Overview

overview

10

Static

static

10

2026-09-04...op.exe

windows10-2004-x64

10

2026-09-04...op.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/09/2026, 16:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-04_2732e4ac578d3d4d132e3d53e7d24534_amadey_darkgate_elex_smoke-loader_stop.exe
  • Size 384KB
  • Sample260905-tg5vbavvf1
  • SHA256 dde33c86baed3c07b2ccbd6a0f37a0336fc27a900143303663142cd611a83805
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarediscoverysystexspywaretrojan

Malware Config

Signatures

  • Family: Systex

    Systex is a trojan loader written in C++.

    trojansystex
  • Executes dropped EXE 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers network information 2 TTPs 19 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 20 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-04_2732e4ac578d3d4d132e3d53e7d24534_amadey_darkgate_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-04_2732e4ac578d3d4d132e3d53e7d24534_amadey_darkgate_elex_smoke-loader_stop.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4312
    • C:\Temp\lfdxsqkifaysqnhf.exe
      C:\Temp\lfdxsqkifaysqnhf.exe run
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1092
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\lfdausnlfc.exe ups_run
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:5840
        • C:\Temp\lfdausnlfc.exe
          C:\Temp\lfdausnlfc.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:476
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:4616
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:4516
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_lfdausnlfc.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:4064
        • C:\Temp\i_lfdausnlfc.exe
          C:\Temp\i_lfdausnlfc.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3020
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\nkfzxrpkhc.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:628
        • C:\Temp\nkfzxrpkhc.exe
          C:\Temp\nkfzxrpkhc.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:364
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:3200
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:1188
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_nkfzxrpkhc.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:4036
        • C:\Temp\i_nkfzxrpkhc.exe
          C:\Temp\i_nkfzxrpkhc.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2444
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\hbzxrpjhcz.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:4152
        • C:\Temp\hbzxrpjhcz.exe
          C:\Temp\hbzxrpjhcz.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5700
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:1484
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:6064
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_hbzxrpjhcz.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:3260
        • C:\Temp\i_hbzxrpjhcz.exe
          C:\Temp\i_hbzxrpjhcz.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1064
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\omhbztrmje.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:2604
        • C:\Temp\omhbztrmje.exe
          C:\Temp\omhbztrmje.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1852
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:1832
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:3572
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_omhbztrmje.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:3872
        • C:\Temp\i_omhbztrmje.exe
          C:\Temp\i_omhbztrmje.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3496
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\ecwuomgezw.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:5508
        • C:\Temp\ecwuomgezw.exe
          C:\Temp\ecwuomgezw.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1056
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:3364
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:900
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_ecwuomgezw.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:3292
        • C:\Temp\i_ecwuomgezw.exe
          C:\Temp\i_ecwuomgezw.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:5516
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\tqojgeyvtr.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:708
        • C:\Temp\tqojgeyvtr.exe
          C:\Temp\tqojgeyvtr.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1508
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:1620
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:1624
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_tqojgeyvtr.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:2124
        • C:\Temp\i_tqojgeyvtr.exe
          C:\Temp\i_tqojgeyvtr.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4264
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\qligaytqli.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:3348
        • C:\Temp\qligaytqli.exe
          C:\Temp\qligaytqli.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4592
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:3468
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:2808
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_qligaytqli.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:1684
        • C:\Temp\i_qligaytqli.exe
          C:\Temp\i_qligaytqli.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2620
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\gavsqkidav.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:1904
        • C:\Temp\gavsqkidav.exe
          C:\Temp\gavsqkidav.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2236
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:5756
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:5996
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_gavsqkidav.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:1344
        • C:\Temp\i_gavsqkidav.exe
          C:\Temp\i_gavsqkidav.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4356
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\idxvsqniga.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:3596
        • C:\Temp\idxvsqniga.exe
          C:\Temp\idxvsqniga.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4548
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:3136
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:2676
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_idxvsqniga.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:5660
        • C:\Temp\i_idxvsqniga.exe
          C:\Temp\i_idxvsqniga.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:200
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\xvpnhfaxsq.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:2356
        • C:\Temp\xvpnhfaxsq.exe
          C:\Temp\xvpnhfaxsq.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4428
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:4116
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:6008
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_xvpnhfaxsq.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:6028
        • C:\Temp\i_xvpnhfaxsq.exe
          C:\Temp\i_xvpnhfaxsq.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:5268
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\mkhfzxusmk.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:5996
        • C:\Temp\mkhfzxusmk.exe
          C:\Temp\mkhfzxusmk.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4512
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
              PID:1388
              • C:\windows\system32\ipconfig.exe
                C:\windows\system32\ipconfig.exe /release
                6⤵
                • Gathers network information
                PID:5340
