Analysis
- max time kernel
149s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/08/2026, 17:01
General
- Target 2026-08-20_d51e9c6e84d69c413b510bbe623b91f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 389KB
- Sample260820-vjp3bavthw
- SHA256 ce8371153b27c4b076fe27a22301e48ec085ff54ec3624d48532c36235f60f19
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_d51e9c6e84d69c413b510bbe623b91f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_d51e9c6e84d69c413b510bbe623b91f0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\ecxusmkicamkeczx.exeC:\Temp\ecxusmkicamkeczx.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hezxrpjhfc.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\hezxrpjhfc.exeC:\Temp\hezxrpjhfc.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hezxrpjhfc.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hezxrpjhfc.exeC:\Temp\i_hezxrpjhfc.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rmjecwuomg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rmjecwuomg.exeC:\Temp\rmjecwuomg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rmjecwuomg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rmjecwuomg.exeC:\Temp\i_rmjecwuomg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omgeywromg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\omgeywromg.exeC:\Temp\omgeywromg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omgeywromg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_omgeywromg.exeC:\Temp\i_omgeywromg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywqojgbztr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ywqojgbztr.exeC:\Temp\ywqojgbztr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywqojgbztr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ywqojgbztr.exeC:\Temp\i_ywqojgbztr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ayvqoigayw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ayvqoigayw.exeC:\Temp\ayvqoigayw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ayvqoigayw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ayvqoigayw.exeC:\Temp\i_ayvqoigayw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dbvsqkifdy.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dbvsqkifdy.exeC:\Temp\dbvsqkifdy.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dbvsqkifdy.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dbvsqkifdy.exeC:\Temp\i_dbvsqkifdy.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dxvtnlfdys.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dxvtnlfdys.exeC:\Temp\dxvtnlfdys.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dxvtnlfdys.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dxvtnlfdys.exeC:\Temp\i_dxvtnlfdys.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hfcauspnhf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hfcauspnhf.exeC:\Temp\hfcauspnhf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hfcauspnhf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hfcauspnhf.exeC:\Temp\i_hfcauspnhf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fcxupmhfzx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fcxupmhfzx.exeC:\Temp\fcxupmhfzx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fcxupmhfzx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fcxupmhfzx.exeC:\Temp\i_fcxupmhfzx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xupmgecwur.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xupmgecwur.exeC:\Temp\xupmgecwur.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xupmgecwur.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xupmgecwur.exeC:\Temp\i_xupmgecwur.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hbztrmjecw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hbztrmjecw.exeC:\Temp\hbztrmjecw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hbztrmjecw.exe ups_ins3⤵
-
C:\Temp\i_hbztrmjecw.exeC:\Temp\i_hbztrmjecw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ztrmgeywqo.exe ups_run3⤵
-
C:\Temp\ztrmgeywqo.exeC:\Temp\ztrmgeywqo.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ztrmgeywqo.exe ups_ins3⤵
-
C:\Temp\i_ztrmgeywqo.exeC:\Temp\i_ztrmgeywqo.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywtoljdbyt.exe ups_run3⤵
-
C:\Temp\ywtoljdbyt.exeC:\Temp\ywtoljdbyt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywtoljdbyt.exe ups_ins3⤵
-
C:\Temp\i_ywtoljdbyt.exeC:\Temp\i_ywtoljdbyt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\yvtnlidbvt.exe ups_run3⤵
-
C:\Temp\yvtnlidbvt.exeC:\Temp\yvtnlidbvt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_yvtnlidbvt.exe ups_ins3⤵
-
C:\Temp\i_yvtnlidbvt.exeC:\Temp\i_yvtnlidbvt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vsqlidxvqn.exe ups_run3⤵
