Overview

overview

10

Static

static

10

2026-08-21...op.exe

windows10-2004-x64

10

2026-08-21...op.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    146s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/08/2026, 13:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-21_6b0cee0b6c6f3587ba914720dc9b93f1_amadey_darkgate_elex_smoke-loader_stop.exe
  • Size 384KB
  • Sample260822-qm2hashj2t
  • SHA256 1df22e0ed05ff4c3bcd47759e3183cf5bdd44a1b272100e422effbccfa25f9ca
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarediscoverysystexspywaretrojan

Malware Config

Signatures

  • Family: Systex

    Systex is a trojan loader written in C++.

    trojansystex
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers network information 2 TTPs 20 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 20 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_6b0cee0b6c6f3587ba914720dc9b93f1_amadey_darkgate_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-21_6b0cee0b6c6f3587ba914720dc9b93f1_amadey_darkgate_elex_smoke-loader_stop.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4308
    • C:\Temp\pkhczurmjhfzxupm.exe
      C:\Temp\pkhczurmjhfzxupm.exe run
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:6424
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\zusmkfzume.exe ups_run
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4332
        • C:\Temp\zusmkfzume.exe
          C:\Temp\zusmkfzume.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5680
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:3748
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:964
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_zusmkfzume.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:1256
        • C:\Temp\i_zusmkfzume.exe
          C:\Temp\i_zusmkfzume.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:5564
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\urpjhbzurm.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:6472
        • C:\Temp\urpjhbzurm.exe
          C:\Temp\urpjhbzurm.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3376
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:696
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:2860
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_urpjhbzurm.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:6848
        • C:\Temp\i_urpjhbzurm.exe
          C:\Temp\i_urpjhbzurm.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:5380
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\wromgeywro.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:2100
        • C:\Temp\wromgeywro.exe
          C:\Temp\wromgeywro.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:6532
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:6040
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:3476
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_wromgeywro.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:4136
        • C:\Temp\i_wromgeywro.exe
          C:\Temp\i_wromgeywro.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:5932
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\rojgbywtom.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:6200
        • C:\Temp\rojgbywtom.exe
          C:\Temp\rojgbywtom.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5536
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:6300
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:1288
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_rojgbywtom.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:4300
        • C:\Temp\i_rojgbywtom.exe
          C:\Temp\i_rojgbywtom.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4080
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\igdyvqoida.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:3000
        • C:\Temp\igdyvqoida.exe
          C:\Temp\igdyvqoida.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3288
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:6636
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:6784
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_igdyvqoida.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:3300
        • C:\Temp\i_igdyvqoida.exe
          C:\Temp\i_igdyvqoida.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4496
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\vtqlidaysq.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:4676
        • C:\Temp\vtqlidaysq.exe
          C:\Temp\vtqlidaysq.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4456
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:5156
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:6540
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_vtqlidaysq.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:3856
        • C:\Temp\i_vtqlidaysq.exe
          C:\Temp\i_vtqlidaysq.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:5228
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\sqkicavsnk.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:2060
        • C:\Temp\sqkicavsnk.exe
          C:\Temp\sqkicavsnk.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4272
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:940
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:4908
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_sqkicavsnk.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:5352
        • C:\Temp\i_sqkicavsnk.exe
          C:\Temp\i_sqkicavsnk.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2936
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\snkfdauspk.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:2904
        • C:\Temp\snkfdauspk.exe
          C:\Temp\snkfdauspk.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1904
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:5372
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:5460
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_snkfdauspk.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:6940
        • C:\Temp\i_snkfdauspk.exe
          C:\Temp\i_snkfdauspk.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4296
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\khcausmkec.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:3980
        • C:\Temp\khcausmkec.exe
          C:\Temp\khcausmkec.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1180
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:6336
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:4896
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_khcausmkec.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:6276
        • C:\Temp\i_khcausmkec.exe
          C:\Temp\i_khcausmkec.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4408
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\bzxrpjhcwu.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:2896
        • C:\Temp\bzxrpjhcwu.exe
          C:\Temp\bzxrpjhcwu.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:6388
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:5304
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:5336
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_bzxrpjhcwu.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:4128
        • C:\Temp\i_bzxrpjhcwu.exe
          C:\Temp\i_bzxrpjhcwu.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1980
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\mjhbztrpjh.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:2448
        • C:\Temp\mjhbztrpjh.exe
          C:\Temp\mjhbztrpjh.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5556
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
              PID:3472
              • C:\windows\system32\ipconfig.exe
                C:\windows\system32\ipconfig.exe /release
                6⤵
                • Gathers network information
                PID:4976
        • C:\temp\CreateProcess.exe
          C:\temp\CreateProcess.exe C:\Temp\i_mjhbztrpjh.exe ups_ins
          3⤵
            PID:3880
            • C:\Temp\i_mjhbztrpjh.exe
              C:\Temp\i_mjhbztrpjh.exe ups_ins
              4⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:2512
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\Temp\mgeywqojgb.exe ups_run
