Overview

overview

10

Static

static

10

2026-08-25...op.exe

windows10-2004-x64

10

2026-08-25...op.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    142s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    26/08/2026, 04:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-25_e81e2e22651e87939a1a0478c728adba_amadey_darkgate_elex_smoke-loader_stop.exe
  • Size 384KB
  • Sample260826-eza1bsbf47
  • SHA256 0f9a03220c02e017403b575da0892deaf80531978f6762879a6e56486343f1c4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarediscoverysystexspywaretrojan

Malware Config

Signatures

  • Family: Systex

    Systex is a trojan loader written in C++.

    trojansystex
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers network information 2 TTPs 20 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 20 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-25_e81e2e22651e87939a1a0478c728adba_amadey_darkgate_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-25_e81e2e22651e87939a1a0478c728adba_amadey_darkgate_elex_smoke-loader_stop.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2532
    • C:\Temp\gaysqkidavtnlfdx.exe
      C:\Temp\gaysqkidavtnlfdx.exe run
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1724
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\fdavtnifys.exe ups_run
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:204
        • C:\Temp\fdavtnifys.exe
          C:\Temp\fdavtnifys.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1336
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:4960
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:2648
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_fdavtnifys.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:3976
        • C:\Temp\i_fdavtnifys.exe
          C:\Temp\i_fdavtnifys.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4548
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\nhfavsnkfd.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:4876
        • C:\Temp\nhfavsnkfd.exe
          C:\Temp\nhfavsnkfd.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5832
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:1768
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:6856
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_nhfavsnkfd.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:6908
        • C:\Temp\i_nhfavsnkfd.exe
          C:\Temp\i_nhfavsnkfd.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:5852
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\spkhcausmk.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:6120
        • C:\Temp\spkhcausmk.exe
          C:\Temp\spkhcausmk.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3280
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:4488
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:620
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_spkhcausmk.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:696
        • C:\Temp\i_spkhcausmk.exe
          C:\Temp\i_spkhcausmk.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:5636
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\czxrpkecwu.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:3480
        • C:\Temp\czxrpkecwu.exe
          C:\Temp\czxrpkecwu.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:6240
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:4968
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:3236
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_czxrpkecwu.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:3940
        • C:\Temp\i_czxrpkecwu.exe
          C:\Temp\i_czxrpkecwu.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3448
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\czurmkecwu.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:3144
        • C:\Temp\czurmkecwu.exe
          C:\Temp\czurmkecwu.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4216
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:1608
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:1004
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_czurmkecwu.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:2776
        • C:\Temp\i_czurmkecwu.exe
          C:\Temp\i_czurmkecwu.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3132
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\rmjebwuomg.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:5392
        • C:\Temp\rmjebwuomg.exe
          C:\Temp\rmjebwuomg.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:6252
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:4152
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:7124
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_rmjebwuomg.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:6080
        • C:\Temp\i_rmjebwuomg.exe
          C:\Temp\i_rmjebwuomg.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:6900
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\ytrljdbwtr.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:1564
        • C:\Temp\ytrljdbwtr.exe
          C:\Temp\ytrljdbwtr.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5656
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:3032
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:1456
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_ytrljdbwtr.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:7148
        • C:\Temp\i_ytrljdbwtr.exe
          C:\Temp\i_ytrljdbwtr.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:5072
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\nljdbvtolg.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:6264
        • C:\Temp\nljdbvtolg.exe
          C:\Temp\nljdbvtolg.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:6836
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:6516
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:6332
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_nljdbvtolg.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:1864
        • C:\Temp\i_nljdbvtolg.exe
          C:\Temp\i_nljdbvtolg.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1344
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\dxvqnigdxv.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:4220
        • C:\Temp\dxvqnigdxv.exe
          C:\Temp\dxvqnigdxv.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1840
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:1200
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:4456
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_dxvqnigdxv.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:472
        • C:\Temp\i_dxvqnigdxv.exe
          C:\Temp\i_dxvqnigdxv.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2000
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\sqkicavsnl.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:2088
        • C:\Temp\sqkicavsnl.exe
          C:\Temp\sqkicavsnl.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4980
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:2216
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:3956
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_sqkicavsnl.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:940
        • C:\Temp\i_sqkicavsnl.exe
          C:\Temp\i_sqkicavsnl.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2104
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\vpnhfdxvpn.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:3180
        • C:\Temp\vpnhfdxvpn.exe
          C:\Temp\vpnhfdxvpn.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:6288
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
              PID:2140
              • C:\windows\system32\ipconfig.exe
                C:\windows\system32\ipconfig.exe /release
                6⤵
                • Gathers network information
                PID:5368
        • C:\temp\CreateProcess.exe
          C:\temp\CreateProcess.exe C:\Temp\i_vpnhfdxvpn.exe ups_ins
          3⤵
            PID:1612
            • C:\Temp\i_vpnhfdxvpn.exe
              C:\Temp\i_vpnhfdxvpn.exe ups_ins
