Overview

overview

10

Static

static

10

2026-05-31...op.exe

windows10-2004-x64

10

2026-05-31...op.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    133s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    31/05/2026, 11:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-31_08959bdf993225e50a9d18a82900b0b1_amadey_darkgate_elex_smoke-loader_stop.exe
  • Size 384KB
  • Sample260531-m856tsfs4v
  • SHA256 6ed7b9f2063f8effe7753084295f89c0352e717f4474a2a1b18090b7854502c3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarediscoverysystexspywaretrojan

Malware Config

Signatures

  • Family: Systex

    Systex is a trojan loader written in C++.

    trojansystex
  • Detects executables containing bas64 encoded gzip files 1 IoCs
  • Executes dropped EXE 64 IoCs
  • Drops file in Windows directory 18 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers network information 2 TTPs 20 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 29 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 20 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-31_08959bdf993225e50a9d18a82900b0b1_amadey_darkgate_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-31_08959bdf993225e50a9d18a82900b0b1_amadey_darkgate_elex_smoke-loader_stop.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5036
    • C:\Temp\cwupmhezxrpjhczu.exe
      C:\Temp\cwupmhezxrpjhczu.exe run
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3208
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\mkecwuohbu.exe ups_run
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4976
        • C:\Temp\mkecwuohbu.exe
          C:\Temp\mkecwuohbu.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2936
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:5648
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:5264
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_mkecwuohbu.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:2392
        • C:\Temp\i_mkecwuohbu.exe
          C:\Temp\i_mkecwuohbu.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:6092
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\rlgeywrojg.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:3048
        • C:\Temp\rlgeywrojg.exe
          C:\Temp\rlgeywrojg.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5720
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:5428
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:1376
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_rlgeywrojg.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:3836
        • C:\Temp\i_rlgeywrojg.exe
          C:\Temp\i_rlgeywrojg.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1072
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\omgeywrobz.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:4000
        • C:\Temp\omgeywrobz.exe
          C:\Temp\omgeywrobz.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4540
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:4620
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:4208
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_omgeywrobz.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:2880
        • C:\Temp\i_omgeywrobz.exe
          C:\Temp\i_omgeywrobz.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3444
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\dywqoigayt.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:1056
        • C:\Temp\dywqoigayt.exe
          C:\Temp\dywqoigayt.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5272
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:2624
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:2184
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_dywqoigayt.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:3556
        • C:\Temp\i_dywqoigayt.exe
          C:\Temp\i_dywqoigayt.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4896
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\vqnigaysqo.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:1832
        • C:\Temp\vqnigaysqo.exe
          C:\Temp\vqnigaysqo.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2072
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:4456
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:3308
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_vqnigaysqo.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:3616
        • C:\Temp\i_vqnigaysqo.exe
          C:\Temp\i_vqnigaysqo.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4648
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\nifaxvpnif.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:3080
        • C:\Temp\nifaxvpnif.exe
          C:\Temp\nifaxvpnif.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1264
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:3992
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:5396
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_nifaxvpnif.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:2388
        • C:\Temp\i_nifaxvpnif.exe
          C:\Temp\i_nifaxvpnif.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:784
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\nhfaysqkau.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:4676
        • C:\Temp\nhfaysqkau.exe
          C:\Temp\nhfaysqkau.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3816
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:484
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:1464
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_nhfaysqkau.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:456
        • C:\Temp\i_nhfaysqkau.exe
          C:\Temp\i_nhfaysqkau.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:5360
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\zxrpnhfzxs.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:5308
        • C:\Temp\zxrpnhfzxs.exe
          C:\Temp\zxrpnhfzxs.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5968
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:2740
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:132
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_zxrpnhfzxs.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:4228
        • C:\Temp\i_zxrpnhfzxs.exe
          C:\Temp\i_zxrpnhfzxs.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3396
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\xrpjhbzurm.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:1544
        • C:\Temp\xrpjhbzurm.exe
          C:\Temp\xrpjhbzurm.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3512
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:2404
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:3444
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_xrpjhbzurm.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:2100
        • C:\Temp\i_xrpjhbzurm.exe
          C:\Temp\i_xrpjhbzurm.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4284
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\jhbztrmjec.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:1820
        • C:\Temp\jhbztrmjec.exe
          C:\Temp\jhbztrmjec.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2432
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:5680
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:2468
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_jhbztrmjec.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:4772
        • C:\Temp\i_jhbztrmjec.exe
          C:\Temp\i_jhbztrmjec.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:5740
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\mgeywrojht.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:4660
        • C:\Temp\mgeywrojht.exe
          C:\Temp\mgeywrojht.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1320
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
              PID:5136
              • C:\windows\system32\ipconfig.exe
                C:\windows\system32\ipconfig.exe /release
                6⤵
                • Gathers network information
