Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 20:42
General
- Target 2026-08-04_3269a1c7d1f32a24dbd0294805aa724c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 389KB
- Sample260804-zhfjpsdr6t
- SHA256 1bc4a0b6a6d84c12b8bd4f43240769ab64dcd88d8cb39eb5b0b7eb887f1cdb1d
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_3269a1c7d1f32a24dbd0294805aa724c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_3269a1c7d1f32a24dbd0294805aa724c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\hcauspnhfcxupmke.exeC:\Temp\hcauspnhfcxupmke.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\smkicapmhe.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\smkicapmhe.exeC:\Temp\smkicapmhe.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_smkicapmhe.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_smkicapmhe.exeC:\Temp\i_smkicapmhe.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxrpmhfzxr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zxrpmhfzxr.exeC:\Temp\zxrpmhfzxr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxrpmhfzxr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zxrpmhfzxr.exeC:\Temp\i_zxrpmhfzxr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bwuojhbztr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bwuojhbztr.exeC:\Temp\bwuojhbztr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bwuojhbztr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bwuojhbztr.exeC:\Temp\i_bwuojhbztr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\olgeywqolj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\olgeywqolj.exeC:\Temp\olgeywqolj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_olgeywqolj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_olgeywqolj.exeC:\Temp\i_olgeywqolj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tqlidbytqo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\tqlidbytqo.exeC:\Temp\tqlidbytqo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tqlidbytqo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_tqlidbytqo.exeC:\Temp\i_tqlidbytqo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\igdysqlavt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\igdysqlavt.exeC:\Temp\igdysqlavt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_igdysqlavt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_igdysqlavt.exeC:\Temp\i_igdysqlavt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cavsqnifay.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\cavsqnifay.exeC:\Temp\cavsqnifay.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cavsqnifay.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_cavsqnifay.exeC:\Temp\i_cavsqnifay.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nkfcausnkf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nkfcausnkf.exeC:\Temp\nkfcausnkf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nkfcausnkf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nkfcausnkf.exeC:\Temp\i_nkfcausnkf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pkhczuspkh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pkhczuspkh.exeC:\Temp\pkhczuspkh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pkhczuspkh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pkhczuspkh.exeC:\Temp\i_pkhczuspkh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhczxrpmhf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jhczxrpmhf.exeC:\Temp\jhczxrpmhf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhczxrpmhf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jhczxrpmhf.exeC:\Temp\i_jhczxrpmhf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zwrpmkebzt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zwrpmkebzt.exeC:\Temp\zwrpmkebzt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zwrpmkebzt.exe ups_ins3⤵
-
C:\Temp\i_zwrpmkebzt.exeC:\Temp\i_zwrpmkebzt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywrljdbzwr.exe ups_run3⤵
-
C:\Temp\ywrljdbzwr.exeC:\Temp\ywrljdbzwr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywrljdbzwr.exe ups_ins3⤵
-
C:\Temp\i_ywrljdbzwr.exeC:\Temp\i_ywrljdbzwr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bytqljdbyw.exe ups_run3⤵
-
C:\Temp\bytqljdbyw.exeC:\Temp\bytqljdbyw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bytqljdbyw.exe ups_ins3⤵
-
C:\Temp\i_bytqljdbyw.exeC:\Temp\i_bytqljdbyw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtqligavtn.exe ups_run3⤵
-
C:\Temp\vtqligavtn.exeC:\Temp\vtqligavtn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vtqligavtn.exe ups_ins3⤵
-
C:\Temp\i_vtqligavtn.exeC:\Temp\i_vtqligavtn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vqnigdyvqn.exe ups_run3⤵
-
C:\Temp\vqnigdyvqn.exeC:\Temp\vqnigdyvqn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vqnigdyvqn.exe ups_ins3⤵