              4⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:6676
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\Temp\ausmkecxup.exe ups_run
            3⤵
              PID:5624
              • C:\Temp\ausmkecxup.exe
                C:\Temp\ausmkecxup.exe ups_run
                4⤵
                • System Location Discovery: System Language Discovery
                PID:6132
                • C:\temp\CreateProcess.exe
                  C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                  5⤵
                    PID:3576
                    • C:\windows\system32\ipconfig.exe
                      C:\windows\system32\ipconfig.exe /release
                      6⤵
                      • Gathers network information
                      PID:5956
              • C:\temp\CreateProcess.exe
                C:\temp\CreateProcess.exe C:\Temp\i_ausmkecxup.exe ups_ins
                3⤵
                  PID:6736
                  • C:\Temp\i_ausmkecxup.exe
                    C:\Temp\i_ausmkecxup.exe ups_ins
                    4⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5668
                • C:\temp\CreateProcess.exe
                  C:\temp\CreateProcess.exe C:\Temp\xrpjhczurm.exe ups_run
                  3⤵
                    PID:6296
                    • C:\Temp\xrpjhczurm.exe
                      C:\Temp\xrpjhczurm.exe ups_run
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:3076
                      • C:\temp\CreateProcess.exe
                        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                        5⤵
                          PID:5464
                          • C:\windows\system32\ipconfig.exe
                            C:\windows\system32\ipconfig.exe /release
                            6⤵
                            • Gathers network information
                            PID:1088
                    • C:\temp\CreateProcess.exe
                      C:\temp\CreateProcess.exe C:\Temp\i_xrpjhczurm.exe ups_ins
                      3⤵
                        PID:5908
                        • C:\Temp\i_xrpjhczurm.exe
                          C:\Temp\i_xrpjhczurm.exe ups_ins
                          4⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          PID:5480
                      • C:\temp\CreateProcess.exe
                        C:\temp\CreateProcess.exe C:\Temp\uomgezwrpj.exe ups_run
                        3⤵
                          PID:2040
                          • C:\Temp\uomgezwrpj.exe
                            C:\Temp\uomgezwrpj.exe ups_run
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:5496
                            • C:\temp\CreateProcess.exe
                              C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                              5⤵
                                PID:6548
                                • C:\windows\system32\ipconfig.exe
                                  C:\windows\system32\ipconfig.exe /release
                                  6⤵
                                  • Gathers network information
                                  PID:6868
                          • C:\temp\CreateProcess.exe
                            C:\temp\CreateProcess.exe C:\Temp\i_uomgezwrpj.exe ups_ins
                            3⤵
                              PID:3344
                              • C:\Temp\i_uomgezwrpj.exe
                                C:\Temp\i_uomgezwrpj.exe ups_ins
                                4⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of AdjustPrivilegeToken
                                PID:780
                            • C:\temp\CreateProcess.exe
                              C:\temp\CreateProcess.exe C:\Temp\ztoljgeywu.exe ups_run
                              3⤵
                                PID:6664
                                • C:\Temp\ztoljgeywu.exe
                                  C:\Temp\ztoljgeywu.exe ups_run
                                  4⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:4724
                                  • C:\temp\CreateProcess.exe
                                    C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                    5⤵
                                      PID:4464
                                      • C:\windows\system32\ipconfig.exe
                                        C:\windows\system32\ipconfig.exe /release
                                        6⤵
                                        • Gathers network information
                                        PID:3800
                                • C:\temp\CreateProcess.exe
                                  C:\temp\CreateProcess.exe C:\Temp\i_ztoljgeywu.exe ups_ins
                                  3⤵
                                    PID:2320
                                    • C:\Temp\i_ztoljgeywu.exe
                                      C:\Temp\i_ztoljgeywu.exe ups_ins
                                      4⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:5960
                                  • C:\temp\CreateProcess.exe
                                    C:\temp\CreateProcess.exe C:\Temp\ytqojgbytr.exe ups_run
                                    3⤵
                                      PID:5220
                                      • C:\Temp\ytqojgbytr.exe
                                        C:\Temp\ytqojgbytr.exe ups_run
                                        4⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:3272
                                        • C:\temp\CreateProcess.exe
                                          C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                          5⤵
                                            PID:6960
                                            • C:\windows\system32\ipconfig.exe
                                              C:\windows\system32\ipconfig.exe /release
                                              6⤵
                                              • Gathers network information
                                              PID:3420
                                      • C:\temp\CreateProcess.exe
                                        C:\temp\CreateProcess.exe C:\Temp\i_ytqojgbytr.exe ups_ins
                                        3⤵
                                          PID:1588
                                          • C:\Temp\i_ytqojgbytr.exe
                                            C:\Temp\i_ytqojgbytr.exe ups_ins
                                            4⤵
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:2800
                                        • C:\temp\CreateProcess.exe
                                          C:\temp\CreateProcess.exe C:\Temp\aysqlidbvt.exe ups_run
                                          3⤵
                                            PID:4636
                                            • C:\Temp\aysqlidbvt.exe
                                              C:\Temp\aysqlidbvt.exe ups_run
                                              4⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:2012
                                              • C:\temp\CreateProcess.exe
                                                C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                5⤵
                                                  PID:5016
                                                  • C:\windows\system32\ipconfig.exe
                                                    C:\windows\system32\ipconfig.exe /release
                                                    6⤵
                                                    • Gathers network information
                                                    PID:5012
                                            • C:\temp\CreateProcess.exe
                                              C:\temp\CreateProcess.exe C:\Temp\i_aysqlidbvt.exe ups_ins
                                              3⤵
                                                PID:5884