        • C:\temp\CreateProcess.exe
          C:\temp\CreateProcess.exe C:\Temp\i_mkhfzxusmk.exe ups_ins
          3⤵
            PID:1992
            • C:\Temp\i_mkhfzxusmk.exe
              C:\Temp\i_mkhfzxusmk.exe ups_ins
              4⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:5652
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\Temp\kebzxrpkec.exe ups_run
            3⤵
              PID:1236
              • C:\Temp\kebzxrpkec.exe
                C:\Temp\kebzxrpkec.exe ups_run
                4⤵
                • System Location Discovery: System Language Discovery
                PID:4244
                • C:\temp\CreateProcess.exe
                  C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                  5⤵
                    PID:1472
                    • C:\windows\system32\ipconfig.exe
                      C:\windows\system32\ipconfig.exe /release
                      6⤵
                      • Gathers network information
                      PID:5136
              • C:\temp\CreateProcess.exe
                C:\temp\CreateProcess.exe C:\Temp\i_kebzxrpkec.exe ups_ins
                3⤵
                  PID:4264
                  • C:\Temp\i_kebzxrpkec.exe
                    C:\Temp\i_kebzxrpkec.exe ups_ins
                    4⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3560
                • C:\temp\CreateProcess.exe
                  C:\temp\CreateProcess.exe C:\Temp\ezwurmjhez.exe ups_run
                  3⤵
                    PID:3612
                    • C:\Temp\ezwurmjhez.exe
                      C:\Temp\ezwurmjhez.exe ups_run
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:1972
                      • C:\temp\CreateProcess.exe
                        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                        5⤵
                          PID:1908
                          • C:\windows\system32\ipconfig.exe
                            C:\windows\system32\ipconfig.exe /release
                            6⤵
                            • Gathers network information
                            PID:5268
                    • C:\temp\CreateProcess.exe
                      C:\temp\CreateProcess.exe C:\Temp\i_ezwurmjhez.exe ups_ins
                      3⤵
                        PID:3504
                        • C:\Temp\i_ezwurmjhez.exe
                          C:\Temp\i_ezwurmjhez.exe ups_ins
                          4⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4668
                      • C:\temp\CreateProcess.exe
                        C:\temp\CreateProcess.exe C:\Temp\ywrojgbztr.exe ups_run
                        3⤵
                          PID:5648
                          • C:\Temp\ywrojgbztr.exe
                            C:\Temp\ywrojgbztr.exe ups_run
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:5624
                            • C:\temp\CreateProcess.exe
                              C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                              5⤵
                                PID:1432
                                • C:\windows\system32\ipconfig.exe
                                  C:\windows\system32\ipconfig.exe /release
                                  6⤵
                                  • Gathers network information
                                  PID:5172
                          • C:\temp\CreateProcess.exe
                            C:\temp\CreateProcess.exe C:\Temp\i_ywrojgbztr.exe ups_ins
                            3⤵
                              PID:5528
                              • C:\Temp\i_ywrojgbztr.exe
                                C:\Temp\i_ywrojgbztr.exe ups_ins
                                4⤵
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4936
                            • C:\temp\CreateProcess.exe
                              C:\temp\CreateProcess.exe C:\Temp\igbytqoidb.exe ups_run
                              3⤵
                                PID:3220
                                • C:\Temp\igbytqoidb.exe
                                  C:\Temp\igbytqoidb.exe ups_run
                                  4⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:2772
                                  • C:\temp\CreateProcess.exe
                                    C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                    5⤵
                                      PID:2060
                                      • C:\windows\system32\ipconfig.exe
                                        C:\windows\system32\ipconfig.exe /release
                                        6⤵
                                        • Gathers network information
                                        PID:2768
                                • C:\temp\CreateProcess.exe
                                  C:\temp\CreateProcess.exe C:\Temp\i_igbytqoidb.exe ups_ins
                                  3⤵
                                    PID:4560
                                    • C:\Temp\i_igbytqoidb.exe
                                      C:\Temp\i_igbytqoidb.exe ups_ins
                                      4⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1064
                                  • C:\temp\CreateProcess.exe
                                    C:\temp\CreateProcess.exe C:\Temp\yvqoigaysq.exe ups_run
                                    3⤵
                                      PID:5472
                                      • C:\Temp\yvqoigaysq.exe
                                        C:\Temp\yvqoigaysq.exe ups_run
                                        4⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:560
                                        • C:\temp\CreateProcess.exe
                                          C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                          5⤵
                                            PID:3592
                                            • C:\windows\system32\ipconfig.exe
                                              C:\windows\system32\ipconfig.exe /release
                                              6⤵
                                              • Gathers network information
                                              PID:5116
                                      • C:\temp\CreateProcess.exe
                                        C:\temp\CreateProcess.exe C:\Temp\i_yvqoigaysq.exe ups_ins
                                        3⤵
                                          PID:828
                                          • C:\Temp\i_yvqoigaysq.exe
                                            C:\Temp\i_yvqoigaysq.exe ups_ins
                                            4⤵
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:4476
                                        • C:\temp\CreateProcess.exe
                                          C:\temp\CreateProcess.exe C:\Temp\yvqnigaysq.exe ups_run
                                          3⤵
                                            PID:4564
                                            • C:\Temp\yvqnigaysq.exe
                                              C:\Temp\yvqnigaysq.exe ups_run
                                              4⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:5468
                                              • C:\temp\CreateProcess.exe
                                                C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                5⤵
                                                  PID:2524
                                                  • C:\windows\system32\ipconfig.exe
                                                    C:\windows\system32\ipconfig.exe /release
                                                    6⤵
