Analysis
- max time kernel
150s - max time network
137s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
08/09/2026, 03:49
General
- Target 2026-09-07_def9d1b2e7b73cd1e4b20af4f33276e6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 381KB
- Sample260908-edp75a1drd
- SHA256 af3fccb381a2fcf882bc4acb244b703617506ac14a4f98e8baeb55dc521476c0
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-07_def9d1b2e7b73cd1e4b20af4f33276e6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-07_def9d1b2e7b73cd1e4b20af4f33276e6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\bywqojgeywqojgbz.exeC:\Temp\bywqojgeywqojgbz.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jgbztrlige.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\jgbztrlige.exeC:\Temp\jgbztrlige.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jgbztrlige.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jgbztrlige.exeC:\Temp\i_jgbztrlige.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bvtnlgdywq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bvtnlgdywq.exeC:\Temp\bvtnlgdywq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bvtnlgdywq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bvtnlgdywq.exeC:\Temp\i_bvtnlgdywq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gdyvqnigay.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gdyvqnigay.exeC:\Temp\gdyvqnigay.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gdyvqnigay.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gdyvqnigay.exeC:\Temp\i_gdyvqnigay.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xsnkicaxsq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xsnkicaxsq.exeC:\Temp\xsnkicaxsq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xsnkicaxsq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xsnkicaxsq.exeC:\Temp\i_xsnkicaxsq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vpnhfzxspk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vpnhfzxspk.exeC:\Temp\vpnhfzxspk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vpnhfzxspk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vpnhfzxspk.exeC:\Temp\i_vpnhfzxspk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mkhczusmke.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mkhczusmke.exeC:\Temp\mkhczusmke.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mkhczusmke.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mkhczusmke.exeC:\Temp\i_mkhczusmke.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecwuomhezw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ecwuomhezw.exeC:\Temp\ecwuomhezw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecwuomhezw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ecwuomhezw.exeC:\Temp\i_ecwuomhezw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bzwqomjebz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bzwqomjebz.exeC:\Temp\bzwqomjebz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bzwqomjebz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bzwqomjebz.exeC:\Temp\i_bzwqomjebz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jgeywrojhb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jgeywrojhb.exeC:\Temp\jgeywrojhb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jgeywrojhb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jgeywrojhb.exeC:\Temp\i_jgeywrojhb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\toigdywqoi.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\toigdywqoi.exeC:\Temp\toigdywqoi.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_toigdywqoi.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_toigdywqoi.exeC:\Temp\i_toigdywqoi.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ligaysqkid.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ligaysqkid.exeC:\Temp\ligaysqkid.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ligaysqkid.exe ups_ins3⤵
-
C:\Temp\i_ligaysqkid.exeC:\Temp\i_ligaysqkid.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kfdxvpnifa.exe ups_run3⤵
-
C:\Temp\kfdxvpnifa.exeC:\Temp\kfdxvpnifa.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kfdxvpnifa.exe ups_ins3⤵
-
C:\Temp\i_kfdxvpnifa.exeC:\Temp\i_kfdxvpnifa.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nkfcausnkf.exe ups_run3⤵
-
C:\Temp\nkfcausnkf.exeC:\Temp\nkfcausnkf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nkfcausnkf.exe ups_ins3⤵
-
C:\Temp\i_nkfcausnkf.exeC:\Temp\i_nkfcausnkf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hfzxspkica.exe ups_run3⤵
-
C:\Temp\hfzxspkica.exeC:\Temp\hfzxspkica.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hfzxspkica.exe ups_ins3⤵
-
