Overview

overview

10

Static

static

10

2026-08-02...op.exe

windows10-2004-x64

10

2026-08-02...op.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 16:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-02_c3a2b9e56e77d5a7a08ce0c815aed174_amadey_darkgate_elex_smoke-loader_stop.exe
  • Size 384KB
  • Sample260802-vffpgacr5v
  • SHA256 3039869a07be69897c623cceed5960ad68b902e7da7f748d097b2946e5a2c69d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarediscoverysystexspywaretrojan

Malware Config

Signatures

  • Family: Systex

    Systex is a trojan loader written in C++.

    trojansystex
  • Executes dropped EXE 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers network information 2 TTPs 20 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 20 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_c3a2b9e56e77d5a7a08ce0c815aed174_amadey_darkgate_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-02_c3a2b9e56e77d5a7a08ce0c815aed174_amadey_darkgate_elex_smoke-loader_stop.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:6132
    • C:\Temp\smkecxupmhecwurp.exe
      C:\Temp\smkecxupmhecwurp.exe run
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5584
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\zxrpjhczur.exe ups_run
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4212
        • C:\Temp\zxrpjhczur.exe
          C:\Temp\zxrpjhczur.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3680
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:4452
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:2812
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_zxrpjhczur.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:3536
        • C:\Temp\i_zxrpjhczur.exe
          C:\Temp\i_zxrpjhczur.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3772
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\rmgezwuomh.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:4368
        • C:\Temp\rmgezwuomh.exe
          C:\Temp\rmgezwuomh.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1092
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:6504
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:2156
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_rmgezwuomh.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:7164
        • C:\Temp\i_rmgezwuomh.exe
          C:\Temp\i_rmgezwuomh.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:5700
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\ljetoljdbz.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:4104
        • C:\Temp\ljetoljdbz.exe
          C:\Temp\ljetoljdbz.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:6776
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:2176
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:5320
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_ljetoljdbz.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:5760
        • C:\Temp\i_ljetoljdbz.exe
          C:\Temp\i_ljetoljdbz.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2932
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\wqojgbytrl.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:5036
        • C:\Temp\wqojgbytrl.exe
          C:\Temp\wqojgbytrl.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4848
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:4892
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:1524
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_wqojgbytrl.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:6868
        • C:\Temp\i_wqojgbytrl.exe
          C:\Temp\i_wqojgbytrl.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4176
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\yvtnlgdvtn.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:2144
        • C:\Temp\yvtnlgdvtn.exe
          C:\Temp\yvtnlgdvtn.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3676
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:6980
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:3940
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_yvtnlgdvtn.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:2768
        • C:\Temp\i_yvtnlgdvtn.exe
          C:\Temp\i_yvtnlgdvtn.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2488
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\ifaysqkica.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:1556
        • C:\Temp\ifaysqkica.exe
          C:\Temp\ifaysqkica.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:460
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:6464
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:1112
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_ifaysqkica.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:5672
        • C:\Temp\i_ifaysqkica.exe
          C:\Temp\i_ifaysqkica.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2844
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\dxusqkicav.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:5460
        • C:\Temp\dxusqkicav.exe
          C:\Temp\dxusqkicav.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:6268
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:2364
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:4080
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_dxusqkicav.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:6544
        • C:\Temp\i_dxusqkicav.exe
          C:\Temp\i_dxusqkicav.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4792
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\fcaxsqkica.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:4052
        • C:\Temp\fcaxsqkica.exe
          C:\Temp\fcaxsqkica.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:6116
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:5604
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:2536
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_fcaxsqkica.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:1560
        • C:\Temp\i_fcaxsqkica.exe
          C:\Temp\i_fcaxsqkica.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:6376
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\fzxupmhfcx.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:4396
        • C:\Temp\fzxupmhfcx.exe
          C:\Temp\fzxupmhfcx.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1152
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:4108
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:2096
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_fzxupmhfcx.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:7108
        • C:\Temp\i_fzxupmhfcx.exe
          C:\Temp\i_fzxupmhfcx.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2328
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\urpjhbztrp.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:6852
        • C:\Temp\urpjhbztrp.exe
          C:\Temp\urpjhbztrp.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:6764
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:6400
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:6948
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_urpjhbztrp.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:2648
        • C:\Temp\i_urpjhbztrp.exe
          C:\Temp\i_urpjhbztrp.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:6184
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\hezwjgbztr.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:1360
        • C:\Temp\hezwjgbztr.exe
          C:\Temp\hezwjgbztr.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5448
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
              PID:5992
              • C:\windows\system32\ipconfig.exe
                C:\windows\system32\ipconfig.exe /release
                6⤵
                • Gathers network information
                PID:5956
        • C:\temp\CreateProcess.exe
          C:\temp\CreateProcess.exe C:\Temp\i_hezwjgbztr.exe ups_ins
          3⤵
            PID:3448
            • C:\Temp\i_hezwjgbztr.exe
              C:\Temp\i_hezwjgbztr.exe ups_ins
