.exe ups_ins
                            3⤵
                              PID:4756
                              • C:\Temp\i_ytjdbvtnlg.exe
                                C:\Temp\i_ytjdbvtnlg.exe ups_ins
                                4⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2476
                            • C:\temp\CreateProcess.exe
                              C:\temp\CreateProcess.exe C:\Temp\lfdyvqoigd.exe ups_run
                              3⤵
                                PID:572
                                • C:\Temp\lfdyvqoigd.exe
                                  C:\Temp\lfdyvqoigd.exe ups_run
                                  4⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:764
                                  • C:\temp\CreateProcess.exe
                                    C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                    5⤵
                                      PID:2896
                                      • C:\windows\system32\ipconfig.exe
                                        C:\windows\system32\ipconfig.exe /release
                                        6⤵
                                        • Gathers network information
                                        PID:5268
                                • C:\temp\CreateProcess.exe
                                  C:\temp\CreateProcess.exe C:\Temp\i_lfdyvqoigd.exe ups_ins
                                  3⤵
                                    PID:4284
                                    • C:\Temp\i_lfdyvqoigd.exe
                                      C:\Temp\i_lfdyvqoigd.exe ups_ins
                                      4⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:5292
                                  • C:\temp\CreateProcess.exe
                                    C:\temp\CreateProcess.exe C:\Temp\dxvpnifays.exe ups_run
                                    3⤵
                                      PID:5528
                                      • C:\Temp\dxvpnifays.exe
                                        C:\Temp\dxvpnifays.exe ups_run
                                        4⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:1580
                                        • C:\temp\CreateProcess.exe
                                          C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                          5⤵
                                            PID:2888
                                            • C:\windows\system32\ipconfig.exe
                                              C:\windows\system32\ipconfig.exe /release
                                              6⤵
                                              • Gathers network information
                                              PID:2280
                                      • C:\temp\CreateProcess.exe
                                        C:\temp\CreateProcess.exe C:\Temp\i_dxvpnifays.exe ups_ins
                                        3⤵
                                          PID:1260
                                          • C:\Temp\i_dxvpnifays.exe
                                            C:\Temp\i_dxvpnifays.exe ups_ins
                                            4⤵
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:1604
                                        • C:\temp\CreateProcess.exe
                                          C:\temp\CreateProcess.exe C:\Temp\nhfzxspkic.exe ups_run
                                          3⤵
                                            PID:3052
                                            • C:\Temp\nhfzxspkic.exe
                                              C:\Temp\nhfzxspkic.exe ups_run
                                              4⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:3932
                                              • C:\temp\CreateProcess.exe
                                                C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                5⤵
                                                  PID:4600
                                                  • C:\windows\system32\ipconfig.exe
                                                    C:\windows\system32\ipconfig.exe /release
                                                    6⤵
                                                    • Gathers network information
                                                    PID:2916
                                            • C:\temp\CreateProcess.exe
                                              C:\temp\CreateProcess.exe C:\Temp\i_nhfzxspkic.exe ups_ins
                                              3⤵
                                                PID:1372
                                                • C:\Temp\i_nhfzxspkic.exe
                                                  C:\Temp\i_nhfzxspkic.exe ups_ins
                                                  4⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:692
                                              • C:\temp\CreateProcess.exe
                                                C:\temp\CreateProcess.exe C:\Temp\fzxspkhcau.exe ups_run
                                                3⤵
                                                  PID:4752
                                                  • C:\Temp\fzxspkhcau.exe
                                                    C:\Temp\fzxspkhcau.exe ups_run
                                                    4⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:2224
                                                    • C:\temp\CreateProcess.exe
                                                      C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                      5⤵
                                                        PID:4776
                                                        • C:\windows\system32\ipconfig.exe
                                                          C:\windows\system32\ipconfig.exe /release
                                                          6⤵
                                                          • Gathers network information
                                                          PID:1080
                                                  • C:\temp\CreateProcess.exe
                                                    C:\temp\CreateProcess.exe C:\Temp\i_fzxspkhcau.exe ups_ins
                                                    3⤵
                                                      PID:5420
                                                      • C:\Temp\i_fzxspkhcau.exe
                                                        C:\Temp\i_fzxspkhcau.exe ups_ins
                                                        4⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:4220
                                                    • C:\temp\CreateProcess.exe
                                                      C:\temp\CreateProcess.exe C:\Temp\fzxrpkhcau.exe ups_run
                                                      3⤵
                                                        PID:3544
                                                        • C:\Temp\fzxrpkhcau.exe
                                                          C:\Temp\fzxrpkhcau.exe ups_run
                                                          4⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:5552
                                                          • C:\temp\CreateProcess.exe
                                                            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                            5⤵
                                                              PID:4676
                                                              • C:\windows\system32\ipconfig.exe
                                                                C:\windows\system32\ipconfig.exe /release
                                                                6⤵
                                                                • Gathers network information
                                                                PID:3280
                                                        • C:\temp\CreateProcess.exe
                                                          C:\temp\CreateProcess.exe C:\Temp\i_fzxrpkhcau.exe ups_ins
                                                          3⤵
                                                            PID:5248
                                                            • C:\Temp\i_fzxrpkhcau.exe
                                                              C:\Temp\i_fzxrpkhcau.exe ups_ins
                                                              4⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:4056
