Analysis
- max time kernel
149s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
02/08/2026, 14:27
General
- Target 2026-08-02_5644432a14e8ee14cf15ad84d082c84d_amadey_darkgate_elex_smoke-loader_stop.exe
- Size 384KB
- Sample260802-rskbmsbc98
- SHA256 2927052213b423e1f44f3d2653d7410884cb4a4dd94d691073f010f8ee45ecd5
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_5644432a14e8ee14cf15ad84d082c84d_amadey_darkgate_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_5644432a14e8ee14cf15ad84d082c84d_amadey_darkgate_elex_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\nlfdxvsnlfdaysqn.exeC:\Temp\nlfdxvsnlfdaysqn.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvtnlfavsq.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\xvtnlfavsq.exeC:\Temp\xvtnlfavsq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xvtnlfavsq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xvtnlfavsq.exeC:\Temp\i_xvtnlfavsq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\spnhfaxspk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\spnhfaxspk.exeC:\Temp\spnhfaxspk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_spnhfaxspk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_spnhfaxspk.exeC:\Temp\i_spnhfaxspk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpjhzxupmh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rpjhzxupmh.exeC:\Temp\rpjhzxupmh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpjhzxupmh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rpjhzxupmh.exeC:\Temp\i_rpjhzxupmh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\czurmkecwu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\czurmkecwu.exeC:\Temp\czurmkecwu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_czurmkecwu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_czurmkecwu.exeC:\Temp\i_czurmkecwu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ojheywuolj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ojheywuolj.exeC:\Temp\ojheywuolj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ojheywuolj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ojheywuolj.exeC:\Temp\i_ojheywuolj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljgbztrljd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ljgbztrljd.exeC:\Temp\ljgbztrljd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljgbztrljd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ljgbztrljd.exeC:\Temp\i_ljgbztrljd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ytqolgeywq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ytqolgeywq.exeC:\Temp\ytqolgeywq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ytqolgeywq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ytqolgeywq.exeC:\Temp\i_ytqolgeywq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tqligaysql.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\tqligaysql.exeC:\Temp\tqligaysql.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tqligaysql.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_tqligaysql.exeC:\Temp\i_tqligaysql.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lfdxvpnifa.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lfdxvpnifa.exeC:\Temp\lfdxvpnifa.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lfdxvpnifa.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lfdxvpnifa.exeC:\Temp\i_lfdxvpnifa.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kfdxvpnhfa.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kfdxvpnhfa.exeC:\Temp\kfdxvpnhfa.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kfdxvpnhfa.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kfdxvpnhfa.exeC:\Temp\i_kfdxvpnhfa.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fcxvpnhfzx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fcxvpnhfzx.exeC:\Temp\fcxvpnhfzx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fcxvpnhfzx.exe ups_ins3⤵
-
C:\Temp\i_fcxvpnhfzx.exeC:\Temp\i_fcxvpnhfzx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cwurmjhfzx.exe ups_run3⤵
-
C:\Temp\cwurmjhfzx.exeC:\Temp\cwurmjhfzx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cwurmjhfzx.exe ups_ins3⤵
-
C:\Temp\i_cwurmjhfzx.exeC:\Temp\i_cwurmjhfzx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wrpjhbztrp.exe ups_run3⤵
-
C:\Temp\wrpjhbztrp.exeC:\Temp\wrpjhbztrp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wrpjhbztrp.exe ups_ins3⤵
-
C:\Temp\i_wrpjhbztrp.exeC:\Temp\i_wrpjhbztrp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bytoljebwu.exe ups_run3⤵
-
C:\Temp\bytoljebwu.exeC:\Temp\bytoljebwu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bytoljebwu.exe ups_ins3⤵
-