                PID:840
        • C:\temp\CreateProcess.exe
          C:\temp\CreateProcess.exe C:\Temp\i_mgeywrojht.exe ups_ins
          3⤵
            PID:476
            • C:\Temp\i_mgeywrojht.exe
              C:\Temp\i_mgeywrojht.exe ups_ins
              4⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:3908
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\Temp\bytrljdbvt.exe ups_run
            3⤵
              PID:3032
              • C:\Temp\bytrljdbvt.exe
                C:\Temp\bytrljdbvt.exe ups_run
                4⤵
                • System Location Discovery: System Language Discovery
                PID:1384
                • C:\temp\CreateProcess.exe
                  C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                  5⤵
                    PID:5196
                    • C:\windows\system32\ipconfig.exe
                      C:\windows\system32\ipconfig.exe /release
                      6⤵
                      • Gathers network information
                      PID:1300
              • C:\temp\CreateProcess.exe
                C:\temp\CreateProcess.exe C:\Temp\i_bytrljdbvt.exe ups_ins
                3⤵
                  PID:1900
                  • C:\Temp\i_bytrljdbvt.exe
                    C:\Temp\i_bytrljdbvt.exe ups_ins
                    4⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5396
                • C:\temp\CreateProcess.exe
                  C:\temp\CreateProcess.exe C:\Temp\tnigaytqli.exe ups_run
                  3⤵
                    PID:1284
                    • C:\Temp\tnigaytqli.exe
                      C:\Temp\tnigaytqli.exe ups_run
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:1528
                      • C:\temp\CreateProcess.exe
                        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                        5⤵
                          PID:3648
                          • C:\windows\system32\ipconfig.exe
                            C:\windows\system32\ipconfig.exe /release
                            6⤵
                            • Gathers network information
                            PID:6088
                    • C:\temp\CreateProcess.exe
                      C:\temp\CreateProcess.exe C:\Temp\i_tnigaytqli.exe ups_ins
                      3⤵
                        PID:2736
                        • C:\Temp\i_tnigaytqli.exe
                          C:\Temp\i_tnigaytqli.exe ups_ins
                          4⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2032
                      • C:\temp\CreateProcess.exe
                        C:\temp\CreateProcess.exe C:\Temp\kidavtnlfd.exe ups_run
                        3⤵
                          PID:460
                          • C:\Temp\kidavtnlfd.exe
                            C:\Temp\kidavtnlfd.exe ups_run
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:6048
                            • C:\temp\CreateProcess.exe
                              C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                              5⤵
                                PID:1328
                                • C:\windows\system32\ipconfig.exe
                                  C:\windows\system32\ipconfig.exe /release
                                  6⤵
                                  • Gathers network information
                                  PID:2420
                          • C:\temp\CreateProcess.exe
                            C:\temp\CreateProcess.exe C:\Temp\i_kidavtnlfd.exe ups_ins
                            3⤵
                              PID:2256
                              • C:\Temp\i_kidavtnlfd.exe
                                C:\Temp\i_kidavtnlfd.exe ups_ins
                                4⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4064
                            • C:\temp\CreateProcess.exe
                              C:\temp\CreateProcess.exe C:\Temp\qkidavsnkf.exe ups_run
                              3⤵
                                PID:3368
                                • C:\Temp\qkidavsnkf.exe
                                  C:\Temp\qkidavsnkf.exe ups_run
                                  4⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:5392
                                  • C:\temp\CreateProcess.exe
                                    C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                    5⤵
                                      PID:2192
                                      • C:\windows\system32\ipconfig.exe
                                        C:\windows\system32\ipconfig.exe /release
                                        6⤵
                                        • Gathers network information
                                        PID:384
                                • C:\temp\CreateProcess.exe
                                  C:\temp\CreateProcess.exe C:\Temp\i_qkidavsnkf.exe ups_ins
                                  3⤵
                                    PID:5152
                                    • C:\Temp\i_qkidavsnkf.exe
                                      C:\Temp\i_qkidavsnkf.exe ups_ins
                                      4⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1676
                                  • C:\temp\CreateProcess.exe
                                    C:\temp\CreateProcess.exe C:\Temp\hfzxspkica.exe ups_run
                                    3⤵
                                      PID:5208
                                      • C:\Temp\hfzxspkica.exe
                                        C:\Temp\hfzxspkica.exe ups_run
                                        4⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:652
                                        • C:\temp\CreateProcess.exe
                                          C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                          5⤵
                                            PID:2512
                                            • C:\windows\system32\ipconfig.exe
                                              C:\windows\system32\ipconfig.exe /release
                                              6⤵
                                              • Gathers network information
                                              PID:3524
                                      • C:\temp\CreateProcess.exe
                                        C:\temp\CreateProcess.exe C:\Temp\i_hfzxspkica.exe ups_ins
                                        3⤵
                                          PID:1692
                                          • C:\Temp\i_hfzxspkica.exe
                                            C:\Temp\i_hfzxspkica.exe ups_ins
                                            4⤵
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:2424
                                        • C:\temp\CreateProcess.exe
                                          C:\temp\CreateProcess.exe C:\Temp\zurmkfcxup.exe ups_run
                                          3⤵
                                            PID:6104
                                            • C:\Temp\zurmkfcxup.exe
                                              C:\Temp\zurmkfcxup.exe ups_run
                                              4⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:2168
                                              • C:\temp\CreateProcess.exe
                                                C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                5⤵
                                                  PID:784
                                                  • C:\windows\system32\ipconfig.exe
                                                    C:\windows\system32\ipconfig.exe /release
                                                    6⤵
                                                    • Gathers network information
                                                    PID:3828
                                            • C:\temp\CreateProcess.exe