C:\Temp\i_hfzxspkica.exeC:\Temp\i_hfzxspkica.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fzxrpjhbzu.exe ups_run3⤵
-
C:\Temp\fzxrpjhbzu.exeC:\Temp\fzxrpjhbzu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fzxrpjhbzu.exe ups_ins3⤵
-
C:\Temp\i_fzxrpjhbzu.exeC:\Temp\i_fzxrpjhbzu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\eywrojgezw.exe ups_run3⤵
-
C:\Temp\eywrojgezw.exeC:\Temp\eywrojgezw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_eywrojgezw.exe ups_ins3⤵
-
C:\Temp\i_eywrojgezw.exeC:\Temp\i_eywrojgezw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\heywqomgby.exe ups_run3⤵
-
C:\Temp\heywqomgby.exeC:\Temp\heywqomgby.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_heywqomgby.exe ups_ins3⤵
-
C:\Temp\i_heywqomgby.exeC:\Temp\i_heywqomgby.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\eywqoigbyt.exe ups_run3⤵
-
C:\Temp\eywqoigbyt.exeC:\Temp\eywqoigbyt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_eywqoigbyt.exe ups_ins3⤵
-
C:\Temp\i_eywqoigbyt.exeC:\Temp\i_eywqoigbyt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tqoigaytql.exe ups_run3⤵
-
C:\Temp\tqoigaytql.exeC:\Temp\tqoigaytql.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tqoigaytql.exe ups_ins3⤵
-
C:\Temp\i_tqoigaytql.exeC:\Temp\i_tqoigaytql.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdxvtnkida.exe ups_run3⤵
-
C:\Temp\fdxvtnkida.exeC:\Temp\fdxvtnkida.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x304,0x7ffd5f15c188,0x7ffd5f15c194,0x7ffd5f15c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,2629414732841009248,7645666320031052229,262144 --field-trial-handle=2908,i,16778234598014684335,3072897408057517664,262144 --variations-seed-version --mojo-platform-channel-handle=2904 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,8185140657157504174,7467094593814703987,524288 --field-trial-handle=2908,i,16778234598014684335,3072897408057517664,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2148,i,4819203528368621908,15141490777525971433,524288 --field-trial-handle=2908,i,16778234598014684335,3072897408057517664,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,13610512330281589579,12592312372818544486,2097152 --field-trial-handle=2908,i,16778234598014684335,3072897408057517664,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,15118830881386152092,11961910984108495958,2097152 --field-trial-handle=2908,i,16778234598014684335,3072897408057517664,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,251280887227218311,9961454980830904640,2097152 --field-trial-handle=2908,i,16778234598014684335,3072897408057517664,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3840,i,4638751553021380888,9183762407349873826,2097152 --field-trial-handle=2908,i,16778234598014684335,3072897408057517664,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3708,i,2513208297228016610,371944901714303948,524288 --field-trial-handle=2908,i,16778234598014684335,3072897408057517664,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,7351065862460913355,16561393856157691891,524288 --field-trial-handle=2908,i,16778234598014684335,3072897408057517664,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,2584206011595222192,5774039113951959599,524288 --field-trial-handle=2908,i,16778234598014684335,3072897408057517664,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,8138726997312858928,1444069877985161599,524288 --field-trial-handle=2908,i,16778234598014684335,3072897408057517664,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,8138726997312858928,1444069877985161599,524288 --field-trial-handle=2908,i,16778234598014684335,3072897408057517664,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,4573311139510498610,11592510054916536194,524288 --field-trial-handle=2908,i,16778234598014684335,3072897408057517664,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,9657742968517605394,7342328636294334937,524288 --field-trial-handle=2908,i,16778234598014684335,3072897408057517664,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,11809353748564799727,4316063312126712538,524288 --field-trial-handle=2908,i,16778234598014684335,3072897408057517664,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,13383938734802469504,15120595864516077214,524288 --field-trial-handle=2908,i,16778234598014684335,3072897408057517664,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,9524990642240464789,9695610110525060480,524288 --field-trial-handle=2908,i,16778234598014684335,3072897408057517664,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,15703704335389546103,1121249738832281808,524288 --field-trial-handle=2908,i,16778234598014684335,3072897408057517664,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,15738456759649236571,6660691959350737701,524288 --field-trial-handle=2908,i,16778234598014684335,3072897408057517664,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,10449814329374879112,14633463132257554703,524288 --field-trial-handle=2908,i,16778234598014684335,3072897408057517664,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,890509353487128308,7050867533949483682,524288 --field-trial-handle=2908,i,16778234598014684335,3072897408057517664,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,11081075981719631959,16161020508916838492,524288 --field-trial-handle=2908,i,16778234598014684335,3072897408057517664,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,3909692598453871752,4536814283981642050,524288 --field-trial-handle=2908,i,16778234598014684335,3072897408057517664,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6756,i,1672693489546915707,13477000825570912825,262144 --field-trial-handle=2908,i,16778234598014684335,3072897408057517664,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,8998425438144194515,13863593282974630279,524288 --field-trial-handle=2908,i,16778234598014684335,3072897408057517664,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\bywqojgeywqojgbz.sysC:\Temp\bywqojgeywqojgbz.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\aytqoigdyt.sysC:\Temp\aytqoigdyt.sys1⤵
- Executes dropped EXE
-
C:\Temp\lidavtnlfd.sysC:\Temp\lidavtnlfd.sys1⤵
- Executes dropped EXE
-
C:\Temp\dxvsqkidav.sysC:\Temp\dxvsqkidav.sys1⤵
- Executes dropped EXE
-
C:\Temp\dxvpnhfzxs.sysC:\Temp\dxvpnhfzxs.sys1⤵
- Executes dropped EXE
-
C:\Temp\upmhecaurp.sysC:\Temp\upmhecaurp.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhbzurmkec.sysC:\Temp\jhbzurmkec.sys1⤵
- Executes dropped EXE
-
C:\Temp\ebzxromjeb.sysC:\Temp\ebzxromjeb.sys1⤵
- Executes dropped EXE
-
C:\Temp\uoljdbwtom.sysC:\Temp\uoljdbwtom.sys1⤵
- Executes dropped EXE
-
C:\Temp\vtrljdbvto.sysC:\Temp\vtrljdbvto.sys1⤵
- Executes dropped EXE
-
C:\Temp\nlidbvtnlf.sysC:\Temp\nlidbvtnlf.sys1⤵
- Executes dropped EXE
-
C:\Temp\vqnifaysqk.sysC:\Temp\vqnifaysqk.sys1⤵
-
C:\Temp\pnkfcayspn.sysC:\Temp\pnkfcayspn.sys1⤵
-
C:\Temp\kicausmkfc.sysC:\Temp\kicausmkfc.sys1⤵
-
C:\Temp\hfzxrpjhcz.sysC:\Temp\hfzxrpjhcz.sys1⤵
-
C:\Temp\pjhbzuomhe.sysC:\Temp\pjhbzuomhe.sys1⤵
-
C:\Temp\jhbzwrpjgb.sysC:\Temp\jhbzwrpjgb.sys1⤵
-
C:\Temp\bywqoljdbw.sysC:\Temp\bywqoljdbw.sys1⤵
-
C:\Temp\ywqoigdyvt.sysC:\Temp\ywqoigdyvt.sys1⤵
-
C:\Temp\oifdbvtqki.sysC:\Temp\oifdbvtqki.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
aytqoigdyt.sys
bvtnlgdywq.exe
bywqojgeywqojgbz.exe
bywqojgeywqojgbz.sys
dxvpnhfzxs.sys
dxvsqkidav.sys
gdyvqnigay.exe
i_bvtnlgdywq.exe
i_gdyvqnigay.exe
i_jgbztrlige.exe
i_vpnhfzxspk.exe
i_xsnkicaxsq.exe
jgbztrlige.exe
lidavtnlfd.sys
mkhczusmke.exe
upmhecaurp.sys
vpnhfzxspk.exe
xsnkicaxsq.exe
settings.dat
settings.dat
the-real-index
the-real-index~RFe59bf10.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Secure Preferences
47e35cbf-47b0-4c10-9629-4ec81c4ddccb.tmp
Local State
Local State
Local State
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
metadata.json
e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
fcde8689-eb87-4d2f-80b8-3c93283a85c8.tmp
metadata.json~RFe599706.TMP
a9f52072-e15d-4b05-84a0-a411fa5311d2.tmp
content_new.js
CreateProcess.exe
memory/200-684-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/964-524-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1164-423-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2192-653-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2332-689-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2332-627-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2424-731-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3316-571-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3392-619-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3392-641-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3484-548-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3504-471-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4140-567-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4224-511-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4268-640-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4336-499-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4504-552-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4708-727-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5144-707-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5144-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5320-664-0x0000000000010000-0x00000000000AB000-memory.dmp