                                                • C:\Temp\i_aysqlidbvt.exe
                                                  C:\Temp\i_aysqlidbvt.exe ups_ins
                                                  4⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:1264
                                              • C:\temp\CreateProcess.exe
                                                C:\temp\CreateProcess.exe C:\Temp\idayvqnlfd.exe ups_run
                                                3⤵
                                                  PID:3968
                                                  • C:\Temp\idayvqnlfd.exe
                                                    C:\Temp\idayvqnlfd.exe ups_run
                                                    4⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:6844
                                                    • C:\temp\CreateProcess.exe
                                                      C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                      5⤵
                                                        PID:3484
                                                        • C:\windows\system32\ipconfig.exe
                                                          C:\windows\system32\ipconfig.exe /release
                                                          6⤵
                                                          • Gathers network information
                                                          PID:5292
                                                  • C:\temp\CreateProcess.exe
                                                    C:\temp\CreateProcess.exe C:\Temp\i_idayvqnlfd.exe ups_ins
                                                    3⤵
                                                      PID:2980
                                                      • C:\Temp\i_idayvqnlfd.exe
                                                        C:\Temp\i_idayvqnlfd.exe ups_ins
                                                        4⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:4544
                                                    • C:\temp\CreateProcess.exe
                                                      C:\temp\CreateProcess.exe C:\Temp\kfdxvpnlfd.exe ups_run
                                                      3⤵
                                                        PID:5636
                                                        • C:\Temp\kfdxvpnlfd.exe
                                                          C:\Temp\kfdxvpnlfd.exe ups_run
                                                          4⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:4620
                                                          • C:\temp\CreateProcess.exe
                                                            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                            5⤵
                                                              PID:5828
                                                              • C:\windows\system32\ipconfig.exe
                                                                C:\windows\system32\ipconfig.exe /release
                                                                6⤵
                                                                • Gathers network information
                                                                PID:3412
                                                        • C:\temp\CreateProcess.exe
                                                          C:\temp\CreateProcess.exe C:\Temp\i_kfdxvpnlfd.exe ups_ins
                                                          3⤵
                                                            PID:5208
                                                            • C:\Temp\i_kfdxvpnlfd.exe
                                                              C:\Temp\i_kfdxvpnlfd.exe ups_ins
                                                              4⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:6472
                                                          • C:\temp\CreateProcess.exe
                                                            C:\temp\CreateProcess.exe C:\Temp\kicauspkif.exe ups_run
                                                            3⤵
                                                              PID:2804
                                                              • C:\Temp\kicauspkif.exe
                                                                C:\Temp\kicauspkif.exe ups_run
                                                                4⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:4852
                                                                • C:\temp\CreateProcess.exe
                                                                  C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                                  5⤵
                                                                    PID:5676
                                                                    • C:\windows\system32\ipconfig.exe
                                                                      C:\windows\system32\ipconfig.exe /release
                                                                      6⤵
                                                                      • Gathers network information
                                                                      PID:6244
                                                            • C:\Program Files\Internet Explorer\iexplore.exe
                                                              "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
                                                              2⤵
                                                              • Modifies Internet Explorer settings
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:3092
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
                                                                3⤵
                                                                • Loads dropped DLL
                                                                • Drops file in Windows directory
                                                                • Enumerates system info in registry
                                                                • Modifies data under HKEY_USERS
                                                                • Modifies registry class
                                                                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                • Suspicious use of FindShellTrayWindow
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:5752
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x304,0x7ffa5e2bc188,0x7ffa5e2bc194,0x7ffa5e2bc1a0
                                                                  4⤵
                                                                    PID:6156
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,6304943296380466083,5912066317739288968,262144 --field-trial-handle=2276,i,2653383859497961625,17431289661157458602,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
                                                                    4⤵
                                                                      PID:6920
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,14691560079231375282,11019069816969585588,524288 --field-trial-handle=2276,i,2653383859497961625,17431289661157458602,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:11
                                                                      4⤵
                                                                      • System Time Discovery
                                                                      PID:716
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,6220190225165454942,5766426642027407933,524288 --field-trial-handle=2276,i,2653383859497961625,17431289661157458602,262144 --variations-seed-version --mojo-platform-channel-handle=3168 /prefetch:13