                                                    • Gathers network information
                                                    PID:4040
                                            • C:\temp\CreateProcess.exe
                                              C:\temp\CreateProcess.exe C:\Temp\i_yvqnigaysq.exe ups_ins
                                              3⤵
                                                PID:6108
                                                • C:\Temp\i_yvqnigaysq.exe
                                                  C:\Temp\i_yvqnigaysq.exe ups_ins
                                                  4⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:5096
                                              • C:\temp\CreateProcess.exe
                                                C:\temp\CreateProcess.exe C:\Temp\nhfaxvpnhf.exe ups_run
                                                3⤵
                                                  PID:5136
                                                  • C:\Temp\nhfaxvpnhf.exe
                                                    C:\Temp\nhfaxvpnhf.exe ups_run
                                                    4⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:2456
                                                    • C:\temp\CreateProcess.exe
                                                      C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                      5⤵
                                                        PID:3188
                                                        • C:\windows\system32\ipconfig.exe
                                                          C:\windows\system32\ipconfig.exe /release
                                                          6⤵
                                                          • Gathers network information
                                                          PID:5264
                                                  • C:\temp\CreateProcess.exe
                                                    C:\temp\CreateProcess.exe C:\Temp\i_nhfaxvpnhf.exe ups_ins
                                                    3⤵
                                                      PID:5948
                                                      • C:\Temp\i_nhfaxvpnhf.exe
                                                        C:\Temp\i_nhfaxvpnhf.exe ups_ins
                                                        4⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:1528
                                                    • C:\temp\CreateProcess.exe
                                                      C:\temp\CreateProcess.exe C:\Temp\nhfzxrpkhf.exe ups_run
                                                      3⤵
                                                        PID:2040
                                                        • C:\Temp\nhfzxrpkhf.exe
                                                          C:\Temp\nhfzxrpkhf.exe ups_run
                                                          4⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:1244
                                                          • C:\temp\CreateProcess.exe
                                                            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
                                                            5⤵
                                                              PID:2620
                                                              • C:\windows\system32\ipconfig.exe
                                                                C:\windows\system32\ipconfig.exe /release
                                                                6⤵
                                                                • Gathers network information
                                                                PID:1252
                                                        • C:\temp\CreateProcess.exe
                                                          C:\temp\CreateProcess.exe C:\Temp\i_nhfzxrpkhf.exe ups_ins
                                                          3⤵
                                                            PID:2828
                                                            • C:\Temp\i_nhfzxrpkhf.exe
                                                              C:\Temp\i_nhfzxrpkhf.exe ups_ins
                                                              4⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:4332
                                                        • C:\Program Files\Internet Explorer\iexplore.exe
                                                          "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
                                                          2⤵
                                                          • Modifies Internet Explorer settings
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2280
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
                                                            3⤵
                                                            • Drops file in Windows directory
                                                            • Enumerates system info in registry
                                                            • Modifies data under HKEY_USERS
                                                            • Modifies registry class
                                                            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                            • Suspicious use of FindShellTrayWindow
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2592
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x314,0x7ffa7789c188,0x7ffa7789c194,0x7ffa7789c1a0
                                                              4⤵
                                                                PID:1120
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2168,i,5404216470564195304,7773556297442758027,524288 --field-trial-handle=3124,i,16653558782751729228,4485461151313014794,262144 --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:11
                                                                4⤵
                                                                • System Time Discovery
                                                                PID:1212
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1972,i,14665947240069597944,8345455639618908874,262144 --field-trial-handle=3124,i,16653558782751729228,4485461151313014794,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:2
                                                                4⤵
                                                                  PID:1272
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,2922707645879742642,6556642582352276176,524288 --field-trial-handle=3124,i,16653558782751729228,4485461151313014794,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:13
                                                                  4⤵
                                                                    PID:4532
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3564,i,8819422342767266358,14746791534011611599,2097152 --field-trial-handle=3124,i,16653558782751729228,4485461151313014794,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
                                                                    4⤵
                                                                      PID:4412
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,8351799709887713205,8716280068645553392,2097152 --field-trial-handle=3124,i,16653558782751729228,4485461151313014794,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
                                                                      4⤵
