Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
21/08/2026, 15:57
General
- Target 2026-08-21_8e8c939ef6d22aaa9c71fd7a1dc5a240_amadey_darkgate_elex_smoke-loader_stop.exe
- Size 384KB
- Sample260821-teev4sxtbw
- SHA256 aed2a50cd40ef58a04edb7b85c6bbd61e7f883d88d63b07630f8a2474768bd96
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-21_8e8c939ef6d22aaa9c71fd7a1dc5a240_amadey_darkgate_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-21_8e8c939ef6d22aaa9c71fd7a1dc5a240_amadey_darkgate_elex_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\ezwrpjhbzurmjebw.exeC:\Temp\ezwrpjhbzurmjebw.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gebwurmgez.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\gebwurmgez.exeC:\Temp\gebwurmgez.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gebwurmgez.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gebwurmgez.exeC:\Temp\i_gebwurmgez.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qojgbztrlj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qojgbztrlj.exeC:\Temp\qojgbztrlj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qojgbztrlj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qojgbztrlj.exeC:\Temp\i_qojgbztrlj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gdywqnlgdb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gdywqnlgdb.exeC:\Temp\gdywqnlgdb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gdywqnlgdb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gdywqnlgdb.exeC:\Temp\i_gdywqnlgdb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nlfdavsqki.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nlfdavsqki.exeC:\Temp\nlfdavsqki.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nlfdavsqki.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nlfdavsqki.exeC:\Temp\i_nlfdavsqki.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqkidavsni.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\sqkidavsni.exeC:\Temp\sqkidavsni.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqkidavsni.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_sqkidavsni.exeC:\Temp\i_sqkidavsni.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnkfcxvpnh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pnkfcxvpnh.exeC:\Temp\pnkfcxvpnh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnkfcxvpnh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pnkfcxvpnh.exeC:\Temp\i_pnkfcxvpnh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mheczxrpjh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mheczxrpjh.exeC:\Temp\mheczxrpjh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mheczxrpjh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mheczxrpjh.exeC:\Temp\i_mheczxrpjh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cxupmherpj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\cxupmherpj.exeC:\Temp\cxupmherpj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cxupmherpj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_cxupmherpj.exeC:\Temp\i_cxupmherpj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mjecwuomge.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mjecwuomge.exeC:\Temp\mjecwuomge.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mjecwuomge.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mjecwuomge.exeC:\Temp\i_mjecwuomge.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\geywrojhbz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\geywrojhbz.exeC:\Temp\geywrojhbz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_geywrojhbz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_geywrojhbz.exeC:\Temp\i_geywrojhbz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywqoigbytq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ywqoigbytq.exeC:\Temp\ywqoigbytq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywqoigbytq.exe ups_ins3⤵
-
C:\Temp\i_ywqoigbytq.exeC:\Temp\i_ywqoigbytq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dyvtnlgdyo.exe ups_run3⤵
-
C:\Temp\dyvtnlgdyo.exeC:\Temp\dyvtnlgdyo.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dyvtnlgdyo.exe ups_ins3⤵
-
C:\Temp\i_dyvtnlgdyo.exeC:\Temp\i_dyvtnlgdyo.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqoigaysql.exe ups_run3⤵
-
C:\Temp\sqoigaysql.exeC:\Temp\sqoigaysql.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqoigaysql.exe ups_ins3⤵
-
C:\Temp\i_sqoigaysql.exeC:\Temp\i_sqoigaysql.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vpkifaysqk.exe ups_run3⤵
-
C:\Temp\vpkifaysqk.exeC:\Temp\vpkifaysqk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vpkifaysqk.exe ups_ins3⤵
-
