Analysis
- max time kernel
148s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 08:57
General
- Target 2026-08-03_f4149f859bbf48cca3133e90a2a4e289_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 389KB
- Sample260804-kw2lrsgd87
- SHA256 57a58074ddc729a51deccb48368bead247bc427b458ed7760ae2a818d8a32df8
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_f4149f859bbf48cca3133e90a2a4e289_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_f4149f859bbf48cca3133e90a2a4e289_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\olgbytrljdbvtolg.exeC:\Temp\olgbytrljdbvtolg.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\oigbywqomg.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\oigbywqomg.exeC:\Temp\oigbywqomg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_oigbywqomg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_oigbywqomg.exeC:\Temp\i_oigbywqomg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wqoigaytoi.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wqoigaytoi.exeC:\Temp\wqoigaytoi.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wqoigaytoi.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wqoigaytoi.exeC:\Temp\i_wqoigaytoi.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ysqnifdxvq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ysqnifdxvq.exeC:\Temp\ysqnifdxvq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ysqnifdxvq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ysqnifdxvq.exeC:\Temp\i_ysqnifdxvq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xnhfaxspnh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xnhfaxspnh.exeC:\Temp\xnhfaxspnh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xnhfaxspnh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xnhfaxspnh.exeC:\Temp\i_xnhfaxspnh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnhfcxusqk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pnhfcxusqk.exeC:\Temp\pnhfcxusqk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnhfcxusqk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pnhfcxusqk.exeC:\Temp\i_pnhfcxusqk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cwupmhczxr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\cwupmhczxr.exeC:\Temp\cwupmhczxr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cwupmhczxr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_cwupmhczxr.exeC:\Temp\i_cwupmhczxr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\uomjhbzwur.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\uomjhbzwur.exeC:\Temp\uomjhbzwur.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_uomjhbzwur.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_uomjhbzwur.exeC:\Temp\i_uomjhbzwur.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zwjhbztrmj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zwjhbztrmj.exeC:\Temp\zwjhbztrmj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zwjhbztrmj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zwjhbztrmj.exeC:\Temp\i_zwjhbztrmj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jgbytqomjd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jgbytqomjd.exeC:\Temp\jgbytqomjd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jgbytqomjd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jgbytqomjd.exeC:\Temp\i_jgbytqomjd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dywqoigayt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dywqoigayt.exeC:\Temp\dywqoigayt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dywqoigayt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dywqoigayt.exeC:\Temp\i_dywqoigayt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bysqlidbvt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bysqlidbvt.exeC:\Temp\bysqlidbvt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bysqlidbvt.exe ups_ins3⤵
-
C:\Temp\i_bysqlidbvt.exeC:\Temp\i_bysqlidbvt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdavsqcaus.exe ups_run3⤵
-
C:\Temp\fdavsqcaus.exeC:\Temp\fdavsqcaus.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdavsqcaus.exe ups_ins3⤵
-
C:\Temp\i_fdavsqcaus.exeC:\Temp\i_fdavsqcaus.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqkicavsnk.exe ups_run3⤵
-
C:\Temp\sqkicavsnk.exeC:\Temp\sqkicavsnk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqkicavsnk.exe ups_ins3⤵
-
C:\Temp\i_sqkicavsnk.exeC:\Temp\i_sqkicavsnk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mkhczxusmk.exe ups_run3⤵
-
C:\Temp\mkhczxusmk.exeC:\Temp\mkhczxusmk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mkhczxusmk.exe ups_ins3⤵
-