                                                        • C:\Program Files\Internet Explorer\iexplore.exe
                                                          "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
                                                          2⤵
                                                          • Modifies Internet Explorer settings
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4656
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
                                                            3⤵
                                                            • Drops file in Windows directory
                                                            • Enumerates system info in registry
                                                            • Modifies data under HKEY_USERS
                                                            • Modifies registry class
                                                            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                            • Suspicious use of FindShellTrayWindow
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:5100
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7ff87ce9c188,0x7ff87ce9c194,0x7ff87ce9c1a0
                                                              4⤵
                                                                PID:4912
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1708,i,4249031974706605524,6509613196733628268,524288 --field-trial-handle=2180,i,10311774721599061914,16694379293989743287,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:11
                                                                4⤵
                                                                • System Time Discovery
                                                                PID:1140
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,15545080139282544988,15422726953723541549,262144 --field-trial-handle=2180,i,10311774721599061914,16694379293989743287,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:2
                                                                4⤵
                                                                  PID:5056
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2380,i,14621799594686071829,13159058299823511635,524288 --field-trial-handle=2180,i,10311774721599061914,16694379293989743287,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:13
                                                                  4⤵
                                                                    PID:1040
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,11429016656692230913,13553190235521338376,2097152 --field-trial-handle=2180,i,10311774721599061914,16694379293989743287,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
                                                                    4⤵
                                                                      PID:5628
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,18038473229208984480,14002599843010720172,2097152 --field-trial-handle=2180,i,10311774721599061914,16694379293989743287,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
                                                                      4⤵
                                                                        PID:4276
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,2573449746487074549,9965048248525946060,524288 --field-trial-handle=2180,i,10311774721599061914,16694379293989743287,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:14
                                                                        4⤵
                                                                          PID:5460
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4892,i,10664373567289754519,11497141838953001668,524288 --field-trial-handle=2180,i,10311774721599061914,16694379293989743287,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:14
                                                                          4⤵
                                                                            PID:5448
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,6170494096001386193,13346123399561191941,524288 --field-trial-handle=2180,i,10311774721599061914,16694379293989743287,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:14
                                                                            4⤵
                                                                              PID:3252
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,6170494096001386193,13346123399561191941,524288 --field-trial-handle=2180,i,10311774721599061914,16694379293989743287,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:14
                                                                              4⤵
                                                                                PID:3736
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,15091869434536801725,8570727763178798667,524288 --field-trial-handle=2180,i,10311774721599061914,16694379293989743287,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:14
                                                                                4⤵
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:1692
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                                                                                  cookie_exporter.exe --cookie-json=1132
                                                                                  5⤵
                                                                                    PID:5260
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,12427224424374301288,2767030362009379925,524288 --field-trial-handle=2180,i,10311774721599061914,16694379293989743287,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
                                                                                  4⤵
                                                                                    PID:3604
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,5575620390248059083,7462045081151727279,524288 --field-trial-handle=2180,i,10311774721599061914,16694379293989743287,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
                                                                                    4⤵
                                                                                      PID:1792
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,10964678823650886760,17645055801931833890,524288 --field-trial-handle=2180,i,10311774721599061914,16694379293989743287,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
                                                                                      4⤵
                                                                                        PID:1756
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,6486723915606551117,3051338459560871349,524288 --field-trial-handle=2180,i,10311774721599061914,16694379293989743287,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:14
                                                                                        4⤵
                                                                                          PID:4504
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,1036112894425849505,9839290635590176587,524288 --field-trial-handle=2180,i,10311774721599061914,16694379293989743287,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
                                                                                          4⤵
                                                                                            PID:6004
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,15815962473411697745,4288505542081131317,524288 --field-trial-handle=2180,i,10311774721599061914,16694379293989743287,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
                                                                                            4⤵
                                                                                              PID:1840
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5452,i,4059401933244445938,951032932569579605,262144 --field-trial-handle=2180,i,10311774721599061914,16694379293989743287,262144 --variations-seed-version --mojo-platform-channel-handle=776 /prefetch:10
                                                                                              4⤵
                                                                                                PID:5400
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                          1⤵
