Analysis
- max time kernel
149s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/08/2026, 22:43
General
- Target 2026-08-10_373a29cfba78006690bd3e73ed76928e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 365KB
- Sample260810-2npexabk3x
- SHA256 47c79680206d52e9d51143a674f532d53248c70dda3d8eaa44bd312eb149dda0
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Detects executables containing bas64 encoded gzip files 1 IoCs
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_373a29cfba78006690bd3e73ed76928e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_373a29cfba78006690bd3e73ed76928e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\qnigayvqnifaysqk.exeC:\Temp\qnigayvqnifaysqk.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqnifdxvqk.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\sqnifdxvqk.exeC:\Temp\sqnifdxvqk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqnifdxvqk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_sqnifdxvqk.exeC:\Temp\i_sqnifdxvqk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xsqkicaspn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xsqkicaspn.exeC:\Temp\xsqkicaspn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xsqkicaspn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xsqkicaspn.exeC:\Temp\i_xsqkicaspn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zurpnhfzxu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zurpnhfzxu.exeC:\Temp\zurpnhfzxu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zurpnhfzxu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zurpnhfzxu.exeC:\Temp\i_zurpnhfzxu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fzxrpkfcxu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fzxrpkfcxu.exeC:\Temp\fzxrpkfcxu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fzxrpkfcxu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fzxrpkfcxu.exeC:\Temp\i_fzxrpkfcxu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kebwuomgec.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kebwuomgec.exeC:\Temp\kebwuomgec.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kebwuomgec.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kebwuomgec.exeC:\Temp\i_kebwuomgec.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wtoljdbwto.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wtoljdbwto.exeC:\Temp\wtoljdbwto.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wtoljdbwto.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wtoljdbwto.exeC:\Temp\i_wtoljdbwto.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wtnljdbvto.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wtnljdbvto.exeC:\Temp\wtnljdbvto.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wtnljdbvto.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wtnljdbvto.exeC:\Temp\i_wtnljdbvto.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gaytqljgby.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gaytqljgby.exeC:\Temp\gaytqljgby.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gaytqljgby.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gaytqljgby.exeC:\Temp\i_gaytqljgby.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nlidbvtnlf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nlidbvtnlf.exeC:\Temp\nlidbvtnlf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nlidbvtnlf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nlidbvtnlf.exeC:\Temp\i_nlidbvtnlf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hfdxvsnlfd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hfdxvsnlfd.exeC:\Temp\hfdxvsnlfd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hfdxvsnlfd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hfdxvsnlfd.exeC:\Temp\i_hfdxvsnlfd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hcausmkecx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hcausmkecx.exeC:\Temp\hcausmkecx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hcausmkecx.exe ups_ins3⤵
-
C:\Temp\i_hcausmkecx.exeC:\Temp\i_hcausmkecx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mkecaujhfz.exe ups_run3⤵
-
C:\Temp\mkecaujhfz.exeC:\Temp\mkecaujhfz.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mkecaujhfz.exe ups_ins3⤵
-
C:\Temp\i_mkecaujhfz.exeC:\Temp\i_mkecaujhfz.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mjhczurpjh.exe ups_run3⤵
-
C:\Temp\mjhczurpjh.exeC:\Temp\mjhczurpjh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mjhczurpjh.exe ups_ins3⤵
-
C:\Temp\i_mjhczurpjh.exeC:\Temp\i_mjhczurpjh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\uomgeywrom.exe ups_run3⤵
-
C:\Temp\uomgeywrom.exeC:\Temp\uomgeywrom.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_uomgeywrom.exe ups_ins3⤵
-
