Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
02/08/2026, 19:16
General
- Target 2026-08-02_264bd35d8cff6639b8c426b314f89063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 365KB
- Sample260802-xy925swvbx
- SHA256 18490a27f32945af8ed6bd4a114b1579c257e10484f9a3046475a7d44169a9ad
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_264bd35d8cff6639b8c426b314f89063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_264bd35d8cff6639b8c426b314f89063_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\czusmkecwupmhfzx.exeC:\Temp\czusmkecwupmhfzx.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\eczurmkecu.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\eczurmkecu.exeC:\Temp\eczurmkecu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_eczurmkecu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_eczurmkecu.exeC:\Temp\i_eczurmkecu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hbztrojgez.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hbztrojgez.exeC:\Temp\hbztrojgez.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hbztrojgez.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hbztrojgez.exeC:\Temp\i_hbztrojgez.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rljgbztrlj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rljgbztrlj.exeC:\Temp\rljgbztrlj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rljgbztrlj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rljgbztrlj.exeC:\Temp\i_rljgbztrlj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qljdbvtnlg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qljdbvtnlg.exeC:\Temp\qljdbvtnlg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qljdbvtnlg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qljdbvtnlg.exeC:\Temp\i_qljdbvtnlg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qlaysqkida.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qlaysqkida.exeC:\Temp\qlaysqkida.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qlaysqkida.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qlaysqkida.exeC:\Temp\i_qlaysqkida.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dxvpnifays.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dxvpnifays.exeC:\Temp\dxvpnifays.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dxvpnifays.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dxvpnifays.exeC:\Temp\i_dxvpnifays.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvpnhfcxsp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xvpnhfcxsp.exeC:\Temp\xvpnhfcxsp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xvpnhfcxsp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xvpnhfcxsp.exeC:\Temp\i_xvpnhfcxsp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xupmhfzxrp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xupmhfzxrp.exeC:\Temp\xupmhfzxrp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xupmhfzxrp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xupmhfzxrp.exeC:\Temp\i_xupmhfzxrp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mhfzxrpjhf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mhfzxrpjhf.exeC:\Temp\mhfzxrpjhf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mhfzxrpjhf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mhfzxrpjhf.exeC:\Temp\i_mhfzxrpjhf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\romgecwurm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\romgecwurm.exeC:\Temp\romgecwurm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_romgecwurm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_romgecwurm.exeC:\Temp\i_romgecwurm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trljdbztrl.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\trljdbztrl.exeC:\Temp\trljdbztrl.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trljdbztrl.exe ups_ins3⤵
-
C:\Temp\i_trljdbztrl.exeC:\Temp\i_trljdbztrl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\olgdbvtroi.exe ups_run3⤵
-
C:\Temp\olgdbvtroi.exeC:\Temp\olgdbvtroi.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_olgdbvtroi.exe ups_ins3⤵
-
C:\Temp\i_olgdbvtroi.exeC:\Temp\i_olgdbvtroi.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qolgdyvqnl.exe ups_run3⤵
-
C:\Temp\qolgdyvqnl.exeC:\Temp\qolgdyvqnl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qolgdyvqnl.exe ups_ins3⤵
-
C:\Temp\i_qolgdyvqnl.exeC:\Temp\i_qolgdyvqnl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nlfdxvqnli.exe ups_run3⤵
-
C:\Temp\nlfdxvqnli.exeC:\Temp\nlfdxvqnli.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nlfdxvqnli.exe ups_ins3⤵
-
C:\Temp\i_nlfdxvqnli.exeC:\Temp\i_nlfdxvqnli.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vpnkidxvsn.exe ups_run3⤵
-