              4⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:6312
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\Temp\lgeywqojgb.exe ups_run
            3⤵
              PID:752
              • C:\Temp\lgeywqojgb.exe
                C:\Temp\lgeywqojgb.exe ups_run
                4⤵
                • System Location Discovery: System Language Discovery
                PID:6208
                • C:\temp\CreateProcess.exe
                  C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                  5⤵
                    PID:5916
                    • C:\windows\system32\ipconfig.exe
                      C:\windows\system32\ipconfig.exe /release
                      6⤵
                      • Gathers network information
                      PID:6560
              • C:\temp\CreateProcess.exe
                C:\temp\CreateProcess.exe C:\Temp\i_lgeywqojgb.exe ups_ins
                3⤵
                  PID:1628
                  • C:\Temp\i_lgeywqojgb.exe
                    C:\Temp\i_lgeywqojgb.exe ups_ins
                    4⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5396
                • C:\temp\CreateProcess.exe
                  C:\temp\CreateProcess.exe C:\Temp\gdbvtoigdy.exe ups_run
                  3⤵
                    PID:2616
                    • C:\Temp\gdbvtoigdy.exe
                      C:\Temp\gdbvtoigdy.exe ups_run
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:6928
                      • C:\temp\CreateProcess.exe
                        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                        5⤵
                          PID:5320
                          • C:\windows\system32\ipconfig.exe
                            C:\windows\system32\ipconfig.exe /release
                            6⤵
                            • Gathers network information
                            PID:2148
                    • C:\temp\CreateProcess.exe
                      C:\temp\CreateProcess.exe C:\Temp\i_gdbvtoigdy.exe ups_ins
                      3⤵
                        PID:1476
                        • C:\Temp\i_gdbvtoigdy.exe
                          C:\Temp\i_gdbvtoigdy.exe ups_ins
                          4⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          PID:5648
                      • C:\temp\CreateProcess.exe
                        C:\temp\CreateProcess.exe C:\Temp\xvqnigayvs.exe ups_run
                        3⤵
                          PID:2384
                          • C:\Temp\xvqnigayvs.exe
                            C:\Temp\xvqnigayvs.exe ups_run
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:4440
                            • C:\temp\CreateProcess.exe
                              C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                              5⤵
                                PID:6880
                                • C:\windows\system32\ipconfig.exe
                                  C:\windows\system32\ipconfig.exe /release
                                  6⤵
                                  • Gathers network information
                                  PID:5364
                          • C:\temp\CreateProcess.exe
                            C:\temp\CreateProcess.exe C:\Temp\i_xvqnigayvs.exe ups_ins
                            3⤵
                              PID:3508
                              • C:\Temp\i_xvqnigayvs.exe
                                C:\Temp\i_xvqnigayvs.exe ups_ins
                                4⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2444
                            • C:\temp\CreateProcess.exe
                              C:\temp\CreateProcess.exe C:\Temp\fdxvtnkidx.exe ups_run
                              3⤵
                                PID:6376
                                • C:\Temp\fdxvtnkidx.exe
                                  C:\Temp\fdxvtnkidx.exe ups_run
                                  4⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:1448
                                  • C:\temp\CreateProcess.exe
                                    C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                    5⤵
                                      PID:5688
                                      • C:\windows\system32\ipconfig.exe
                                        C:\windows\system32\ipconfig.exe /release
                                        6⤵
                                        • Gathers network information
                                        PID:5636
                                • C:\temp\CreateProcess.exe
                                  C:\temp\CreateProcess.exe C:\Temp\i_fdxvtnkidx.exe ups_ins
                                  3⤵
                                    PID:5924
                                    • C:\Temp\i_fdxvtnkidx.exe
                                      C:\Temp\i_fdxvtnkidx.exe ups_ins
                                      4⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2492
                                  • C:\temp\CreateProcess.exe
                                    C:\temp\CreateProcess.exe C:\Temp\kfcausnkfd.exe ups_run
                                    3⤵
                                      PID:6832
                                      • C:\Temp\kfcausnkfd.exe
                                        C:\Temp\kfcausnkfd.exe ups_run
                                        4⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:2840
                                        • C:\temp\CreateProcess.exe
                                          C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                          5⤵
                                            PID:5004
                                            • C:\windows\system32\ipconfig.exe
                                              C:\windows\system32\ipconfig.exe /release
                                              6⤵
                                              • Gathers network information
                                              PID:6040
                                      • C:\temp\CreateProcess.exe
                                        C:\temp\CreateProcess.exe C:\Temp\i_kfcausnkfd.exe ups_ins
                                        3⤵
                                          PID:256
                                          • C:\Temp\i_kfcausnkfd.exe
                                            C:\Temp\i_kfcausnkfd.exe ups_ins
                                            4⤵
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:1916
                                        • C:\temp\CreateProcess.exe
                                          C:\temp\CreateProcess.exe C:\Temp\causpkhfcx.exe ups_run
                                          3⤵
                                            PID:4868
                                            • C:\Temp\causpkhfcx.exe
                                              C:\Temp\causpkhfcx.exe ups_run
                                              4⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:5148
                                              • C:\temp\CreateProcess.exe
                                                C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                5⤵
                                                  PID:6184
                                                  • C:\windows\system32\ipconfig.exe
                                                    C:\windows\system32\ipconfig.exe /release
                                                    6⤵
                                                    • Gathers network information
                                                    PID:5632
                                            • C:\temp\CreateProcess.exe
                                              C:\temp\CreateProcess.exe C:\Temp\i_causpkhfcx.exe ups_ins
                                              3⤵
                                                PID:5292
                                                • C:\Temp\i_causpkhfcx.exe