                                                                        PID:2520
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,5326689105321925793,6597967009190738444,2097152 --field-trial-handle=3124,i,16653558782751729228,4485461151313014794,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
                                                                        4⤵
                                                                          PID:5784
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,5167007241976600820,5066955939266650916,2097152 --field-trial-handle=3124,i,16653558782751729228,4485461151313014794,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:9
                                                                          4⤵
                                                                            PID:3224
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,3931659692518362084,7646746530662975342,524288 --field-trial-handle=3124,i,16653558782751729228,4485461151313014794,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:14
                                                                            4⤵
                                                                              PID:2076
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,5303395802741038306,12298456474457067734,524288 --field-trial-handle=3124,i,16653558782751729228,4485461151313014794,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
                                                                              4⤵
                                                                                PID:5260
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,17044345884461335732,11425539641754460759,524288 --field-trial-handle=3124,i,16653558782751729228,4485461151313014794,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
                                                                                4⤵
                                                                                  PID:3704
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,17491115358262512185,4018419791161307280,524288 --field-trial-handle=3124,i,16653558782751729228,4485461151313014794,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
                                                                                  4⤵
                                                                                    PID:2424
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,17491115358262512185,4018419791161307280,524288 --field-trial-handle=3124,i,16653558782751729228,4485461151313014794,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
                                                                                    4⤵
                                                                                      PID:2512
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,6120574498198648455,13814967158803822218,524288 --field-trial-handle=3124,i,16653558782751729228,4485461151313014794,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
                                                                                      4⤵
                                                                                        PID:4756
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,15352477658630590620,1746179407901045070,524288 --field-trial-handle=3124,i,16653558782751729228,4485461151313014794,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:14
                                                                                        4⤵
                                                                                          PID:1564
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,16659307526965743102,9183743589966490089,524288 --field-trial-handle=3124,i,16653558782751729228,4485461151313014794,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:14
                                                                                          4⤵
                                                                                            PID:5660
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,10406461520710068004,4332260542239989092,524288 --field-trial-handle=3124,i,16653558782751729228,4485461151313014794,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
                                                                                            4⤵
                                                                                              PID:1232
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,10855464114310918703,14765319805093796076,524288 --field-trial-handle=3124,i,16653558782751729228,4485461151313014794,262144 --variations-seed-version --mojo-platform-channel-handle=1300 /prefetch:14
                                                                                              4⤵
                                                                                                PID:5048
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,90057690971815500,9494128352377211088,524288 --field-trial-handle=3124,i,16653558782751729228,4485461151313014794,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:14
                                                                                                4⤵
                                                                                                  PID:1904
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,1393577627781013079,1485594899711544150,524288 --field-trial-handle=3124,i,16653558782751729228,4485461151313014794,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
                                                                                                  4⤵
                                                                                                    PID:3884
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,4558383906178010385,14925296193032298240,524288 --field-trial-handle=3124,i,16653558782751729228,4485461151313014794,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14
                                                                                                    4⤵
                                                                                                      PID:3412
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,11185130497089697446,10109228351710139761,524288 --field-trial-handle=3124,i,16653558782751729228,4485461151313014794,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
                                                                                                      4⤵
                                                                                                        PID:3284
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6080,i,5414177070169439408,8205474005119428600,262144 --field-trial-handle=3124,i,16653558782751729228,4485461151313014794,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:10
                                                                                                        4⤵
                                                                                                          PID:4668
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,13361590581471254224,11709245721777386616,524288 --field-trial-handle=3124,i,16653558782751729228,4485461151313014794,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
                                                                                                          4⤵
                                                                                                            PID:3336
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                      1⤵
                                                                                                        PID:5132
