Analysis
- max time kernel
149s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
02/08/2026, 21:13
General
- Target 2026-08-02_cc98d9beb3bf82894b448a95b6afe0ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 365KB
- Sample260802-z2z3fssakd
- SHA256 504511482d4191542dbebed65a420b248a3d52bdc195775440804923b8842a99
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cc98d9beb3bf82894b448a95b6afe0ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_cc98d9beb3bf82894b448a95b6afe0ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\nlfdxvpnifaysqki.exeC:\Temp\nlfdxvpnifaysqki.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nifdxvpnkf.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\nifdxvpnkf.exeC:\Temp\nifdxvpnkf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nifdxvpnkf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nifdxvpnkf.exeC:\Temp\i_nifdxvpnkf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\khfzxrpkhc.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\khfzxrpkhc.exeC:\Temp\khfzxrpkhc.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_khfzxrpkhc.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_khfzxrpkhc.exeC:\Temp\i_khfzxrpkhc.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\upmhezusmk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\upmhezusmk.exeC:\Temp\upmhezusmk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_upmhezusmk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_upmhezusmk.exeC:\Temp\i_upmhezusmk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wuomgeztrm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wuomgeztrm.exeC:\Temp\wuomgeztrm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wuomgeztrm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wuomgeztrm.exeC:\Temp\i_wuomgeztrm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mgetolgeyw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mgetolgeyw.exeC:\Temp\mgetolgeyw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mgetolgeyw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mgetolgeyw.exeC:\Temp\i_mgetolgeyw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wtojgbywqo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wtojgbywqo.exeC:\Temp\wtojgbywqo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wtojgbywqo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wtojgbywqo.exeC:\Temp\i_wtojgbywqo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ligaytqljd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ligaytqljd.exeC:\Temp\ligaytqljd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ligaytqljd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ligaytqljd.exeC:\Temp\i_ligaytqljd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gdyvqkigay.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gdyvqkigay.exeC:\Temp\gdyvqkigay.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gdyvqkigay.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gdyvqkigay.exeC:\Temp\i_gdyvqkigay.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\faxnifaxsp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\faxnifaxsp.exeC:\Temp\faxnifaxsp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_faxnifaxsp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_faxnifaxsp.exeC:\Temp\i_faxnifaxsp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\axsmkicaus.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\axsmkicaus.exeC:\Temp\axsmkicaus.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_axsmkicaus.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_axsmkicaus.exeC:\Temp\i_axsmkicaus.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xupmhfzxrp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xupmhfzxrp.exeC:\Temp\xupmhfzxrp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xupmhfzxrp.exe ups_ins3⤵
-
C:\Temp\i_xupmhfzxrp.exeC:\Temp\i_xupmhfzxrp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpmhezxrpj.exe ups_run3⤵
-
C:\Temp\rpmhezxrpj.exeC:\Temp\rpmhezxrpj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpmhezxrpj.exe ups_ins3⤵
-
C:\Temp\i_rpmhezxrpj.exeC:\Temp\i_rpmhezxrpj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpjhezwjhb.exe ups_run3⤵
-
C:\Temp\rpjhezwjhb.exeC:\Temp\rpjhezwjhb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpjhezwjhb.exe ups_ins3⤵
-
C:\Temp\i_rpjhezwjhb.exeC:\Temp\i_rpjhezwjhb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\romgeywroj.exe ups_run3⤵
-
C:\Temp\romgeywroj.exeC:\Temp\romgeywroj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_romgeywroj.exe ups_ins3⤵
-