                                                  C:\Temp\i_causpkhfcx.exe ups_ins
                                                  4⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:3460
                                              • C:\temp\CreateProcess.exe
                                                C:\temp\CreateProcess.exe C:\Temp\cwupmhfzxr.exe ups_run
                                                3⤵
                                                  PID:2012
                                                  • C:\Temp\cwupmhfzxr.exe
                                                    C:\Temp\cwupmhfzxr.exe ups_run
                                                    4⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:6508
                                                    • C:\temp\CreateProcess.exe
                                                      C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                      5⤵
                                                        PID:6396
                                                        • C:\windows\system32\ipconfig.exe
                                                          C:\windows\system32\ipconfig.exe /release
                                                          6⤵
                                                          • Gathers network information
                                                          PID:6660
                                                  • C:\temp\CreateProcess.exe
                                                    C:\temp\CreateProcess.exe C:\Temp\i_cwupmhfzxr.exe ups_ins
                                                    3⤵
                                                      PID:5348
                                                      • C:\Temp\i_cwupmhfzxr.exe
                                                        C:\Temp\i_cwupmhfzxr.exe ups_ins
                                                        4⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:5300
                                                    • C:\temp\CreateProcess.exe
                                                      C:\temp\CreateProcess.exe C:\Temp\ecwuomgezw.exe ups_run
                                                      3⤵
                                                        PID:6744
                                                        • C:\Temp\ecwuomgezw.exe
                                                          C:\Temp\ecwuomgezw.exe ups_run
                                                          4⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:4836
                                                          • C:\temp\CreateProcess.exe
                                                            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                            5⤵
                                                              PID:6308
                                                              • C:\windows\system32\ipconfig.exe
                                                                C:\windows\system32\ipconfig.exe /release
                                                                6⤵
                                                                • Gathers network information
                                                                PID:6212
                                                        • C:\temp\CreateProcess.exe
                                                          C:\temp\CreateProcess.exe C:\Temp\i_ecwuomgezw.exe ups_ins
                                                          3⤵
                                                            PID:2464
                                                            • C:\Temp\i_ecwuomgezw.exe
                                                              C:\Temp\i_ecwuomgezw.exe ups_ins
                                                              4⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:1064
                                                          • C:\temp\CreateProcess.exe
                                                            C:\temp\CreateProcess.exe C:\Temp\uomjebwuoj.exe ups_run
                                                            3⤵
                                                              PID:5704
                                                              • C:\Temp\uomjebwuoj.exe
                                                                C:\Temp\uomjebwuoj.exe ups_run
                                                                4⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:4188
                                                                • C:\temp\CreateProcess.exe
                                                                  C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                                  5⤵
                                                                    PID:7144
                                                                    • C:\windows\system32\ipconfig.exe
                                                                      C:\windows\system32\ipconfig.exe /release
                                                                      6⤵
                                                                      • Gathers network information
                                                                      PID:5876
                                                            • C:\Program Files\Internet Explorer\iexplore.exe
                                                              "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
                                                              2⤵
                                                              • Modifies Internet Explorer settings
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:2080
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
                                                                3⤵
                                                                • Drops file in Windows directory
                                                                • Enumerates system info in registry
                                                                • Modifies data under HKEY_USERS
                                                                • Modifies registry class
                                                                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                • Suspicious use of FindShellTrayWindow
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:2388
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffc611dc188,0x7ffc611dc194,0x7ffc611dc1a0
                                                                  4⤵
                                                                    PID:4864
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1764,i,6376489616686796460,18252704841672894709,262144 --field-trial-handle=2300,i,17621566727953576234,11540411739555740116,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
                                                                    4⤵
                                                                      PID:4124
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,14250477587599108864,18346901777422164050,524288 --field-trial-handle=2300,i,17621566727953576234,11540411739555740116,262144 --variations-seed-version --mojo-platform-channel-handle=2820 /prefetch:11
                                                                      4⤵
                                                                      • System Time Discovery
                                                                      PID:4312
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2512,i,15604390584810167790,17351215098019739778,524288 --field-trial-handle=2300,i,17621566727953576234,11540411739555740116,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:13
                                                                      4⤵