                                                                                                      • C:\Temp\lfdxsqkifaysqnhf.sys
                                                                                                        C:\Temp\lfdxsqkifaysqnhf.sys
                                                                                                        1⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:3492
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                        1⤵
                                                                                                          PID:628
                                                                                                        • C:\Temp\pnhfzxspnh.sys
                                                                                                          C:\Temp\pnhfzxspnh.sys
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:1808
                                                                                                        • C:\Temp\pmhfzxupmh.sys
                                                                                                          C:\Temp\pmhfzxupmh.sys
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:1236
                                                                                                        • C:\Temp\zurmkhbzur.sys
                                                                                                          C:\Temp\zurmkhbzur.sys
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:2828
                                                                                                        • C:\Temp\ebwuomjgew.sys
                                                                                                          C:\Temp\ebwuomjgew.sys
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:4776
                                                                                                        • C:\Temp\wtomgeywqo.sys
                                                                                                          C:\Temp\wtomgeywqo.sys
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:3448
                                                                                                        • C:\Temp\nljgdyvtql.sys
                                                                                                          C:\Temp\nljgdyvtql.sys
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:4560
                                                                                                        • C:\Temp\vtnlgdyvqn.sys
                                                                                                          C:\Temp\vtnlgdyvqn.sys
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:1908
                                                                                                        • C:\Temp\lfdxvpnlig.sys
                                                                                                          C:\Temp\lfdxvpnlig.sys
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:1992
                                                                                                        • C:\Temp\caxsqkifau.sys
                                                                                                          C:\Temp\caxsqkifau.sys
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:3276
                                                                                                        • C:\Temp\khcaxrpnkh.sys
                                                                                                          C:\Temp\khcaxrpnkh.sys
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:3244
                                                                                                        • C:\Temp\upmhezxrpm.sys
                                                                                                          C:\Temp\upmhezxrpm.sys
                                                                                                          1⤵
                                                                                                            PID:3336
                                                                                                          • C:\Temp\jecwuomgec.sys
                                                                                                            C:\Temp\jecwuomgec.sys
                                                                                                            1⤵
                                                                                                              PID:3608
                                                                                                            • C:\Temp\zwrojhbztr.sys
                                                                                                              C:\Temp\zwrojhbztr.sys
                                                                                                              1⤵
                                                                                                                PID:5812
                                                                                                              • C:\Temp\ljdbytqoig.sys
                                                                                                                C:\Temp\ljdbytqoig.sys
                                                                                                                1⤵
                                                                                                                  PID:2700
                                                                                                                • C:\Temp\ljgaytqlgd.sys
                                                                                                                  C:\Temp\ljgaytqlgd.sys
                                                                                                                  1⤵
                                                                                                                    PID:5852
                                                                                                                  • C:\Temp\aysqligays.sys
                                                                                                                    C:\Temp\aysqligays.sys
                                                                                                                    1⤵
                                                                                                                      PID:4776
                                                                                                                    • C:\Temp\pnhfdxvpnh.sys
                                                                                                                      C:\Temp\pnhfdxvpnh.sys
                                                                                                                      1⤵
                                                                                                                        PID:2880
                                                                                                                      • C:\Temp\nhfzxuspkh.sys
                                                                                                                        C:\Temp\nhfzxuspkh.sys
                                                                                                                        1⤵
                                                                                                                          PID:4268