                                                                                            PID:5692
                                                                                          • C:\Temp\qkidxvpnhfaxsica.sys
                                                                                            C:\Temp\qkidxvpnhfaxsica.sys
                                                                                            1⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:572
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                            1⤵
                                                                                              PID:2180
                                                                                            • C:\Temp\ausmkecxup.sys
                                                                                              C:\Temp\ausmkecxup.sys
                                                                                              1⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:2420
                                                                                            • C:\Temp\mhezxrpjhe.sys
                                                                                              C:\Temp\mhezxrpjhe.sys
                                                                                              1⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:596
                                                                                            • C:\Temp\trljebwuom.sys
                                                                                              C:\Temp\trljebwuom.sys
                                                                                              1⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:3000
                                                                                            • C:\Temp\uomgeywrob.sys
                                                                                              C:\Temp\uomgeywrob.sys
                                                                                              1⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:1448
                                                                                            • C:\Temp\ywqoigbytr.sys
                                                                                              C:\Temp\ywqoigbytr.sys
                                                                                              1⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:1044
                                                                                            • C:\Temp\gaysqkidav.sys
                                                                                              C:\Temp\gaysqkidav.sys
                                                                                              1⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:5592
                                                                                            • C:\Temp\pnlfdxvpni.sys
                                                                                              C:\Temp\pnlfdxvpni.sys
                                                                                              1⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:1932
                                                                                            • C:\Temp\sqkausmkfc.sys
                                                                                              C:\Temp\sqkausmkfc.sys
                                                                                              1⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:5016
                                                                                            • C:\Temp\icausmkfcx.sys
                                                                                              C:\Temp\icausmkfcx.sys
                                                                                              1⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:3208
                                                                                            • C:\Temp\usmkecxupm.sys
                                                                                              C:\Temp\usmkecxupm.sys
                                                                                              1⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:1260
                                                                                            • C:\Temp\omgeztomge.sys
                                                                                              C:\Temp\omgeztomge.sys
                                                                                              1⤵
                                                                                                PID:1916
                                                                                              • C:\Temp\ljetolgeyw.sys
                                                                                                C:\Temp\ljetolgeyw.sys
                                                                                                1⤵
                                                                                                  PID:2964
                                                                                                • C:\Temp\jdbwtomgey.sys
                                                                                                  C:\Temp\jdbwtomgey.sys
                                                                                                  1⤵
                                                                                                    PID:4164
                                                                                                  • C:\Temp\vtnlgdywql.sys
                                                                                                    C:\Temp\vtnlgdywql.sys
                                                                                                    1⤵
                                                                                                      PID:392
                                                                                                    • C:\Temp\nigaysqkid.sys
                                                                                                      C:\Temp\nigaysqkid.sys
                                                                                                      1⤵
                                                                                                        PID:4640
                                                                                                      • C:\Temp\fdxnifausn.sys
                                                                                                        C:\Temp\fdxnifausn.sys
                                                                                                        1⤵
                                                                                                          PID:5712
                                                                                                        • C:\Temp\usmkfcxvpn.sys
                                                                                                          C:\Temp\usmkfcxvpn.sys
                                                                                                          1⤵
                                                                                                            PID:1564
                                                                                                          • C:\Temp\mkecwupmhf.sys
                                                                                                            C:\Temp\mkecwupmhf.sys
                                                                                                            1⤵
                                                                                                              PID:2936
                                                                                                            • C:\Temp\ecwuomhezw.sys
                                                                                                              C:\Temp\ecwuomhezw.sys
                                                                                                              1⤵
                                                                                                                PID:4628