                                              C:\temp\CreateProcess.exe C:\Temp\i_zurmkfcxup.exe ups_ins
                                              3⤵
                                                PID:6140
                                                • C:\Temp\i_zurmkfcxup.exe
                                                  C:\Temp\i_zurmkfcxup.exe ups_ins
                                                  4⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:4696
                                              • C:\temp\CreateProcess.exe
                                                C:\temp\CreateProcess.exe C:\Temp\pjhbzurmje.exe ups_run
                                                3⤵
                                                  PID:2268
                                                  • C:\Temp\pjhbzurmje.exe
                                                    C:\Temp\pjhbzurmje.exe ups_run
                                                    4⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:336
                                                    • C:\temp\CreateProcess.exe
                                                      C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                      5⤵
                                                        PID:5312
                                                        • C:\windows\system32\ipconfig.exe
                                                          C:\windows\system32\ipconfig.exe /release
                                                          6⤵
                                                          • Gathers network information
                                                          PID:1388
                                                  • C:\temp\CreateProcess.exe
                                                    C:\temp\CreateProcess.exe C:\Temp\i_pjhbzurmje.exe ups_ins
                                                    3⤵
                                                      PID:5380
                                                      • C:\Temp\i_pjhbzurmje.exe
                                                        C:\Temp\i_pjhbzurmje.exe ups_ins
                                                        4⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:5672
                                                    • C:\temp\CreateProcess.exe
                                                      C:\temp\CreateProcess.exe C:\Temp\omgezwrpjh.exe ups_run
                                                      3⤵
                                                        PID:3896
                                                        • C:\Temp\omgezwrpjh.exe
                                                          C:\Temp\omgezwrpjh.exe ups_run
                                                          4⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:3140
                                                          • C:\temp\CreateProcess.exe
                                                            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                            5⤵
                                                              PID:3444
                                                              • C:\windows\system32\ipconfig.exe
                                                                C:\windows\system32\ipconfig.exe /release
                                                                6⤵
                                                                • Gathers network information
                                                                PID:6096
                                                        • C:\temp\CreateProcess.exe
                                                          C:\temp\CreateProcess.exe C:\Temp\i_omgezwrpjh.exe ups_ins
                                                          3⤵
                                                            PID:3336
                                                            • C:\Temp\i_omgezwrpjh.exe
                                                              C:\Temp\i_omgezwrpjh.exe ups_ins
                                                              4⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:5280
                                                          • C:\temp\CreateProcess.exe
                                                            C:\temp\CreateProcess.exe C:\Temp\rljebwromg.exe ups_run
                                                            3⤵
                                                              PID:1936
                                                              • C:\Temp\rljebwromg.exe
                                                                C:\Temp\rljebwromg.exe ups_run
                                                                4⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:2924
                                                                • C:\temp\CreateProcess.exe
                                                                  C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                                  5⤵
                                                                    PID:384
                                                                    • C:\windows\system32\ipconfig.exe
                                                                      C:\windows\system32\ipconfig.exe /release
                                                                      6⤵
                                                                      • Gathers network information
                                                                      PID:3880
                                                            • C:\Program Files\Internet Explorer\iexplore.exe
                                                              "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
                                                              2⤵
                                                              • Modifies Internet Explorer settings
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:5696
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
                                                                3⤵
                                                                • Drops file in Windows directory
                                                                • Enumerates system info in registry
                                                                • Modifies data under HKEY_USERS
                                                                • Modifies registry class
                                                                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                • Suspicious use of FindShellTrayWindow
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5256
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7ff97512c188,0x7ff97512c194,0x7ff97512c1a0
                                                                  4⤵
                                                                    PID:4936
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,8830803170425047668,9026912662133245601,524288 --field-trial-handle=2392,i,4594285820424639664,12657220124802041511,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:11
                                                                    4⤵
                                                                    • System Time Discovery
                                                                    PID:4032
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1608,i,4466474324250349691,13082740488821484745,262144 --field-trial-handle=2392,i,4594285820424639664,12657220124802041511,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:2
                                                                    4⤵
                                                                      PID:2944
