Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
12/08/2026, 14:06
General
- Target 2026-08-12_dfdd0c9962a768f6e452cf9cf7ca12a4_amadey_darkgate_elex_smoke-loader_stop.exe
- Size 384KB
- Sample260812-retcdshq2w
- SHA256 4486cd2c28a1caa8ef497337e02a0e1828e758245a6b9ea887c2595f4de3d8ba
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-12_dfdd0c9962a768f6e452cf9cf7ca12a4_amadey_darkgate_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-12_dfdd0c9962a768f6e452cf9cf7ca12a4_amadey_darkgate_elex_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\mhfzxrpjhezxupmk.exeC:\Temp\mhfzxrpjhezxupmk.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\uomhezxrpk.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\uomhezxrpk.exeC:\Temp\uomhezxrpk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_uomhezxrpk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_uomhezxrpk.exeC:\Temp\i_uomhezxrpk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pjheywrojh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pjheywrojh.exeC:\Temp\pjheywrojh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pjheywrojh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pjheywrojh.exeC:\Temp\i_pjheywrojh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mjebvtrljg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mjebvtrljg.exeC:\Temp\mjebvtrljg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mjebvtrljg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mjebvtrljg.exeC:\Temp\i_mjebvtrljg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lgdbvtolgd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lgdbvtolgd.exeC:\Temp\lgdbvtolgd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lgdbvtolgd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lgdbvtolgd.exeC:\Temp\i_lgdbvtolgd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdavtnlxvq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jdavtnlxvq.exeC:\Temp\jdavtnlxvq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdavtnlxvq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jdavtnlxvq.exeC:\Temp\i_jdavtnlxvq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\avsnlfdavs.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\avsnlfdavs.exeC:\Temp\avsnlfdavs.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_avsnlfdavs.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_avsnlfdavs.exeC:\Temp\i_avsnlfdavs.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nkfdxvpnhf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nkfdxvpnhf.exeC:\Temp\nkfdxvpnhf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nkfdxvpnhf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nkfdxvpnhf.exeC:\Temp\i_nkfdxvpnhf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpnkfzxupn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rpnkfzxupn.exeC:\Temp\rpnkfzxupn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpnkfzxupn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rpnkfzxupn.exeC:\Temp\i_rpnkfzxupn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pmhfzxupmh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pmhfzxupmh.exeC:\Temp\pmhfzxupmh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pmhfzxupmh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pmhfzxupmh.exeC:\Temp\i_pmhfzxupmh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kebwtromge.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kebwtromge.exeC:\Temp\kebwtromge.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kebwtromge.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kebwtromge.exeC:\Temp\i_kebwtromge.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bwtoljdbwt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bwtoljdbwt.exeC:\Temp\bwtoljdbwt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bwtoljdbwt.exe ups_ins3⤵
-
C:\Temp\i_bwtoljdbwt.exeC:\Temp\i_bwtoljdbwt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\olgdbvtroi.exe ups_run3⤵
-
C:\Temp\olgdbvtroi.exeC:\Temp\olgdbvtroi.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_olgdbvtroi.exe ups_ins3⤵
-
C:\Temp\i_olgdbvtroi.exeC:\Temp\i_olgdbvtroi.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qoigdyvqoi.exe ups_run3⤵
-
C:\Temp\qoigdyvqoi.exeC:\Temp\qoigdyvqoi.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qoigdyvqoi.exe ups_ins3⤵
-
C:\Temp\i_qoigdyvqoi.exeC:\Temp\i_qoigdyvqoi.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdxvqoigay.exe ups_run3⤵
-
C:\Temp\fdxvqoigay.exeC:\Temp\fdxvqoigay.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdxvqoigay.exe ups_ins3⤵