                                                                      4⤵
                                                                        PID:2944
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,14297873929024540572,2390596638906024963,2097152 --field-trial-handle=2276,i,2653383859497961625,17431289661157458602,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
                                                                        4⤵
                                                                          PID:6196
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3536,i,6099029504290869304,12388741385592001274,2097152 --field-trial-handle=2276,i,2653383859497961625,17431289661157458602,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
                                                                          4⤵
                                                                            PID:7036
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,16429409173685276739,2886430379053466078,524288 --field-trial-handle=2276,i,2653383859497961625,17431289661157458602,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
                                                                            4⤵
                                                                              PID:468
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,6721059666581185582,13471558475711123732,524288 --field-trial-handle=2276,i,2653383859497961625,17431289661157458602,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:14
                                                                              4⤵
                                                                                PID:1972
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,172527258295305471,10318202883200402325,524288 --field-trial-handle=2276,i,2653383859497961625,17431289661157458602,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:14
                                                                                4⤵
                                                                                  PID:6516
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,172527258295305471,10318202883200402325,524288 --field-trial-handle=2276,i,2653383859497961625,17431289661157458602,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:14
                                                                                  4⤵
                                                                                    PID:4796
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,1696549615486074089,11323254326248994276,524288 --field-trial-handle=2276,i,2653383859497961625,17431289661157458602,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
                                                                                    4⤵
                                                                                      PID:5908
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,1167758172790614656,7893940738594890723,524288 --field-trial-handle=2276,i,2653383859497961625,17431289661157458602,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:14
                                                                                      4⤵
                                                                                        PID:6796
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,18190381340715361079,11272351888898156004,524288 --field-trial-handle=2276,i,2653383859497961625,17431289661157458602,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
                                                                                        4⤵
                                                                                          PID:1696
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,6068566543947572761,15791844933184013775,524288 --field-trial-handle=2276,i,2653383859497961625,17431289661157458602,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:14
                                                                                          4⤵
                                                                                            PID:964
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2144,i,15524335375760548918,1701193529583505902,524288 --field-trial-handle=2276,i,2653383859497961625,17431289661157458602,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:14
                                                                                            4⤵
                                                                                              PID:1264
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,11093247692859998733,1357413322265211310,524288 --field-trial-handle=2276,i,2653383859497961625,17431289661157458602,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:14
                                                                                              4⤵
                                                                                                PID:484
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,3627087777197877971,12187314692399360788,524288 --field-trial-handle=2276,i,2653383859497961625,17431289661157458602,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
                                                                                                4⤵
                                                                                                  PID:2544
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,14882606864446964162,9917580986400488441,524288 --field-trial-handle=2276,i,2653383859497961625,17431289661157458602,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
                                                                                                  4⤵
                                                                                                    PID:5372
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,2071740484396330974,16636995014314701792,524288 --field-trial-handle=2276,i,2653383859497961625,17431289661157458602,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
                                                                                                    4⤵
                                                                                                      PID:4104
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5376,i,10020355337293609397,17187876482111661628,262144 --field-trial-handle=2276,i,2653383859497961625,17431289661157458602,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:10
                                                                                                      4⤵
                                                                                                        PID:6228
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,1854459491046935188,11260204830551181428,524288 --field-trial-handle=2276,i,2653383859497961625,17431289661157458602,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:14
                                                                                                        4⤵
                                                                                                          PID:3932
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                    1⤵
                                                                                                      PID:5968
                                                                                                    • C:\Temp\gaysqkidavtnlfdx.sys
                                                                                                      C:\Temp\gaysqkidavtnlfdx.sys
                                                                                                      1⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:4452
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                      1⤵
                                                                                                        PID:908
