Overview

overview

10

Static

static

10

2026-08-01...op.exe

windows10-2004-x64

10

2026-08-01...op.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/08/2026, 02:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-01_a46c1e7440bde842816a95fe38702864_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
  • Size 365KB
  • Sample260801-dcb4fadk3s
  • SHA256 055943873a0d59c8a0dda4f326ce359903f7e1f6cc8bfd303a4bd665f2c8ea6b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarediscoverysystexspywaretrojan

Malware Config

Signatures

  • Family: Systex

    Systex is a trojan loader written in C++.

    trojansystex
  • Executes dropped EXE 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers network information 2 TTPs 20 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 20 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_a46c1e7440bde842816a95fe38702864_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-01_a46c1e7440bde842816a95fe38702864_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:6856
    • C:\Temp\ztrpjgbztrljheuo.exe
      C:\Temp\ztrpjgbztrljheuo.exe run
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:6628
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\ztrojgbwtl.exe ups_run
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:6396
        • C:\Temp\ztrojgbwtl.exe
          C:\Temp\ztrojgbwtl.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:120
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:3300
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:5656
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_ztrojgbwtl.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:2136
        • C:\Temp\i_ztrojgbwtl.exe
          C:\Temp\i_ztrojgbwtl.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:5636
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\gdywqoigby.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:3664
        • C:\Temp\gdywqoigby.exe
          C:\Temp\gdywqoigby.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2404
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:4552
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:2580
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_gdywqoigby.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:1872
        • C:\Temp\i_gdywqoigby.exe
          C:\Temp\i_gdywqoigby.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:5952
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\gaysqoigav.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:3996
        • C:\Temp\gaysqoigav.exe
          C:\Temp\gaysqoigav.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1320
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:6104
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:4904
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_gaysqoigav.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:968
        • C:\Temp\i_gaysqoigav.exe
          C:\Temp\i_gaysqoigav.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:6080
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\tqkifdxvqn.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:2748
        • C:\Temp\tqkifdxvqn.exe
          C:\Temp\tqkifdxvqn.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4128
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:7112
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:1044
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_tqkifdxvqn.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:1180
        • C:\Temp\i_tqkifdxvqn.exe
          C:\Temp\i_tqkifdxvqn.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:5492
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\icaxspkica.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:5432
        • C:\Temp\icaxspkica.exe
          C:\Temp\icaxspkica.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4784
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:6152
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:3296
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_icaxspkica.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:6228
        • C:\Temp\i_icaxspkica.exe
          C:\Temp\i_icaxspkica.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2464
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\kicxvpnhfz.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:4928
        • C:\Temp\kicxvpnhfz.exe
          C:\Temp\kicxvpnhfz.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5728
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:1364
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:5812
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_kicxvpnhfz.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:6080
        • C:\Temp\i_kicxvpnhfz.exe
          C:\Temp\i_kicxvpnhfz.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1408
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\fzxrpjhczu.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:3248
        • C:\Temp\fzxrpjhczu.exe
          C:\Temp\fzxrpjhczu.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5068
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:4604
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:6088
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_fzxrpjhczu.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:3088
        • C:\Temp\i_fzxrpjhczu.exe
          C:\Temp\i_fzxrpjhczu.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:7128
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\zwurmjecwu.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:4836
        • C:\Temp\zwurmjecwu.exe
          C:\Temp\zwurmjecwu.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:264
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:6540
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:1268
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_zwurmjecwu.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:4716
        • C:\Temp\i_zwurmjecwu.exe
          C:\Temp\i_zwurmjecwu.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:5960
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\uomgebwuom.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:240
        • C:\Temp\uomgebwuom.exe
          C:\Temp\uomgebwuom.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:6620
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:4412
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:5492
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_uomgebwuom.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:3672
        • C:\Temp\i_uomgebwuom.exe
          C:\Temp\i_uomgebwuom.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:6872
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\qojgeywqoj.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:7048
        • C:\Temp\qojgeywqoj.exe
          C:\Temp\qojgeywqoj.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:6992
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:3884
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:4132
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_qojgeywqoj.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:6860
        • C:\Temp\i_qojgeywqoj.exe
          C:\Temp\i_qojgeywqoj.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:6364
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\daytqljdbv.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:3304
        • C:\Temp\daytqljdbv.exe
          C:\Temp\daytqljdbv.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1620
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
              PID:1356
              • C:\windows\system32\ipconfig.exe
                C:\windows\system32\ipconfig.exe /release
                6⤵
                • Gathers network information
                PID:3344
        • C:\temp\CreateProcess.exe
          C:\temp\CreateProcess.exe C:\Temp\i_daytqljdbv.exe ups_ins
          3⤵
            PID:1760
            • C:\Temp\i_daytqljdbv.exe
              C:\Temp\i_daytqljdbv.exe ups_ins
              4⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:3964
