Analysis
- max time kernel
149s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
01/08/2026, 19:08
General
- Target 2026-08-01_df80e5d3888dee576b1a8a41f38afea2_amadey_darkgate_elex_smoke-loader_stop.exe
- Size 384KB
- Sample260801-xtqspsv1dw
- SHA256 e85bc524ead7f9f67278dac29d0b46cea719ae65bc3422bac8c21d4917b300a6
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_df80e5d3888dee576b1a8a41f38afea2_amadey_darkgate_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_df80e5d3888dee576b1a8a41f38afea2_amadey_darkgate_elex_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\qkicaysqkauspkif.exeC:\Temp\qkicaysqkauspkif.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnifzxvpkf.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\pnifzxvpkf.exeC:\Temp\pnifzxvpkf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnifzxvpkf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pnifzxvpkf.exeC:\Temp\i_pnifzxvpkf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnkhczxrpk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pnkhczxrpk.exeC:\Temp\pnkhczxrpk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnkhczxrpk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pnkhczxrpk.exeC:\Temp\i_pnkhczxrpk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhfzuspjec.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jhfzuspjec.exeC:\Temp\jhfzuspjec.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhfzuspjec.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jhfzuspjec.exeC:\Temp\i_jhfzuspjec.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trpjhecwuo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\trpjhecwuo.exeC:\Temp\trpjhecwuo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trpjhecwuo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_trpjhecwuo.exeC:\Temp\i_trpjhecwuo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljdbwtomge.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ljdbwtomge.exeC:\Temp\ljdbwtomge.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljdbwtomge.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ljdbwtomge.exeC:\Temp\i_ljdbwtomge.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jgbywtrljd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jgbywtrljd.exeC:\Temp\jgbywtrljd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jgbywtrljd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jgbywtrljd.exeC:\Temp\i_jgbywtrljd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lfdyvqoigd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lfdyvqoigd.exeC:\Temp\lfdyvqoigd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lfdyvqoigd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lfdyvqoigd.exeC:\Temp\i_lfdyvqoigd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lfdxvqnkic.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lfdxvqnkic.exeC:\Temp\lfdxvqnkic.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lfdxvqnkic.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lfdxvqnkic.exeC:\Temp\i_lfdxvqnkic.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvsnkidxvp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xvsnkidxvp.exeC:\Temp\xvsnkidxvp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xvsnkidxvp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xvsnkidxvp.exeC:\Temp\i_xvsnkidxvp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nkfcaxspkh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nkfcaxspkh.exeC:\Temp\nkfcaxspkh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nkfcaxspkh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nkfcaxspkh.exeC:\Temp\i_nkfcaxspkh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\khczxupmhc.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\khczxupmhc.exeC:\Temp\khczxupmhc.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_khczxupmhc.exe ups_ins3⤵
-
C:\Temp\i_khczxupmhc.exeC:\Temp\i_khczxupmhc.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mkebzurmje.exe ups_run3⤵
-
C:\Temp\mkebzurmje.exeC:\Temp\mkebzurmje.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mkebzurmje.exe ups_ins3⤵
-
C:\Temp\i_mkebzurmje.exeC:\Temp\i_mkebzurmje.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gebwuomjeb.exe ups_run3⤵
-
C:\Temp\gebwuomjeb.exeC:\Temp\gebwuomjeb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gebwuomjeb.exe ups_ins3⤵
-
C:\Temp\i_gebwuomjeb.exeC:\Temp\i_gebwuomjeb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rojhbztrlj.exe ups_run3⤵
-
C:\Temp\rojhbztrlj.exeC:\Temp\rojhbztrlj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rojhbztrlj.exe ups_ins3⤵
-
C:\Temp\i_rojhbztrlj.exeC:\Temp\i_rojhbztrlj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gdbvtqligd.exe ups_run3⤵
-
C:\Temp\gdbvtqligd.exeC:\Temp\gdbvtqligd.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gdbvtqligd.exe ups_ins3⤵