                                                                        PID:6788
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,13616227535682597153,3708379329658409348,2097152 --field-trial-handle=2300,i,17621566727953576234,11540411739555740116,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
                                                                        4⤵
                                                                          PID:4944
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3536,i,15876084111902099524,17618526454858869823,2097152 --field-trial-handle=2300,i,17621566727953576234,11540411739555740116,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
                                                                          4⤵
                                                                            PID:3028
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,278100543888752765,17276999401053993989,524288 --field-trial-handle=2300,i,17621566727953576234,11540411739555740116,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:14
                                                                            4⤵
                                                                              PID:6348
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,5639973655759620759,15691252064419140787,524288 --field-trial-handle=2300,i,17621566727953576234,11540411739555740116,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:14
                                                                              4⤵
                                                                                PID:4264
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,16860424758319033034,1917836530190632760,524288 --field-trial-handle=2300,i,17621566727953576234,11540411739555740116,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:14
                                                                                4⤵
                                                                                  PID:5628
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,16860424758319033034,1917836530190632760,524288 --field-trial-handle=2300,i,17621566727953576234,11540411739555740116,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:14
                                                                                  4⤵
                                                                                    PID:6560
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,7092222653069521991,4000094267802232270,524288 --field-trial-handle=2300,i,17621566727953576234,11540411739555740116,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:14
                                                                                    4⤵
                                                                                      PID:3780
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,669510445062564551,1972131101289356016,524288 --field-trial-handle=2300,i,17621566727953576234,11540411739555740116,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:14
                                                                                      4⤵
                                                                                        PID:2528
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=744,i,6125574200256101859,8950851913524110437,524288 --field-trial-handle=2300,i,17621566727953576234,11540411739555740116,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
                                                                                        4⤵
                                                                                          PID:1972
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2908,i,9705149555481950743,16524558237074399497,524288 --field-trial-handle=2300,i,17621566727953576234,11540411739555740116,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:14
                                                                                          4⤵
                                                                                            PID:3412
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2796,i,8361535083277378763,5812892271169788683,524288 --field-trial-handle=2300,i,17621566727953576234,11540411739555740116,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
                                                                                            4⤵
                                                                                              PID:6772
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,5021114809883723058,3626612175532565625,524288 --field-trial-handle=2300,i,17621566727953576234,11540411739555740116,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:14
                                                                                              4⤵
                                                                                                PID:420
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2840,i,6282037012398879554,16840382514362176091,524288 --field-trial-handle=2300,i,17621566727953576234,11540411739555740116,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
                                                                                                4⤵
                                                                                                  PID:1640
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=916,i,2234088194229309474,7599472269806244024,524288 --field-trial-handle=2300,i,17621566727953576234,11540411739555740116,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:14
                                                                                                  4⤵
                                                                                                    PID:6484
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,4210688429968035488,999627736138499785,524288 --field-trial-handle=2300,i,17621566727953576234,11540411739555740116,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:14
                                                                                                    4⤵
                                                                                                      PID:236
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6504,i,10844927832158470856,18232284548924712292,262144 --field-trial-handle=2300,i,17621566727953576234,11540411739555740116,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:10
                                                                                                      4⤵
                                                                                                        PID:1992
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                  1⤵
                                                                                                    PID:6824
                                                                                                  • C:\Temp\smkecxupmhecwurp.sys
                                                                                                    C:\Temp\smkecxupmhecwurp.sys
                                                                                                    1⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:5688
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                    1⤵
                                                                                                      PID:1156
                                                                                                    • C:\Temp\czusecwuom.sys
                                                                                                      C:\Temp\czusecwuom.sys
                                                                                                      1⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:3136
                                                                                                    • C:\Temp\omgezwrojg.sys