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\Temp\idbvtnlfdy.exe ups_run
            3⤵
              PID:2464
              • C:\Temp\idbvtnlfdy.exe
                C:\Temp\idbvtnlfdy.exe ups_run
                4⤵
                • System Location Discovery: System Language Discovery
                PID:6556
                • C:\temp\CreateProcess.exe
                  C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                  5⤵
                    PID:2576
                    • C:\windows\system32\ipconfig.exe
                      C:\windows\system32\ipconfig.exe /release
                      6⤵
                      • Gathers network information
                      PID:5952
              • C:\temp\CreateProcess.exe
                C:\temp\CreateProcess.exe C:\Temp\i_idbvtnlfdy.exe ups_ins
                3⤵
                  PID:2684
                  • C:\Temp\i_idbvtnlfdy.exe
                    C:\Temp\i_idbvtnlfdy.exe ups_ins
                    4⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2364
                • C:\temp\CreateProcess.exe
                  C:\temp\CreateProcess.exe C:\Temp\xvpnifaysq.exe ups_run
                  3⤵
                    PID:5680
                    • C:\Temp\xvpnifaysq.exe
                      C:\Temp\xvpnifaysq.exe ups_run
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:4524
                      • C:\temp\CreateProcess.exe
                        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                        5⤵
                          PID:3176
                          • C:\windows\system32\ipconfig.exe
                            C:\windows\system32\ipconfig.exe /release
                            6⤵
                            • Gathers network information
                            PID:6184
                    • C:\temp\CreateProcess.exe
                      C:\temp\CreateProcess.exe C:\Temp\i_xvpnifaysq.exe ups_ins
                      3⤵
                        PID:1856
                        • C:\Temp\i_xvpnifaysq.exe
                          C:\Temp\i_xvpnifaysq.exe ups_ins
                          4⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1788
                      • C:\temp\CreateProcess.exe
                        C:\temp\CreateProcess.exe C:\Temp\axvpnicaus.exe ups_run
                        3⤵
                          PID:2856
                          • C:\Temp\axvpnicaus.exe
                            C:\Temp\axvpnicaus.exe ups_run
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:1044
                            • C:\temp\CreateProcess.exe
                              C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                              5⤵
                                PID:1248
                                • C:\windows\system32\ipconfig.exe
                                  C:\windows\system32\ipconfig.exe /release
                                  6⤵
                                  • Gathers network information
                                  PID:5932
                          • C:\temp\CreateProcess.exe
                            C:\temp\CreateProcess.exe C:\Temp\i_axvpnicaus.exe ups_ins
                            3⤵
                              PID:6040
                              • C:\Temp\i_axvpnicaus.exe
                                C:\Temp\i_axvpnicaus.exe ups_ins
                                4⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4344
                            • C:\temp\CreateProcess.exe
                              C:\temp\CreateProcess.exe C:\Temp\ausmkhcxup.exe ups_run
                              3⤵
                                PID:6924
                                • C:\Temp\ausmkhcxup.exe
                                  C:\Temp\ausmkhcxup.exe ups_run
                                  4⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:6084
                                  • C:\temp\CreateProcess.exe
                                    C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                    5⤵
                                      PID:3772
                                      • C:\windows\system32\ipconfig.exe
                                        C:\windows\system32\ipconfig.exe /release
                                        6⤵
                                        • Gathers network information
                                        PID:6920
                                • C:\temp\CreateProcess.exe
                                  C:\temp\CreateProcess.exe C:\Temp\i_ausmkhcxup.exe ups_ins
                                  3⤵
                                    PID:2944
                                    • C:\Temp\i_ausmkhcxup.exe
                                      C:\Temp\i_ausmkhcxup.exe ups_ins
                                      4⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:5364
                                  • C:\temp\CreateProcess.exe
                                    C:\temp\CreateProcess.exe C:\Temp\ezxrpjhbzu.exe ups_run
                                    3⤵
                                      PID:7088
                                      • C:\Temp\ezxrpjhbzu.exe
                                        C:\Temp\ezxrpjhbzu.exe ups_run
                                        4⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:5192
                                        • C:\temp\CreateProcess.exe
                                          C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                          5⤵
                                            PID:2708
                                            • C:\windows\system32\ipconfig.exe
                                              C:\windows\system32\ipconfig.exe /release
                                              6⤵
                                              • Gathers network information
                                              PID:2532
                                      • C:\temp\CreateProcess.exe
                                        C:\temp\CreateProcess.exe C:\Temp\i_ezxrpjhbzu.exe ups_ins
                                        3⤵
                                          PID:2520
                                          • C:\Temp\i_ezxrpjhbzu.exe
                                            C:\Temp\i_ezxrpjhbzu.exe ups_ins
                                            4⤵
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:1096
                                        • C:\temp\CreateProcess.exe
                                          C:\temp\CreateProcess.exe C:\Temp\wrojhbzwrp.exe ups_run
                                          3⤵
                                            PID:2004
                                            • C:\Temp\wrojhbzwrp.exe
                                              C:\Temp\wrojhbzwrp.exe ups_run
                                              4⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:2488
                                              • C:\temp\CreateProcess.exe
                                                C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                5⤵
                                                  PID:2976
                                                  • C:\windows\system32\ipconfig.exe
                                                    C:\windows\system32\ipconfig.exe /release
                                                    6⤵
                                                    • Gathers network information
                                                    PID:3120
                                            • C:\temp\CreateProcess.exe
                                              C:\temp\CreateProcess.exe C:\Temp\i_wrojhbzwrp.exe ups_ins
                                              3⤵
                                                PID:7152
                                                • C:\Temp\i_wrojhbzwrp.exe