-
C:\Temp\i_fdxvqoigay.exeC:\Temp\i_fdxvqoigay.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ifaxvpnifa.exe ups_run3⤵
-
C:\Temp\ifaxvpnifa.exeC:\Temp\ifaxvpnifa.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ifaxvpnifa.exe ups_ins3⤵
-
C:\Temp\i_ifaxvpnifa.exeC:\Temp\i_ifaxvpnifa.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cxupmkfcxu.exe ups_run3⤵
-
C:\Temp\cxupmkfcxu.exeC:\Temp\cxupmkfcxu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cxupmkfcxu.exe ups_ins3⤵
-
C:\Temp\i_cxupmkfcxu.exeC:\Temp\i_cxupmkfcxu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hfcxupnhfz.exe ups_run3⤵
-
C:\Temp\hfcxupnhfz.exeC:\Temp\hfcxupnhfz.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hfcxupnhfz.exe ups_ins3⤵
-
C:\Temp\i_hfcxupnhfz.exeC:\Temp\i_hfcxupnhfz.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pjhbzurmjh.exe ups_run3⤵
-
C:\Temp\pjhbzurmjh.exeC:\Temp\pjhbzurmjh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pjhbzurmjh.exe ups_ins3⤵
-
C:\Temp\i_pjhbzurmjh.exeC:\Temp\i_pjhbzurmjh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mgezwuolje.exe ups_run3⤵
-
C:\Temp\mgezwuolje.exeC:\Temp\mgezwuolje.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mgezwuolje.exe ups_ins3⤵
-
C:\Temp\i_mgezwuolje.exeC:\Temp\i_mgezwuolje.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jgbvtrlgey.exe ups_run3⤵
-
C:\Temp\jgbvtrlgey.exeC:\Temp\jgbvtrlgey.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7fff244fc188,0x7fff244fc194,0x7fff244fc1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,16066716390689338694,14280482510347124729,262144 --field-trial-handle=2316,i,6239548262860631623,5579918726244566834,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,5551213319202283155,12069475661908898829,524288 --field-trial-handle=2316,i,6239548262860631623,5579918726244566834,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,13867563606271443441,1265021362013377210,524288 --field-trial-handle=2316,i,6239548262860631623,5579918726244566834,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,7418718662655573657,184138897360936489,2097152 --field-trial-handle=2316,i,6239548262860631623,5579918726244566834,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,1841075908885624585,13322414736434298733,2097152 --field-trial-handle=2316,i,6239548262860631623,5579918726244566834,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,17815042008671569801,15714286812324459285,2097152 --field-trial-handle=2316,i,6239548262860631623,5579918726244566834,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,8196342740078741019,4724415953752885621,2097152 --field-trial-handle=2316,i,6239548262860631623,5579918726244566834,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,15008777408398267286,18219543398989941843,524288 --field-trial-handle=2316,i,6239548262860631623,5579918726244566834,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,6609824007703937025,3920373556240304252,524288 --field-trial-handle=2316,i,6239548262860631623,5579918726244566834,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,17220820020801065599,18239299603085886814,524288 --field-trial-handle=2316,i,6239548262860631623,5579918726244566834,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,816575289035447836,12453197944885040548,524288 --field-trial-handle=2316,i,6239548262860631623,5579918726244566834,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,816575289035447836,12453197944885040548,524288 --field-trial-handle=2316,i,6239548262860631623,5579918726244566834,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,4694025971344117241,5644028277819088688,524288 --field-trial-handle=2316,i,6239548262860631623,5579918726244566834,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,12642145618327693089,4172732348774940293,524288 --field-trial-handle=2316,i,6239548262860631623,5579918726244566834,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,10710985876499567967,12399041805213404131,524288 --field-trial-handle=2316,i,6239548262860631623,5579918726244566834,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,17641040993289505822,5969726439061606224,524288 --field-trial-handle=2316,i,6239548262860631623,5579918726244566834,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,7492445057957795578,17723656735404921012,524288 --field-trial-handle=2316,i,6239548262860631623,5579918726244566834,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,7823556817465401,17952741301020052735,524288 --field-trial-handle=2316,i,6239548262860631623,5579918726244566834,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4260,i,2724912373814359144,5487192806470273000,524288 --field-trial-handle=2316,i,6239548262860631623,5579918726244566834,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,55404482085113319,6152552658463971136,524288 --field-trial-handle=2316,i,6239548262860631623,5579918726244566834,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,10208832503694877390,13594426379733262121,524288 --field-trial-handle=2316,i,6239548262860631623,5579918726244566834,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,11372910103263779348,7222302044594517944,524288 --field-trial-handle=2316,i,6239548262860631623,5579918726244566834,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,17785269434351772353,5752803782802531113,524288 --field-trial-handle=2316,i,6239548262860631623,5579918726244566834,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6240,i,1619787624780567749,6279767309574011462,262144 --field-trial-handle=2316,i,6239548262860631623,5579918726244566834,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6816,i,789554101436684200,12457416414005824908,524288 --field-trial-handle=2316,i,6239548262860631623,5579918726244566834,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\mhfzxrpjhezxupmk.sysC:\Temp\mhfzxrpjhezxupmk.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\rmjhbztroj.sysC:\Temp\rmjhbztroj.sys1⤵
- Executes dropped EXE
-
C:\Temp\rljebwtolj.sysC:\Temp\rljebwtolj.sys1⤵
- Executes dropped EXE
-
C:\Temp\trljeywlge.sysC:\Temp\trljeywlge.sys1⤵
- Executes dropped EXE
-
C:\Temp\jdbvsqolfd.sysC:\Temp\jdbvsqolfd.sys1⤵
- Executes dropped EXE
-
C:\Temp\davsqkidav.sysC:\Temp\davsqkidav.sys1⤵
- Executes dropped EXE
-
C:\Temp\pkhfaxsqki.sysC:\Temp\pkhfaxsqki.sys1⤵
- Executes dropped EXE
-
C:\Temp\xvpnkfcxus.sysC:\Temp\xvpnkfcxus.sys1⤵
- Executes dropped EXE
-
C:\Temp\usmkeczusm.sysC:\Temp\usmkeczusm.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhbztrpmge.sysC:\Temp\jhbztrpmge.sys1⤵
- Executes dropped EXE
-
C:\Temp\bwuomgeywt.sysC:\Temp\bwuomgeywt.sys1⤵
- Executes dropped EXE
-
C:\Temp\wtoljgeywq.sysC:\Temp\wtoljgeywq.sys1⤵
-
C:\Temp\vtolgdyvqo.sysC:\Temp\vtolgdyvqo.sys1⤵
-
C:\Temp\ifdyvqnifd.sysC:\Temp\ifdyvqnifd.sys1⤵
-
C:\Temp\fdxvsnkfdx.sysC:\Temp\fdxvsnkfdx.sys1⤵
-
C:\Temp\qnhfdxvpni.sysC:\Temp\qnhfdxvpni.sys1⤵
-
C:\Temp\kecaxrpmhe.sysC:\Temp\kecaxrpmhe.sys1⤵
-
C:\Temp\pmhbzxupmh.sysC:\Temp\pmhbzxupmh.sys1⤵
-
C:\Temp\mjecwuomjh.sysC:\Temp\mjecwuomjh.sys1⤵
-
C:\Temp\urmjgeywuo.sysC:\Temp\urmjgeywuo.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
avsnlfdavs.exe
davsqkidav.sys
i_jdavtnlxvq.exe
i_lgdbvtolgd.exe
i_mjebvtrljg.exe
i_pjheywrojh.exe
i_uomhezxrpk.exe
jdavtnlxvq.exe
jdbvsqolfd.sys
lgdbvtolgd.exe
mhfzxrpjhezxupmk.exe
mhfzxrpjhezxupmk.sys
mjebvtrljg.exe
pjheywrojh.exe
rljebwtolj.sys
rmjhbztroj.sys
trljeywlge.sys
uomhezxrpk.exe
settings.dat
settings.dat
the-real-index
the-real-index~RFe5974e8.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
OperationConfig
OperationConfig~RFe5a0fa1.TMP
Local State
Local State
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
aace47a8-8c7b-40bb-9844-86b9e91f51a6.tmp
metadata.json~RFe594c32.TMP
c5cc1825-c4fb-4b2a-bc6c-d31aa6c6e5a1.tmp
content_new.js
CreateProcess.exe
memory/572-551-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/992-703-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1288-619-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1544-639-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1692-663-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2424-468-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2676-679-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2716-532-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2904-720-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3696-699-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4196-510-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4204-64-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4472-599-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4848-517-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4848-496-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5104-643-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5216-674-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5420-566-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5864-547-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6040-421-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6048-570-0x0000000000010000-0x00000000000AB000-memory.dmp