            3⤵
              PID:2436
              • C:\Temp\mgeywqojgb.exe
                C:\Temp\mgeywqojgb.exe ups_run
                4⤵
                • System Location Discovery: System Language Discovery
                PID:2292
                • C:\temp\CreateProcess.exe
                  C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                  5⤵
                    PID:996
                    • C:\windows\system32\ipconfig.exe
                      C:\windows\system32\ipconfig.exe /release
                      6⤵
                      • Gathers network information
                      PID:5500
              • C:\temp\CreateProcess.exe
                C:\temp\CreateProcess.exe C:\Temp\i_mgeywqojgb.exe ups_ins
                3⤵
                  PID:1448
                  • C:\Temp\i_mgeywqojgb.exe
                    C:\Temp\i_mgeywqojgb.exe ups_ins
                    4⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5756
                • C:\temp\CreateProcess.exe
                  C:\temp\CreateProcess.exe C:\Temp\rljdbvtolg.exe ups_run
                  3⤵
                    PID:5704
                    • C:\Temp\rljdbvtolg.exe
                      C:\Temp\rljdbvtolg.exe ups_run
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:4320
                      • C:\temp\CreateProcess.exe
                        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                        5⤵
                          PID:4756
                          • C:\windows\system32\ipconfig.exe
                            C:\windows\system32\ipconfig.exe /release
                            6⤵
                            • Gathers network information
                            PID:2324
                    • C:\temp\CreateProcess.exe
                      C:\temp\CreateProcess.exe C:\Temp\i_rljdbvtolg.exe ups_ins
                      3⤵
                        PID:1416
                        • C:\Temp\i_rljdbvtolg.exe
                          C:\Temp\i_rljdbvtolg.exe ups_ins
                          4⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          PID:864
                      • C:\temp\CreateProcess.exe
                        C:\temp\CreateProcess.exe C:\Temp\qolgdbnlgd.exe ups_run
                        3⤵
                          PID:6480
                          • C:\Temp\qolgdbnlgd.exe
                            C:\Temp\qolgdbnlgd.exe ups_run
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:4900
                            • C:\temp\CreateProcess.exe
                              C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                              5⤵
                                PID:1888
                                • C:\windows\system32\ipconfig.exe
                                  C:\windows\system32\ipconfig.exe /release
                                  6⤵
                                  • Gathers network information
                                  PID:5488
                          • C:\temp\CreateProcess.exe
                            C:\temp\CreateProcess.exe C:\Temp\i_qolgdbnlgd.exe ups_ins
                            3⤵
                              PID:1216
                              • C:\Temp\i_qolgdbnlgd.exe
                                C:\Temp\i_qolgdbnlgd.exe ups_ins
                                4⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of AdjustPrivilegeToken
                                PID:6668
                            • C:\temp\CreateProcess.exe
                              C:\temp\CreateProcess.exe C:\Temp\sqoidavsql.exe ups_run
                              3⤵
                                PID:2744
                                • C:\Temp\sqoidavsql.exe
                                  C:\Temp\sqoidavsql.exe ups_run
                                  4⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:1196
                                  • C:\temp\CreateProcess.exe
                                    C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                    5⤵
                                      PID:3824
                                      • C:\windows\system32\ipconfig.exe
                                        C:\windows\system32\ipconfig.exe /release
                                        6⤵
                                        • Gathers network information
                                        PID:5808
                                • C:\temp\CreateProcess.exe
                                  C:\temp\CreateProcess.exe C:\Temp\i_sqoidavsql.exe ups_ins
                                  3⤵
                                    PID:6032
                                    • C:\Temp\i_sqoidavsql.exe
                                      C:\Temp\i_sqoidavsql.exe ups_ins
                                      4⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:7104
                                  • C:\temp\CreateProcess.exe
                                    C:\temp\CreateProcess.exe C:\Temp\snkifaysqk.exe ups_run
                                    3⤵
                                      PID:1228
                                      • C:\Temp\snkifaysqk.exe
                                        C:\Temp\snkifaysqk.exe ups_run
                                        4⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:5812
                                        • C:\temp\CreateProcess.exe
                                          C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                          5⤵
                                            PID:5492
                                            • C:\windows\system32\ipconfig.exe
                                              C:\windows\system32\ipconfig.exe /release
                                              6⤵
                                              • Gathers network information
                                              PID:6360
                                      • C:\temp\CreateProcess.exe
                                        C:\temp\CreateProcess.exe C:\Temp\i_snkifaysqk.exe ups_ins
                                        3⤵
                                          PID:3096
                                          • C:\Temp\i_snkifaysqk.exe
                                            C:\Temp\i_snkifaysqk.exe ups_ins
                                            4⤵
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:2024
                                        • C:\temp\CreateProcess.exe
                                          C:\temp\CreateProcess.exe C:\Temp\xsmkfcausp.exe ups_run
                                          3⤵
                                            PID:1664
                                            • C:\Temp\xsmkfcausp.exe
                                              C:\Temp\xsmkfcausp.exe ups_run
                                              4⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:6864
                                              • C:\temp\CreateProcess.exe
                                                C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                5⤵
                                                  PID:1432
                                                  • C:\windows\system32\ipconfig.exe
                                                    C:\windows\system32\ipconfig.exe /release
                                                    6⤵
                                                    • Gathers network information
                                                    PID:3408
                                            • C:\temp\CreateProcess.exe
                                              C:\temp\CreateProcess.exe C:\Temp\i_xsmkfcausp.exe ups_ins
                                              3⤵
                                                PID:6228
                                                • C:\Temp\i_xsmkfcausp.exe
                                                  C:\Temp\i_xsmkfcausp.exe ups_ins
                                                  4⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:5112