                                                                                                                        Network

                                                                                                                              MITRE ATT&CK Enterprise v16

                                                                                                                              Replay Monitor

                                                                                                                              Loading Replay Monitor...

                                                                                                                              Downloads

                                                                                                                              ebwuomjgew.sys
                                                                                                                              • Path C:\Temp\ebwuomjgew.sys
                                                                                                                              • Size 293KB
                                                                                                                              • SHA256 26255b701ef3a932de7dba2402f56fd483981a7ac30565060ba3501cc3519cea
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              ecwuomgezw.exe
                                                                                                                              • Path C:\Temp\ecwuomgezw.exe
                                                                                                                              • Size 384KB
                                                                                                                              • SHA256 abcc3f831bc82adbb4d13190e21a494875e072bce5a5e82f615be97d43284ce1
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              hbzxrpjhcz.exe
                                                                                                                              • Path C:\Temp\hbzxrpjhcz.exe
                                                                                                                              • Size 384KB
                                                                                                                              • SHA256 8739b86fd2d88407486cbcc0a6696f4843f82f0c7e612285961474aeff0b8af7
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              i_ecwuomgezw.exe
                                                                                                                              • Path C:\Temp\i_ecwuomgezw.exe
                                                                                                                              • Size 384KB
                                                                                                                              • SHA256 0f90279bc59ad9ec63397965e9ede425663e7ece48ccbc6dfd7686e6b4aa1126
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              i_hbzxrpjhcz.exe
                                                                                                                              • Path C:\Temp\i_hbzxrpjhcz.exe
                                                                                                                              • Size 384KB
                                                                                                                              • SHA256 bfd57b07704579fa91e9bcd6a91d7246b6c07e4b48bbbc38cded0314432314a0
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              i_lfdausnlfc.exe
                                                                                                                              • Path C:\Temp\i_lfdausnlfc.exe
                                                                                                                              • Size 384KB
                                                                                                                              • SHA256 a53b9e4ac4e44d2ac2421f6c4d66836dc243350f46f8ba29e22a83c92a55d022
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              i_nkfzxrpkhc.exe
                                                                                                                              • Path C:\Temp\i_nkfzxrpkhc.exe
                                                                                                                              • Size 384KB
                                                                                                                              • SHA256 0d3e30dbd0b96cc10b22cf2a21c8aa5dffba75b1349ebfee687a451d2914bfce
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              i_omhbztrmje.exe
                                                                                                                              • Path C:\Temp\i_omhbztrmje.exe
                                                                                                                              • Size 384KB
                                                                                                                              • SHA256 94d40ec63849b212e85a1096db7643fcf89fae431ab506fe71e0e80f8b0f8544
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              lfdausnlfc.exe
                                                                                                                              • Path C:\Temp\lfdausnlfc.exe
                                                                                                                              • Size 384KB
                                                                                                                              • SHA256 b7ee054143469c8de2ff69c4ebfb330e03bbf1cce7794b7975edeeefba5e0b44
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              lfdxsqkifaysqnhf.exe
                                                                                                                              • Path C:\Temp\lfdxsqkifaysqnhf.exe
                                                                                                                              • Size 384KB
                                                                                                                              • SHA256 5020914abc3cf5b2ea2fe1477e2abf66b89f4b6059280bae0e463c5ae629b4d4