                                                  C:\Temp\i_wrojhbzwrp.exe ups_ins
                                                  4⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:2120
                                              • C:\temp\CreateProcess.exe
                                                C:\temp\CreateProcess.exe C:\Temp\ywurljgbzt.exe ups_run
                                                3⤵
                                                  PID:6212
                                                  • C:\Temp\ywurljgbzt.exe
                                                    C:\Temp\ywurljgbzt.exe ups_run
                                                    4⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:3888
                                                    • C:\temp\CreateProcess.exe
                                                      C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                      5⤵
                                                        PID:5420
                                                        • C:\windows\system32\ipconfig.exe
                                                          C:\windows\system32\ipconfig.exe /release
                                                          6⤵
                                                          • Gathers network information
                                                          PID:1252
                                                  • C:\temp\CreateProcess.exe
                                                    C:\temp\CreateProcess.exe C:\Temp\i_ywurljgbzt.exe ups_ins
                                                    3⤵
                                                      PID:6868
                                                      • C:\Temp\i_ywurljgbzt.exe
                                                        C:\Temp\i_ywurljgbzt.exe ups_ins
                                                        4⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:4424
                                                    • C:\temp\CreateProcess.exe
                                                      C:\temp\CreateProcess.exe C:\Temp\dbztrljdbv.exe ups_run
                                                      3⤵
                                                        PID:5952
                                                        • C:\Temp\dbztrljdbv.exe
                                                          C:\Temp\dbztrljdbv.exe ups_run
                                                          4⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:1348
                                                          • C:\temp\CreateProcess.exe
                                                            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                            5⤵
                                                              PID:4700
                                                              • C:\windows\system32\ipconfig.exe
                                                                C:\windows\system32\ipconfig.exe /release
                                                                6⤵
                                                                • Gathers network information
                                                                PID:4304
                                                        • C:\temp\CreateProcess.exe
                                                          C:\temp\CreateProcess.exe C:\Temp\i_dbztrljdbv.exe ups_ins
                                                          3⤵
                                                            PID:6788
                                                            • C:\Temp\i_dbztrljdbv.exe
                                                              C:\Temp\i_dbztrljdbv.exe ups_ins
                                                              4⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:4148
                                                          • C:\temp\CreateProcess.exe
                                                            C:\temp\CreateProcess.exe C:\Temp\ysqoljdayv.exe ups_run
                                                            3⤵
                                                              PID:5852
                                                              • C:\Temp\ysqoljdayv.exe
                                                                C:\Temp\ysqoljdayv.exe ups_run
                                                                4⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:668
                                                                • C:\temp\CreateProcess.exe
                                                                  C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                                  5⤵
                                                                    PID:3048
                                                                    • C:\windows\system32\ipconfig.exe
                                                                      C:\windows\system32\ipconfig.exe /release
                                                                      6⤵
                                                                      • Gathers network information
                                                                      PID:5812
                                                            • C:\Program Files\Internet Explorer\iexplore.exe
                                                              "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
                                                              2⤵
                                                              • Modifies Internet Explorer settings
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:924
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
                                                                3⤵
                                                                • Drops file in Windows directory
                                                                • Enumerates system info in registry
                                                                • Modifies data under HKEY_USERS
                                                                • Modifies registry class
                                                                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                • Suspicious use of FindShellTrayWindow
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4756
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x300,0x7ffe33f3c188,0x7ffe33f3c194,0x7ffe33f3c1a0
                                                                  4⤵
                                                                    PID:3200
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1952,i,9810079556868174757,15433504974315456447,262144 --field-trial-handle=2936,i,16871473925026614507,5832281163039876423,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:2
                                                                    4⤵
                                                                      PID:6200
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2172,i,7530329152285828242,11033796941383466441,524288 --field-trial-handle=2936,i,16871473925026614507,5832281163039876423,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:11
                                                                      4⤵
                                                                      • System Time Discovery
                                                                      PID:1440
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2368,i,4490086393032803476,7360903498739204287,524288 --field-trial-handle=2936,i,16871473925026614507,5832281163039876423,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:13
                                                                      4⤵
                                                                        PID:244