                                              • C:\temp\CreateProcess.exe
                                                C:\temp\CreateProcess.exe C:\Temp\czusmkecxu.exe ups_run
                                                3⤵
                                                  PID:4348
                                                  • C:\Temp\czusmkecxu.exe
                                                    C:\Temp\czusmkecxu.exe ups_run
                                                    4⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:2748
                                                    • C:\temp\CreateProcess.exe
                                                      C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                      5⤵
                                                        PID:4220
                                                        • C:\windows\system32\ipconfig.exe
                                                          C:\windows\system32\ipconfig.exe /release
                                                          6⤵
                                                          • Gathers network information
                                                          PID:6592
                                                  • C:\temp\CreateProcess.exe
                                                    C:\temp\CreateProcess.exe C:\Temp\i_czusmkecxu.exe ups_ins
                                                    3⤵
                                                      PID:3792
                                                      • C:\Temp\i_czusmkecxu.exe
                                                        C:\Temp\i_czusmkecxu.exe ups_ins
                                                        4⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:716
                                                    • C:\temp\CreateProcess.exe
                                                      C:\temp\CreateProcess.exe C:\Temp\ecwupmhecw.exe ups_run
                                                      3⤵
                                                        PID:4464
                                                        • C:\Temp\ecwupmhecw.exe
                                                          C:\Temp\ecwupmhecw.exe ups_run
                                                          4⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:3972
                                                          • C:\temp\CreateProcess.exe
                                                            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                            5⤵
                                                              PID:4504
                                                              • C:\windows\system32\ipconfig.exe
                                                                C:\windows\system32\ipconfig.exe /release
                                                                6⤵
                                                                • Gathers network information
                                                                PID:2660
                                                        • C:\temp\CreateProcess.exe
                                                          C:\temp\CreateProcess.exe C:\Temp\i_ecwupmhecw.exe ups_ins
                                                          3⤵
                                                            PID:1600
                                                            • C:\Temp\i_ecwupmhecw.exe
                                                              C:\Temp\i_ecwupmhecw.exe ups_ins
                                                              4⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:5964
                                                          • C:\temp\CreateProcess.exe
                                                            C:\temp\CreateProcess.exe C:\Temp\hbztrojebz.exe ups_run
                                                            3⤵
                                                              PID:972
                                                              • C:\Temp\hbztrojebz.exe
                                                                C:\Temp\hbztrojebz.exe ups_run
                                                                4⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:4908
                                                                • C:\temp\CreateProcess.exe
                                                                  C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                                  5⤵
                                                                    PID:6008
                                                                    • C:\windows\system32\ipconfig.exe
                                                                      C:\windows\system32\ipconfig.exe /release
                                                                      6⤵
                                                                      • Gathers network information
                                                                      PID:5428
                                                            • C:\Program Files\Internet Explorer\iexplore.exe
                                                              "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
                                                              2⤵
                                                              • Modifies Internet Explorer settings
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:3348
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
                                                                3⤵
                                                                • Loads dropped DLL
                                                                • Drops file in Windows directory
                                                                • Enumerates system info in registry
                                                                • Modifies data under HKEY_USERS
                                                                • Modifies registry class
                                                                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                • Suspicious use of FindShellTrayWindow
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:6620
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffd8bbfc188,0x7ffd8bbfc194,0x7ffd8bbfc1a0
                                                                  4⤵
                                                                    PID:4468
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,5646972709977259182,14825002130064124432,262144 --field-trial-handle=2312,i,8191234557900469703,12649070385950899023,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
                                                                    4⤵
                                                                      PID:1372
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,14263376176134768058,4988568823426402943,524288 --field-trial-handle=2312,i,8191234557900469703,12649070385950899023,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:11
                                                                      4⤵
                                                                      • System Time Discovery
                                                                      PID:3924
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2444,i,2584668080443893275,13933063262857454069,524288 --field-trial-handle=2312,i,8191234557900469703,12649070385950899023,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:13
                                                                      4⤵
                                                                        PID:6272
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,5869356659519847399,818649941058685049,2097152 --field-trial-handle=2312,i,8191234557900469703,12649070385950899023,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