                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                        C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                                                                        1⤵
                                                                                                          PID:2136
                                                                                                        • C:\Temp\davsnlfdxv.sys
                                                                                                          C:\Temp\davsnlfdxv.sys
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:3272
                                                                                                        • C:\Temp\snkfdxvpnh.sys
                                                                                                          C:\Temp\snkfdxvpnh.sys
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:6020
                                                                                                        • C:\Temp\cxusmkeczx.sys
                                                                                                          C:\Temp\cxusmkeczx.sys
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:200
                                                                                                        • C:\Temp\jhbzxuomhe.sys
                                                                                                          C:\Temp\jhbzxuomhe.sys
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:1116
                                                                                                        • C:\Temp\ztrmjebzwr.sys
                                                                                                          C:\Temp\ztrmjebzwr.sys
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:404
                                                                                                        • C:\Temp\ztrojgbzwr.sys
                                                                                                          C:\Temp\ztrojgbzwr.sys
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:4524
                                                                                                        • C:\Temp\lgdywqoigb.sys
                                                                                                          C:\Temp\lgdywqoigb.sys
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:2388
                                                                                                        • C:\Temp\ligayvtnlf.sys
                                                                                                          C:\Temp\ligayvtnlf.sys
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:4792
                                                                                                        • C:\Temp\fdyvqnigay.sys
                                                                                                          C:\Temp\fdyvqnigay.sys
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:4548
                                                                                                        • C:\Temp\xvpnifaysq.sys
                                                                                                          C:\Temp\xvpnifaysq.sys
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:896
                                                                                                        • C:\Temp\ausmkecxup.sys
                                                                                                          C:\Temp\ausmkecxup.sys
                                                                                                          1⤵
                                                                                                            PID:3388
                                                                                                          • C:\Temp\zxrpmhezxr.sys
                                                                                                            C:\Temp\zxrpmhezxr.sys
                                                                                                            1⤵
                                                                                                              PID:5028
                                                                                                            • C:\Temp\cwurmkecwu.sys
                                                                                                              C:\Temp\cwurmkecwu.sys
                                                                                                              1⤵
                                                                                                                PID:2656
                                                                                                              • C:\Temp\wtomgeywro.sys
                                                                                                                C:\Temp\wtomgeywro.sys
                                                                                                                1⤵
                                                                                                                  PID:2144
                                                                                                                • C:\Temp\bwqomgebvt.sys
                                                                                                                  C:\Temp\bwqomgebvt.sys
                                                                                                                  1⤵
                                                                                                                    PID:7024
                                                                                                                  • C:\Temp\jdbvtndyvq.sys
                                                                                                                    C:\Temp\jdbvtndyvq.sys
                                                                                                                    1⤵
                                                                                                                      PID:3088
                                                                                                                    • C:\Temp\idavsqoiga.sys
                                                                                                                      C:\Temp\idavsqoiga.sys
                                                                                                                      1⤵
                                                                                                                        PID:5396
                                                                                                                      • C:\Temp\nifdavtnlf.sys
                                                                                                                        C:\Temp\nifdavtnlf.sys
                                                                                                                        1⤵
                                                                                                                          PID:5228
                                                                                                                        • C:\Temp\nhfzxspnic.sys
                                                                                                                          C:\Temp\nhfzxspnic.sys
                                                                                                                          1⤵
                                                                                                                            PID:5028