C:\Temp\i_mkhczxusmk.exeC:\Temp\i_mkhczxusmk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpjhczusmk.exe ups_run3⤵
-
C:\Temp\rpjhczusmk.exeC:\Temp\rpjhczusmk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpjhczusmk.exe ups_ins3⤵
-
C:\Temp\i_rpjhczusmk.exeC:\Temp\i_rpjhczusmk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpjhbztrmj.exe ups_run3⤵
-
C:\Temp\rpjhbztrmj.exeC:\Temp\rpjhbztrmj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpjhbztrmj.exe ups_ins3⤵
-
C:\Temp\i_rpjhbztrmj.exeC:\Temp\i_rpjhbztrmj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\eywrojhbzt.exe ups_run3⤵
-
C:\Temp\eywrojhbzt.exeC:\Temp\eywrojhbzt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_eywrojhbzt.exe ups_ins3⤵
-
C:\Temp\i_eywrojhbzt.exeC:\Temp\i_eywrojhbzt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ztrljdbwto.exe ups_run3⤵
-
C:\Temp\ztrljdbwto.exeC:\Temp\ztrljdbwto.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ztrljdbwto.exe ups_ins3⤵
-
C:\Temp\i_ztrljdbwto.exeC:\Temp\i_ztrljdbwto.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\oigdyvqoig.exe ups_run3⤵
-
C:\Temp\oigdyvqoig.exeC:\Temp\oigdyvqoig.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_oigdyvqoig.exe ups_ins3⤵
-
C:\Temp\i_oigdyvqoig.exeC:\Temp\i_oigdyvqoig.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffc3e19c188,0x7ffc3e19c194,0x7ffc3e19c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,17561378950972845348,6727427216790208326,262144 --field-trial-handle=2728,i,1333667771720055156,4897467507164135948,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,9932604319139187095,7979252943168988563,524288 --field-trial-handle=2728,i,1333667771720055156,4897467507164135948,262144 --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2432,i,12971779296127484862,326803918858365340,524288 --field-trial-handle=2728,i,1333667771720055156,4897467507164135948,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,15938059145689104934,15984639246070506181,2097152 --field-trial-handle=2728,i,1333667771720055156,4897467507164135948,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,12249599444770640717,6171068558268816346,2097152 --field-trial-handle=2728,i,1333667771720055156,4897467507164135948,262144 --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,8461393684574328708,5333792238903026977,2097152 --field-trial-handle=2728,i,1333667771720055156,4897467507164135948,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,1456511483689809932,9823047782341150838,2097152 --field-trial-handle=2728,i,1333667771720055156,4897467507164135948,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3764,i,5684622274296866404,5799495377419608142,524288 --field-trial-handle=2728,i,1333667771720055156,4897467507164135948,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3764,i,14439665042415606448,9559243694510259634,524288 --field-trial-handle=2728,i,1333667771720055156,4897467507164135948,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,4078649572393829388,18165653777377403054,524288 --field-trial-handle=2728,i,1333667771720055156,4897467507164135948,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,12079421875394143187,17949573816882810408,524288 --field-trial-handle=2728,i,1333667771720055156,4897467507164135948,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,12079421875394143187,17949573816882810408,524288 --field-trial-handle=2728,i,1333667771720055156,4897467507164135948,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,5697808563707923431,18131809905163178050,524288 --field-trial-handle=2728,i,1333667771720055156,4897467507164135948,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,3248653262087753767,16741518408935344118,524288 --field-trial-handle=2728,i,1333667771720055156,4897467507164135948,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6676,i,1079830819687858692,2074292396448148681,524288 --field-trial-handle=2728,i,1333667771720055156,4897467507164135948,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6848,i,11671165961718852225,11732532970170400612,524288 --field-trial-handle=2728,i,1333667771720055156,4897467507164135948,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,6495823380558045421,6319299615739430835,524288 --field-trial-handle=2728,i,1333667771720055156,4897467507164135948,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,10094223767447397992,1030649089929737104,524288 --field-trial-handle=2728,i,1333667771720055156,4897467507164135948,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4840,i,11604843737200544577,17589944196213821645,524288 --field-trial-handle=2728,i,1333667771720055156,4897467507164135948,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,10370306636437420349,12383154434695680549,524288 --field-trial-handle=2728,i,1333667771720055156,4897467507164135948,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,11360115779983071357,8689897672857727639,524288 --field-trial-handle=2728,i,1333667771720055156,4897467507164135948,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,567653393834853435,16086767564916669765,524288 --field-trial-handle=2728,i,1333667771720055156,4897467507164135948,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,11672285411051436723,14748857074959921435,524288 --field-trial-handle=2728,i,1333667771720055156,4897467507164135948,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6224,i,4675584940670880762,16517643359545325672,262144 --field-trial-handle=2728,i,1333667771720055156,4897467507164135948,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,8358250906461737443,7328466338373584030,524288 --field-trial-handle=2728,i,1333667771720055156,4897467507164135948,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\olgbytrljdbvtolg.sysC:\Temp\olgbytrljdbvtolg.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\ywqoigaywq.sysC:\Temp\ywqoigaywq.sys1⤵
- Executes dropped EXE
-
C:\Temp\xvtnkigays.sysC:\Temp\xvtnkigays.sys1⤵
- Executes dropped EXE
-
C:\Temp\avsnlfdxvp.sysC:\Temp\avsnlfdxvp.sys1⤵
- Executes dropped EXE
-
C:\Temp\vpnkfcxusn.sysC:\Temp\vpnkfcxusn.sys1⤵
- Executes dropped EXE
-
C:\Temp\fzxspkhcau.sysC:\Temp\fzxspkhcau.sys1⤵
- Executes dropped EXE
-
C:\Temp\rpmkhczurm.sysC:\Temp\rpmkhczurm.sys1⤵
- Executes dropped EXE
-
C:\Temp\wurmjecwuo.sysC:\Temp\wurmjecwuo.sys1⤵
- Executes dropped EXE
-
C:\Temp\rljebwtrlj.sysC:\Temp\rljebwtrlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\dyvtrljdbv.sysC:\Temp\dyvtrljdbv.sys1⤵
- Executes dropped EXE
-
C:\Temp\ljdbnlfdyv.sysC:\Temp\ljdbnlfdyv.sys1⤵
- Executes dropped EXE
-
C:\Temp\fdavsqkigd.sysC:\Temp\fdavsqkigd.sys1⤵
-
C:\Temp\aysqkicaus.sysC:\Temp\aysqkicaus.sys1⤵
-
C:\Temp\nhfcausmkh.sysC:\Temp\nhfcausmkh.sys1⤵
-
C:\Temp\czxrpjhczu.sysC:\Temp\czxrpjhczu.sys1⤵
-
C:\Temp\urmkeczurp.sysC:\Temp\urmkeczurp.sys1⤵
-
C:\Temp\jhbztromge.sysC:\Temp\jhbztromge.sys1⤵
-
C:\Temp\bwtolgeywq.sysC:\Temp\bwtolgeywq.sys1⤵
-
C:\Temp\ytqligeywq.sysC:\Temp\ytqligeywq.sys1⤵
-
C:\Temp\ysqkidavtn.sysC:\Temp\ysqkidavtn.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
avsnlfdxvp.sys
cwupmhczxr.exe
fzxspkhcau.sys
i_oigbywqomg.exe
i_pnhfcxusqk.exe
i_wqoigaytoi.exe
i_xnhfaxspnh.exe
i_ysqnifdxvq.exe
oigbywqomg.exe
olgbytrljdbvtolg.exe
olgbytrljdbvtolg.sys
pnhfcxusqk.exe
vpnkfcxusn.sys
wqoigaytoi.exe
xnhfaxspnh.exe
xvtnkigays.sys
ysqnifdxvq.exe
ywqoigaywq.sys
settings.dat
settings.dat
the-real-index
the-real-index~RFe59ba2e.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Secure Preferences
50b8d7e7-f19e-45a8-a92d-24a7223371af.tmp
Local State
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
3f4b805a-7a33-4d4b-8182-0849cdcf4cc1.tmp
metadata.json~RFe59912a.TMP
7746eeb2-49d3-4eba-ab1a-521730a3a785.tmp
content_new.js
CreateProcess.exe
memory/796-661-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1624-490-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1624-511-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2012-61-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2012-616-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2880-538-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2880-502-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3388-462-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3468-562-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3532-693-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3720-518-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4288-672-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4404-637-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4608-718-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4688-574-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4688-597-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4804-697-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4836-701-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4948-541-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5220-595-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5220-617-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5516-641-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5804-545-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5940-415-0x0000000000010000-0x00000000000AB000-memory.dmp