                                                                        4⤵
                                                                          PID:5272
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3540,i,13909303552348236300,3195009791451084810,2097152 --field-trial-handle=2312,i,8191234557900469703,12649070385950899023,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
                                                                          4⤵
                                                                            PID:1208
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,14317500814358361710,8300433481707754427,524288 --field-trial-handle=2312,i,8191234557900469703,12649070385950899023,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:14
                                                                            4⤵
                                                                              PID:2620
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,16297014881334354472,7670825151405937561,524288 --field-trial-handle=2312,i,8191234557900469703,12649070385950899023,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:14
                                                                              4⤵
                                                                                PID:2736
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,17453176472378209067,17313280811794586938,524288 --field-trial-handle=2312,i,8191234557900469703,12649070385950899023,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:14
                                                                                4⤵
                                                                                  PID:2984
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,17453176472378209067,17313280811794586938,524288 --field-trial-handle=2312,i,8191234557900469703,12649070385950899023,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:14
                                                                                  4⤵
                                                                                    PID:6632
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,3554099560683705364,9867846577182502831,524288 --field-trial-handle=2312,i,8191234557900469703,12649070385950899023,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
                                                                                    4⤵
                                                                                      PID:2952
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,14122167109678196596,16060450628439833803,524288 --field-trial-handle=2312,i,8191234557900469703,12649070385950899023,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:14
                                                                                      4⤵
                                                                                        PID:4144
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,16130500617885269047,13180277365564786117,524288 --field-trial-handle=2312,i,8191234557900469703,12649070385950899023,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
                                                                                        4⤵
                                                                                          PID:1888
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3376,i,12285299878679453825,3548276042182789216,524288 --field-trial-handle=2312,i,8191234557900469703,12649070385950899023,262144 --variations-seed-version --mojo-platform-channel-handle=3928 /prefetch:14
                                                                                          4⤵
                                                                                            PID:7120
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3276,i,379119746836982521,6307556429596715620,524288 --field-trial-handle=2312,i,8191234557900469703,12649070385950899023,262144 --variations-seed-version --mojo-platform-channel-handle=3928 /prefetch:14
                                                                                            4⤵
                                                                                              PID:96
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,14033422415213135520,3284744810811182998,524288 --field-trial-handle=2312,i,8191234557900469703,12649070385950899023,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
                                                                                              4⤵
                                                                                                PID:1408
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,1177645379605986342,13785544352707296327,524288 --field-trial-handle=2312,i,8191234557900469703,12649070385950899023,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
                                                                                                4⤵
                                                                                                  PID:936
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6776,i,5033295930011473782,4406185175317840171,524288 --field-trial-handle=2312,i,8191234557900469703,12649070385950899023,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:14
                                                                                                  4⤵
                                                                                                    PID:4464
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,1929474577729709078,4352558758640870321,524288 --field-trial-handle=2312,i,8191234557900469703,12649070385950899023,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
                                                                                                    4⤵
                                                                                                      PID:7144
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6800,i,5858862288872642690,16275272714252706669,262144 --field-trial-handle=2312,i,8191234557900469703,12649070385950899023,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:10
                                                                                                      4⤵
                                                                                                        PID:6840
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,18440498241274787044,5599392663359798816,524288 --field-trial-handle=2312,i,8191234557900469703,12649070385950899023,262144 --variations-seed-version --mojo-platform-channel-handle=1204 /prefetch:14
                                                                                                        4⤵
                                                                                                          PID:5688
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                    1⤵
                                                                                                      PID:6384
                                                                                                    • C:\Temp\pkhczurmjhfzxupm.sys
                                                                                                      C:\Temp\pkhczurmjhfzxupm.sys
                                                                                                      1⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:3424
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                      1⤵
                                                                                                        PID:5496
                                                                                                      • C:\Temp\mhczurmkec.sys
                                                                                                        C:\Temp\mhczurmkec.sys
                                                                                                        1⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:6520
                                                                                                      • C:\Temp\wuomgezwro.sys