                                                                                                      C:\Temp\omgezwrojg.sys
                                                                                                      1⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:6216
                                                                                                    • C:\Temp\trljgeywqo.sys
                                                                                                      C:\Temp\trljgeywqo.sys
                                                                                                      1⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:2180
                                                                                                    • C:\Temp\fdyvqoigdy.sys
                                                                                                      C:\Temp\fdyvqoigdy.sys
                                                                                                      1⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:1640
                                                                                                    • C:\Temp\nkigaysqli.sys
                                                                                                      C:\Temp\nkigaysqli.sys
                                                                                                      1⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:6308
                                                                                                    • C:\Temp\idavsnkica.sys
                                                                                                      C:\Temp\idavsnkica.sys
                                                                                                      1⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:7056
                                                                                                    • C:\Temp\hfcaxspkhf.sys
                                                                                                      C:\Temp\hfcaxspkhf.sys
                                                                                                      1⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:4156
                                                                                                    • C:\Temp\hfzxspjhcz.sys
                                                                                                      C:\Temp\hfzxspjhcz.sys
                                                                                                      1⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:6572
                                                                                                    • C:\Temp\erpjhbzxro.sys
                                                                                                      C:\Temp\erpjhbzxro.sys
                                                                                                      1⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:256
                                                                                                    • C:\Temp\hezwrojgez.sys
                                                                                                      C:\Temp\hezwrojgez.sys
                                                                                                      1⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:2460
                                                                                                    • C:\Temp\jhbzwqomjh.sys
                                                                                                      C:\Temp\jhbzwqomjh.sys
                                                                                                      1⤵
                                                                                                        PID:2012
                                                                                                      • C:\Temp\olgdbvtolg.sys
                                                                                                        C:\Temp\olgdbvtolg.sys
                                                                                                        1⤵
                                                                                                          PID:1812
                                                                                                        • C:\Temp\ljdbvtnlgd.sys
                                                                                                          C:\Temp\ljdbvtnlgd.sys
                                                                                                          1⤵
                                                                                                            PID:4128
                                                                                                          • C:\Temp\idavtqoifd.sys
                                                                                                            C:\Temp\idavtqoifd.sys
                                                                                                            1⤵
                                                                                                              PID:1136
                                                                                                            • C:\Temp\kicausnkfd.sys
                                                                                                              C:\Temp\kicausnkfd.sys
                                                                                                              1⤵
                                                                                                                PID:3556
                                                                                                              • C:\Temp\hfcxvpnhfz.sys
                                                                                                                C:\Temp\hfcxvpnhfz.sys
                                                                                                                1⤵
                                                                                                                  PID:1960
                                                                                                                • C:\Temp\hczxrpnhfz.sys
                                                                                                                  C:\Temp\hczxrpnhfz.sys
                                                                                                                  1⤵
                                                                                                                    PID:6636
                                                                                                                  • C:\Temp\hezxrpjhbz.sys
                                                                                                                    C:\Temp\hezxrpjhbz.sys
                                                                                                                    1⤵
                                                                                                                      PID:3840
                                                                                                                    • C:\Temp\rojgeywtrp.sys
                                                                                                                      C:\Temp\rojgeywtrp.sys
                                                                                                                      1⤵
                                                                                                                        PID:3496