                                                                                                                          Network

                                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                                Replay Monitor

                                                                                                                                Loading Replay Monitor...

                                                                                                                                Downloads

                                                                                                                                cxusmkeczx.sys
                                                                                                                                • Path C:\Temp\cxusmkeczx.sys
                                                                                                                                • Size 293KB
                                                                                                                                • SHA256 d11b613c78e0018285aa447abaf626b3c42ddfd15843641cf261a62e05bda3ec
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                czurmkecwu.exe
                                                                                                                                • Path C:\Temp\czurmkecwu.exe
                                                                                                                                • Size 384KB
                                                                                                                                • SHA256 8720dc17e7f0ff7dbbb9ef160e4ffad0c33b6da18ee5e008bf3477f10d8ba461
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                czxrpkecwu.exe
                                                                                                                                • Path C:\Temp\czxrpkecwu.exe
                                                                                                                                • Size 384KB
                                                                                                                                • SHA256 5798a31b3d2c415692bb3aa79dff4b41c6cece4d1caafca649ac51404a9c96dc
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                davsnlfdxv.sys
                                                                                                                                • Path C:\Temp\davsnlfdxv.sys
                                                                                                                                • Size 293KB
                                                                                                                                • SHA256 2df3b08ab86331d5db2079992304655916989bc005943a16ba9a6f5353c3eed4
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                fdavtnifys.exe
                                                                                                                                • Path C:\Temp\fdavtnifys.exe
                                                                                                                                • Size 384KB
                                                                                                                                • SHA256 8ce7a1e35f59493b1afdcd2548374a08aeef8dbb3fcb6948fd7748d778899c92
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                gaysqkidavtnlfdx.exe
                                                                                                                                • Path C:\Temp\gaysqkidavtnlfdx.exe
                                                                                                                                • Size 384KB
                                                                                                                                • SHA256 26b13851f3ab90bd078500c7b5901d2cba343dbd08b81420bbccfddb44140bf0
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                gaysqkidavtnlfdx.sys
                                                                                                                                • Path C:\Temp\gaysqkidavtnlfdx.sys
                                                                                                                                • Size 293KB
                                                                                                                                • SHA256 5b844e909acb06a3cee6a734c4fc418f12b443ba15ea20107833ff0241975dfc
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                i_czurmkecwu.exe
                                                                                                                                • Path C:\Temp\i_czurmkecwu.exe
                                                                                                                                • Size 384KB
                                                                                                                                • SHA256 53ecb2b7fd43e416b5837fbe7d40a6645eb5d3bf323fa8430aba782c5fbae35a
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                i_czxrpkecwu.exe
                                                                                                                                • Path C:\Temp\i_czxrpkecwu.exe
                                                                                                                                • Size 384KB
                                                                                                                                • SHA256 821024890ee01f368a4db7d43a08afaaace532752d08125fab83a71f3d68d45e
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                i_fdavtnifys.exe
                                                                                                                                • Path C:\Temp\i_fdavtnifys.exe
                                                                                                                                • Size 384KB
                                                                                                                                • SHA256 5937b4426beceb8f852e630fa17ece9ac3623962ebcac1696de2700d7cbda3fb
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                i_nhfavsnkfd.exe
                                                                                                                                • Path C:\Temp\i_nhfavsnkfd.exe
                                                                                                                                • Size 384KB
                                                                                                                                • SHA256 d9ff3b9d50bb49a996382c70f14fe18fd92198f27700bdb7730f682ef1f695e1
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                i_rmjebwuomg.exe
                                                                                                                                • Path C:\Temp\i_rmjebwuomg.exe
                                                                                                                                • Size 384KB