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              lfdxsqkifaysqnhf.sys
                                                                                                                              • Path C:\Temp\lfdxsqkifaysqnhf.sys
                                                                                                                              • Size 293KB
                                                                                                                              • SHA256 990f68f59d64cd7f1521062654342845c29895d6184f298f83d5b3bacca1bc7d
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              nkfzxrpkhc.exe
                                                                                                                              • Path C:\Temp\nkfzxrpkhc.exe
                                                                                                                              • Size 384KB
                                                                                                                              • SHA256 750b040e2dffe4da3a628bb2323df05be83b6ae219e49151af9aca1703f89b8c
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              omhbztrmje.exe
                                                                                                                              • Path C:\Temp\omhbztrmje.exe
                                                                                                                              • Size 384KB
                                                                                                                              • SHA256 d1177d5cb7c75aa5c56046b059a0565183df2773f62a121517f7e15662d43461
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              pmhfzxupmh.sys
                                                                                                                              • Path C:\Temp\pmhfzxupmh.sys
                                                                                                                              • Size 293KB
                                                                                                                              • SHA256 1c12fe0c3681515b6748173ab79784b29399331e2728a4e27a6471f6b19612d0
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              pnhfzxspnh.sys
                                                                                                                              • Path C:\Temp\pnhfzxspnh.sys
                                                                                                                              • Size 293KB
                                                                                                                              • SHA256 6d0262faa48ffae0a79057bea73193467e6e903b9a656e57933b1d055241fbc2
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              tqojgeyvtr.exe
                                                                                                                              • Path C:\Temp\tqojgeyvtr.exe
                                                                                                                              • Size 384KB
                                                                                                                              • SHA256 7b3faf56aeb251ef4b31b820f7a56e94c2192c3d6a786bfb3894da780d9bef7b
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              wtomgeywqo.sys
                                                                                                                              • Path C:\Temp\wtomgeywqo.sys
                                                                                                                              • Size 293KB
                                                                                                                              • SHA256 2bd4fcdeb8c3200f791c05c613faf636a5de74d4a5dc9f3188edb9c9c340ea6f
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              zurmkhbzur.sys
                                                                                                                              • Path C:\Temp\zurmkhbzur.sys
                                                                                                                              • Size 293KB
                                                                                                                              • SHA256 8c6761284afdf2d603301f64718a00416c1a9b023e10fd2e87577b49b10b02cb
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              settings.dat
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                              • Size 280B
                                                                                                                              • SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              settings.dat
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                              • Size 280B
                                                                                                                              • SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              the-real-index
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                              • Size 3KB
                                                                                                                              • SHA256 55eab33b96913d2a44be3823c1bc9ca021a485176b18ff4d6eb7041245e6d37c
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              the-real-index~RFe592001.TMP
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592001.TMP
                                                                                                                              • Size 3KB
                                                                                                                              • SHA256 287794488b528d695dadd9a0183048f1d26d8239cca15522bcd41d8be3fd9058
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              SiteList-Enterprise.json
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                              • Size 2B
                                                                                                                              • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                              Submit Download

