Analysis
- max time kernel
149s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
07/08/2026, 15:54
General
- Target 2026-08-07_760e9c0ab0cd2bfbd64cd8ee35b0c4b2_amadey_darkgate_elex_smoke-loader_stop.exe
- Size 384KB
- Sample260807-tchh8agf76
- SHA256 c1b9032695453f8e1812e4bc21416a7f345b9a47bd2b11cc9600abf55e25e542
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_760e9c0ab0cd2bfbd64cd8ee35b0c4b2_amadey_darkgate_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_760e9c0ab0cd2bfbd64cd8ee35b0c4b2_amadey_darkgate_elex_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\qoigaywqnigdbvtq.exeC:\Temp\qoigaywqnigdbvtq.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bvtqlavtni.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\bvtqlavtni.exeC:\Temp\bvtqlavtni.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bvtqlavtni.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bvtqlavtni.exeC:\Temp\i_bvtqlavtni.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\caysqkidxv.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\caysqkidxv.exeC:\Temp\caysqkidxv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_caysqkidxv.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_caysqkidxv.exeC:\Temp\i_caysqkidxv.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ifaxspnhfc.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ifaxspnhfc.exeC:\Temp\ifaxspnhfc.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ifaxspnhfc.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ifaxspnhfc.exeC:\Temp\i_ifaxspnhfc.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fcwusmkecx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fcwusmkecx.exeC:\Temp\fcwusmkecx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fcwusmkecx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fcwusmkecx.exeC:\Temp\i_fcwusmkecx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxrpjhbzwr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zxrpjhbzwr.exeC:\Temp\zxrpjhbzwr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxrpjhbzwr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zxrpjhbzwr.exeC:\Temp\i_zxrpjhbzwr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wromhezwro.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wromhezwro.exeC:\Temp\wromhezwro.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wromhezwro.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wromhezwro.exeC:\Temp\i_wromhezwro.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trljdbwtom.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\trljdbwtom.exeC:\Temp\trljdbwtom.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trljdbwtom.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_trljdbwtom.exeC:\Temp\i_trljdbwtom.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tolgdbytqo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\tolgdbytqo.exeC:\Temp\tolgdbytqo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tolgdbytqo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_tolgdbytqo.exeC:\Temp\i_tolgdbytqo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\idavtnlfdy.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\idavtnlfdy.exeC:\Temp\idavtnlfdy.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_idavtnlfdy.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_idavtnlfdy.exeC:\Temp\i_idavtnlfdy.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dxvtnkiday.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dxvtnkiday.exeC:\Temp\dxvtnkiday.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dxvtnkiday.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dxvtnkiday.exeC:\Temp\i_dxvtnkiday.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\faxvpnkfdx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\faxvpnkfdx.exeC:\Temp\faxvpnkfdx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_faxvpnkfdx.exe ups_ins3⤵
-
C:\Temp\i_faxvpnkfdx.exeC:\Temp\i_faxvpnkfdx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cxvpnhfzxs.exe ups_run3⤵
-
C:\Temp\cxvpnhfzxs.exeC:\Temp\cxvpnhfzxs.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cxvpnhfzxs.exe ups_ins3⤵
-
C:\Temp\i_cxvpnhfzxs.exeC:\Temp\i_cxvpnhfzxs.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpmkeczxrp.exe ups_run3⤵
-
C:\Temp\rpmkeczxrp.exeC:\Temp\rpmkeczxrp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpmkeczxrp.exe ups_ins3⤵
-
C:\Temp\i_rpmkeczxrp.exeC:\Temp\i_rpmkeczxrp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rmgebzurpj.exe ups_run3⤵
-
C:\Temp\rmgebzurpj.exeC:\Temp\rmgebzurpj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rmgebzurpj.exe ups_ins3⤵
-
C:\Temp\i_rmgebzurpj.exeC:\Temp\i_rmgebzurpj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wromgebzwr.exe ups_run3⤵
-
C:\Temp\wromgebzwr.exeC:\Temp\wromgebzwr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wromgebzwr.exe ups_ins3⤵
