Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 19:21
General
- Target 2026-08-04_8c9a7cae798a2c900580da1affe54d9c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 389KB
- Sample260804-x2y42sybnd
- SHA256 8a3248834d71087f9ebae7d1c300333b05dc12d5062b537765602176135bcd69
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_8c9a7cae798a2c900580da1affe54d9c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_8c9a7cae798a2c900580da1affe54d9c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\wuomgeywromgebzt.exeC:\Temp\wuomgeywromgebzt.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ezwuomebwu.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\ezwuomebwu.exeC:\Temp\ezwuomebwu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ezwuomebwu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ezwuomebwu.exeC:\Temp\i_ezwuomebwu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bytrljdbvt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bytrljdbvt.exeC:\Temp\bytrljdbvt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bytrljdbvt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bytrljdbvt.exeC:\Temp\i_bytrljdbvt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdbvtnlfdb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jdbvtnlfdb.exeC:\Temp\jdbvtnlfdb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdbvtnlfdb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jdbvtnlfdb.exeC:\Temp\i_jdbvtnlfdb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tnlfdavsqk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\tnlfdavsqk.exeC:\Temp\tnlfdavsqk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tnlfdavsqk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_tnlfdavsqk.exeC:\Temp\i_tnlfdavsqk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvpnkifaxs.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xvpnkifaxs.exeC:\Temp\xvpnkifaxs.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xvpnkifaxs.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xvpnkifaxs.exeC:\Temp\i_xvpnkifaxs.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\faxvpnfzxs.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\faxvpnfzxs.exeC:\Temp\faxvpnfzxs.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_faxvpnfzxs.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_faxvpnfzxs.exeC:\Temp\i_faxvpnfzxs.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xuspkhfzwu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xuspkhfzwu.exeC:\Temp\xuspkhfzwu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xuspkhfzwu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xuspkhfzwu.exeC:\Temp\i_xuspkhfzwu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zurmjecwuo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zurmjecwuo.exeC:\Temp\zurmjecwuo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zurmjecwuo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zurmjecwuo.exeC:\Temp\i_zurmjecwuo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omgeztrlje.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\omgeztrlje.exeC:\Temp\omgeztrlje.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omgeztrlje.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_omgeztrlje.exeC:\Temp\i_omgeztrlje.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gbztrljdbz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gbztrljdbz.exeC:\Temp\gbztrljdbz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gbztrljdbz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gbztrljdbz.exeC:\Temp\i_gbztrljdbz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lgeyvtnljd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lgeyvtnljd.exeC:\Temp\lgeyvtnljd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lgeyvtnljd.exe ups_ins3⤵
-
C:\Temp\i_lgeyvtnljd.exeC:\Temp\i_lgeyvtnljd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\davtqligax.exe ups_run3⤵
-
C:\Temp\davtqligax.exeC:\Temp\davtqligax.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_davtqligax.exe ups_ins3⤵
-
C:\Temp\i_davtqligax.exeC:\Temp\i_davtqligax.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hfaxsqkica.exe ups_run3⤵
-
C:\Temp\hfaxsqkica.exeC:\Temp\hfaxsqkica.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hfaxsqkica.exe ups_ins3⤵
-
C:\Temp\i_hfaxsqkica.exeC:\Temp\i_hfaxsqkica.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nkfcxusqki.exe ups_run3⤵
-
C:\Temp\nkfcxusqki.exeC:\Temp\nkfcxusqki.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nkfcxusqki.exe ups_ins3⤵
-
C:\Temp\i_nkfcxusqki.exeC:\Temp\i_nkfcxusqki.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cxupnkecau.exe ups_run3⤵