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,15538999551083279231,947603344901132182,2097152 --field-trial-handle=2936,i,16871473925026614507,5832281163039876423,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
                                                                        4⤵
                                                                          PID:4200
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,15736030844905136974,1846386796919201171,2097152 --field-trial-handle=2936,i,16871473925026614507,5832281163039876423,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
                                                                          4⤵
                                                                            PID:4868
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,10897426391962921204,6380597870190511568,524288 --field-trial-handle=2936,i,16871473925026614507,5832281163039876423,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:14
                                                                            4⤵
                                                                              PID:544
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,6382569323646366981,12280839486130513215,524288 --field-trial-handle=2936,i,16871473925026614507,5832281163039876423,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:14
                                                                              4⤵
                                                                                PID:2044
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,10091767446547871217,3246420074083225900,524288 --field-trial-handle=2936,i,16871473925026614507,5832281163039876423,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:14
                                                                                4⤵
                                                                                  PID:564
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,10091767446547871217,3246420074083225900,524288 --field-trial-handle=2936,i,16871473925026614507,5832281163039876423,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:14
                                                                                  4⤵
                                                                                    PID:5844
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,1560232784450767114,9033950173585178065,524288 --field-trial-handle=2936,i,16871473925026614507,5832281163039876423,262144 --variations-seed-version --mojo-platform-channel-handle=1276 /prefetch:14
                                                                                    4⤵
                                                                                      PID:3592
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,8522329784718094690,16943861151246059038,524288 --field-trial-handle=2936,i,16871473925026614507,5832281163039876423,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:14
                                                                                      4⤵
                                                                                        PID:5660
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,11975236040952575033,11952819156861494864,524288 --field-trial-handle=2936,i,16871473925026614507,5832281163039876423,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
                                                                                        4⤵
                                                                                          PID:3752
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,10750647478284574523,10293196620717483234,524288 --field-trial-handle=2936,i,16871473925026614507,5832281163039876423,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
                                                                                          4⤵
                                                                                            PID:3564
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,12559159038429110880,18004250529129518765,524288 --field-trial-handle=2936,i,16871473925026614507,5832281163039876423,262144 --variations-seed-version --mojo-platform-channel-handle=1276 /prefetch:14
                                                                                            4⤵
                                                                                              PID:6552
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,332895408971742924,13190935179202032009,524288 --field-trial-handle=2936,i,16871473925026614507,5832281163039876423,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:14
                                                                                              4⤵
                                                                                                PID:6932
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,7577567219725462255,5462730489849615254,524288 --field-trial-handle=2936,i,16871473925026614507,5832281163039876423,262144 --variations-seed-version --mojo-platform-channel-handle=1464 /prefetch:14
                                                                                                4⤵
                                                                                                  PID:5700
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,8962695658976815545,11287065518411885104,524288 --field-trial-handle=2936,i,16871473925026614507,5832281163039876423,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:14
                                                                                                  4⤵
                                                                                                    PID:908
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,5176380678718330137,17090792363954001612,524288 --field-trial-handle=2936,i,16871473925026614507,5832281163039876423,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:14
                                                                                                    4⤵
                                                                                                      PID:6848
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6424,i,533597420836441603,2928138767650456264,262144 --field-trial-handle=2936,i,16871473925026614507,5832281163039876423,262144 --variations-seed-version --mojo-platform-channel-handle=1372 /prefetch:10
                                                                                                      4⤵
                                                                                                        PID:5528
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                  1⤵
                                                                                                    PID:3968
                                                                                                  • C:\Temp\ztrpjgbztrljheuo.sys
                                                                                                    C:\Temp\ztrpjgbztrljheuo.sys
                                                                                                    1⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:6516
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                    1⤵
                                                                                                      PID:2144
                                                                                                    • C:\Temp\rljdbvtolg.sys
                                                                                                      C:\Temp\rljdbvtolg.sys
                                                                                                      1⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:4452
                                                                                                    • C:\Temp\nlgdyvqoig.sys