                                                                                                                      Network

                                                                                                                            MITRE ATT&CK Enterprise v16

                                                                                                                            Replay Monitor

                                                                                                                            Loading Replay Monitor...

                                                                                                                            Downloads

                                                                                                                            czusecwuom.sys
                                                                                                                            • Path C:\Temp\czusecwuom.sys
                                                                                                                            • Size 293KB
                                                                                                                            • SHA256 8e4e30c7acfe984723836f1b1007240eb5305ef2c2b7badcda04092e08574a00
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            fdyvqoigdy.sys
                                                                                                                            • Path C:\Temp\fdyvqoigdy.sys
                                                                                                                            • Size 293KB
                                                                                                                            • SHA256 8dc59c81d566c6cd230a3a283642791ff4581ba3a0edc903a8c7e3405ff5e259
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            i_ifaysqkica.exe
                                                                                                                            • Path C:\Temp\i_ifaysqkica.exe
                                                                                                                            • Size 384KB
                                                                                                                            • SHA256 6fa2aa5e36be229417683ed715e7492d499292aa84069fcb2850ebe63c68d0e0
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            i_ljetoljdbz.exe
                                                                                                                            • Path C:\Temp\i_ljetoljdbz.exe
                                                                                                                            • Size 384KB
                                                                                                                            • SHA256 75d2a84822fc1a6263186cc2878ce0e38c90417365b75b821b2d1a237da13018
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            i_rmgezwuomh.exe
                                                                                                                            • Path C:\Temp\i_rmgezwuomh.exe
                                                                                                                            • Size 384KB
                                                                                                                            • SHA256 95df1ab67406e04784df54fd5b7b62473f8dde1d5c7849bd039ddf3f66db0fc6
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            i_wqojgbytrl.exe
                                                                                                                            • Path C:\Temp\i_wqojgbytrl.exe
                                                                                                                            • Size 384KB
                                                                                                                            • SHA256 dcf784bec23671057440e914cd0368c675a6a75ccb4664325261886d0aa04298
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            i_yvtnlgdvtn.exe
                                                                                                                            • Path C:\Temp\i_yvtnlgdvtn.exe
                                                                                                                            • Size 384KB
                                                                                                                            • SHA256 ac1896ed91760827d4b3aafe642ad5f9caf4860b1a9074efacb51e767d56ce07
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            i_zxrpjhczur.exe
                                                                                                                            • Path C:\Temp\i_zxrpjhczur.exe
                                                                                                                            • Size 384KB
                                                                                                                            • SHA256 6a1ce3640c5ec787a141758f4462047cbddc573ec6b4b1ba0528d8566c161fe7
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            ifaysqkica.exe
                                                                                                                            • Path C:\Temp\ifaysqkica.exe
                                                                                                                            • Size 384KB
                                                                                                                            • SHA256 e02f1538ef6dd43e3631233f64d8d5f0cc5bd8e6fc83fe263f0c7355c3ead35b
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            ljetoljdbz.exe
                                                                                                                            • Path C:\Temp\ljetoljdbz.exe
                                                                                                                            • Size 384KB
                                                                                                                            • SHA256 9c7301394e79e77586ecb60744df3d876d936fabb20b57186e5568a15afac6eb
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            nkigaysqli.sys