-
C:\Temp\cxupnkecau.exeC:\Temp\cxupnkecau.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cxupnkecau.exe ups_ins3⤵
-
C:\Temp\i_cxupnkecau.exeC:\Temp\i_cxupnkecau.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xrpjhbzurm.exe ups_run3⤵
-
C:\Temp\xrpjhbzurm.exeC:\Temp\xrpjhbzurm.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xrpjhbzurm.exe ups_ins3⤵
-
C:\Temp\i_xrpjhbzurm.exeC:\Temp\i_xrpjhbzurm.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omgeywrojg.exe ups_run3⤵
-
C:\Temp\omgeywrojg.exeC:\Temp\omgeywrojg.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omgeywrojg.exe ups_ins3⤵
-
C:\Temp\i_omgeywrojg.exeC:\Temp\i_omgeywrojg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wrojhbztrl.exe ups_run3⤵
-
C:\Temp\wrojhbztrl.exeC:\Temp\wrojhbztrl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wrojhbztrl.exe ups_ins3⤵
-
C:\Temp\i_wrojhbztrl.exeC:\Temp\i_wrojhbztrl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gebvtolgby.exe ups_run3⤵
-
C:\Temp\gebvtolgby.exeC:\Temp\gebvtolgby.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gebvtolgby.exe ups_ins3⤵
-
C:\Temp\i_gebvtolgby.exeC:\Temp\i_gebvtolgby.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2cc,0x2f4,0x2f8,0x2c8,0x354,0x7ffcb089c188,0x7ffcb089c194,0x7ffcb089c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1964,i,12586905425703488129,9891068130454857364,262144 --field-trial-handle=3108,i,5723720727549213938,4306203900585691410,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2172,i,14014107016093017628,7855585924065072384,524288 --field-trial-handle=3108,i,5723720727549213938,4306203900585691410,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,15403754111748486173,9453235788114685083,524288 --field-trial-handle=3108,i,5723720727549213938,4306203900585691410,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,447102154717350192,13634311773217017668,2097152 --field-trial-handle=3108,i,5723720727549213938,4306203900585691410,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,13453843531177005704,1461973829527553895,2097152 --field-trial-handle=3108,i,5723720727549213938,4306203900585691410,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,290835205860897295,6411264375832216964,2097152 --field-trial-handle=3108,i,5723720727549213938,4306203900585691410,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,2573122599283381946,4456146676291092526,2097152 --field-trial-handle=3108,i,5723720727549213938,4306203900585691410,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3756,i,8158658094010904408,17182653702901730205,524288 --field-trial-handle=3108,i,5723720727549213938,4306203900585691410,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,1070454827941243652,15219867578115644827,524288 --field-trial-handle=3108,i,5723720727549213938,4306203900585691410,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,4386905816398291495,8940603632263757254,524288 --field-trial-handle=3108,i,5723720727549213938,4306203900585691410,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,7105922936294007464,4437369469524533207,524288 --field-trial-handle=3108,i,5723720727549213938,4306203900585691410,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,7105922936294007464,4437369469524533207,524288 --field-trial-handle=3108,i,5723720727549213938,4306203900585691410,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,16351793421362929337,16097259336786471318,524288 --field-trial-handle=3108,i,5723720727549213938,4306203900585691410,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,18117302449955552668,10063342807724088133,524288 --field-trial-handle=3108,i,5723720727549213938,4306203900585691410,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,16105547371523580616,6223963653105342771,524288 --field-trial-handle=3108,i,5723720727549213938,4306203900585691410,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,9808253440059681441,11747566143931027727,524288 --field-trial-handle=3108,i,5723720727549213938,4306203900585691410,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1308,i,5614228678743499625,14755763650140640135,524288 --field-trial-handle=3108,i,5723720727549213938,4306203900585691410,262144 --variations-seed-version --mojo-platform-channel-handle=1304 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1296,i,15048689053413876919,9426879335233544531,524288 --field-trial-handle=3108,i,5723720727549213938,4306203900585691410,262144 --variations-seed-version --mojo-platform-channel-handle=1444 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1300,i,3637013474394849185,4505124277446158844,524288 --field-trial-handle=3108,i,5723720727549213938,4306203900585691410,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1412,i,8985620705605842424,8123235925902457161,524288 --field-trial-handle=3108,i,5723720727549213938,4306203900585691410,262144 --variations-seed-version --mojo-platform-channel-handle=1432 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,3157921522983914264,8720350852868477214,524288 --field-trial-handle=3108,i,5723720727549213938,4306203900585691410,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,14745601228911259201,5517872076146181864,524288 --field-trial-handle=3108,i,5723720727549213938,4306203900585691410,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,10131443152047753743,12965828880238739562,524288 --field-trial-handle=3108,i,5723720727549213938,4306203900585691410,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5448,i,17784458177008904351,16363647717699808359,262144 --field-trial-handle=3108,i,5723720727549213938,4306203900585691410,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,684735339682633426,14897908815424949020,524288 --field-trial-handle=3108,i,5723720727549213938,4306203900585691410,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\wuomgeywromgebzt.sysC:\Temp\wuomgeywromgebzt.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\jdbwtoljdb.sysC:\Temp\jdbwtoljdb.sys1⤵
- Executes dropped EXE
-
C:\Temp\lgaywqolfd.sysC:\Temp\lgaywqolfd.sys1⤵
- Executes dropped EXE
-
C:\Temp\qkigayvqnl.sysC:\Temp\qkigayvqnl.sys1⤵
- Executes dropped EXE
-
C:\Temp\kicaysqkig.sysC:\Temp\kicaysqkig.sys1⤵
- Executes dropped EXE
-
C:\Temp\idxvpnhfax.sysC:\Temp\idxvpnhfax.sys1⤵
- Executes dropped EXE
-
C:\Temp\cxupmhfzxu.sysC:\Temp\cxupmhfzxu.sys1⤵
- Executes dropped EXE
-
C:\Temp\zwrpjhbzur.sysC:\Temp\zwrpjhbzur.sys1⤵
- Executes dropped EXE
-
C:\Temp\cwuomgezwr.sysC:\Temp\cwuomgezwr.sys1⤵
- Executes dropped EXE
-
C:\Temp\geywqojgey.sysC:\Temp\geywqojgey.sys1⤵
- Executes dropped EXE
-
C:\Temp\ljgbytqoig.sysC:\Temp\ljgbytqoig.sys1⤵
- Executes dropped EXE
-
C:\Temp\ifdyvqniga.sysC:\Temp\ifdyvqniga.sys1⤵
-
C:\Temp\yvqnigaysq.sysC:\Temp\yvqnigaysq.sys1⤵
-
C:\Temp\nhfaxvpnhf.sysC:\Temp\nhfaxvpnhf.sys1⤵
-
C:\Temp\ecausmkfcx.sysC:\Temp\ecausmkfcx.sys1⤵
-
C:\Temp\xupmhecwup.sysC:\Temp\xupmhecwup.sys1⤵
-
C:\Temp\bzurmkeczu.sysC:\Temp\bzurmkeczu.sys1⤵
-
C:\Temp\urljebwuom.sysC:\Temp\urljebwuom.sys1⤵
-
C:\Temp\rojdbwtrlj.sysC:\Temp\rojdbwtrlj.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
bytrljdbvt.exe
ezwuomebwu.exe
faxvpnfzxs.exe
i_bytrljdbvt.exe
i_ezwuomebwu.exe
i_jdbvtnlfdb.exe
i_tnlfdavsqk.exe
i_xvpnkifaxs.exe
idxvpnhfax.sys
jdbvtnlfdb.exe
jdbwtoljdb.sys
kicaysqkig.sys
lgaywqolfd.sys
qkigayvqnl.sys
tnlfdavsqk.exe
wuomgeywromgebzt.exe
wuomgeywromgebzt.sys
xvpnkifaxs.exe
settings.dat
settings.dat
the-real-index
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Secure Preferences
OperationConfig
OperationConfig~RFe5a3c6e.TMP
Local State
Local State
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
metadata.json
299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
b5a65298-e3ef-4c2d-999b-6faf991f6543.tmp
metadata.json~RFe59773a.TMP
286a34c1-18ba-44c8-bf64-06b407d55962.tmp
content_new.js
CreateProcess.exe
memory/704-709-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1160-713-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1520-671-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2096-566-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2564-636-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2604-493-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3420-562-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3420-546-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3424-539-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3424-505-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3444-692-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3664-591-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3664-609-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4204-561-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4348-660-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4476-607-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4680-526-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4908-467-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5016-542-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5112-640-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5552-64-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5656-420-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5656-473-0x0000000000010000-0x00000000000AB000-memory.dmp