                                                                                                                                • SHA256 0829ba412c3371afc70af6787a5313e27d3efbc3721c72c9c5e92a754c4afc64
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                i_spkhcausmk.exe
                                                                                                                                • Path C:\Temp\i_spkhcausmk.exe
                                                                                                                                • Size 384KB
                                                                                                                                • SHA256 193dfe6d0bacb2ea5078da05c114eb3cea8636a8de9e3e6a7f87668811fef134
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                jhbzxuomhe.sys
                                                                                                                                • Path C:\Temp\jhbzxuomhe.sys
                                                                                                                                • Size 293KB
                                                                                                                                • SHA256 f3b5e03c236b58955b81566c09b225112fcb814f40fe973d2975b508c1efaab5
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                nhfavsnkfd.exe
                                                                                                                                • Path C:\Temp\nhfavsnkfd.exe
                                                                                                                                • Size 384KB
                                                                                                                                • SHA256 8a83156ff99dc53d4bc49052d1362d2f0cc0075c3d7717a46e07f480ca89a0af
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                rmjebwuomg.exe
                                                                                                                                • Path C:\Temp\rmjebwuomg.exe
                                                                                                                                • Size 384KB
                                                                                                                                • SHA256 fc723cee2f814a3de4cdbb13c4232ca6f4079583da7aa32cfa00eec92456eeaf
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                snkfdxvpnh.sys
                                                                                                                                • Path C:\Temp\snkfdxvpnh.sys
                                                                                                                                • Size 293KB
                                                                                                                                • SHA256 caf26bd6aea5a9a1d10bd0605f9ccfac6684b441d8fd5dd5a74381ad6b7b2149
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                spkhcausmk.exe
                                                                                                                                • Path C:\Temp\spkhcausmk.exe
                                                                                                                                • Size 384KB
                                                                                                                                • SHA256 c3a0ea1a6e848248dfa39c00adb4019dd04d704ece82533591c239cb71bf5e81
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                ztrmjebzwr.sys
                                                                                                                                • Path C:\Temp\ztrmjebzwr.sys
                                                                                                                                • Size 293KB
                                                                                                                                • SHA256 9ec35109a5e366592c1304259acf98d296eed28d82b68495c650e5dad563276e
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                ztrojgbzwr.sys
                                                                                                                                • Path C:\Temp\ztrojgbzwr.sys
                                                                                                                                • Size 293KB
                                                                                                                                • SHA256 a64f1b2317933136294e1088ce01d076b2d07c55a7ac79c3f80934c06f131902
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                settings.dat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                • Size 280B
                                                                                                                                • SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                settings.dat
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                • Size 280B
                                                                                                                                • SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                BookmarkMergedSurfaceOrdering
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                                • Size 6B
                                                                                                                                • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                Submit Download

                                                                                                                                BrowsingTopicsState
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
                                                                                                                                • Size 414B
                                                                                                                                • SHA256 cd9d444c4aad6b292da9703fb8df42cfa49e226ffc002c5320878e261438b07b
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                SiteList-Enterprise.json
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                                • Size 2B
                                                                                                                                • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                Submit Download

                                                                                                                                Network Persistent State
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                • Size 2KB
                                                                                                                                • SHA256 e07b2071dc772621efaf9c255a4ff107a57696272dbde4f1ab8ece639a402812
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                SCT Auditing Pending Reports
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                • Size 2B
                                                                                                                                • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                Submit Download