                                                                                                        C:\Temp\wuomgezwro.sys
                                                                                                        1⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:6812
                                                                                                      • C:\Temp\rojgeywqoj.sys
                                                                                                        C:\Temp\rojgeywqoj.sys
                                                                                                        1⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:3872
                                                                                                      • C:\Temp\oigaytqlid.sys
                                                                                                        C:\Temp\oigaytqlid.sys
                                                                                                        1⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:2760
                                                                                                      • C:\Temp\igaysqlidb.sys
                                                                                                        C:\Temp\igaysqlidb.sys
                                                                                                        1⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:3792
                                                                                                      • C:\Temp\avtnlfdxvq.sys
                                                                                                        C:\Temp\avtnlfdxvq.sys
                                                                                                        1⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:3328
                                                                                                      • C:\Temp\vsnkicavsn.sys
                                                                                                        C:\Temp\vsnkicavsn.sys
                                                                                                        1⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:2468
                                                                                                      • C:\Temp\smkhczxusm.sys
                                                                                                        C:\Temp\smkhczxusm.sys
                                                                                                        1⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:4384
                                                                                                      • C:\Temp\pmhfzxrpjh.sys
                                                                                                        C:\Temp\pmhfzxrpjh.sys
                                                                                                        1⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:968
                                                                                                      • C:\Temp\mkebzurmjh.sys
                                                                                                        C:\Temp\mkebzurmjh.sys
                                                                                                        1⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:3884
                                                                                                      • C:\Temp\mgebwuomje.sys
                                                                                                        C:\Temp\mgebwuomje.sys
                                                                                                        1⤵
                                                                                                          PID:4696
                                                                                                        • C:\Temp\ywqoiytqlj.sys
                                                                                                          C:\Temp\ywqoiytqlj.sys
                                                                                                          1⤵
                                                                                                            PID:4832
                                                                                                          • C:\Temp\tqljgbytql.sys
                                                                                                            C:\Temp\tqljgbytql.sys
                                                                                                            1⤵
                                                                                                              PID:6516
                                                                                                            • C:\Temp\xvqnifaysq.sys
                                                                                                              C:\Temp\xvqnifaysq.sys
                                                                                                              1⤵
                                                                                                                PID:3536
                                                                                                              • C:\Temp\vsnkfdavsn.sys
                                                                                                                C:\Temp\vsnkfdavsn.sys
                                                                                                                1⤵
                                                                                                                  PID:6948
                                                                                                                • C:\Temp\dxvpnkfcxv.sys
                                                                                                                  C:\Temp\dxvpnkfcxv.sys
                                                                                                                  1⤵
                                                                                                                    PID:1724
                                                                                                                  • C:\Temp\hcausmkhca.sys
                                                                                                                    C:\Temp\hcausmkhca.sys
                                                                                                                    1⤵
                                                                                                                      PID:3956
                                                                                                                    • C:\Temp\bzurmkecwu.sys
                                                                                                                      C:\Temp\bzurmkecwu.sys
                                                                                                                      1⤵
                                                                                                                        PID:1144
                                                                                                                      • C:\Temp\gecwuomgez.sys
                                                                                                                        C:\Temp\gecwuomgez.sys
                                                                                                                        1⤵
                                                                                                                          PID:1176