                                                                                                              Network

                                                                                                                    MITRE ATT&CK Enterprise v16

                                                                                                                    Replay Monitor

                                                                                                                    Loading Replay Monitor...

                                                                                                                    Downloads

                                                                                                                    CreateProcess.exe
                                                                                                                    • Path C:\Temp\CreateProcess.exe
                                                                                                                    • Size 3KB
                                                                                                                    • SHA256 d880b0217fb5e05ca7c1d8f50312268688e8e43dcca3617ab06d1c4b21b8e882
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    ausmkecxup.sys
                                                                                                                    • Path C:\Temp\ausmkecxup.sys
                                                                                                                    • Size 293KB
                                                                                                                    • SHA256 730d9e09c1ab63734cf702cc2fd98ba23d20c8086f56677c7da764e3090647fc
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    ecwuomhecw.exe
                                                                                                                    • Path C:\Temp\ecwuomhecw.exe
                                                                                                                    • Size 381KB
                                                                                                                    • SHA256 e9faca7f2da3066266fda1e1d0d5a6fc987022898d75b3eb4f7f124add5e4086
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    gaysqkidav.sys
                                                                                                                    • Path C:\Temp\gaysqkidav.sys
                                                                                                                    • Size 293KB
                                                                                                                    • SHA256 aee295fa7b5646b8318c64686323a067ffb4f8d9292032545b35a259e3c8d03d
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    i_ecwuomhecw.exe
                                                                                                                    • Path C:\Temp\i_ecwuomhecw.exe
                                                                                                                    • Size 381KB
                                                                                                                    • SHA256 38f4b391889fd7446513c705b7831435ee04d3e4ae1673c53d3a956d720df430
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    i_ljdtnlgdyv.exe
                                                                                                                    • Path C:\Temp\i_ljdtnlgdyv.exe
                                                                                                                    • Size 381KB
                                                                                                                    • SHA256 e015c31161e54c5eb7cf931aad99226089f1fca4eabf99143f3c8b6a93946053
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    i_nhfzxrmkec.exe
                                                                                                                    • Path C:\Temp\i_nhfzxrmkec.exe
                                                                                                                    • Size 381KB
                                                                                                                    • SHA256 24e5169d30692dcd35c6b84903bf7fd6efca7d7bfa60f1e45b9d29aa39070ed1
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    i_pjhczusmke.exe
                                                                                                                    • Path C:\Temp\i_pjhczusmke.exe
                                                                                                                    • Size 381KB
                                                                                                                    • SHA256 4ee2569b248e0ccb3a5db5138e3d50c1306b102ce78ade39c0ffc477eebf428a
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    i_trljebwuom.exe
                                                                                                                    • Path C:\Temp\i_trljebwuom.exe
                                                                                                                    • Size 381KB
                                                                                                                    • SHA256 720313dacca78f70ae68548fa60ed8196c1f1f5a700ca0b080f72ddfb58ed6df
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    i_ywqoigbytq.exe
                                                                                                                    • Path C:\Temp\i_ywqoigbytq.exe
                                                                                                                    • Size 381KB
                                                                                                                    • SHA256 a1cca587a9c2e01721a629cfebaf8f22cb377930cf54998b6d18df1cbd3b52d3
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    ljdtnlgdyv.exe
                                                                                                                    • Path C:\Temp\ljdtnlgdyv.exe
                                                                                                                    • Size 381KB
                                                                                                                    • SHA256 0d8ee5ad558f75b274aa0109360ed2d10dcf8eb322041fc07ea1254eac05dc87
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    mhezxrpjhe.sys
                                                                                                                    • Path C:\Temp\mhezxrpjhe.sys
                                                                                                                    • Size 293KB