-
C:\Temp\i_gdbvtqligd.exeC:\Temp\i_gdbvtqligd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gaysqkidav.exe ups_run3⤵
-
C:\Temp\gaysqkidav.exeC:\Temp\gaysqkidav.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gaysqkidav.exe ups_ins3⤵
-
C:\Temp\i_gaysqkidav.exeC:\Temp\i_gaysqkidav.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\snifaxsqki.exe ups_run3⤵
-
C:\Temp\snifaxsqki.exeC:\Temp\snifaxsqki.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_snifaxsqki.exe ups_ins3⤵
-
C:\Temp\i_snifaxsqki.exeC:\Temp\i_snifaxsqki.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kicausqkfc.exe ups_run3⤵
-
C:\Temp\kicausqkfc.exeC:\Temp\kicausqkfc.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kicausqkfc.exe ups_ins3⤵
-
C:\Temp\i_kicausqkfc.exeC:\Temp\i_kicausqkfc.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fzusmkecxu.exe ups_run3⤵
-
C:\Temp\fzusmkecxu.exeC:\Temp\fzusmkecxu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fzusmkecxu.exe ups_ins3⤵
-
C:\Temp\i_fzusmkecxu.exeC:\Temp\i_fzusmkecxu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wurmkecwuo.exe ups_run3⤵
-
C:\Temp\wurmkecwuo.exeC:\Temp\wurmkecwuo.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x2c8,0x7ffb17d7c188,0x7ffb17d7c194,0x7ffb17d7c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1992,i,14471733360781221464,10883607052827510202,262144 --field-trial-handle=2472,i,11509320228992745324,17687982706780771989,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2168,i,3575463668140093751,15825872787993103924,524288 --field-trial-handle=2472,i,11509320228992745324,17687982706780771989,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2656,i,4353783294417766659,14503399759342713315,524288 --field-trial-handle=2472,i,11509320228992745324,17687982706780771989,262144 --variations-seed-version --mojo-platform-channel-handle=3340 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,13947356183178898131,8083689804760555525,2097152 --field-trial-handle=2472,i,11509320228992745324,17687982706780771989,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,8490691010525860735,15793103490055267047,2097152 --field-trial-handle=2472,i,11509320228992745324,17687982706780771989,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,10010644325548471391,16990722876598156886,2097152 --field-trial-handle=2472,i,11509320228992745324,17687982706780771989,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,3609096924270016410,1729285978628759508,2097152 --field-trial-handle=2472,i,11509320228992745324,17687982706780771989,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3868,i,8278164375206036899,12667051262109869988,524288 --field-trial-handle=2472,i,11509320228992745324,17687982706780771989,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,15526114954621748295,15770107028297552075,524288 --field-trial-handle=2472,i,11509320228992745324,17687982706780771989,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,1061925522782146056,1327448371577104820,524288 --field-trial-handle=2472,i,11509320228992745324,17687982706780771989,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,4191037981830625046,5919857158506410579,524288 --field-trial-handle=2472,i,11509320228992745324,17687982706780771989,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,4191037981830625046,5919857158506410579,524288 --field-trial-handle=2472,i,11509320228992745324,17687982706780771989,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,1939783169658383447,214675437681072191,524288 --field-trial-handle=2472,i,11509320228992745324,17687982706780771989,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,681391988513737716,12795187563516675059,524288 --field-trial-handle=2472,i,11509320228992745324,17687982706780771989,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,14672327746013330321,11499146602314135970,524288 --field-trial-handle=2472,i,11509320228992745324,17687982706780771989,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,4037403419108069971,5485440382122265523,524288 --field-trial-handle=2472,i,11509320228992745324,17687982706780771989,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1436,i,8773359067534207567,15733756352739771395,524288 --field-trial-handle=2472,i,11509320228992745324,17687982706780771989,262144 --variations-seed-version --mojo-platform-channel-handle=1300 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1448,i,10427220091812317958,8229491116813575805,524288 --field-trial-handle=2472,i,11509320228992745324,17687982706780771989,262144 --variations-seed-version --mojo-platform-channel-handle=1308 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1472,i,7840644816122753765,1971144896952264358,524288 --field-trial-handle=2472,i,11509320228992745324,17687982706780771989,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,9561990763261057828,13733037790373587230,524288 --field-trial-handle=2472,i,11509320228992745324,17687982706780771989,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6880,i,14541568514114480332,7108970811659031571,524288 --field-trial-handle=2472,i,11509320228992745324,17687982706780771989,262144 --variations-seed-version --mojo-platform-channel-handle=1472 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,14882994294606461194,13252903785243684437,524288 --field-trial-handle=2472,i,11509320228992745324,17687982706780771989,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,15821412753447656429,4538524346064537604,524288 --field-trial-handle=2472,i,11509320228992745324,17687982706780771989,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,14435849226510265061,18397173868262810534,524288 --field-trial-handle=2472,i,11509320228992745324,17687982706780771989,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5580,i,5248853753540542654,11668151533865562952,262144 --field-trial-handle=2472,i,11509320228992745324,17687982706780771989,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,13042749644401562055,10757327300596251317,524288 --field-trial-handle=2472,i,11509320228992745324,17687982706780771989,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\qkicaysqkauspkif.sysC:\Temp\qkicaysqkauspkif.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\usmkfcxupm.sysC:\Temp\usmkfcxupm.sys1⤵
- Executes dropped EXE
-
C:\Temp\mkecxrpjhe.sysC:\Temp\mkecxrpjhe.sys1⤵
- Executes dropped EXE
-
C:\Temp\rpjhbzwurm.sysC:\Temp\rpjhbzwurm.sys1⤵
- Executes dropped EXE
-
C:\Temp\bzwrpjhbzt.sysC:\Temp\bzwrpjhbzt.sys1⤵
- Executes dropped EXE
-
C:\Temp\jdbztrljgb.sysC:\Temp\jdbztrljgb.sys1⤵
- Executes dropped EXE
-
C:\Temp\lgdyvtnlgd.sysC:\Temp\lgdyvtnlgd.sys1⤵
- Executes dropped EXE
-
C:\Temp\kigaysqlid.sysC:\Temp\kigaysqlid.sys1⤵
- Executes dropped EXE
-
C:\Temp\nifdavsqki.sysC:\Temp\nifdavsqki.sys1⤵
- Executes dropped EXE
-
C:\Temp\qkicausmkf.sysC:\Temp\qkicausmkf.sys1⤵
- Executes dropped EXE
-
C:\Temp\khfzxupnke.sysC:\Temp\khfzxupnke.sys1⤵
- Executes dropped EXE
-
C:\Temp\pmhezwrpmh.sysC:\Temp\pmhezwrpmh.sys1⤵
-
C:\Temp\xrpjhbztro.sysC:\Temp\xrpjhbztro.sys1⤵
-
C:\Temp\qomjhbztrl.sysC:\Temp\qomjhbztrl.sys1⤵
-
C:\Temp\lgdywqoiga.sysC:\Temp\lgdywqoiga.sys1⤵
-
C:\Temp\gaytqnigay.sysC:\Temp\gaytqnigay.sys1⤵
-
C:\Temp\ayvqkicays.sysC:\Temp\ayvqkicays.sys1⤵
-
C:\Temp\nkfdausqki.sysC:\Temp\nkfdausqki.sys1⤵
-
C:\Temp\hfzxrpkhcz.sysC:\Temp\hfzxrpkhcz.sys1⤵
-
C:\Temp\wupmkeczxu.sysC:\Temp\wupmkeczxu.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
bzwrpjhbzt.sys
i_jhfzuspjec.exe
i_ljdbwtomge.exe
i_pnifzxvpkf.exe
i_pnkhczxrpk.exe
i_trpjhecwuo.exe
jdbztrljgb.sys
jgbywtrljd.exe
jhfzuspjec.exe
ljdbwtomge.exe
mkecxrpjhe.sys
pnifzxvpkf.exe
pnkhczxrpk.exe
qkicaysqkauspkif.exe
qkicaysqkauspkif.sys
rpjhbzwurm.sys
trpjhecwuo.exe
usmkfcxupm.sys
settings.dat
settings.dat
7eace806-6a56-42a6-a5c2-0598a1ad4fe8.tmp
BookmarkMergedSurfaceOrdering
the-real-index
the-real-index~RFe59302e.TMP
SiteList-Enterprise.json
Edge Profile.ico
13cf572c-ba3d-419a-b287-6b5087e5de99.tmp
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
OperationConfig
OperationConfig~RFe59cc20.TMP
Local State
Local State
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
3b8a32aa-80ad-4335-b72a-6a35e56c6f1c.tmp
metadata.json~RFe5907d6.TMP
a3821f3a-7006-4ebe-a473-c62ae69a062f.tmp
content_new.js
CreateProcess.exe
memory/984-724-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1224-504-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1224-470-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1792-666-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2016-498-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2028-707-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2032-638-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2504-677-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2708-511-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3664-569-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4136-550-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4516-565-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4528-598-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4772-610-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5040-682-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5188-703-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5352-646-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5404-63-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5584-423-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5848-524-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6100-546-0x0000000000010000-0x00000000000AB000-memory.dmp