                                                                                                      C:\Temp\nlgdyvqoig.sys
                                                                                                      1⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:1304
                                                                                                    • C:\Temp\sqligdxvtn.sys
                                                                                                      C:\Temp\sqligdxvtn.sys
                                                                                                      1⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:2732
                                                                                                    • C:\Temp\xvpnifaysq.sys
                                                                                                      C:\Temp\xvpnifaysq.sys
                                                                                                      1⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:2580
                                                                                                    • C:\Temp\kicaxvpnki.sys
                                                                                                      C:\Temp\kicaxvpnki.sys
                                                                                                      1⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:5428
                                                                                                    • C:\Temp\hczusmkhcz.sys
                                                                                                      C:\Temp\hczusmkhcz.sys
                                                                                                      1⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:2768
                                                                                                    • C:\Temp\czurmjebzu.sys
                                                                                                      C:\Temp\czurmjebzu.sys
                                                                                                      1⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:3752
                                                                                                    • C:\Temp\jhezwuomge.sys
                                                                                                      C:\Temp\jhezwuomge.sys
                                                                                                      1⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:260
                                                                                                    • C:\Temp\wqljdbwtol.sys
                                                                                                      C:\Temp\wqljdbwtol.sys
                                                                                                      1⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:6296
                                                                                                    • C:\Temp\lgeywtnlgd.sys
                                                                                                      C:\Temp\lgeywtnlgd.sys
                                                                                                      1⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:3120
                                                                                                    • C:\Temp\igavtnlfdx.sys
                                                                                                      C:\Temp\igavtnlfdx.sys
                                                                                                      1⤵
                                                                                                        PID:5828
                                                                                                      • C:\Temp\nlfdavsnki.sys
                                                                                                        C:\Temp\nlfdavsnki.sys
                                                                                                        1⤵
                                                                                                          PID:5940
                                                                                                        • C:\Temp\fdxsqkicau.sys
                                                                                                          C:\Temp\fdxsqkicau.sys
                                                                                                          1⤵
                                                                                                            PID:5064
                                                                                                          • C:\Temp\zxrpnhfzxs.sys
                                                                                                            C:\Temp\zxrpnhfzxs.sys
                                                                                                            1⤵
                                                                                                              PID:3724
                                                                                                            • C:\Temp\cwurpjhfzx.sys
                                                                                                              C:\Temp\cwurpjhfzx.sys
                                                                                                              1⤵
                                                                                                                PID:6988
                                                                                                              • C:\Temp\hbztrmjecw.sys
                                                                                                                C:\Temp\hbztrmjecw.sys
                                                                                                                1⤵
                                                                                                                  PID:3336
                                                                                                                • C:\Temp\ztromgecwt.sys
                                                                                                                  C:\Temp\ztromgecwt.sys
                                                                                                                  1⤵
                                                                                                                    PID:3796
                                                                                                                  • C:\Temp\jgbwtrljdb.sys
                                                                                                                    C:\Temp\jgbwtrljdb.sys
                                                                                                                    1⤵
                                                                                                                      PID:7156
                                                                                                                    • C:\Temp\vtnljdbywq.sys
                                                                                                                      C:\Temp\vtnljdbywq.sys
                                                                                                                      1⤵
                                                                                                                        PID:4340