                                                                                                                              Edge Profile.ico
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                              • Size 70KB
                                                                                                                              • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              Network Persistent State
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                              • Size 2KB
                                                                                                                              • SHA256 79a41b8818a02f105d1fefe50478bbd0ab20f28a5c49fa264d2a932b79629360
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              SCT Auditing Pending Reports
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                              • Size 2B
                                                                                                                              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                              Submit Download

                                                                                                                              Sdch Dictionaries
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                              • Size 40B
                                                                                                                              • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                              Submit Download

                                                                                                                              Preferences
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                              • Size 12KB
                                                                                                                              • SHA256 2d5cd2d6c97ead20138baf1468bfe9df37b92e035d3c0f67e6a18a29a9687303
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              Preferences
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                              • Size 11KB
                                                                                                                              • SHA256 f33d993a5b541b59f1ac37c184d44ed6b849caec19e6b34d927e9267e67ea186
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              Preferences
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                              • Size 12KB
                                                                                                                              • SHA256 022b7f873f489d93698fed2ad1ba03d7e0637af74abc0e29064309ccb47a9a62
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              Secure Preferences
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                              • Size 29KB
                                                                                                                              • SHA256 2b81fc920e22ad2641483750b01977afdb21762487412a5b0b1c473670523a15
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              2d68accb-623e-4a0a-bdc4-7f1169f52197.tmp
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2d68accb-623e-4a0a-bdc4-7f1169f52197.tmp
                                                                                                                              • Size 22KB
                                                                                                                              • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              Local State
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                              • Size 42KB
                                                                                                                              • SHA256 006d36671423ae98493b0e7a7ecb034b713ddd448066d7108ef4e1db28077bd4
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              Local State
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                              • Size 33KB
                                                                                                                              • SHA256 b92e8408b05afdd18980159b1bad606f1cbe2afac9383ba465f563bd08dc046f
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              Local State
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                              • Size 38KB
                                                                                                                              • SHA256 c08d5912ba09c633c00c4ba3d69e96a8522d5848bb64a3e594fdc78a2f9012f6
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              Local State
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                              • Size 41KB
                                                                                                                              • SHA256 27d64594e5784c5cca847e869efad9393ce8057551e6c91d4acd0ed891e8db29
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              Local State
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                              • Size 39KB
                                                                                                                              • SHA256 78f8d3a4f5d00b06f584f53ad2fa899b8186d7fb198c1a83ca80e8095b27d262
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              metadata.json
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                              • Size 252B
                                                                                                                              • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              metadata.json
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                              • Size 132B
                                                                                                                              • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              8a4a8ba7-9d52-4af1-8abb-c81ba9babce0.tmp
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8a4a8ba7-9d52-4af1-8abb-c81ba9babce0.tmp
                                                                                                                              • Size 132B
                                                                                                                              • SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
                                                                                                                              • Size 154KB
                                                                                                                              • SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              metadata.json
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                                                                              • Size 13B
                                                                                                                              • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                              Submit Download

                                                                                                                              57f12473-9d1e-4134-8305-277c8d894bae.tmp
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\57f12473-9d1e-4134-8305-277c8d894bae.tmp
                                                                                                                              • Size 1B
                                                                                                                              • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                              Submit Download

                                                                                                                              content_new.js
                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2592_911709064\CRX_INSTALL\content_new.js
                                                                                                                              • Size 10KB
                                                                                                                              • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                              Submit Download

                                                                                                                              CreateProcess.exe
                                                                                                                              • Path C:\temp\CreateProcess.exe
                                                                                                                              • Size 3KB
                                                                                                                              • SHA256 d4b2efabcf29bea206ede74d9be1a069be0980cb20d6341a4ef664b6ac086870
                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                              Submit Download

                                                                                                                              memory/1236-466-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/1808-417-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/1908-550-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/1992-565-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2700-651-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2828-494-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/2880-665-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3244-593-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3276-594-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3336-606-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3448-539-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3492-451-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3492-64-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/3608-619-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4268-669-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4560-546-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4776-657-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/4776-510-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/5812-627-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download

                                                                                                                              memory/5852-650-0x0000000000010000-0x00000000000AB000-memory.dmp
                                                                                                                              Download