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,6957817807362272972,163787095191655325,524288 --field-trial-handle=2392,i,4594285820424639664,12657220124802041511,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:13
                                                                      4⤵
                                                                        PID:3376
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,16798846003588914482,4763361399473234480,2097152 --field-trial-handle=2392,i,4594285820424639664,12657220124802041511,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
                                                                        4⤵
                                                                          PID:5644
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,17019908728662433593,3084771932062399005,2097152 --field-trial-handle=2392,i,4594285820424639664,12657220124802041511,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
                                                                          4⤵
                                                                            PID:3276
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4856,i,13442893699784531813,4700395177740677147,524288 --field-trial-handle=2392,i,4594285820424639664,12657220124802041511,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14
                                                                            4⤵
                                                                              PID:4428
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,17777193943111463949,10483702679609493265,524288 --field-trial-handle=2392,i,4594285820424639664,12657220124802041511,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
                                                                              4⤵
                                                                                PID:4532
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,8857195172550969356,8460690181245318610,524288 --field-trial-handle=2392,i,4594285820424639664,12657220124802041511,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:14
                                                                                4⤵
                                                                                  PID:5668
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,8857195172550969356,8460690181245318610,524288 --field-trial-handle=2392,i,4594285820424639664,12657220124802041511,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:14
                                                                                  4⤵
                                                                                    PID:2484
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,6510398377026709974,4293795103826929943,524288 --field-trial-handle=2392,i,4594285820424639664,12657220124802041511,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
                                                                                    4⤵
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:5928
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                                                                                      cookie_exporter.exe --cookie-json=1108
                                                                                      5⤵
                                                                                        PID:4660
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,12118887896024810408,2326815233338795613,524288 --field-trial-handle=2392,i,4594285820424639664,12657220124802041511,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14
                                                                                      4⤵
                                                                                        PID:2468
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,9676774769733115896,17751870122253175868,524288 --field-trial-handle=2392,i,4594285820424639664,12657220124802041511,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
                                                                                        4⤵
                                                                                          PID:5800
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,235361755090726311,8387464456553341620,524288 --field-trial-handle=2392,i,4594285820424639664,12657220124802041511,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
                                                                                          4⤵
                                                                                            PID:2196
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,16851650738149610606,18398172803249627120,524288 --field-trial-handle=2392,i,4594285820424639664,12657220124802041511,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
                                                                                            4⤵
                                                                                              PID:4748
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,1132711715436339008,6091709008438563113,524288 --field-trial-handle=2392,i,4594285820424639664,12657220124802041511,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
                                                                                              4⤵
                                                                                                PID:548
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,2299858559805265893,11549408999467767764,524288 --field-trial-handle=2392,i,4594285820424639664,12657220124802041511,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:14
                                                                                                4⤵
                                                                                                  PID:232
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5136,i,4654683145859786438,7411318180676070190,262144 --field-trial-handle=2392,i,4594285820424639664,12657220124802041511,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:10
                                                                                                  4⤵
                                                                                                    PID:3892
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,7324851161472350700,11265886200277797390,524288 --field-trial-handle=2392,i,4594285820424639664,12657220124802041511,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:14
                                                                                                    4⤵
                                                                                                      PID:4764
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                1⤵
                                                                                                  PID:4056
                                                                                                • C:\Temp\cwupmhezxrpjhczu.sys
                                                                                                  C:\Temp\cwupmhezxrpjhczu.sys
                                                                                                  1⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:5800
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                  1⤵
                                                                                                    PID:532
                                                                                                  • C:\Temp\mhbzurmgez.sys
                                                                                                    C:\Temp\mhbzurmgez.sys
                                                                                                    1⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:4988