                                                                                                                      Network

                                                                                                                            MITRE ATT&CK Enterprise v16

                                                                                                                            Replay Monitor

                                                                                                                            Loading Replay Monitor...

                                                                                                                            Downloads

                                                                                                                            gaysqoigav.exe
                                                                                                                            • Path C:\Temp\gaysqoigav.exe
                                                                                                                            • Size 365KB
                                                                                                                            • SHA256 a3c5b065fbec9ef6d3f43492e858c7f9164af517a8edf12b2573a1179b9a6942
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            gdywqoigby.exe
                                                                                                                            • Path C:\Temp\gdywqoigby.exe
                                                                                                                            • Size 365KB
                                                                                                                            • SHA256 b1a2cad7e8d9249de4c572a62cd05245b9a69ea9ee9bc6b4e52c52ffa571f205
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            hczusmkhcz.sys
                                                                                                                            • Path C:\Temp\hczusmkhcz.sys
                                                                                                                            • Size 293KB
                                                                                                                            • SHA256 9a908329e5e53205fbd270bf60e90eb6fb6efb6758777d3b8eedb8cd57ba068c
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            i_gaysqoigav.exe
                                                                                                                            • Path C:\Temp\i_gaysqoigav.exe
                                                                                                                            • Size 365KB
                                                                                                                            • SHA256 358273d689f9066f892a404fc40b09c72f5177b756181f831b21f874673b8090
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            i_gdywqoigby.exe
                                                                                                                            • Path C:\Temp\i_gdywqoigby.exe
                                                                                                                            • Size 365KB
                                                                                                                            • SHA256 6a9b7439af2691876c51b5100b60cc48605fd789e59930f7dafd817b9868f809
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            i_icaxspkica.exe
                                                                                                                            • Path C:\Temp\i_icaxspkica.exe
                                                                                                                            • Size 365KB
                                                                                                                            • SHA256 6ecb8d583b61ce75567895b915ee0e132ecf00bb925228c610a8e4057c49f5a1
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            i_kicxvpnhfz.exe
                                                                                                                            • Path C:\Temp\i_kicxvpnhfz.exe
                                                                                                                            • Size 365KB
                                                                                                                            • SHA256 cd652b49606b0b1f33588b2bc9f0dfbf4c0f2a1f6175405ee8841ad700883f91
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            i_tqkifdxvqn.exe
                                                                                                                            • Path C:\Temp\i_tqkifdxvqn.exe
                                                                                                                            • Size 365KB
                                                                                                                            • SHA256 7c6f7fdd097bb729fcee2d5aec1c265f0191a69f4cb0c1657434a7b98b15dc8d
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            i_ztrojgbwtl.exe
                                                                                                                            • Path C:\Temp\i_ztrojgbwtl.exe
                                                                                                                            • Size 365KB
                                                                                                                            • SHA256 683a0069adef159a00e9d509811550e521f7bfd4cf61cfaa7d385aee0599b482
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            icaxspkica.exe
                                                                                                                            • Path C:\Temp\icaxspkica.exe
                                                                                                                            • Size 365KB
                                                                                                                            • SHA256 38f5ae7829731ae3902160abafe04556b5208f1a9823cac44e1b1db69e3cfe6e