-
C:\Temp\i_wromgebzwr.exeC:\Temp\i_wromgebzwr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trojgbytql.exe ups_run3⤵
-
C:\Temp\trojgbytql.exeC:\Temp\trojgbytql.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trojgbytql.exe ups_ins3⤵
-
C:\Temp\i_trojgbytql.exeC:\Temp\i_trojgbytql.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bytqdyvtnl.exe ups_run3⤵
-
C:\Temp\bytqdyvtnl.exeC:\Temp\bytqdyvtnl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bytqdyvtnl.exe ups_ins3⤵
-
C:\Temp\i_bytqdyvtnl.exeC:\Temp\i_bytqdyvtnl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qolgdaysqo.exe ups_run3⤵
-
C:\Temp\qolgdaysqo.exeC:\Temp\qolgdaysqo.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qolgdaysqo.exe ups_ins3⤵
-
C:\Temp\i_qolgdaysqo.exeC:\Temp\i_qolgdaysqo.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kfdaysqkic.exe ups_run3⤵
-
C:\Temp\kfdaysqkic.exeC:\Temp\kfdaysqkic.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kfdaysqkic.exe ups_ins3⤵
-
C:\Temp\i_kfdaysqkic.exeC:\Temp\i_kfdaysqkic.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kfdxvspkhf.exe ups_run3⤵
-
C:\Temp\kfdxvspkhf.exeC:\Temp\kfdxvspkhf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x2c8,0x7ffb1056c188,0x7ffb1056c194,0x7ffb1056c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1936,i,9826487697358084062,79159716950145888,262144 --field-trial-handle=2576,i,8147168058652666340,4399990056019285383,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2168,i,124846939893109168,13326254832241951535,524288 --field-trial-handle=2576,i,8147168058652666340,4399990056019285383,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,9033717927060645370,10018373463899893694,524288 --field-trial-handle=2576,i,8147168058652666340,4399990056019285383,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,9490855655759393558,16226977298230053871,2097152 --field-trial-handle=2576,i,8147168058652666340,4399990056019285383,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,10482597234717705523,12935019777221910580,2097152 --field-trial-handle=2576,i,8147168058652666340,4399990056019285383,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,12680194483998412869,3342534229901294829,2097152 --field-trial-handle=2576,i,8147168058652666340,4399990056019285383,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,14991952292150333265,18424077137726523553,2097152 --field-trial-handle=2576,i,8147168058652666340,4399990056019285383,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3772,i,17335767547451855287,11248092676971282216,2097152 --field-trial-handle=2576,i,8147168058652666340,4399990056019285383,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,4453915234008215785,6172854792111542655,524288 --field-trial-handle=2576,i,8147168058652666340,4399990056019285383,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5456,i,915110000293571297,14775706548801067887,2097152 --field-trial-handle=2576,i,8147168058652666340,4399990056019285383,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,2284886228845150633,3526538230635029558,524288 --field-trial-handle=2576,i,8147168058652666340,4399990056019285383,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3696,i,12031939519976564188,5688774995834014825,524288 --field-trial-handle=2576,i,8147168058652666340,4399990056019285383,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,304098659689252079,7309208329443132758,524288 --field-trial-handle=2576,i,8147168058652666340,4399990056019285383,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,304098659689252079,7309208329443132758,524288 --field-trial-handle=2576,i,8147168058652666340,4399990056019285383,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,3074847728376394738,5256311394052917706,524288 --field-trial-handle=2576,i,8147168058652666340,4399990056019285383,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,7391547302790856341,528371012061648939,524288 --field-trial-handle=2576,i,8147168058652666340,4399990056019285383,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,10767931973771674978,16414041644170178724,524288 --field-trial-handle=2576,i,8147168058652666340,4399990056019285383,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,609665348539519282,16206377224396507419,524288 --field-trial-handle=2576,i,8147168058652666340,4399990056019285383,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1276,i,11488576445899074994,17377010355304479868,524288 --field-trial-handle=2576,i,8147168058652666340,4399990056019285383,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,9672923074813606086,7447829271140511902,524288 --field-trial-handle=2576,i,8147168058652666340,4399990056019285383,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1284,i,18443667199990079443,18220972075081448856,524288 --field-trial-handle=2576,i,8147168058652666340,4399990056019285383,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,5289027631457865238,11881460436157219639,524288 --field-trial-handle=2576,i,8147168058652666340,4399990056019285383,262144 --variations-seed-version --mojo-platform-channel-handle=1228 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,17629144085834276124,15499859901680816935,524288 --field-trial-handle=2576,i,8147168058652666340,4399990056019285383,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3692,i,6444788416690169804,5307309239727003985,524288 --field-trial-handle=2576,i,8147168058652666340,4399990056019285383,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,4440794648410600740,14942373980236966502,524288 --field-trial-handle=2576,i,8147168058652666340,4399990056019285383,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,15345324676971967079,18221884549782754702,524288 --field-trial-handle=2576,i,8147168058652666340,4399990056019285383,262144 --variations-seed-version --mojo-platform-channel-handle=944 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6232,i,3949331535575347286,6573891703008147626,262144 --field-trial-handle=2576,i,8147168058652666340,4399990056019285383,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3612,i,5370257101709873803,7518473451834694372,524288 --field-trial-handle=2576,i,8147168058652666340,4399990056019285383,262144 --variations-seed-version --mojo-platform-channel-handle=1216 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\qoigaywqnigdbvtq.sysC:\Temp\qoigaywqnigdbvtq.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\ifaysqkica.sysC:\Temp\ifaysqkica.sys1⤵
- Executes dropped EXE
-
C:\Temp\kicausnkic.sysC:\Temp\kicausnkic.sys1⤵
- Executes dropped EXE
-
C:\Temp\cwusmkhfzx.sysC:\Temp\cwusmkhfzx.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfzxupmkec.sysC:\Temp\hfzxupmkec.sys1⤵
- Executes dropped EXE
-
C:\Temp\wuomhezwuo.sysC:\Temp\wuomhezwuo.sys1⤵
- Executes dropped EXE
-
C:\Temp\toljebwtrl.sysC:\Temp\toljebwtrl.sys1⤵
- Executes dropped EXE
-
C:\Temp\qoigbytrlj.sysC:\Temp\qoigbytrlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\tqolgdaytq.sysC:\Temp\tqolgdaytq.sys1⤵
- Executes dropped EXE
-
C:\Temp\igdyvqnifa.sysC:\Temp\igdyvqnifa.sys1⤵
- Executes dropped EXE
-
C:\Temp\auspnhfday.sysC:\Temp\auspnhfday.sys1⤵
- Executes dropped EXE
-
C:\Temp\xupmkicaxs.sysC:\Temp\xupmkicaxs.sys1⤵
-
C:\Temp\xuspkhfcxu.sysC:\Temp\xuspkhfcxu.sys1⤵
-
C:\Temp\uomhezwuom.sysC:\Temp\uomhezwuom.sys1⤵
-
C:\Temp\uomgezwuom.sysC:\Temp\uomgezwuom.sys1⤵
-
C:\Temp\eyomgeywqo.sysC:\Temp\eyomgeywqo.sys1⤵
-
C:\Temp\dywtolgeyw.sysC:\Temp\dywtolgeyw.sys1⤵
-
C:\Temp\sqoigaysqo.sysC:\Temp\sqoigaysqo.sys1⤵
-
C:\Temp\qnifaysqni.sysC:\Temp\qnifaysqni.sys1⤵
-
C:\Temp\pkifdxvkif.sysC:\Temp\pkifdxvkif.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
bvtqlavtni.exe
caysqkidxv.exe
cwusmkhfzx.sys
fcwusmkecx.exe
hfzxupmkec.sys
i_bvtqlavtni.exe
i_caysqkidxv.exe
i_fcwusmkecx.exe
i_ifaxspnhfc.exe
i_zxrpjhbzwr.exe
ifaxspnhfc.exe
ifaysqkica.sys
kicausnkic.sys
qoigaywqnigdbvtq.exe
qoigaywqnigdbvtq.sys
wuomhezwuo.sys
zxrpjhbzwr.exe
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
the-real-index
the-real-index~RFe59f226.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
OperationConfig
OperationConfig~RFe5a8e47.TMP
Local State
Local State
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
25244dfb-ccaf-4fd4-9c13-55cc529e2ea2.tmp
299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
metadata.json~RFe59c961.TMP
59688889-2b7e-4727-9cd2-06048683eb7d.tmp
content_new.js
CreateProcess.exe
memory/2064-679-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2464-425-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2740-604-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2900-718-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3540-668-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3580-532-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3636-65-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4104-560-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4736-476-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4792-516-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4944-556-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5044-624-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5212-735-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5272-648-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5312-504-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5424-707-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5424-683-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5524-644-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5544-552-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5660-575-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5852-705-0x0000000000010000-0x00000000000AB000-memory.dmp