                                                                                                                    • SHA256 6ce07555f3656ccbbdcac14b28ac636d0062e155d6f9f77bad6a4306e30a1aee
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    nhfzxrmkec.exe
                                                                                                                    • Path C:\Temp\nhfzxrmkec.exe
                                                                                                                    • Size 381KB
                                                                                                                    • SHA256 f68f98321517d69990175aea19f34a6e84b64f9b7c16de1f72de38137e0c416e
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    pjhczusmke.exe
                                                                                                                    • Path C:\Temp\pjhczusmke.exe
                                                                                                                    • Size 381KB
                                                                                                                    • SHA256 d29e57ce1b47134bec0537de121e320481839c92e89f67690014807e8d937ad0
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    qkidxvpnhfaxsica.exe
                                                                                                                    • Path C:\Temp\qkidxvpnhfaxsica.exe
                                                                                                                    • Size 381KB
                                                                                                                    • SHA256 c7bdb7ee2a4b2eb90fb49289f8a61779df965992af337bf985070ef7dc0e7817
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    qkidxvpnhfaxsica.sys
                                                                                                                    • Path C:\Temp\qkidxvpnhfaxsica.sys
                                                                                                                    • Size 293KB
                                                                                                                    • SHA256 f8954b94da0ace4ebd4590541d7a78d80f6dca5fce4859f2f98ee9e7cb9ae536
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    trljebwuom.exe
                                                                                                                    • Path C:\Temp\trljebwuom.exe
                                                                                                                    • Size 381KB
                                                                                                                    • SHA256 21b91d789b87e95f9c0542e19111b7f084cffe520d8c0f90915564f2df008153
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    trljebwuom.sys
                                                                                                                    • Path C:\Temp\trljebwuom.sys
                                                                                                                    • Size 293KB
                                                                                                                    • SHA256 55fd75eefe69740614cac15013df695faa2f4be5feaedba47781f0b8a9561069
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    uomgeywrob.sys
                                                                                                                    • Path C:\Temp\uomgeywrob.sys
                                                                                                                    • Size 293KB
                                                                                                                    • SHA256 e17cc175a932e17728acc81d12924c2f70f3ee77d4fdd8bd3ab08542b6cf7c35
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    ywqoigbytq.exe
                                                                                                                    • Path C:\Temp\ywqoigbytq.exe
                                                                                                                    • Size 381KB
                                                                                                                    • SHA256 4982f262134540befacf2e26cdf839445549dc87459e93642613dd2e8e9ee3cd
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    ywqoigbytr.sys
                                                                                                                    • Path C:\Temp\ywqoigbytr.sys
                                                                                                                    • Size 293KB
                                                                                                                    • SHA256 e972dce06efec89727a2b96c13d0a8f16259f96dab56e86a31fb388a7ae0381e
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    settings.dat
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                    • Size 280B
                                                                                                                    • SHA256 1eac715bceeccb15cc45a13a9b914a80ac00eeb9f178f8c94511c17b32720b1a
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    settings.dat
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                    • Size 280B
                                                                                                                    • SHA256 2172811336537a33607e0aadb9c5ba8cadf28b2a4fcb84d32213c685b1c34544
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    BookmarkMergedSurfaceOrdering
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                    • Size 6B
                                                                                                                    • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                    Submit Download

                                                                                                                    BrowsingTopicsState
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
                                                                                                                    • Size 414B
                                                                                                                    • SHA256 52fcf2098975257aa0fc32a91276d9a02bd71bb02f50a5779142d256008ef087
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    SiteList-Enterprise.json
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                    • Size 2B
                                                                                                                    • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                    Submit Download

