Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
04/06/2026, 11:55
General
- Target 2026-06-04_814d39ec561434fdd89b167f5315e6c7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 389KB
- Sample260604-n3ktdaex8j
- SHA256 9c4673e757767e44de1960708ea6ae3c057372458700a2ea1f271de24ab9a19a
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Custom signatureDetects executables containing bas64 encoded gzip files 1 IoCs
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 9 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 29 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-04_814d39ec561434fdd89b167f5315e6c7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-04_814d39ec561434fdd89b167f5315e6c7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\ztrmjecwrojhbzto.exeC:\Temp\ztrmjecwrojhbzto.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hbztrmjebw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\hbztrmjebw.exeC:\Temp\hbztrmjebw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hbztrmjebw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hbztrmjebw.exeC:\Temp\i_hbztrmjebw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljdbvtoigb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ljdbvtoigb.exeC:\Temp\ljdbvtoigb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljdbvtoigb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ljdbvtoigb.exeC:\Temp\i_ljdbvtoigb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\toigaytqlf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\toigaytqlf.exeC:\Temp\toigaytqlf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_toigaytqlf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_toigaytqlf.exeC:\Temp\i_toigaytqlf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdxvqnigay.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fdxvqnigay.exeC:\Temp\fdxvqnigay.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdxvqnigay.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fdxvqnigay.exeC:\Temp\i_fdxvqnigay.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ysqkicavsn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ysqkicavsn.exeC:\Temp\ysqkicavsn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ysqkicavsn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ysqkicavsn.exeC:\Temp\i_ysqkicavsn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\causnkfzxs.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\causnkfzxs.exeC:\Temp\causnkfzxs.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_causnkfzxs.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_causnkfzxs.exeC:\Temp\i_causnkfzxs.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecwupmhezx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ecwupmhezx.exeC:\Temp\ecwupmhezx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecwupmhezx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ecwupmhezx.exeC:\Temp\i_ecwupmhezx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mgezwrojhb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mgezwrojhb.exeC:\Temp\mgezwrojhb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mgezwrojhb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mgezwrojhb.exeC:\Temp\i_mgezwrojhb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hbztrmgeyw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hbztrmgeyw.exeC:\Temp\hbztrmgeyw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hbztrmgeyw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hbztrmgeyw.exeC:\Temp\i_hbztrmgeyw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\igbztrljdb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\igbztrljdb.exeC:\Temp\igbztrljdb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_igbztrljdb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_igbztrljdb.exeC:\Temp\i_igbztrljdb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qljdbwqoid.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qljdbwqoid.exeC:\Temp\qljdbwqoid.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qljdbwqoid.exe ups_ins3⤵
-
C:\Temp\i_qljdbwqoid.exeC:\Temp\i_qljdbwqoid.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\avtnlfdyvq.exe ups_run3⤵
-
C:\Temp\avtnlfdyvq.exeC:\Temp\avtnlfdyvq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_avtnlfdyvq.exe ups_ins3⤵
-
C:\Temp\i_avtnlfdyvq.exeC:\Temp\i_avtnlfdyvq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\snkfdxvqni.exe ups_run3⤵
-
C:\Temp\snkfdxvqni.exeC:\Temp\snkfdxvqni.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_snkfdxvqni.exe ups_ins3⤵
-
C:\Temp\i_snkfdxvqni.exeC:\Temp\i_snkfdxvqni.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\axspkicaus.exe ups_run3⤵
-
C:\Temp\axspkicaus.exeC:\Temp\axspkicaus.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_axspkicaus.exe ups_ins3⤵
-
C:\Temp\i_axspkicaus.exeC:\Temp\i_axspkicaus.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mkecxupmhf.exe ups_run3⤵
-
C:\Temp\mkecxupmhf.exeC:\Temp\mkecxupmhf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mkecxupmhf.exe ups_ins3⤵