                                                                                                                            • Path C:\Temp\nkigaysqli.sys
                                                                                                                            • Size 293KB
                                                                                                                            • SHA256 a9c2d54c5d5e3eab2347711f3de146e7d6b71ebd0c2bd3ab204ed02b4635725d
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            omgezwrojg.sys
                                                                                                                            • Path C:\Temp\omgezwrojg.sys
                                                                                                                            • Size 293KB
                                                                                                                            • SHA256 f67192325de4bbac982881ca557ef25b659e0ee56fff9bd0a1db3bbaabbb7f2f
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            rmgezwuomh.exe
                                                                                                                            • Path C:\Temp\rmgezwuomh.exe
                                                                                                                            • Size 384KB
                                                                                                                            • SHA256 b53fcf68b14624c4fcdf9af7689714b5de1d481746f33c579a0d82839d3f5fd8
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            smkecxupmhecwurp.exe
                                                                                                                            • Path C:\Temp\smkecxupmhecwurp.exe
                                                                                                                            • Size 384KB
                                                                                                                            • SHA256 ae7ae08135e6605a95ceba23fa6f70c8d1b873e3243f7816d57043b18745ec1b
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            smkecxupmhecwurp.sys
                                                                                                                            • Path C:\Temp\smkecxupmhecwurp.sys
                                                                                                                            • Size 293KB
                                                                                                                            • SHA256 e25cb7226bb3d5b780d0bf2b3e30005d58945b244d6a5d3aba67692f7c0b50d5
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            trljgeywqo.sys
                                                                                                                            • Path C:\Temp\trljgeywqo.sys
                                                                                                                            • Size 293KB
                                                                                                                            • SHA256 d87f95f0316e3448abb41c554e644cdd0c4cacf50e2c7eb632d40debe8bb3725
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            wqojgbytrl.exe
                                                                                                                            • Path C:\Temp\wqojgbytrl.exe
                                                                                                                            • Size 384KB
                                                                                                                            • SHA256 28e6c7a5e20f0d6e671e2a235c5bb5eb9bc4d3761ff177878303b673eb588b61
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            yvtnlgdvtn.exe
                                                                                                                            • Path C:\Temp\yvtnlgdvtn.exe
                                                                                                                            • Size 384KB
                                                                                                                            • SHA256 f59f4772ae09507f62ea9bb69fc371511cbf0e80a73c15f74d2563c301ea0fd1
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            zxrpjhczur.exe
                                                                                                                            • Path C:\Temp\zxrpjhczur.exe
                                                                                                                            • Size 384KB
                                                                                                                            • SHA256 4a00287ac54f6c93410f1240fab6f0417eaddf81af82ec3ee97612102842b2b9
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            80f0eee5-87d8-4528-b5ed-425e8decab37.tmp
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\80f0eee5-87d8-4528-b5ed-425e8decab37.tmp
                                                                                                                            • Size 33KB
                                                                                                                            • SHA256 2ad23b07742f2cc4d107cbb8d2ecd4d58f17aebfe363c49db542f23db885a473
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            settings.dat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                            • Size 280B
                                                                                                                            • SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            settings.dat
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                            • Size 280B
                                                                                                                            • SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            BookmarkMergedSurfaceOrdering
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                            • Size 6B
                                                                                                                            • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                            Submit Download