-
C:\Temp\vsqlidxvqn.exeC:\Temp\vsqlidxvqn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vsqlidxvqn.exe ups_ins3⤵
-
C:\Temp\i_vsqlidxvqn.exeC:\Temp\i_vsqlidxvqn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\khfdavsnlf.exe ups_run3⤵
-
C:\Temp\khfdavsnlf.exeC:\Temp\khfdavsnlf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_khfdavsnlf.exe ups_ins3⤵
-
C:\Temp\i_khfdavsnlf.exeC:\Temp\i_khfdavsnlf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kicausmkec.exe ups_run3⤵
-
C:\Temp\kicausmkec.exeC:\Temp\kicausmkec.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kicausmkec.exe ups_ins3⤵
-
C:\Temp\i_kicausmkec.exeC:\Temp\i_kicausmkec.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\keczusmkec.exe ups_run3⤵
-
C:\Temp\keczusmkec.exeC:\Temp\keczusmkec.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_keczusmkec.exe ups_ins3⤵
-
C:\Temp\i_keczusmkec.exeC:\Temp\i_keczusmkec.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pjhczurmke.exe ups_run3⤵
-
C:\Temp\pjhczurmke.exeC:\Temp\pjhczurmke.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pjhczurmke.exe ups_ins3⤵
-
C:\Temp\i_pjhczurmke.exeC:\Temp\i_pjhczurmke.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffb6e9cc188,0x7ffb6e9cc194,0x7ffb6e9cc1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2056,i,16303400487702969731,15114806904092102240,262144 --field-trial-handle=2524,i,17852559109584295254,4584458699886966392,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2172,i,6780854972031823011,11441427962190275115,524288 --field-trial-handle=2524,i,17852559109584295254,4584458699886966392,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,10033840652852831454,16093231703045720390,524288 --field-trial-handle=2524,i,17852559109584295254,4584458699886966392,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3536,i,14093221892259417665,5380879885288607115,2097152 --field-trial-handle=2524,i,17852559109584295254,4584458699886966392,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3528,i,10793649702147678611,12443867557686604697,2097152 --field-trial-handle=2524,i,17852559109584295254,4584458699886966392,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,9408632931429254089,2430687190216423416,2097152 --field-trial-handle=2524,i,17852559109584295254,4584458699886966392,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,2716477906495278648,5268739856569026920,2097152 --field-trial-handle=2524,i,17852559109584295254,4584458699886966392,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3520,i,12209871881325944313,17480542170690874267,524288 --field-trial-handle=2524,i,17852559109584295254,4584458699886966392,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,11689677955795034374,202542528228664910,524288 --field-trial-handle=2524,i,17852559109584295254,4584458699886966392,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,17893064293443161029,14722396570429357146,524288 --field-trial-handle=2524,i,17852559109584295254,4584458699886966392,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,11396396256556100619,11980341256713775859,524288 --field-trial-handle=2524,i,17852559109584295254,4584458699886966392,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,11396396256556100619,11980341256713775859,524288 --field-trial-handle=2524,i,17852559109584295254,4584458699886966392,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,8895274090295472803,15454810320324432287,524288 --field-trial-handle=2524,i,17852559109584295254,4584458699886966392,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,98742373260038476,13188350493426772117,524288 --field-trial-handle=2524,i,17852559109584295254,4584458699886966392,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,10298679138459537763,13246781730946787923,524288 --field-trial-handle=2524,i,17852559109584295254,4584458699886966392,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,11633036204079176754,4329784278902707272,524288 --field-trial-handle=2524,i,17852559109584295254,4584458699886966392,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1408,i,13444810901223585419,363873872717497083,524288 --field-trial-handle=2524,i,17852559109584295254,4584458699886966392,262144 --variations-seed-version --mojo-platform-channel-handle=1260 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1440,i,2825240895912373488,13586040154406212915,524288 --field-trial-handle=2524,i,17852559109584295254,4584458699886966392,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1404,i,9456876689686049577,7065707977720651780,524288 --field-trial-handle=2524,i,17852559109584295254,4584458699886966392,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1224,i,2546232708417594735,14342672019481910380,524288 --field-trial-handle=2524,i,17852559109584295254,4584458699886966392,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3716,i,15514105191884591292,6474670381031742635,524288 --field-trial-handle=2524,i,17852559109584295254,4584458699886966392,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,10945464304963011730,14564784552366269770,524288 --field-trial-handle=2524,i,17852559109584295254,4584458699886966392,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6920,i,10531378707372607200,961496969654372776,524288 --field-trial-handle=2524,i,17852559109584295254,4584458699886966392,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5968,i,18110590668391922924,12083906194057635583,262144 --field-trial-handle=2524,i,17852559109584295254,4584458699886966392,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,16346791865878393954,14704946608293763525,524288 --field-trial-handle=2524,i,17852559109584295254,4584458699886966392,262144 --variations-seed-version --mojo-platform-channel-handle=1388 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\ecxusmkicamkeczx.sysC:\Temp\ecxusmkicamkeczx.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\fcwuomhecw.sysC:\Temp\fcwuomhecw.sys1⤵
- Executes dropped EXE
-
C:\Temp\omjhbzwroj.sysC:\Temp\omjhbzwroj.sys1⤵
- Executes dropped EXE
-
C:\Temp\bwtrljdbwt.sysC:\Temp\bwtrljdbwt.sys1⤵
- Executes dropped EXE
-
C:\Temp\bywqnljdbv.sysC:\Temp\bywqnljdbv.sys1⤵
- Executes dropped EXE
-
C:\Temp\qoigaysqli.sysC:\Temp\qoigaysqli.sys1⤵
- Executes dropped EXE
-
C:\Temp\ayvqnlfdav.sysC:\Temp\ayvqnlfdav.sys1⤵
- Executes dropped EXE
-
C:\Temp\kfdxvsnkhf.sysC:\Temp\kfdxvsnkhf.sys1⤵
- Executes dropped EXE
-
C:\Temp\mkfcxupmhf.sysC:\Temp\mkfcxupmhf.sys1⤵
- Executes dropped EXE
-
C:\Temp\ecxupnhezx.sysC:\Temp\ecxupnhezx.sys1⤵
- Executes dropped EXE
-
C:\Temp\ezwuomgezw.sysC:\Temp\ezwuomgezw.sys1⤵
- Executes dropped EXE
-
C:\Temp\bwtomgeywt.sysC:\Temp\bwtomgeywt.sys1⤵
-
C:\Temp\ywtolgeywq.sysC:\Temp\ywtolgeywq.sys1⤵
-
C:\Temp\gaytqolgdb.sysC:\Temp\gaytqolgdb.sys1⤵
-
C:\Temp\xvsqkidavs.sysC:\Temp\xvsqkidavs.sys1⤵
-
C:\Temp\nkicaxspnl.sysC:\Temp\nkicaxspnl.sys1⤵
-
C:\Temp\pkhcausmke.sysC:\Temp\pkhcausmke.sys1⤵
-
C:\Temp\rpnhfzxusm.sysC:\Temp\rpnhfzxusm.sys1⤵
-
C:\Temp\omkecwuomh.sysC:\Temp\omkecwuomh.sys1⤵
-
C:\Temp\mgeywurmje.sysC:\Temp\mgeywurmje.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ayvqoigayw.exe
bwtrljdbwt.sys
bywqnljdbv.sys
dbvsqkifdy.exe
ecxusmkicamkeczx.exe
ecxusmkicamkeczx.sys
fcwuomhecw.sys
hezxrpjhfc.exe
i_ayvqoigayw.exe
i_hezxrpjhfc.exe
i_omgeywromg.exe
i_rmjecwuomg.exe
i_ywqojgbztr.exe
omgeywromg.exe
omjhbzwroj.sys
qoigaysqli.sys
rmjecwuomg.exe
ywqojgbztr.exe
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
the-real-index
the-real-index~RFe5959fd.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
OperationConfig
OperationConfig~RFe59f4a7.TMP
Local State
Local State
Local State
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
4f206b13-bb69-4d3d-9c15-c0b31b6606c1.tmp
e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
metadata.json~RFe593109.TMP
75fe5466-8893-476c-a3d9-bc3a9cd1973c.tmp
content_new.js
CreateProcess.exe
memory/928-545-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1000-499-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1248-549-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1248-566-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1724-585-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1952-719-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1996-564-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2912-618-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3188-65-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3288-423-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3288-476-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3396-598-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4048-698-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4212-658-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4240-715-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4252-662-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4512-694-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4708-511-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4904-470-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5188-638-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5376-538-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5772-673-0x0000000000010000-0x00000000000AB000-memory.dmp