                                                                                                                                Sdch Dictionaries
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                                • Size 40B
                                                                                                                                • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                Submit Download

                                                                                                                                Preferences
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                • Size 15KB
                                                                                                                                • SHA256 831ce915d0eb6ffb0c1ea6dab42cbf4d0d4ab5f5edd47235c3f5d83a3d93c726
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                Preferences
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                • Size 16KB
                                                                                                                                • SHA256 22b7c2408f149b810179d33f9bedc41f596597de172cf75907635800069e20ab
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                Secure Preferences
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                • Size 32KB
                                                                                                                                • SHA256 f8828f9fa50acc36fb4834c7b84b563ec5789ae25f493a074ba934b54d5746e6
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                sync_diagnostic.log
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                                • Size 23KB
                                                                                                                                • SHA256 fc45f716a9947f7e41baf57a9386e7b1d4469c87f434fa31699843a5adeea278
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                Local State
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                • Size 26KB
                                                                                                                                • SHA256 77e2c4ed496c38852f0b8c305de3ceb178265928f5898f578aebd72b214de542
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                Local State
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                • Size 27KB
                                                                                                                                • SHA256 1e598ea6cf7e5c83e41f6c55106436483e41f209d02da26613ca9ae9c011f5b9
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                Local State
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                • Size 24KB
                                                                                                                                • SHA256 9bb866bbe6ef073627d39de39ec0651db2adc3e1415a5e106042dd4727d801f2
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                Local State
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                • Size 32KB
                                                                                                                                • SHA256 1d770d98714d8211d9974795fc4ca81b93276bab5e55c78b9f3b4494250c32d7
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                Local State
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                • Size 27KB
                                                                                                                                • SHA256 9dbcd31f5065c03e354d488a4b2b92198313701cffa7bc2b714f14d5e9ffd31f
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                b0ee3a38-ccb5-4557-91d1-4f6c963b58b3.tmp
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b0ee3a38-ccb5-4557-91d1-4f6c963b58b3.tmp
                                                                                                                                • Size 27KB
                                                                                                                                • SHA256 6857ba657c25cba73fdc70dd9d0706ee3d92296d87dae0a3cc578a1896dc0c01
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                metadata.json
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                • Size 2KB
                                                                                                                                • SHA256 5b13b6fcdf04fb96e793406611cf7bea4f0b25a21e6210ff6fcfb1601d456cec
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                metadata.json
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                • Size 2KB
                                                                                                                                • SHA256 f7edb8e54884795a399cf363b08025af7a10f0a9e9c48c87854a53534b72072a
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                metadata.json
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                • Size 2KB
                                                                                                                                • SHA256 198b99c6b5a58e5459049aaee5a73965c3b7935d6a5a4e19951ec0cd4030687b
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                metadata.json
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                • Size 2KB
                                                                                                                                • SHA256 fc8158bcac0e1a43c912e8899e7f1c5e1d622db63f0096f7ece6833f081442b6
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                03c03bb2-fae6-4638-b29f-6375391d7e79.tmp
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\03c03bb2-fae6-4638-b29f-6375391d7e79.tmp
                                                                                                                                • Size 132B
                                                                                                                                • SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
                                                                                                                                • Size 154KB
                                                                                                                                • SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                Submit Download

                                                                                                                                CreateProcess.exe
                                                                                                                                • Path C:\temp\CreateProcess.exe
                                                                                                                                • Size 3KB
                                                                                                                                • SHA256 0856015110fd3b002b196cbd442c9087d549e973963ac5fe3dfa3714f3ca317c
                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                Submit Download

                                                                                                                                memory/200-464-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/200-210-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/404-471-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/896-559-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/1116-450-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2144-619-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2388-516-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/2656-599-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3088-651-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3272-154-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3272-195-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/3388-577-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4452-61-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4524-517-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4524-512-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4548-561-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4548-527-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/4792-521-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5028-595-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5028-678-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5228-667-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/5396-655-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/6020-189-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download

                                                                                                                                memory/7024-630-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                                Download