                                                                                                                            BrowsingTopicsState
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
                                                                                                                            • Size 649B
                                                                                                                            • SHA256 e0ac07485d7d8d3ceee6e64425685363ce245bf97faec4ab3992288c2457544d
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            SiteList-Enterprise.json
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                            • Size 2B
                                                                                                                            • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                            Submit Download

                                                                                                                            Network Persistent State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                            • Size 2KB
                                                                                                                            • SHA256 ea4e96dfef67032b8470152247c98530d65d88eb678dbdc928f9bf58997853e1
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            SCT Auditing Pending Reports
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                            • Size 2B
                                                                                                                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                            Submit Download

                                                                                                                            Sdch Dictionaries
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                            • Size 40B
                                                                                                                            • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                            Submit Download

                                                                                                                            Preferences
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                            • Size 13KB
                                                                                                                            • SHA256 97ec95d761c9c8f14d846625ef04809d9b9a05ed286a66fafada975a3e52e85c
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Preferences
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                            • Size 13KB
                                                                                                                            • SHA256 d730a3f6d2ca33bc723a42eeb7b0786a6f9a973114849f56ec2ca65664809fc6
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Preferences
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                            • Size 13KB
                                                                                                                            • SHA256 2b2cbee9602485b3d9ac0a13857254b2eaeeeafd45a479f6548ee8edbf8e6c46
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Secure Preferences
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                            • Size 29KB
                                                                                                                            • SHA256 9694d71c20310c6dff0dbd44ea54f5caed451b7ea510bcd4612226074ff751cc
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            sync_diagnostic.log
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                            • Size 23KB
                                                                                                                            • SHA256 1f6768168ebb97473adfdef0a2fa273ef08764013669de143c12a5b0fc9491fd
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Local State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                            • Size 26KB
                                                                                                                            • SHA256 34d288eea7d142a7536708a3a73dc18590873edee7405a0350118954f0b67605
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Local State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                            • Size 28KB
                                                                                                                            • SHA256 840f538a98085101452911558af8f57e2c829ab9219e72ba64520dbdf61fe618
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            Local State
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                            • Size 24KB
                                                                                                                            • SHA256 82fe2b7b149bb54921473a3c6b6a5fbbcdc2d37a6c7dae0de446333615f2c943
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            metadata.json
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                            • Size 2KB
                                                                                                                            • SHA256 60dcf11b489bd712b3d51c6df8db08d58506497d44b6cfb082dedd072a4df063
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            metadata.json
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                            • Size 2KB
                                                                                                                            • SHA256 9c769fbeb4559235145a1c47edf7a8aa4c5418a72f3267b015bb1a7874f96327
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            metadata.json
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                            • Size 2KB
                                                                                                                            • SHA256 462d7e808963e2604c30ade17e2177d755e533a3d5aafcfbd2a338e44dc14cbc
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                                                                            • Size 153KB
                                                                                                                            • SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                            Submit Download

                                                                                                                            metadata.json
                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                                                                            • Size 132B
                                                                                                                            • SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            CreateProcess.exe
                                                                                                                            • Path C:\temp\CreateProcess.exe
                                                                                                                            • Size 3KB
                                                                                                                            • SHA256 9f19c9a85a3dbf9c2bf16f4e9332387416afecea9c35d34074f3ab2be5228182
                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                            Submit Download

                                                                                                                            memory/256-515-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1136-593-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1640-496-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1640-398-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1812-562-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/1960-609-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2012-556-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2180-200-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2460-558-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/2460-539-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3136-180-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3136-144-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3496-638-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3556-597-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3556-611-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/3840-634-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4128-573-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/4156-507-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/5688-50-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6216-179-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6308-470-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6572-511-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/6636-614-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                            Download

                                                                                                                            memory/7056-503-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                            Download