C:\Temp\i_bytoljebwu.exeC:\Temp\i_bytoljebwu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tolgdywqoi.exe ups_run3⤵
-
C:\Temp\tolgdywqoi.exeC:\Temp\tolgdywqoi.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tolgdywqoi.exe ups_ins3⤵
-
C:\Temp\i_tolgdywqoi.exeC:\Temp\i_tolgdywqoi.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdywqoigay.exe ups_run3⤵
-
C:\Temp\fdywqoigay.exeC:\Temp\fdywqoigay.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdywqoigay.exe ups_ins3⤵
-
C:\Temp\i_fdywqoigay.exeC:\Temp\i_fdywqoigay.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\idsqnidavt.exe ups_run3⤵
-
C:\Temp\idsqnidavt.exeC:\Temp\idsqnidavt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_idsqnidavt.exe ups_ins3⤵
-
C:\Temp\i_idsqnidavt.exeC:\Temp\i_idsqnidavt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\snkfdxvpni.exe ups_run3⤵
-
C:\Temp\snkfdxvpni.exeC:\Temp\snkfdxvpni.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_snkfdxvpni.exe ups_ins3⤵
-
C:\Temp\i_snkfdxvpni.exeC:\Temp\i_snkfdxvpni.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fcausmkfca.exe ups_run3⤵
-
C:\Temp\fcausmkfca.exeC:\Temp\fcausmkfca.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fcausmkfca.exe ups_ins3⤵
-
C:\Temp\i_fcausmkfca.exeC:\Temp\i_fcausmkfca.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffb5125c188,0x7ffb5125c194,0x7ffb5125c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,9266426776798056978,14127619093751401671,524288 --field-trial-handle=2336,i,15932762650372260379,4367238057190370179,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,2661305654302558650,14488572753954217248,262144 --field-trial-handle=2336,i,15932762650372260379,4367238057190370179,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2352,i,10647532596323453737,13809525352329821403,524288 --field-trial-handle=2336,i,15932762650372260379,4367238057190370179,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,6303031401859869846,1902365314140384561,2097152 --field-trial-handle=2336,i,15932762650372260379,4367238057190370179,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,13806035844187251931,3502743641400360716,2097152 --field-trial-handle=2336,i,15932762650372260379,4367238057190370179,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4336,i,15612647209236076430,14981153397919146474,2097152 --field-trial-handle=2336,i,15932762650372260379,4367238057190370179,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,10074389679802090658,9493384644434480721,2097152 --field-trial-handle=2336,i,15932762650372260379,4367238057190370179,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,9440132792529550501,4427599912008565025,524288 --field-trial-handle=2336,i,15932762650372260379,4367238057190370179,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,15050063641755548738,13007094239172954896,524288 --field-trial-handle=2336,i,15932762650372260379,4367238057190370179,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,489443390390112712,14018260525659361521,524288 --field-trial-handle=2336,i,15932762650372260379,4367238057190370179,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,14472055299389852632,16594028358101271655,524288 --field-trial-handle=2336,i,15932762650372260379,4367238057190370179,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,14472055299389852632,16594028358101271655,524288 --field-trial-handle=2336,i,15932762650372260379,4367238057190370179,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,15856853912978757255,6258328992919887611,524288 --field-trial-handle=2336,i,15932762650372260379,4367238057190370179,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,5306451241950029896,18191007498524301172,524288 --field-trial-handle=2336,i,15932762650372260379,4367238057190370179,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,5562569756618385792,10981623826294103173,524288 --field-trial-handle=2336,i,15932762650372260379,4367238057190370179,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,11605737065306388305,468117010880418603,524288 --field-trial-handle=2336,i,15932762650372260379,4367238057190370179,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,17937130039369504220,6216582207982192058,524288 --field-trial-handle=2336,i,15932762650372260379,4367238057190370179,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,5334967451166873900,11814229014303179600,524288 --field-trial-handle=2336,i,15932762650372260379,4367238057190370179,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,596505698184353982,3435968472638853684,524288 --field-trial-handle=2336,i,15932762650372260379,4367238057190370179,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,16901741316999535440,2481248096737657167,524288 --field-trial-handle=2336,i,15932762650372260379,4367238057190370179,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3480,i,7050469383286888664,5424033858966397240,524288 --field-trial-handle=2336,i,15932762650372260379,4367238057190370179,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3508,i,18332544570022705444,147718564565000002,524288 --field-trial-handle=2336,i,15932762650372260379,4367238057190370179,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3508,i,2546715345576929499,5749075102088999976,524288 --field-trial-handle=2336,i,15932762650372260379,4367238057190370179,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6012,i,15646156040360219012,16228059116597593945,262144 --field-trial-handle=2336,i,15932762650372260379,4367238057190370179,262144 --variations-seed-version --mojo-platform-channel-handle=920 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6608,i,13096084458293568562,1754422206631906450,524288 --field-trial-handle=2336,i,15932762650372260379,4367238057190370179,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,9221694786457578247,7720917136793000351,524288 --field-trial-handle=2336,i,15932762650372260379,4367238057190370179,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\nlfdxvsnlfdaysqn.sysC:\Temp\nlfdxvsnlfdaysqn.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Temp\vpnhfzxspn.sysC:\Temp\vpnhfzxspn.sys1⤵
- Executes dropped EXE
-
C:\Temp\xrpmhfzxus.sysC:\Temp\xrpmhfzxus.sys1⤵
- Executes dropped EXE
-
C:\Temp\ecwuomhezw.sysC:\Temp\ecwuomhezw.sys1⤵
- Executes dropped EXE
-
C:\Temp\cwuomhezwu.sysC:\Temp\cwuomhezwu.sys1⤵
- Executes dropped EXE
-
C:\Temp\mjebztrljd.sysC:\Temp\mjebztrljd.sys1⤵
- Executes dropped EXE
-
C:\Temp\bvtnlgdbyt.sysC:\Temp\bvtnlgdbyt.sys1⤵
- Executes dropped EXE
-
C:\Temp\tnligdyvtq.sysC:\Temp\tnligdyvtq.sys1⤵
- Executes dropped EXE
-
C:\Temp\dbvtnlfdyv.sysC:\Temp\dbvtnlfdyv.sys1⤵
- Executes dropped EXE
-
C:\Temp\kfcxvsnkif.sysC:\Temp\kfcxvsnkif.sys1⤵
- Executes dropped EXE
-
C:\Temp\hcausmkecx.sysC:\Temp\hcausmkecx.sys1⤵
- Executes dropped EXE
-
C:\Temp\cxurmkhfzx.sysC:\Temp\cxurmkhfzx.sys1⤵
-
C:\Temp\jebzurmkhb.sysC:\Temp\jebzurmkhb.sys1⤵
-
C:\Temp\bzwrojhbzw.sysC:\Temp\bzwrojhbzw.sys1⤵
-
C:\Temp\trljgbywqo.sysC:\Temp\trljgbywqo.sys1⤵
-
C:\Temp\vtndyvqoig.sysC:\Temp\vtndyvqoig.sys1⤵
-
C:\Temp\ligayvqnlf.sysC:\Temp\ligayvqnlf.sys1⤵
-
C:\Temp\vpnifaxsqk.sysC:\Temp\vpnifaxsqk.sys1⤵
-
C:\Temp\fcaxsqkhfc.sysC:\Temp\fcaxsqkhfc.sys1⤵
-
C:\Temp\mkausmkeca.sysC:\Temp\mkausmkeca.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
cwuomhezwu.sys
czurmkecwu.exe
ecwuomhezw.sys
i_czurmkecwu.exe
i_ojheywuolj.exe
i_rpjhzxupmh.exe
i_spnhfaxspk.exe
i_xvtnlfavsq.exe
ljgbztrljd.exe
mjebztrljd.sys
nlfdxvsnlfdaysqn.exe
nlfdxvsnlfdaysqn.sys
ojheywuolj.exe
rpjhzxupmh.exe
spnhfaxspk.exe
vpnhfzxspn.sys
xrpmhfzxus.sys
xvtnlfavsq.exe
settings.dat
settings.dat
the-real-index
the-real-index~RFe5a133b.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Secure Preferences
3fde4e2d-315b-4f54-8442-443fa21365d9.tmp
Local State
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
metadata.json
299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
metadata.json
metadata.json
6788cb9f-7d99-464e-a6e2-bcaefcb6304d.tmp
content_new.js
CreateProcess.exe
memory/244-729-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1112-631-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1484-530-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1588-64-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2360-651-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2596-662-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2948-550-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3036-700-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3340-548-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3432-564-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3516-705-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3676-466-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3840-682-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4484-725-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4760-518-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5116-496-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5164-574-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5528-599-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5880-419-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6008-626-0x0000000000010000-0x00000000000AB000-memory.dmp