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            kicaxvpnki.sys
                                                                                                                            • Path C:\Temp\kicaxvpnki.sys
                                                                                                                            • Size 293KB
                                                                                                                            • SHA256 73b1d6f8c753f0d3fcb953028f9085a0f0c325376b6fe8e3220b497bdd697921
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            kicxvpnhfz.exe
                                                                                                                            • Path C:\Temp\kicxvpnhfz.exe
                                                                                                                            • Size 365KB
                                                                                                                            • SHA256 c472b766e5c3a9f6a0f8f86ad53a63966ac328f3b9f6d6a4f81303c0de9478f9
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            nlgdyvqoig.sys
                                                                                                                            • Path C:\Temp\nlgdyvqoig.sys
                                                                                                                            • Size 293KB
                                                                                                                            • SHA256 1e1116a84c69914d6119c94d0519945013c99daed24c437279ea4426cda15cd3
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            rljdbvtolg.sys
                                                                                                                            • Path C:\Temp\rljdbvtolg.sys
                                                                                                                            • Size 293KB
                                                                                                                            • SHA256 87b4cb9e388925a801975766091b68422ab3e501a788802ae9100772b5cff898
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            sqligdxvtn.sys
                                                                                                                            • Path C:\Temp\sqligdxvtn.sys
                                                                                                                            • Size 293KB
                                                                                                                            • SHA256 ef33ed370194df2051dac4a9affd9f81753184ea1f5baf1614829bcf88710f8c
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            tqkifdxvqn.exe
                                                                                                                            • Path C:\Temp\tqkifdxvqn.exe
                                                                                                                            • Size 365KB
                                                                                                                            • SHA256 d4568a42d5795cfa9c98fee7552835e55b7314254bd6a28b3efb4501f8e1bc9d
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            xvpnifaysq.sys
                                                                                                                            • Path C:\Temp\xvpnifaysq.sys
                                                                                                                            • Size 293KB
                                                                                                                            • SHA256 1fed6540ec5a841fb7d40366a879f535ce427688215be20e18202eae78a12d14
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            ztrojgbwtl.exe
                                                                                                                            • Path C:\Temp\ztrojgbwtl.exe
                                                                                                                            • Size 365KB
                                                                                                                            • SHA256 34736cc1541c8355f3721e9857add21f15b70ee8a8a863e53984d5a55f68a1b1
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            ztrpjgbztrljheuo.exe
                                                                                                                            • Path C:\Temp\ztrpjgbztrljheuo.exe
                                                                                                                            • Size 365KB
                                                                                                                            • SHA256 f8ed595cee5936ebae9516995a6959d896ae37e2ec5cb04ce8b7d55e9fa7fe07
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            ztrpjgbztrljheuo.sys
                                                                                                                            • Path C:\Temp\ztrpjgbztrljheuo.sys
                                                                                                                            • Size 293KB
                                                                                                                            • SHA256 b84b77e4e6f89444bd021ac267d631c80474522e5768b007389468684fd4dc68
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            settings.dat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                            • Size 280B
                                                                                                                            • SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            BookmarkMergedSurfaceOrdering
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                            • Size 6B
                                                                                                                            • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                            Submit Download