                                                                                                                    HubApps
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                                                                                                    • Size 106KB
                                                                                                                    • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    Network Persistent State
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                    • Size 1KB
                                                                                                                    • SHA256 6253e0a66dd45176732cef9ae2e323920e48464965024eac41ebacd3f870c015
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    SCT Auditing Pending Reports
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                    • Size 2B
                                                                                                                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                    Submit Download

                                                                                                                    Sdch Dictionaries
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                    • Size 40B
                                                                                                                    • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                    Submit Download

                                                                                                                    Preferences
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                    • Size 16KB
                                                                                                                    • SHA256 4e219a9daae939a3cd287363c139e316c47e985c7bef6b43e120e8a898a34db3
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    Preferences
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                    • Size 15KB
                                                                                                                    • SHA256 943890ec67d113326226cefa89a7c725a1743963cc71df718d88cec710e5565b
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    Secure Preferences
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                    • Size 36KB
                                                                                                                    • SHA256 e6bd97e979fb48bb9ba5f128c404c69e54681391fdc74096b954b84ff1c86fda
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    sync_diagnostic.log
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                    • Size 23KB
                                                                                                                    • SHA256 38a6816223f3349985afef67eceedd9c5e6cf306a0a77e5a4a4dff0e92163e53
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    CURRENT
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
                                                                                                                    • Size 16B
                                                                                                                    • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                    Submit Download

                                                                                                                    MANIFEST-000001
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
                                                                                                                    • Size 41B
                                                                                                                    • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                    Submit Download

                                                                                                                    Local State
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                    • Size 32KB
                                                                                                                    • SHA256 f6edf4d314a0655a670d32e1d42c726f51bd4b1e8c86584ff27ff273ddbf4f7b
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    Local State
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                    • Size 26KB
                                                                                                                    • SHA256 d7bbd1bf755d87e517c1487f8f805f9446994ed177230b5c5d8c361556a7db80
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    Local State
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                    • Size 26KB
                                                                                                                    • SHA256 32531512e326dc2738f29f51c6915d9742b9df19fdb05e7f6f2d8a6cfd7e3cab
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    Local State
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                    • Size 27KB
                                                                                                                    • SHA256 673ca78b051f648205d0b3dbb2cc90afffb3fae3fc5f52f6216a476b0e3cbc80
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    Local State
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                    • Size 27KB
                                                                                                                    • SHA256 d2c9336c97928b6642f71ebc2377e873d4fe9fcf5411e49faa8a4157a218c09e
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    Local State
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                    • Size 27KB
                                                                                                                    • SHA256 41870d879bcafb282de04b92f662cd1eda80f6f86c9626d1d1588b928a366e00
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    keys.json
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.3.23.1\keys.json
                                                                                                                    • Size 8KB
                                                                                                                    • SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                    Submit Download

                                                                                                                    metadata.json
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                    • Size 1KB
                                                                                                                    • SHA256 9bf1063dfbd2ecd64c68aecc36d61b41e81b7bcbffc887fead2f67353c88759b
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    metadata.json
                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                    • Size 1KB
                                                                                                                    • SHA256 dde0a44aac28ef6b41691d00cfc85b0180d0ea26ad6cbafed293ce5cace7d316
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    manifest.json
                                                                                                                    • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5100_729322489\manifest.json
                                                                                                                    • Size 79B
                                                                                                                    • SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                    Submit Download

                                                                                                                    memory/392-458-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/392-471-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/572-60-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/596-237-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1044-285-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1260-395-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1260-413-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1448-270-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1564-495-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1916-412-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/1932-326-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2420-200-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2936-507-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/2964-426-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3000-273-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3000-257-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3208-350-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/3736-225-0x00000299796D0000-0x0000029979E7E000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4164-446-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4628-519-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/4640-470-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5016-346-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5592-321-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                    Download

                                                                                                                    memory/5712-483-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                    Download