                                                                                                  • C:\Temp\bwtomgeywq.sys
                                                                                                    C:\Temp\bwtomgeywq.sys
                                                                                                    1⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:2868
                                                                                                  • C:\Temp\olgeywrljg.sys
                                                                                                    C:\Temp\olgeywrljg.sys
                                                                                                    1⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:2420
                                                                                                  • C:\Temp\dbvtqlidbv.sys
                                                                                                    C:\Temp\dbvtqlidbv.sys
                                                                                                    1⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:5104
                                                                                                  • C:\Temp\fdxvqnigay.sys
                                                                                                    C:\Temp\fdxvqnigay.sys
                                                                                                    1⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:3640
                                                                                                  • C:\Temp\avsnkidxsq.sys
                                                                                                    C:\Temp\avsnkidxsq.sys
                                                                                                    1⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:5960
                                                                                                  • C:\Temp\nhfzxrpkhc.sys
                                                                                                    C:\Temp\nhfzxrpkhc.sys
                                                                                                    1⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:5352
                                                                                                  • C:\Temp\ecwupmhfzx.sys
                                                                                                    C:\Temp\ecwupmhfzx.sys
                                                                                                    1⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:3708
                                                                                                  • C:\Temp\fzxrpjhcwu.sys
                                                                                                    C:\Temp\fzxrpjhcwu.sys
                                                                                                    1⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:1932
                                                                                                  • C:\Temp\wrpjhbztrm.sys
                                                                                                    C:\Temp\wrpjhbztrm.sys
                                                                                                    1⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:3120
                                                                                                  • C:\Temp\lgeywqojgb.sys
                                                                                                    C:\Temp\lgeywqojgb.sys
                                                                                                    1⤵
                                                                                                      PID:1060
                                                                                                    • C:\Temp\dbvtnlgdyw.sys
                                                                                                      C:\Temp\dbvtnlgdyw.sys
                                                                                                      1⤵
                                                                                                        PID:1696
                                                                                                      • C:\Temp\gaytqljdbv.sys
                                                                                                        C:\Temp\gaytqljdbv.sys
                                                                                                        1⤵
                                                                                                          PID:5380
                                                                                                        • C:\Temp\xvpnifavsn.sys
                                                                                                          C:\Temp\xvpnifavsn.sys
                                                                                                          1⤵
                                                                                                            PID:1932
                                                                                                          • C:\Temp\sqkicausnk.sys
                                                                                                            C:\Temp\sqkicausnk.sys
                                                                                                            1⤵
                                                                                                              PID:2456
                                                                                                            • C:\Temp\kecxupnhfc.sys
                                                                                                              C:\Temp\kecxupnhfc.sys
                                                                                                              1⤵
                                                                                                                PID:2972
                                                                                                              • C:\Temp\hfzurmkecw.sys
                                                                                                                C:\Temp\hfzurmkecw.sys
                                                                                                                1⤵
                                                                                                                  PID:712
                                                                                                                • C:\Temp\zuomhezwrp.sys
                                                                                                                  C:\Temp\zuomhezwrp.sys
                                                                                                                  1⤵
                                                                                                                    PID:440
                                                                                                                  • C:\Temp\ztrljgbwuo.sys
                                                                                                                    C:\Temp\ztrljgbwuo.sys
                                                                                                                    1⤵
                                                                                                                      PID:5956