                                                                                                                            BrowsingTopicsState
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
                                                                                                                            • Size 649B
                                                                                                                            • SHA256 3dc28b0a5c4baa400c68bba3f39f3ba2bc75853a4c0a32fb7210e3b860c48062
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            SiteList-Enterprise.json
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                            • Size 2B
                                                                                                                            • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                            Submit Download

                                                                                                                            Network Persistent State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                            • Size 2KB
                                                                                                                            • SHA256 a117c0ad4aa8815f9050935838ac3419692628dba7b78f885df878a466fc1b7c
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            SCT Auditing Pending Reports
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                            • Size 2B
                                                                                                                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                            Submit Download

                                                                                                                            Sdch Dictionaries
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                            • Size 40B
                                                                                                                            • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                            Submit Download

                                                                                                                            Preferences
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                            • Size 15KB
                                                                                                                            • SHA256 0e3cada431865c459e9aa4314409107b82d0e7d0fac5a1b48ce7156979e3d249
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Preferences
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                            • Size 16KB
                                                                                                                            • SHA256 a44025f4b3b1354cd8df2ad671d7cf69897b0f2a719c8f03233e7a6c3d99368a
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Secure Preferences
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                            • Size 32KB
                                                                                                                            • SHA256 c18d5de947ea3280b6ae1edacc345dbbf4f7960480d3972350a40cf6234bf9f5
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            sync_diagnostic.log
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                            • Size 23KB
                                                                                                                            • SHA256 6db042d4c83f245ee4d5d609531508189bacce7e3a0781a3a663cb0c960c7465
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Local State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                            • Size 33KB
                                                                                                                            • SHA256 7285301ecb7af8c5fe879f11ecacc76e5872a81d3a137b7360a0596067c05a64
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Local State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                            • Size 26KB
                                                                                                                            • SHA256 d4fc0e2f8d1ef652f701d2c16ca6ee7a611ae77e61ec8bfeec5bb8140e728c80
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Local State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                            • Size 28KB
                                                                                                                            • SHA256 a6d852a1a448f02636519c654e702344be695d27adf1ed3cca09e43d8100d295
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Local State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                            • Size 28KB
                                                                                                                            • SHA256 68b8012dd57481757ffec2ac7c32d61db09a94af9f40aa7f89d8131212af801e
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            metadata.json
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                            • Size 2KB
                                                                                                                            • SHA256 63f557abf3f15c211ed60cb4185a8429b4a44b2e292a0f6c7d89230e20b29120
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            metadata.json
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                            • Size 2KB
                                                                                                                            • SHA256 25afb2f2bbaa4983e1dd9fbc7dbd3db3c6f90ba68a4da5cfa259e6125d7af563
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            metadata.json
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                            • Size 2KB
                                                                                                                            • SHA256 bc40160699a9c493f07f187ac9ff324c35efd61713d54877437bd5cc9a198319
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                                                                            • Size 153KB
                                                                                                                            • SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            metadata.json
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                                                                            • Size 132B
                                                                                                                            • SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            CreateProcess.exe
                                                                                                                            • Path C:\temp\CreateProcess.exe
                                                                                                                            • Size 3KB
                                                                                                                            • SHA256 a740f0e2bf64a058a5a27f5eb847a4ed0ead7cafec14643b4f1db576ce2e9933
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            memory/260-511-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1304-180-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2580-448-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2732-201-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2768-502-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3120-539-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3336-647-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3336-617-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3724-601-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3752-507-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3796-621-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4340-654-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4452-145-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4452-181-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5064-581-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5428-503-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5428-461-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5828-557-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5940-562-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6296-541-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6296-515-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6516-52-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6988-605-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/7156-650-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                            Download