                                                                                                                        Network

                                                                                                                              MITRE ATT&CK Enterprise v16

                                                                                                                              Replay Monitor

                                                                                                                              Loading Replay Monitor...

                                                                                                                              Downloads

                                                                                                                              avtnlfdxvq.sys
                                                                                                                              • Path C:\Temp\avtnlfdxvq.sys
                                                                                                                              • Size 293KB
                                                                                                                              • SHA256 16fb68d1d2f69e320e56173d72987167774209fa7b3ce7b08e59548ccd0dfe8c
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              i_igdyvqoida.exe
                                                                                                                              • Path C:\Temp\i_igdyvqoida.exe
                                                                                                                              • Size 384KB
                                                                                                                              • SHA256 ae4ee3500c21ada7e8b5b553940c695aa4b21329bd31f6c46bbdce912a228515
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              i_rojgbywtom.exe
                                                                                                                              • Path C:\Temp\i_rojgbywtom.exe
                                                                                                                              • Size 384KB
                                                                                                                              • SHA256 236a4039c41832d636673c96f5fcec2bddb1577740b7165be2dd6a1bf1a7efdf
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              i_urpjhbzurm.exe
                                                                                                                              • Path C:\Temp\i_urpjhbzurm.exe
                                                                                                                              • Size 384KB
                                                                                                                              • SHA256 9141445a6ca16a84632357239991f1f9245f8f8576cb3104e21d1ecd3f257f17
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              i_vtqlidaysq.exe
                                                                                                                              • Path C:\Temp\i_vtqlidaysq.exe
                                                                                                                              • Size 384KB
                                                                                                                              • SHA256 cd16d48447f7e20a4e9559729652a94dfcfbbb06618a15a0a124286a3f4b9638
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              i_wromgeywro.exe
                                                                                                                              • Path C:\Temp\i_wromgeywro.exe
                                                                                                                              • Size 384KB
                                                                                                                              • SHA256 4baf71b6d6a572e4b6b81f55f065257a92394da5e8ef1d2462441af81fdd1590
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              i_zusmkfzume.exe
                                                                                                                              • Path C:\Temp\i_zusmkfzume.exe
                                                                                                                              • Size 384KB
                                                                                                                              • SHA256 b34dc20723a752ea672d0ce6128f2364631603a41cc917a5d06a35743a450b8e
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              igaysqlidb.sys
                                                                                                                              • Path C:\Temp\igaysqlidb.sys
                                                                                                                              • Size 293KB
                                                                                                                              • SHA256 d5e240f3a64d63be4c663555142c71b43c96fe186cc52bfb4569215a9e1ec5af
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              igdyvqoida.exe
                                                                                                                              • Path C:\Temp\igdyvqoida.exe
                                                                                                                              • Size 384KB
                                                                                                                              • SHA256 14023e2a153d1e018e437765ed9ac18bf270a6696062706de90266c8ef530163
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              mhczurmkec.sys
                                                                                                                              • Path C:\Temp\mhczurmkec.sys
                                                                                                                              • Size 293KB
                                                                                                                              • SHA256 0fd8155e53db197c58202889982bd216ee43f9c2e5c0477341a205695044dace