                                                                                                                    Network

                                                                                                                          MITRE ATT&CK Enterprise v16

                                                                                                                          Replay Monitor

                                                                                                                          Loading Replay Monitor...

                                                                                                                          Downloads

                                                                                                                          avsnkidxsq.sys
                                                                                                                          • Path C:\Temp\avsnkidxsq.sys
                                                                                                                          • Size 293KB
                                                                                                                          • SHA256 b369c181438b6780d96f32f5d70ebacbea4305b891267057c9d605c8cc6d08bd
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          bwtomgeywq.sys
                                                                                                                          • Path C:\Temp\bwtomgeywq.sys
                                                                                                                          • Size 293KB
                                                                                                                          • SHA256 3b75fca10382be33da4cfefe86dac0328de03bc5dd3569bbdf35597cf8ade63c
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          cwupmhezxrpjhczu.exe
                                                                                                                          • Path C:\Temp\cwupmhezxrpjhczu.exe
                                                                                                                          • Size 384KB
                                                                                                                          • SHA256 f0e1666641a13fa447ee911369a5873bd64e364bc8444c6ae8aba4b67dcaa8c8
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          cwupmhezxrpjhczu.sys
                                                                                                                          • Path C:\Temp\cwupmhezxrpjhczu.sys
                                                                                                                          • Size 293KB
                                                                                                                          • SHA256 bbc8251ed358f4bab28e36e2e3846b6ad42aef886812ccf5acdfa4522fc2645c
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          dbvtqlidbv.sys
                                                                                                                          • Path C:\Temp\dbvtqlidbv.sys
                                                                                                                          • Size 293KB
                                                                                                                          • SHA256 a151bf5726d40e51e18f60f3b64bb20d86cb4b056bc8436bbb47227856477237
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          dywqoigayt.exe
                                                                                                                          • Path C:\Temp\dywqoigayt.exe
                                                                                                                          • Size 384KB
                                                                                                                          • SHA256 3911c3b576c8fd8b6b494b326bf80fc5db4caf86a5c501ffa7f84b6a1ce5b887
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          fdxvqnigay.sys
                                                                                                                          • Path C:\Temp\fdxvqnigay.sys
                                                                                                                          • Size 293KB
                                                                                                                          • SHA256 e62a940473631fc515c06c719b4712065eb4258ef0ffa939e969a3076d0068a1
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          i_dywqoigayt.exe
                                                                                                                          • Path C:\Temp\i_dywqoigayt.exe
                                                                                                                          • Size 384KB
                                                                                                                          • SHA256 1463c7d0efbb8d3c5ab2e503ad3cbcdefbd9808324dc2445e62c32ed930f84d0
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          i_mkecwuohbu.exe
                                                                                                                          • Path C:\Temp\i_mkecwuohbu.exe
                                                                                                                          • Size 384KB
                                                                                                                          • SHA256 7f12bc42d5db1afb5f36d8bd94124186d6aa7971cf6b27412335ce1c3547a703
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          i_nifaxvpnif.exe
                                                                                                                          • Path C:\Temp\i_nifaxvpnif.exe
                                                                                                                          • Size 384KB
                                                                                                                          • SHA256 033c84da28c60d3587a7682be932c2e50a45ca7afb947d9a2f3be4c795c1f79e
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          i_omgeywrobz.exe
                                                                                                                          • Path C:\Temp\i_omgeywrobz.exe
                                                                                                                          • Size 384KB
                                                                                                                          • SHA256 b5f00da265eb550003a55afc2ab07fc6485a118f4e5d7a917b8ef5f101b7a70d
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          i_rlgeywrojg.exe
                                                                                                                          • Path C:\Temp\i_rlgeywrojg.exe
                                                                                                                          • Size 384KB
                                                                                                                          • SHA256 2f4caa53e44203e6362f1dd2f8d161a3c018cfb3032101c29f2bbc9e1579b97a
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          i_vqnigaysqo.exe
                                                                                                                          • Path C:\Temp\i_vqnigaysqo.exe
                                                                                                                          • Size 384KB
                                                                                                                          • SHA256 66803b97cc146b1cb2c9605ccf07ba18ab9bd1e71ef5e72840ff91fbb4277f52
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          mhbzurmgez.sys
                                                                                                                          • Path C:\Temp\mhbzurmgez.sys