-
C:\Temp\i_mkecxupmhf.exeC:\Temp\i_mkecxupmhf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\urmkezwrpj.exe ups_run3⤵
-
C:\Temp\urmkezwrpj.exeC:\Temp\urmkezwrpj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_urmkezwrpj.exe ups_ins3⤵
-
C:\Temp\i_urmkezwrpj.exeC:\Temp\i_urmkezwrpj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhbzurmjec.exe ups_run3⤵
-
C:\Temp\jhbzurmjec.exeC:\Temp\jhbzurmjec.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhbzurmjec.exe ups_ins3⤵
-
C:\Temp\i_jhbzurmjec.exeC:\Temp\i_jhbzurmjec.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rljdbwtolg.exe ups_run3⤵
-
C:\Temp\rljdbwtolg.exeC:\Temp\rljdbwtolg.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rljdbwtolg.exe ups_ins3⤵
-
C:\Temp\i_rljdbwtolg.exeC:\Temp\i_rljdbwtolg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljdbvtolge.exe ups_run3⤵
-
C:\Temp\ljdbvtolge.exeC:\Temp\ljdbvtolge.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljdbvtolge.exe ups_ins3⤵
-
C:\Temp\i_ljdbvtolge.exeC:\Temp\i_ljdbvtolge.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x33c,0x7ffe1487c188,0x7ffe1487c194,0x7ffe1487c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1780,i,4062510435771919812,16825615222921600997,262144 --field-trial-handle=1964,i,15073065526758041833,10371621761205451888,262144 --variations-seed-version --mojo-platform-channel-handle=1960 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2216,i,16081545014940375510,6251125734975912067,524288 --field-trial-handle=1964,i,15073065526758041833,10371621761205451888,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2436,i,15684304474309757761,4881231615000160930,524288 --field-trial-handle=1964,i,15073065526758041833,10371621761205451888,262144 --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3516,i,12883150476331202311,5619743700924906079,2097152 --field-trial-handle=1964,i,15073065526758041833,10371621761205451888,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3520,i,11768898927746632674,13745676040114298554,2097152 --field-trial-handle=1964,i,15073065526758041833,10371621761205451888,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,2635911200751433324,10056078944532305850,2097152 --field-trial-handle=1964,i,15073065526758041833,10371621761205451888,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,1756085253967637203,10884354751663182855,2097152 --field-trial-handle=1964,i,15073065526758041833,10371621761205451888,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4320,i,3944242321403297797,11397709916074883489,2097152 --field-trial-handle=1964,i,15073065526758041833,10371621761205451888,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4440,i,15133159722228015657,6008447905870985081,2097152 --field-trial-handle=1964,i,15073065526758041833,10371621761205451888,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4244,i,1924723087758183403,12427814023872731599,524288 --field-trial-handle=1964,i,15073065526758041833,10371621761205451888,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,6374649380086372902,13517926228345131024,524288 --field-trial-handle=1964,i,15073065526758041833,10371621761205451888,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,10894073137468171896,10681406521380153718,524288 --field-trial-handle=1964,i,15073065526758041833,10371621761205451888,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,12509214972218091404,12693611913425451823,524288 --field-trial-handle=1964,i,15073065526758041833,10371621761205451888,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:144⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11325⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,9211880128181177559,11589038752101652779,524288 --field-trial-handle=1964,i,15073065526758041833,10371621761205451888,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,9211880128181177559,11589038752101652779,524288 --field-trial-handle=1964,i,15073065526758041833,10371621761205451888,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,1655356179586657350,362729106816541126,524288 --field-trial-handle=1964,i,15073065526758041833,10371621761205451888,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,10306902286037468016,5825753565794378389,524288 --field-trial-handle=1964,i,15073065526758041833,10371621761205451888,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,7848003362430118704,7435897444480038362,524288 --field-trial-handle=1964,i,15073065526758041833,10371621761205451888,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,12392896611466137822,16128022256518530233,524288 --field-trial-handle=1964,i,15073065526758041833,10371621761205451888,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,8192263583945035569,14964663985383952908,524288 --field-trial-handle=1964,i,15073065526758041833,10371621761205451888,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4620,i,9888387739674614741,4076361014864508914,524288 --field-trial-handle=1964,i,15073065526758041833,10371621761205451888,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,14856930083273965752,12760186484789958718,524288 --field-trial-handle=1964,i,15073065526758041833,10371621761205451888,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4768,i,6437556253510139019,14042775340931260339,524288 --field-trial-handle=1964,i,15073065526758041833,10371621761205451888,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,229009275378266062,11866703496738323,524288 --field-trial-handle=1964,i,15073065526758041833,10371621761205451888,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,9390691122420806360,16187833575927200524,524288 --field-trial-handle=1964,i,15073065526758041833,10371621761205451888,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,16337507993674972119,15838801254070982605,524288 --field-trial-handle=1964,i,15073065526758041833,10371621761205451888,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,14072374086345679536,8318871725628436282,524288 --field-trial-handle=1964,i,15073065526758041833,10371621761205451888,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4304,i,5034249374639313168,6144341827099940051,262144 --field-trial-handle=1964,i,15073065526758041833,10371621761205451888,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,18119150131527382848,11181981934653425548,524288 --field-trial-handle=1964,i,15073065526758041833,10371621761205451888,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\ztrmjecwrojhbzto.sysC:\Temp\ztrmjecwrojhbzto.sys1⤵
- Executes dropped EXE
-
C:\Temp\ywqoigbytr.sysC:\Temp\ywqoigbytr.sys1⤵
- Executes dropped EXE
-
C:\Temp\jdbvtolgdy.sysC:\Temp\jdbvtolgdy.sys1⤵
- Executes dropped EXE
-
C:\Temp\toigaysqli.sysC:\Temp\toigaysqli.sys1⤵
- Executes dropped EXE
-
C:\Temp\icxvpnicau.sysC:\Temp\icxvpnicau.sys1⤵
- Executes dropped EXE
-
C:\Temp\kicausnkfd.sysC:\Temp\kicausnkfd.sys1⤵
- Executes dropped EXE
-
C:\Temp\amkecxupnh.sysC:\Temp\amkecxupnh.sys1⤵
- Executes dropped EXE
-
C:\Temp\fzxrpjhczu.sysC:\Temp\fzxrpjhczu.sys1⤵
- Executes dropped EXE
-
C:\Temp\omgezwrpjh.sysC:\Temp\omgezwrpjh.sys1⤵
- Executes dropped EXE
-
C:\Temp\tomgeywqoj.sysC:\Temp\tomgeywqoj.sys1⤵
- Executes dropped EXE
-
C:\Temp\ytqlidbvtn.sysC:\Temp\ytqlidbvtn.sys1⤵
- Executes dropped EXE
-
C:\Temp\dxvqnigays.sysC:\Temp\dxvqnigays.sys1⤵
-
C:\Temp\nkfaxsqkic.sysC:\Temp\nkfaxsqkic.sys1⤵
-
C:\Temp\xupnhfzxsp.sysC:\Temp\xupnhfzxsp.sys1⤵
-
C:\Temp\pkhczusmkf.sysC:\Temp\pkhczusmkf.sys1⤵
-
C:\Temp\wuomhbzurm.sysC:\Temp\wuomhbzurm.sys1⤵
-
C:\Temp\bwuomgeywr.sysC:\Temp\bwuomgeywr.sys1⤵
-
C:\Temp\dbvtqligby.sysC:\Temp\dbvtqligby.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
fdxvqnigay.exe
hbztrmjebw.exe
i_fdxvqnigay.exe
i_hbztrmjebw.exe
i_ljdbvtoigb.exe
i_toigaytqlf.exe
i_ysqkicavsn.exe
icxvpnicau.sys
jdbvtolgdy.sys
kicausnkfd.sys
ljdbvtoigb.exe
toigaysqli.sys
toigaytqlf.exe
ysqkicavsn.exe
ywqoigbytr.sys
ztrmjecwrojhbzto.exe
ztrmjecwrojhbzto.sys
blocklist
protocols.json
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
the-real-index
the-real-index~RFe58a67c.TMP
SiteList-Enterprise.json
Edge Profile.ico
HubApps
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
OperationConfig
OperationConfig~RFe59427e.TMP
office_endpoints_list.json
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
nav_config.json
metadata.json
metadata.json
metadata.json
metadata.json
8bd6e9ac-6faf-412a-b14b-1980f6070ed4.tmp
a64d2c5e-b4a4-450e-a9e7-6ceb9881c73d.tmp
fdc6d51a-9578-4bdd-adb1-6a7157a2ee74.tmp
0a0ee81e-1e93-43e5-904b-57425da2289f.tmp
content_new.js
manifest.json
manifest.json
manifest.json
manifest.json
memory/772-507-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1096-592-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1096-597-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1164-777-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1240-790-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1336-596-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1892-587-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2560-588-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2560-563-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2612-640-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2612-658-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3100-74-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3260-628-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3428-808-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3596-708-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3748-543-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3828-720-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3996-458-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4340-754-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4340-779-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4504-732-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5016-657-0x0000000000010000-0x00000000000AB000-memory.dmp