-
C:\Temp\i_vqnigdyvqn.exeC:\Temp\i_vqnigdyvqn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nkfdavsqki.exe ups_run3⤵
-
C:\Temp\nkfdavsqki.exeC:\Temp\nkfdavsqki.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nkfdavsqki.exe ups_ins3⤵
-
C:\Temp\i_nkfdavsqki.exeC:\Temp\i_nkfdavsqki.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\khcausmkhc.exe ups_run3⤵
-
C:\Temp\khcausmkhc.exeC:\Temp\khcausmkhc.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_khcausmkhc.exe ups_ins3⤵
-
C:\Temp\i_khcausmkhc.exeC:\Temp\i_khcausmkhc.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pjhfcauspn.exe ups_run3⤵
-
C:\Temp\pjhfcauspn.exeC:\Temp\pjhfcauspn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pjhfcauspn.exe ups_ins3⤵
-
C:\Temp\i_pjhfcauspn.exeC:\Temp\i_pjhfcauspn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zwuomhezwu.exe ups_run3⤵
-
C:\Temp\zwuomhezwu.exeC:\Temp\zwuomhezwu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zwuomhezwu.exe ups_ins3⤵
-
C:\Temp\i_zwuomhezwu.exeC:\Temp\i_zwuomhezwu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wuomgeywro.exe ups_run3⤵
-
C:\Temp\wuomgeywro.exeC:\Temp\wuomgeywro.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffd6c62c188,0x7ffd6c62c194,0x7ffd6c62c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,8569644041872013562,9146370320944914244,262144 --field-trial-handle=2252,i,5149901893209099986,10971741411815702905,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,1831275529987444847,18386572130680598394,524288 --field-trial-handle=2252,i,5149901893209099986,10971741411815702905,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2216,i,5686217461269712890,7610618077215172160,524288 --field-trial-handle=2252,i,5149901893209099986,10971741411815702905,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,3947142464854973168,12872148596468774720,2097152 --field-trial-handle=2252,i,5149901893209099986,10971741411815702905,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,5594183383895624449,232658829703678100,2097152 --field-trial-handle=2252,i,5149901893209099986,10971741411815702905,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,3775222368463004633,9255500551642305121,2097152 --field-trial-handle=2252,i,5149901893209099986,10971741411815702905,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,7099827552014814689,11678262799817691559,2097152 --field-trial-handle=2252,i,5149901893209099986,10971741411815702905,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3760,i,15436707703311212765,10639658986125959992,2097152 --field-trial-handle=2252,i,5149901893209099986,10971741411815702905,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,6231660681458748543,7932195278951054245,524288 --field-trial-handle=2252,i,5149901893209099986,10971741411815702905,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5460,i,5011290595214262170,3856332839866910002,2097152 --field-trial-handle=2252,i,5149901893209099986,10971741411815702905,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4620,i,481238375099369038,10537540320776959265,524288 --field-trial-handle=2252,i,5149901893209099986,10971741411815702905,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4904,i,2150173997814653959,1963949004965478968,524288 --field-trial-handle=2252,i,5149901893209099986,10971741411815702905,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,4931138713147773355,10600547973209307318,524288 --field-trial-handle=2252,i,5149901893209099986,10971741411815702905,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,4931138713147773355,10600547973209307318,524288 --field-trial-handle=2252,i,5149901893209099986,10971741411815702905,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,1487180502600795278,17479754782484962090,524288 --field-trial-handle=2252,i,5149901893209099986,10971741411815702905,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,1963280510724626738,10783005819695821366,524288 --field-trial-handle=2252,i,5149901893209099986,10971741411815702905,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,9408827501538260355,8261481985794918795,524288 --field-trial-handle=2252,i,5149901893209099986,10971741411815702905,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,5598683569644957193,17322032581812739011,524288 --field-trial-handle=2252,i,5149901893209099986,10971741411815702905,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4932,i,11729926359000441837,7497334436731101511,524288 --field-trial-handle=2252,i,5149901893209099986,10971741411815702905,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,17827918120816972220,2706352181878232942,524288 --field-trial-handle=2252,i,5149901893209099986,10971741411815702905,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,3432691347981856602,2289357036484587702,524288 --field-trial-handle=2252,i,5149901893209099986,10971741411815702905,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,14387398542636087210,7386233766997468443,524288 --field-trial-handle=2252,i,5149901893209099986,10971741411815702905,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3800,i,6369836317119742621,17134236438573569308,524288 --field-trial-handle=2252,i,5149901893209099986,10971741411815702905,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=912,i,11830033933287494214,3251660847915521459,524288 --field-trial-handle=2252,i,5149901893209099986,10971741411815702905,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,10023810968774704999,15079873284910149572,524288 --field-trial-handle=2252,i,5149901893209099986,10971741411815702905,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,5668946409632196532,8609500726914839524,524288 --field-trial-handle=2252,i,5149901893209099986,10971741411815702905,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5000,i,5348405877465195762,169107614147948982,262144 --field-trial-handle=2252,i,5149901893209099986,10971741411815702905,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,10670503030023526446,1080974297550313918,524288 --field-trial-handle=2252,i,5149901893209099986,10971741411815702905,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\hcauspnhfcxupmke.sysC:\Temp\hcauspnhfcxupmke.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\czurpjhfzx.sysC:\Temp\czurpjhfzx.sys1⤵
- Executes dropped EXE
-
C:\Temp\ebztrpjhbz.sysC:\Temp\ebztrpjhbz.sys1⤵
- Executes dropped EXE
-
C:\Temp\ojgeywqomg.sysC:\Temp\ojgeywqomg.sys1⤵
- Executes dropped EXE
-
C:\Temp\geywqoljdb.sysC:\Temp\geywqoljdb.sys1⤵
- Executes dropped EXE
-
C:\Temp\qlidbvtnlf.sysC:\Temp\qlidbvtnlf.sys1⤵
- Executes dropped EXE
-
C:\Temp\avsqnifdav.sysC:\Temp\avsqnifdav.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfaxspnhfd.sysC:\Temp\hfaxspnhfd.sys1⤵
- Executes dropped EXE
-
C:\Temp\ausnkfcaxs.sysC:\Temp\ausnkfcaxs.sys1⤵
- Executes dropped EXE
-
C:\Temp\pmhfzxrpjh.sysC:\Temp\pmhfzxrpjh.sys1⤵
- Executes dropped EXE
-
C:\Temp\cwuomhecwu.sysC:\Temp\cwuomhecwu.sys1⤵
- Executes dropped EXE
-
C:\Temp\bwtrmjebwu.sysC:\Temp\bwtrmjebwu.sys1⤵
-
C:\Temp\jhbywtomge.sysC:\Temp\jhbywtomge.sys1⤵
-
C:\Temp\vtrligaytq.sysC:\Temp\vtrligaytq.sys1⤵
-
C:\Temp\aysqkigayt.sysC:\Temp\aysqkigayt.sys1⤵
-
C:\Temp\qkicavsnki.sysC:\Temp\qkicavsnki.sys1⤵
-
C:\Temp\xvsnkfcavs.sysC:\Temp\xvsnkfcavs.sys1⤵
-
C:\Temp\pnhfzxrpkh.sysC:\Temp\pnhfzxrpkh.sys1⤵
-
C:\Temp\wurpjheczu.sysC:\Temp\wurpjheczu.sys1⤵
-
C:\Temp\ywrojgeztr.sysC:\Temp\ywrojgeztr.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
bwuojhbztr.exe
czurpjhfzx.sys
ebztrpjhbz.sys
geywqoljdb.sys
hcauspnhfcxupmke.exe
hcauspnhfcxupmke.sys
i_bwuojhbztr.exe
i_olgeywqolj.exe
i_smkicapmhe.exe
i_tqlidbytqo.exe
i_zxrpmhfzxr.exe
ojgeywqomg.sys
olgeywqolj.exe
qlidbvtnlf.sys
smkicapmhe.exe
tqlidbytqo.exe
zxrpmhfzxr.exe
94440ab4-83a9-4c2c-8fb4-657c9aaac71d.tmp
settings.dat
settings.dat
the-real-index
the-real-index~RFe59553a.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Secure Preferences
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
95979b3b-431f-442c-b94a-268cac383a40.tmp
metadata.json
d85979d9-0337-414a-b241-99af41427a4a.tmp
content_new.js
CreateProcess.exe
memory/756-622-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2632-449-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2788-676-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2788-653-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2940-630-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3296-709-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3400-494-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3516-553-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3588-666-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3704-541-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4124-662-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4148-416-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4584-545-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4700-549-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4724-688-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5228-529-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5612-516-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5952-464-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5964-582-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6048-602-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6084-692-0x0000000000010000-0x00000000000AB000-memory.dmp