                                                                                                                          • Size 293KB
                                                                                                                          • SHA256 5beadeebfe51312d3bfe64c618bc9b90588f05c855298d7032288dd7d615eff7
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          mkecwuohbu.exe
                                                                                                                          • Path C:\Temp\mkecwuohbu.exe
                                                                                                                          • Size 384KB
                                                                                                                          • SHA256 9155e6a6b7ab0c83fb6861f2dcf8ae3321dafd23547f7773e3dcfa647fe9d733
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          nifaxvpnif.exe
                                                                                                                          • Path C:\Temp\nifaxvpnif.exe
                                                                                                                          • Size 384KB
                                                                                                                          • SHA256 deeed2697b06cc33fe4e346565c050b37607698c2d40c4d34cc696440e3c3b06
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          olgeywrljg.sys
                                                                                                                          • Path C:\Temp\olgeywrljg.sys
                                                                                                                          • Size 293KB
                                                                                                                          • SHA256 85378c6bba0a7b43e71b839cfa85540b75de6fca9ffb5c96b48ed5133216aa6d
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          omgeywrobz.exe
                                                                                                                          • Path C:\Temp\omgeywrobz.exe
                                                                                                                          • Size 384KB
                                                                                                                          • SHA256 741da4ff86476cc60fa12a86eed8f90fb73945b60afb1f02726af29a996448b6
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          rlgeywrojg.exe
                                                                                                                          • Path C:\Temp\rlgeywrojg.exe
                                                                                                                          • Size 384KB
                                                                                                                          • SHA256 039c33228e710b988b05021f17ac66503d3a817c69fa87712bed972f4814c9e4
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          vqnigaysqo.exe
                                                                                                                          • Path C:\Temp\vqnigaysqo.exe
                                                                                                                          • Size 384KB
                                                                                                                          • SHA256 10ab9ee5afc2c8093f8ac0777f8d0dcbc2e2aeffa673e7476b2391800bf1a73c
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          settings.dat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                          • Size 280B
                                                                                                                          • SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          settings.dat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                          • Size 280B
                                                                                                                          • SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          449027a4-51f5-4fa6-9038-dc74614e00a9.tmp
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\449027a4-51f5-4fa6-9038-dc74614e00a9.tmp
                                                                                                                          • Size 6B
                                                                                                                          • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          BrowsingTopicsState
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
                                                                                                                          • Size 649B
                                                                                                                          • SHA256 e0f086f5505e8d7cfea53de4092b14bdbbd0c33c0818689e55fd2beaad5df08c
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          SiteList-Enterprise.json
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                          • Size 2B
                                                                                                                          • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          HubApps
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                                                                                                          • Size 106KB
                                                                                                                          • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          Network Persistent State
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                          • Size 2KB
                                                                                                                          • SHA256 f1f4b81ae508ce0c02c26b6420aecfa264f065f3af56eb2f29ec6581af82d5af
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          SCT Auditing Pending Reports
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                          • Size 2B
                                                                                                                          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          Sdch Dictionaries
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                          • Size 40B
                                                                                                                          • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          Preferences
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                          • Size 15KB
                                                                                                                          • SHA256 e93f62548a926377493cd9616cee57568996a10390a91a1ca569ae53772a1ad9
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          Preferences
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                          • Size 15KB
                                                                                                                          • SHA256 b16243ba46cdce0a31cdbc31a1988bc22ce5c1de4813ab5dad4f996ff02ae33b
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          Secure Preferences
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                          • Size 36KB
                                                                                                                          • SHA256 c4387ad64101dfaf679f4900b772abd690f868acdffec65c70aa83783ec3f915
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          sync_diagnostic.log
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                          • Size 23KB
                                                                                                                          • SHA256 6b60dccbacdf62eaeb5e59e36659053dfc85bac8b9e9c995bf384334863b25ef