C:\Temp\i_uomgeywrom.exeC:\Temp\i_uomgeywrom.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wrojgbztrl.exe ups_run3⤵
-
C:\Temp\wrojgbztrl.exeC:\Temp\wrojgbztrl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wrojgbztrl.exe ups_ins3⤵
-
C:\Temp\i_wrojgbztrl.exeC:\Temp\i_wrojgbztrl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywqoigbytq.exe ups_run3⤵
-
C:\Temp\ywqoigbytq.exeC:\Temp\ywqoigbytq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywqoigbytq.exe ups_ins3⤵
-
C:\Temp\i_ywqoigbytq.exeC:\Temp\i_ywqoigbytq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqoigaysqk.exe ups_run3⤵
-
C:\Temp\sqoigaysqk.exeC:\Temp\sqoigaysqk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqoigaysqk.exe ups_ins3⤵
-
C:\Temp\i_sqoigaysqk.exeC:\Temp\i_sqoigaysqk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\igaxsqkica.exe ups_run3⤵
-
C:\Temp\igaxsqkica.exeC:\Temp\igaxsqkica.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_igaxsqkica.exe ups_ins3⤵
-
C:\Temp\i_igaxsqkica.exeC:\Temp\i_igaxsqkica.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usqkicausm.exe ups_run3⤵
-
C:\Temp\usqkicausm.exeC:\Temp\usqkicausm.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usqkicausm.exe ups_ins3⤵
-
C:\Temp\i_usqkicausm.exeC:\Temp\i_usqkicausm.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2cc,0x2f4,0x2f8,0x2c8,0x394,0x7fff1669c188,0x7fff1669c194,0x7fff1669c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,11530100573414361448,15605446398615242132,262144 --field-trial-handle=2304,i,18352129964133387973,12673062135741926240,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,7700089679553120815,1396196471951483114,524288 --field-trial-handle=2304,i,18352129964133387973,12673062135741926240,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2368,i,3947979585998602472,2530952066649631581,524288 --field-trial-handle=2304,i,18352129964133387973,12673062135741926240,262144 --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,8167313735851860677,3823396817067800251,2097152 --field-trial-handle=2304,i,18352129964133387973,12673062135741926240,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3580,i,8779357447669005588,8578182626681265151,2097152 --field-trial-handle=2304,i,18352129964133387973,12673062135741926240,262144 --variations-seed-version --mojo-platform-channel-handle=3340 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,66686540007472158,18192774821803385116,2097152 --field-trial-handle=2304,i,18352129964133387973,12673062135741926240,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,6250713718499738496,16552361871677217374,2097152 --field-trial-handle=2304,i,18352129964133387973,12673062135741926240,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5364,i,4992655841679214097,16337249407209812074,2097152 --field-trial-handle=2304,i,18352129964133387973,12673062135741926240,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,17292125931359129468,4294184430493382551,524288 --field-trial-handle=2304,i,18352129964133387973,12673062135741926240,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5452,i,2580542943364849878,12864713353692746322,2097152 --field-trial-handle=2304,i,18352129964133387973,12673062135741926240,262144 --variations-seed-version --mojo-platform-channel-handle=3340 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,2469527047157659975,18189081622657056427,524288 --field-trial-handle=2304,i,18352129964133387973,12673062135741926240,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4308,i,11966028743322904674,229343538099767584,524288 --field-trial-handle=2304,i,18352129964133387973,12673062135741926240,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,17480294365295964059,662138130840286955,524288 --field-trial-handle=2304,i,18352129964133387973,12673062135741926240,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,17480294365295964059,662138130840286955,524288 --field-trial-handle=2304,i,18352129964133387973,12673062135741926240,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,7166422720936682086,5316004426793954832,524288 --field-trial-handle=2304,i,18352129964133387973,12673062135741926240,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,2270195962412066187,1100954976511250087,524288 --field-trial-handle=2304,i,18352129964133387973,12673062135741926240,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,6837467629721331428,16942396592397033392,524288 --field-trial-handle=2304,i,18352129964133387973,12673062135741926240,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,6691784846162734668,2375152216010245860,524288 --field-trial-handle=2304,i,18352129964133387973,12673062135741926240,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4932,i,15169546762443039685,1525472937130567561,524288 --field-trial-handle=2304,i,18352129964133387973,12673062135741926240,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,6796077656349984217,16455079730277586148,524288 --field-trial-handle=2304,i,18352129964133387973,12673062135741926240,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,13313427855391773151,13340214068503173725,524288 --field-trial-handle=2304,i,18352129964133387973,12673062135741926240,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2768,i,12479270518991679253,2758796635611428045,524288 --field-trial-handle=2304,i,18352129964133387973,12673062135741926240,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6676,i,3138958391297248540,13014762818826781035,524288 --field-trial-handle=2304,i,18352129964133387973,12673062135741926240,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,14232506599357980286,15178296744485320431,524288 --field-trial-handle=2304,i,18352129964133387973,12673062135741926240,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,2206791436030573755,3873002332367014912,524288 --field-trial-handle=2304,i,18352129964133387973,12673062135741926240,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2456,i,9548606519696140299,15585620032391426302,262144 --field-trial-handle=2304,i,18352129964133387973,12673062135741926240,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,5377084438619262194,15632054414659619937,524288 --field-trial-handle=2304,i,18352129964133387973,12673062135741926240,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\qnigayvqnifaysqk.sysC:\Temp\qnigayvqnifaysqk.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Temp\dausqkicau.sysC:\Temp\dausqkicau.sys1⤵
- Executes dropped EXE
-
C:\Temp\khcaxspnkf.sysC:\Temp\khcaxspnkf.sys1⤵
- Executes dropped EXE
-
C:\Temp\cxusmkecwu.sysC:\Temp\cxusmkecwu.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhezxuomje.sysC:\Temp\jhezxuomje.sys1⤵
- Executes dropped EXE
-
C:\Temp\wtomgeywqo.sysC:\Temp\wtomgeywqo.sys1⤵
- Executes dropped EXE
-
C:\Temp\bztrljdbyw.sysC:\Temp\bztrljdbyw.sys1⤵
- Executes dropped EXE
-
C:\Temp\gaytqoigby.sysC:\Temp\gaytqoigby.sys1⤵
- Executes dropped EXE
-
C:\Temp\tnlfdyvqnl.sysC:\Temp\tnlfdyvqnl.sys1⤵
- Executes dropped EXE
-
C:\Temp\licausqkif.sysC:\Temp\licausqkif.sys1⤵
- Executes dropped EXE
-
C:\Temp\kicspkhcau.sysC:\Temp\kicspkhcau.sys1⤵
- Executes dropped EXE
-
C:\Temp\pnhfzxrpnh.sysC:\Temp\pnhfzxrpnh.sys1⤵
-
C:\Temp\rmkecwusmj.sysC:\Temp\rmkecwusmj.sys1⤵
-
C:\Temp\pjheywrojh.sysC:\Temp\pjheywrojh.sys1⤵
-
C:\Temp\wtrljgbywr.sysC:\Temp\wtrljgbywr.sys1⤵
-
C:\Temp\vtrljdbvto.sysC:\Temp\vtrljdbvto.sys1⤵
-
C:\Temp\yvtnlfdyvt.sysC:\Temp\yvtnlfdyvt.sys1⤵
-
C:\Temp\ifdxvsqkid.sysC:\Temp\ifdxvsqkid.sys1⤵
-
C:\Temp\fdavsnlfdx.sysC:\Temp\fdavsnlfdx.sys1⤵
-
C:\Temp\pkhfzxspkh.sysC:\Temp\pkhfzxspkh.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
cxusmkecwu.sys
dausqkicau.sys
fzxrpkfcxu.exe
i_fzxrpkfcxu.exe
i_kebwuomgec.exe
i_sqnifdxvqk.exe
i_xsqkicaspn.exe
i_zurpnhfzxu.exe
jhezxuomje.sys
kebwuomgec.exe
khcaxspnkf.sys
qnigayvqnifaysqk.exe
qnigayvqnifaysqk.sys
sqnifdxvqk.exe
wtomgeywqo.sys
xsqkicaspn.exe
zurpnhfzxu.exe
settings.dat
settings.dat
the-real-index
the-real-index~RFe5a05be.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Secure Preferences
66a76dcf-719d-47dc-90b3-4ed9949df7b1.tmp
Local State
Local State
Local State
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
metadata.json
metadata.json
75fea181-bc72-4067-9470-f89e131c66c1.tmp
content_new.js
CreateProcess.exe
memory/1120-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1120-470-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1304-584-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1360-548-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1376-719-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1440-498-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1488-531-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1556-672-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1812-544-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2572-637-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2760-698-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2760-510-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2764-693-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3528-597-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4464-641-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4600-661-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4636-423-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4768-702-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6124-563-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6128-617-0x0000000000010000-0x00000000000AB000-memory.dmp