C:\Temp\i_vpkifaysqk.exeC:\Temp\i_vpkifaysqk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usmkicausp.exe ups_run3⤵
-
C:\Temp\usmkicausp.exeC:\Temp\usmkicausp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usmkicausp.exe ups_ins3⤵
-
C:\Temp\i_usmkicausp.exeC:\Temp\i_usmkicausp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hczxupmhec.exe ups_run3⤵
-
C:\Temp\hczxupmhec.exeC:\Temp\hczxupmhec.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hczxupmhec.exe ups_ins3⤵
-
C:\Temp\i_hczxupmhec.exeC:\Temp\i_hczxupmhec.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kecwuomhec.exe ups_run3⤵
-
C:\Temp\kecwuomhec.exeC:\Temp\kecwuomhec.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kecwuomhec.exe ups_ins3⤵
-
C:\Temp\i_kecwuomhec.exeC:\Temp\i_kecwuomhec.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wuomgebzwr.exe ups_run3⤵
-
C:\Temp\wuomgebzwr.exeC:\Temp\wuomgebzwr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wuomgebzwr.exe ups_ins3⤵
-
C:\Temp\i_wuomgebzwr.exeC:\Temp\i_wuomgebzwr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wtolgdbvto.exe ups_run3⤵
-
C:\Temp\wtolgdbvto.exeC:\Temp\wtolgdbvto.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wtolgdbvto.exe ups_ins3⤵
-
C:\Temp\i_wtolgdbvto.exeC:\Temp\i_wtolgdbvto.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\toljgbywqo.exe ups_run3⤵
-
C:\Temp\toljgbywqo.exeC:\Temp\toljgbywqo.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x300,0x7ffe2a9ac188,0x7ffe2a9ac194,0x7ffe2a9ac1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,10741160713885602235,13663655160102962474,262144 --field-trial-handle=2540,i,653605179622751970,255505327861350560,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,11073655446469929861,15362616808273427140,524288 --field-trial-handle=2540,i,653605179622751970,255505327861350560,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2348,i,15099069253487593361,1716195801186346894,524288 --field-trial-handle=2540,i,653605179622751970,255505327861350560,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,4221196183061995540,10474020704078473692,2097152 --field-trial-handle=2540,i,653605179622751970,255505327861350560,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,17897281668884235392,16829630675400777240,2097152 --field-trial-handle=2540,i,653605179622751970,255505327861350560,262144 --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,13931442341415698520,9340162290388190613,2097152 --field-trial-handle=2540,i,653605179622751970,255505327861350560,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,8884713685486508332,17964311558163245629,2097152 --field-trial-handle=2540,i,653605179622751970,255505327861350560,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,5881761304928784676,13949771818889403932,524288 --field-trial-handle=2540,i,653605179622751970,255505327861350560,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,11785365333403234250,8736808014060671747,524288 --field-trial-handle=2540,i,653605179622751970,255505327861350560,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,4085115161761591797,16267864292423403555,524288 --field-trial-handle=2540,i,653605179622751970,255505327861350560,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,7351556946333161823,4256371955724264098,524288 --field-trial-handle=2540,i,653605179622751970,255505327861350560,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,7351556946333161823,4256371955724264098,524288 --field-trial-handle=2540,i,653605179622751970,255505327861350560,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,3415349122903300762,14582542206688716428,524288 --field-trial-handle=2540,i,653605179622751970,255505327861350560,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,2815739629220133583,6449122109953768224,524288 --field-trial-handle=2540,i,653605179622751970,255505327861350560,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,18384143701613911678,5099696463455314038,524288 --field-trial-handle=2540,i,653605179622751970,255505327861350560,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,11603750071424741901,241771162686914558,524288 --field-trial-handle=2540,i,653605179622751970,255505327861350560,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,6527216729612757967,2584222319040011364,524288 --field-trial-handle=2540,i,653605179622751970,255505327861350560,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,13155120061777474066,1926745231169735700,524288 --field-trial-handle=2540,i,653605179622751970,255505327861350560,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,1496144611737272437,13450608423900821053,524288 --field-trial-handle=2540,i,653605179622751970,255505327861350560,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,9643458220760088874,15560676587623680679,524288 --field-trial-handle=2540,i,653605179622751970,255505327861350560,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6840,i,10147844290948086464,11373557216245003883,524288 --field-trial-handle=2540,i,653605179622751970,255505327861350560,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,15176281130493117384,6491801906786023636,524288 --field-trial-handle=2540,i,653605179622751970,255505327861350560,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,12488954987497482544,10734090908841138528,524288 --field-trial-handle=2540,i,653605179622751970,255505327861350560,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6832,i,14549696328837789776,14996117044583168493,262144 --field-trial-handle=2540,i,653605179622751970,255505327861350560,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3280,i,3898678455429876444,6247377802766370736,524288 --field-trial-handle=2540,i,653605179622751970,255505327861350560,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\ezwrpjhbzurmjebw.sysC:\Temp\ezwrpjhbzurmjebw.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\wtoljdbztr.sysC:\Temp\wtoljdbztr.sys1⤵
- Executes dropped EXE
-
C:\Temp\lgeyvqnljg.sysC:\Temp\lgeyvqnljg.sys1⤵
- Executes dropped EXE
-
C:\Temp\yvqolfdyvq.sysC:\Temp\yvqolfdyvq.sys1⤵
- Executes dropped EXE
-
C:\Temp\avsnkigays.sysC:\Temp\avsnkigays.sys1⤵
- Executes dropped EXE
-
C:\Temp\nkfcaxsqki.sysC:\Temp\nkfcaxsqki.sys1⤵
- Executes dropped EXE
-
C:\Temp\spczxrpnke.sysC:\Temp\spczxrpnke.sys1⤵
- Executes dropped EXE
-
C:\Temp\wupmkecwup.sysC:\Temp\wupmkecwup.sys1⤵
- Executes dropped EXE
-
C:\Temp\rpmgeczurm.sysC:\Temp\rpmgeczurm.sys1⤵
- Executes dropped EXE
-
C:\Temp\geywqojhbz.sysC:\Temp\geywqojhbz.sys1⤵
- Executes dropped EXE
-
C:\Temp\ebwtolbytq.sysC:\Temp\ebwtolbytq.sys1⤵
- Executes dropped EXE
-
C:\Temp\dbvqoigdbv.sysC:\Temp\dbvqoigdbv.sys1⤵
-
C:\Temp\yvqoigaysq.sysC:\Temp\yvqoigaysq.sys1⤵
-
C:\Temp\vsqkifaysq.sysC:\Temp\vsqkifaysq.sys1⤵
-
C:\Temp\fcxvpnhfzx.sysC:\Temp\fcxvpnhfzx.sys1⤵
-
C:\Temp\fcxusmkhfz.sysC:\Temp\fcxusmkhfz.sys1⤵
-
C:\Temp\mkecwupmhf.sysC:\Temp\mkecwupmhf.sys1⤵
-
C:\Temp\wurpjgezwr.sysC:\Temp\wurpjgezwr.sys1⤵
-
C:\Temp\ebwuomgebw.sysC:\Temp\ebwuomgebw.sys1⤵
-
C:\Temp\qolgdyvtrl.sysC:\Temp\qolgdyvtrl.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
avsnkigays.sys
ezwrpjhbzurmjebw.exe
ezwrpjhbzurmjebw.sys
gdywqnlgdb.exe
gebwurmgez.exe
i_gdywqnlgdb.exe
i_gebwurmgez.exe
i_nlfdavsqki.exe
i_qojgbztrlj.exe
i_sqkidavsni.exe
lgeyvqnljg.sys
nkfcaxsqki.sys
nlfdavsqki.exe
pnkfcxvpnh.exe
qojgbztrlj.exe
sqkidavsni.exe
wtoljdbztr.sys
yvqolfdyvq.sys
settings.dat
settings.dat
9dc16b44-698e-4e7a-bd7b-3012c4b3fe60.tmp
the-real-index
the-real-index~RFe5992ff.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Secure Preferences
OperationConfig
OperationConfig~RFe5a2eb2.TMP
Local State
Local State
Local State
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
5844461b-1e37-4543-8870-9e3c959e5f64.tmp
e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
metadata.json~RFe596a2a.TMP
6491dee6-041a-481f-be7c-1a2d4516ccd8.tmp
content_new.js
CreateProcess.exe
memory/924-676-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2044-601-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2332-525-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2444-702-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2452-645-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2864-499-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2872-665-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3508-423-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3512-681-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3600-512-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4620-641-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4636-621-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4880-571-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5292-548-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5332-552-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5360-567-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5360-594-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5392-471-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5392-505-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5496-456-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5496-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5508-706-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5584-723-0x0000000000010000-0x00000000000AB000-memory.dmp