C:\Temp\i_romgeywroj.exeC:\Temp\i_romgeywroj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ayvtolgeyw.exe ups_run3⤵
-
C:\Temp\ayvtolgeyw.exeC:\Temp\ayvtolgeyw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ayvtolgeyw.exe ups_ins3⤵
-
C:\Temp\i_ayvtolgeyw.exeC:\Temp\i_ayvtolgeyw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gaysqligay.exe ups_run3⤵
-
C:\Temp\gaysqligay.exeC:\Temp\gaysqligay.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gaysqligay.exe ups_ins3⤵
-
C:\Temp\i_gaysqligay.exeC:\Temp\i_gaysqligay.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xspnkfcays.exe ups_run3⤵
-
C:\Temp\xspnkfcays.exeC:\Temp\xspnkfcays.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xspnkfcays.exe ups_ins3⤵
-
C:\Temp\i_xspnkfcays.exeC:\Temp\i_xspnkfcays.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\icausnkfcx.exe ups_run3⤵
-
C:\Temp\icausnkfcx.exeC:\Temp\icausnkfcx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_icausnkfcx.exe ups_ins3⤵
-
C:\Temp\i_icausnkfcx.exeC:\Temp\i_icausnkfcx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hczxrpkhca.exe ups_run3⤵
-
C:\Temp\hczxrpkhca.exeC:\Temp\hczxrpkhca.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hczxrpkhca.exe ups_ins3⤵
-
C:\Temp\i_hczxrpkhca.exeC:\Temp\i_hczxrpkhca.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7fffeeedc188,0x7fffeeedc194,0x7fffeeedc1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,2086308314117313923,7324094508157773923,262144 --field-trial-handle=2284,i,258167847563066321,3719401104346755886,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,2788673390544073334,4273813842149503614,524288 --field-trial-handle=2284,i,258167847563066321,3719401104346755886,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,10464671108892941241,913185718084965169,524288 --field-trial-handle=2284,i,258167847563066321,3719401104346755886,262144 --variations-seed-version --mojo-platform-channel-handle=2992 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,10142315526012785204,7192241786059191453,2097152 --field-trial-handle=2284,i,258167847563066321,3719401104346755886,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,12177298996802725163,13119369256425280961,2097152 --field-trial-handle=2284,i,258167847563066321,3719401104346755886,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,7028932920296306603,3641541117546192490,2097152 --field-trial-handle=2284,i,258167847563066321,3719401104346755886,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,15414034183030822787,8608598300121078267,2097152 --field-trial-handle=2284,i,258167847563066321,3719401104346755886,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,7597361034372549343,9992114177776748807,524288 --field-trial-handle=2284,i,258167847563066321,3719401104346755886,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,2340323118843801893,13075871577044009348,524288 --field-trial-handle=2284,i,258167847563066321,3719401104346755886,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3688,i,6179366260776644355,16531650405802100237,524288 --field-trial-handle=2284,i,258167847563066321,3719401104346755886,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,14930856139468964584,17051186347878327563,524288 --field-trial-handle=2284,i,258167847563066321,3719401104346755886,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,14930856139468964584,17051186347878327563,524288 --field-trial-handle=2284,i,258167847563066321,3719401104346755886,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,16976983323586465932,9285222765879795910,524288 --field-trial-handle=2284,i,258167847563066321,3719401104346755886,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,17815166471888789661,4223052281541327159,524288 --field-trial-handle=2284,i,258167847563066321,3719401104346755886,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,10981224518779832311,4664664887857579872,524288 --field-trial-handle=2284,i,258167847563066321,3719401104346755886,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4208,i,17916355669817934525,8092078998483513987,524288 --field-trial-handle=2284,i,258167847563066321,3719401104346755886,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,13667706233656876393,5273985135978291484,524288 --field-trial-handle=2284,i,258167847563066321,3719401104346755886,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,12505224570933287479,10207952642020657377,524288 --field-trial-handle=2284,i,258167847563066321,3719401104346755886,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,3110769817876994945,12875255395295773110,524288 --field-trial-handle=2284,i,258167847563066321,3719401104346755886,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,3049434931779668028,17526118867334595704,524288 --field-trial-handle=2284,i,258167847563066321,3719401104346755886,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,4549679655547008413,16578605441603178314,524288 --field-trial-handle=2284,i,258167847563066321,3719401104346755886,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,17863397754566507773,3295513527370296175,524288 --field-trial-handle=2284,i,258167847563066321,3719401104346755886,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,7676834306980416797,2477014318303275297,524288 --field-trial-handle=2284,i,258167847563066321,3719401104346755886,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6136,i,1174785654451840130,12175269512496701317,262144 --field-trial-handle=2284,i,258167847563066321,3719401104346755886,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,12809770193371892133,15223625107261094008,524288 --field-trial-handle=2284,i,258167847563066321,3719401104346755886,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\nlfdxvpnifaysqki.sysC:\Temp\nlfdxvpnifaysqki.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\spkifaxspk.sysC:\Temp\spkifaxspk.sys1⤵
- Executes dropped EXE
-
C:\Temp\rpmhfcausm.sysC:\Temp\rpmhfcausm.sys1⤵
- Executes dropped EXE
-
C:\Temp\khczurmbwu.sysC:\Temp\khczurmbwu.sys1⤵
- Executes dropped EXE
-
C:\Temp\mjebzwuomg.sysC:\Temp\mjebzwuomg.sys1⤵
- Executes dropped EXE
-
C:\Temp\wqomgeywqo.sysC:\Temp\wqomgeywqo.sys1⤵
- Executes dropped EXE
-
C:\Temp\ljdbywqolg.sysC:\Temp\ljdbywqolg.sys1⤵
- Executes dropped EXE
-
C:\Temp\nlxvqnifay.sysC:\Temp\nlxvqnifay.sys1⤵
- Executes dropped EXE
-
C:\Temp\fdavsqnifd.sysC:\Temp\fdavsqnifd.sys1⤵
- Executes dropped EXE
-
C:\Temp\faxsqkicau.sysC:\Temp\faxsqkicau.sys1⤵
- Executes dropped EXE
-
C:\Temp\usmkhfzxup.sysC:\Temp\usmkhfzxup.sys1⤵
- Executes dropped EXE
-
C:\Temp\fzxrpkeuom.sysC:\Temp\fzxrpkeuom.sys1⤵
-
C:\Temp\wuomhezxrp.sysC:\Temp\wuomhezxrp.sys1⤵
-
C:\Temp\omjdbywqoj.sysC:\Temp\omjdbywqoj.sys1⤵
-
C:\Temp\ebvtnligey.sysC:\Temp\ebvtnligey.sys1⤵
-
C:\Temp\gdyvqoigay.sysC:\Temp\gdyvqoigay.sys1⤵
-
C:\Temp\lidavsnlfd.sysC:\Temp\lidavsnlfd.sys1⤵
-
C:\Temp\nhfdxvpnif.sysC:\Temp\nhfdxvpnif.sys1⤵
-
C:\Temp\kicausmkfc.sysC:\Temp\kicausmkfc.sys1⤵
-
C:\Temp\khczxuhfzx.sysC:\Temp\khczxuhfzx.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
i_khfzxrpkhc.exe
i_mgetolgeyw.exe
i_nifdxvpnkf.exe
i_upmhezusmk.exe
i_wuomgeztrm.exe
khczurmbwu.sys
khfzxrpkhc.exe
mgetolgeyw.exe
mjebzwuomg.sys
nifdxvpnkf.exe
nlfdxvpnifaysqki.exe
nlfdxvpnifaysqki.sys
rpmhfcausm.sys
spkifaxspk.sys
upmhezusmk.exe
wqomgeywqo.sys
wtojgbywqo.exe
wuomgeztrm.exe
settings.dat
settings.dat
the-real-index
the-real-index~RFe5926f7.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
09579894-0da6-4cdb-9734-01d9cc089933.tmp
Local State
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
metadata.json
metadata.json
2d16050b-35ed-4109-b3cf-118c69aff817.tmp
content_new.js
CreateProcess.exe
memory/616-720-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/832-562-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1600-548-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1852-506-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1852-231-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1860-690-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2004-614-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2640-716-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2724-585-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3180-62-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3180-216-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3500-711-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4188-495-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4188-536-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4296-534-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4448-678-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4880-566-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4968-654-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5412-737-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5520-679-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5520-658-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5868-183-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5924-634-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5960-581-0x0000000000010000-0x00000000000AB000-memory.dmp