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              oigaytqlid.sys
                                                                                                                              • Path C:\Temp\oigaytqlid.sys
                                                                                                                              • Size 293KB
                                                                                                                              • SHA256 845db87f9f283b7053e450174e32634114030f476b62f1e6683bd53d61636ecc
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              pkhczurmjhfzxupm.exe
                                                                                                                              • Path C:\Temp\pkhczurmjhfzxupm.exe
                                                                                                                              • Size 384KB
                                                                                                                              • SHA256 e5c494be24b79d2c921b2d8309cdfd0ca7205b4262b29efe72ec87935799fe8c
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              pkhczurmjhfzxupm.sys
                                                                                                                              • Path C:\Temp\pkhczurmjhfzxupm.sys
                                                                                                                              • Size 293KB
                                                                                                                              • SHA256 d6437d77606ccdabd251fcfc81f893ba5493e2d624b957bab517ba5528abb4a7
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              rojgbywtom.exe
                                                                                                                              • Path C:\Temp\rojgbywtom.exe
                                                                                                                              • Size 384KB
                                                                                                                              • SHA256 4d3e8e0fb0543ecdde030f45b4d51b90f9300ffcb6725e6e5b473d0bd3f29ec9
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              rojgeywqoj.sys
                                                                                                                              • Path C:\Temp\rojgeywqoj.sys
                                                                                                                              • Size 293KB
                                                                                                                              • SHA256 c2b63434a657e5f4e0389c63e8d99f6bc15f5fb59d52249393fe49eb57d2d70b
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              urpjhbzurm.exe
                                                                                                                              • Path C:\Temp\urpjhbzurm.exe
                                                                                                                              • Size 384KB
                                                                                                                              • SHA256 0bf45614bebb4ea8bad9aaa05718b1b0ec38a6493041225dd054be331880874c
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              vtqlidaysq.exe
                                                                                                                              • Path C:\Temp\vtqlidaysq.exe
                                                                                                                              • Size 384KB
                                                                                                                              • SHA256 a80911fa2f18c0057d045b2090a6a2550bb8eb28f67d79d030d429bdcddf3aac
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              wromgeywro.exe
                                                                                                                              • Path C:\Temp\wromgeywro.exe
                                                                                                                              • Size 384KB
                                                                                                                              • SHA256 c731587b2b7d9682b0c3adfd6a78081a2cfdd1e8ea16f287219cc8a3a0431567
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              wuomgezwro.sys
                                                                                                                              • Path C:\Temp\wuomgezwro.sys
                                                                                                                              • Size 293KB
                                                                                                                              • SHA256 3c648b4aa4bd2dd17409505d17e6f5ef0f6363b8e266cb7d9093512fb0e97482
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              zusmkfzume.exe
                                                                                                                              • Path C:\Temp\zusmkfzume.exe
                                                                                                                              • Size 384KB
                                                                                                                              • SHA256 e9315ea3906c39e8b22a560db809074484453a33daadfa00c219d0dd8fe746c8
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              settings.dat
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                              • Size 280B
                                                                                                                              • SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              BookmarkMergedSurfaceOrdering
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                              • Size 6B
                                                                                                                              • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                              Submit Download