C:\Temp\vpnkidxvsn.exeC:\Temp\vpnkidxvsn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vpnkidxvsn.exe ups_ins3⤵
-
C:\Temp\i_vpnkidxvsn.exeC:\Temp\i_vpnkidxvsn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usmkiczxrp.exe ups_run3⤵
-
C:\Temp\usmkiczxrp.exeC:\Temp\usmkiczxrp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usmkiczxrp.exe ups_ins3⤵
-
C:\Temp\i_usmkiczxrp.exeC:\Temp\i_usmkiczxrp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kecxrpmhfz.exe ups_run3⤵
-
C:\Temp\kecxrpmhfz.exeC:\Temp\kecxrpmhfz.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kecxrpmhfz.exe ups_ins3⤵
-
C:\Temp\i_kecxrpmhfz.exeC:\Temp\i_kecxrpmhfz.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fzxrpjhbzw.exe ups_run3⤵
-
C:\Temp\fzxrpjhbzw.exeC:\Temp\fzxrpjhbzw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fzxrpjhbzw.exe ups_ins3⤵
-
C:\Temp\i_fzxrpjhbzw.exeC:\Temp\i_fzxrpjhbzw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gebztrpjhb.exe ups_run3⤵
-
C:\Temp\gebztrpjhb.exeC:\Temp\gebztrpjhb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gebztrpjhb.exe ups_ins3⤵
-
C:\Temp\i_gebztrpjhb.exeC:\Temp\i_gebztrpjhb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\geywqoigby.exe ups_run3⤵
-
C:\Temp\geywqoigby.exeC:\Temp\geywqoigby.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x208,0x304,0x7fff1f77c188,0x7fff1f77c194,0x7fff1f77c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,8526164886675273161,6139435740251129027,262144 --field-trial-handle=2468,i,8720115475527503734,8860040798558010709,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,13741553541009920132,2069480699809872158,524288 --field-trial-handle=2468,i,8720115475527503734,8860040798558010709,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2512,i,2529452080963236275,5240345247790960044,524288 --field-trial-handle=2468,i,8720115475527503734,8860040798558010709,262144 --variations-seed-version --mojo-platform-channel-handle=1964 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,9541977393403216250,5745564240166783956,2097152 --field-trial-handle=2468,i,8720115475527503734,8860040798558010709,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3608,i,5562069758470290947,18225668606169048459,2097152 --field-trial-handle=2468,i,8720115475527503734,8860040798558010709,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,8910480688603914569,6425456489977232675,2097152 --field-trial-handle=2468,i,8720115475527503734,8860040798558010709,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,76224425328666438,13743113206859927691,2097152 --field-trial-handle=2468,i,8720115475527503734,8860040798558010709,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,2926555477187067298,2701973360378312468,524288 --field-trial-handle=2468,i,8720115475527503734,8860040798558010709,262144 --variations-seed-version --mojo-platform-channel-handle=3880 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,9892858615923109683,2679232732645461285,524288 --field-trial-handle=2468,i,8720115475527503734,8860040798558010709,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,585913170193453049,1872305526090903095,524288 --field-trial-handle=2468,i,8720115475527503734,8860040798558010709,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,8361889711155220758,10102555669821814645,524288 --field-trial-handle=2468,i,8720115475527503734,8860040798558010709,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,8361889711155220758,10102555669821814645,524288 --field-trial-handle=2468,i,8720115475527503734,8860040798558010709,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,15828434649018070468,460945008494736085,524288 --field-trial-handle=2468,i,8720115475527503734,8860040798558010709,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,15365650879393431450,10619852811414216020,524288 --field-trial-handle=2468,i,8720115475527503734,8860040798558010709,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,12680678901304458936,679246883277565577,524288 --field-trial-handle=2468,i,8720115475527503734,8860040798558010709,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,9082068008417053830,8825419157492059414,524288 --field-trial-handle=2468,i,8720115475527503734,8860040798558010709,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,10254363837128883328,5691458237951874584,524288 --field-trial-handle=2468,i,8720115475527503734,8860040798558010709,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,8088929692969179486,4019227713627580364,524288 --field-trial-handle=2468,i,8720115475527503734,8860040798558010709,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,15489452823251052560,6652387753373823255,524288 --field-trial-handle=2468,i,8720115475527503734,8860040798558010709,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2240,i,2389408474174113969,8891990251626133694,524288 --field-trial-handle=2468,i,8720115475527503734,8860040798558010709,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,2275618538740001383,12635060969765960523,524288 --field-trial-handle=2468,i,8720115475527503734,8860040798558010709,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,1295389030060226561,15803807479746398844,524288 --field-trial-handle=2468,i,8720115475527503734,8860040798558010709,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,13769709131125335523,9421300942601724365,524288 --field-trial-handle=2468,i,8720115475527503734,8860040798558010709,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5108,i,3394949776122413843,7243547099683690954,262144 --field-trial-handle=2468,i,8720115475527503734,8860040798558010709,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,18245604951952954520,5069611980037433748,524288 --field-trial-handle=2468,i,8720115475527503734,8860040798558010709,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\czusmkecwupmhfzx.sysC:\Temp\czusmkecwupmhfzx.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\jecwuomgeb.sysC:\Temp\jecwuomgeb.sys1⤵
- Executes dropped EXE
-
C:\Temp\rojgeywqom.sysC:\Temp\rojgeywqom.sys1⤵
- Executes dropped EXE
-
C:\Temp\bvtgdywqoi.sysC:\Temp\bvtgdywqoi.sys1⤵
- Executes dropped EXE
-
C:\Temp\vqlidaytql.sysC:\Temp\vqlidaytql.sys1⤵
- Executes dropped EXE
-
C:\Temp\avsnlidavt.sysC:\Temp\avsnlidavt.sys1⤵
- Executes dropped EXE
-
C:\Temp\vpnhfcxvpn.sysC:\Temp\vpnhfcxvpn.sys1⤵
- Executes dropped EXE
-
C:\Temp\czxspfzxus.sysC:\Temp\czxspfzxus.sys1⤵
- Executes dropped EXE
-
C:\Temp\mkecwupmhf.sysC:\Temp\mkecwupmhf.sys1⤵
- Executes dropped EXE
-
C:\Temp\trmjebzxrp.sysC:\Temp\trmjebzxrp.sys1⤵
- Executes dropped EXE
-
C:\Temp\romgezwqoj.sysC:\Temp\romgezwqoj.sys1⤵
- Executes dropped EXE
-
C:\Temp\wtrljdbywq.sysC:\Temp\wtrljdbywq.sys1⤵
-
C:\Temp\tqoigbywqo.sysC:\Temp\tqoigbywqo.sys1⤵
-
C:\Temp\qkidavtnli.sysC:\Temp\qkidavtnli.sys1⤵
-
C:\Temp\yvpnhfaxsq.sysC:\Temp\yvpnhfaxsq.sys1⤵
-
C:\Temp\caxsqkicau.sysC:\Temp\caxsqkicau.sys1⤵
-
C:\Temp\pkhfcxuspk.sysC:\Temp\pkhfcxuspk.sys1⤵
-
C:\Temp\hczxrpjhcz.sysC:\Temp\hczxrpjhcz.sys1⤵
-
C:\Temp\gebztrojge.sysC:\Temp\gebztrojge.sys1⤵
-
C:\Temp\omgeywqomg.sysC:\Temp\omgeywqomg.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
avsnlidavt.sys
bvtgdywqoi.sys
czusmkecwupmhfzx.exe
czusmkecwupmhfzx.sys
dxvpnifays.exe
eczurmkecu.exe
hbztrojgez.exe
i_eczurmkecu.exe
i_hbztrojgez.exe
i_qlaysqkida.exe
i_qljdbvtnlg.exe
i_rljgbztrlj.exe
jecwuomgeb.sys
qlaysqkida.exe
qljdbvtnlg.exe
rljgbztrlj.exe
rojgeywqom.sys
vqlidaytql.sys
settings.dat
settings.dat
the-real-index
the-real-index~RFe5976bd.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
Sdch Dictionaries
f3d28d8a-acc7-40f4-a842-b5481847d279.tmp
Preferences
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
Local State
Local State
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
773a2fef-681f-4766-a164-66e138937415.tmp
metadata.json~RFe594e45.TMP
1d229bc2-0a03-4879-acc7-cda2f8a0b382.tmp
content_new.js
CreateProcess.exe
memory/996-605-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1512-552-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2388-509-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2636-625-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2968-710-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2996-585-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3040-551-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3296-706-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3296-688-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3720-712-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3720-692-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3956-666-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4196-662-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4344-544-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4580-685-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4580-660-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4580-659-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4580-422-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4924-521-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5296-629-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5504-497-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5596-469-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5944-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6100-556-0x0000000000010000-0x00000000000AB000-memory.dmp