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          Local State
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                          • Size 33KB
                                                                                                                          • SHA256 753b204397479dfaf6b92ed50ea3d74bb5630bdc10930d6356495fcdb2f4dbb7
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          Local State
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                          • Size 25KB
                                                                                                                          • SHA256 053f9a447afc101a2a307940a4133e1a9791d18b61f50af9f254666d8da14595
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          Local State
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                          • Size 28KB
                                                                                                                          • SHA256 3ed9e29dc6da367a07f2bc8df25ba3412457c67abd16bcacf38158912a434b4f
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          Local State
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                          • Size 28KB
                                                                                                                          • SHA256 f2d7a433995e4a5514f89455cf6f3ba16ef559ac4f46b49fe08d9dfec1492dcb
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          Filtering Rules
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.84\Filtering Rules
                                                                                                                          • Size 2.1MB
                                                                                                                          • SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          LICENSE
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.84\LICENSE
                                                                                                                          • Size 24KB
                                                                                                                          • SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          typosquatting_list.pb
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.28.1\typosquatting_list.pb
                                                                                                                          • Size 507KB
                                                                                                                          • SHA256 b34c96309ee41ff6d06dea8e605991b9b8c4d67fb4885cde883350c3b5ad674d
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          metadata.json
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                          • Size 2KB
                                                                                                                          • SHA256 f66390cc10588252875863b34374f88c9659c9a497e06dbb89d8be91e55d629a
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          metadata.json
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                          • Size 2KB
                                                                                                                          • SHA256 207da53588d43687ff2984d79c7f0a7b4769e1e063d727289920f2303e0eb60a
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          metadata.json
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                          • Size 2KB
                                                                                                                          • SHA256 3db5016446020d36f4ce7128b88735d564d921e4831965ecf32ebd28b38b9929
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          data.txt
                                                                                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5256_1265413380\data.txt
                                                                                                                          • Size 146KB
                                                                                                                          • SHA256 bcf1a17189b6ae7371429804a2df2ba36c798b142dbc4f7f06a7332834405408
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          manifest.json
                                                                                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5256_1265413380\manifest.json
                                                                                                                          • Size 52B
                                                                                                                          • SHA256 5a708ec5a10762801001cca55997ce9813d9c312a009b3c4fa197426c752fe90
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          manifest.json
                                                                                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5256_1363598850\manifest.json
                                                                                                                          • Size 118B
                                                                                                                          • SHA256 1b90c1e9cbd34978ee21dae135f1ea9f51599d19014f9219cd47d730fd914f55
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          manifest.json
                                                                                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5256_316501302\manifest.json
                                                                                                                          • Size 116B
                                                                                                                          • SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          CreateProcess.exe
                                                                                                                          • Path C:\temp\CreateProcess.exe
                                                                                                                          • Size 3KB
                                                                                                                          • SHA256 261763949bef8d15573d4e722435e2bc8bda32f42abb7fca71f75857813fd15e
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          memory/440-560-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/712-540-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1060-408-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1060-379-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1696-398-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1696-430-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1932-339-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1932-434-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1932-455-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2420-228-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2456-454-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2868-207-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/2972-468-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3120-380-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3120-356-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3640-302-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3640-273-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/3708-327-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4988-172-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4988-208-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5104-249-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5352-315-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5380-421-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5800-66-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5956-572-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/5960-301-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                          Download