                                                                                                                              BrowsingTopicsState
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
                                                                                                                              • Size 414B
                                                                                                                              • SHA256 ad81d278f40538fa3969c044b954ea768c23e4d29c897060b4700549eb72ffc0
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              SiteList-Enterprise.json
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                              • Size 2B
                                                                                                                              • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                              Submit Download

                                                                                                                              Network Persistent State
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                              • Size 2KB
                                                                                                                              • SHA256 908a72efc8e365ed4a832f164e88490f78eb5baf90953f73338ac17bda0c435b
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              SCT Auditing Pending Reports
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                              • Size 2B
                                                                                                                              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                              Submit Download

                                                                                                                              Sdch Dictionaries
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                              • Size 40B
                                                                                                                              • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                              Submit Download

                                                                                                                              Preferences
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                              • Size 15KB
                                                                                                                              • SHA256 879193679344afe4dbec25616547c7186c33478d4cfecd603cb14278d5638b6f
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              Preferences
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                              • Size 16KB
                                                                                                                              • SHA256 7345980b6927b03f33e866b36884c462644839f6300fa9525df46aff49d27d42
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              Secure Preferences
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                              • Size 32KB
                                                                                                                              • SHA256 b7c0c779ea8717083ac51db564b35e308c535ba08740c3934096dd360683ef8b
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              sync_diagnostic.log
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                              • Size 23KB
                                                                                                                              • SHA256 1938a24810331a384c98a1ce99562b74dcc022f64b0a81f97ee000b7ab9d9f03
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              Local State
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                              • Size 24KB
                                                                                                                              • SHA256 92efe6f1b8a94942fc75304c404fce4f49024b47977acfce0c2b1ffeafcadd58
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              Local State
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                              • Size 31KB
                                                                                                                              • SHA256 e0d20accc22a622a01574725e0c0bc672e14b31094b9dddb2a6bed93c5f3f37c
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              Local State
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                              • Size 26KB
                                                                                                                              • SHA256 6a6784719e501b601f0e7133147ae26e4b693bbf657d473953829ac256d02237
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              Local State
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                              • Size 26KB
                                                                                                                              • SHA256 fd8400ae7674a56e4c305725f1d298b6a1b61e45d9faf5fc81844d103bf6c717
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              Local State
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                              • Size 27KB
                                                                                                                              • SHA256 6f16555cca2bb0357296f20c53c03f828cede9e1d71921d32ae615421d04fff3
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              Local State
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                              • Size 26KB
                                                                                                                              • SHA256 624d18a116976c58933718342ba9ee0fabe1f25fb4d2be6b67e00d26452885bb
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              metadata.json
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                              • Size 2KB
                                                                                                                              • SHA256 a3278f957234771d848a4b3ee9901aeec341d2434b924c995300d2e0713b1b7b
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              metadata.json
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                              • Size 2KB
                                                                                                                              • SHA256 c588967d7a6416eedcbfa0801806f5137d43ab27f0332710af7b137709088910
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              metadata.json
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                              • Size 2KB
                                                                                                                              • SHA256 462d7e808963e2604c30ade17e2177d755e533a3d5aafcfbd2a338e44dc14cbc
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
                                                                                                                              • Size 154KB
                                                                                                                              • SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              metadata.json
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                                                                              • Size 132B
                                                                                                                              • SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              CreateProcess.exe
                                                                                                                              • Path C:\temp\CreateProcess.exe
                                                                                                                              • Size 3KB
                                                                                                                              • SHA256 1fdd7a091a13894d142d541e911abcd767cdad405c579e449acefd26b192f40a
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              memory/968-516-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/1144-657-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/1176-668-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/1724-624-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2468-507-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2760-449-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3328-509-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3328-503-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3424-52-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3536-608-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3792-462-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3872-201-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3884-548-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3956-645-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4384-512-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4696-552-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4832-583-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4832-588-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/6516-587-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/6520-145-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/6520-186-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/6812-180-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/6812-207-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/6948-619-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download