Analysis
- max time kernel
148s - max time network
143s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
25/05/2026, 11:07
General
- Target 2026-05-25_f9162c1a55f62db98c0326706d1263e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 389KB
- Sample260525-m8fk6set2p
- SHA256 6bccc36260e2b7b5d764d4a15b1fbeb5b8ed6a462a0ff57a318cff4cef811483
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 10 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 29 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-25_f9162c1a55f62db98c0326706d1263e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-25_f9162c1a55f62db98c0326706d1263e0_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\ojhbwtoeywqoigby.exeC:\Temp\ojhbwtoeywqoigby.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rljdywqojb.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\rljdywqojb.exeC:\Temp\rljdywqojb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rljdywqojb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rljdywqojb.exeC:\Temp\i_rljdywqojb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gbytolgeyw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gbytolgeyw.exeC:\Temp\gbytolgeyw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gbytolgeyw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gbytolgeyw.exeC:\Temp\i_gbytolgeyw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ysqkidavtn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ysqkidavtn.exeC:\Temp\ysqkidavtn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ysqkidavtn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ysqkidavtn.exeC:\Temp\i_ysqkidavtn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nifaysqkic.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nifaysqkic.exeC:\Temp\nifaysqkic.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nifaysqkic.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nifaysqkic.exeC:\Temp\i_nifaysqkic.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxspkicaup.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zxspkicaup.exeC:\Temp\zxspkicaup.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxspkicaup.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zxspkicaup.exeC:\Temp\i_zxspkicaup.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ausmkfzxsp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ausmkfzxsp.exeC:\Temp\ausmkfzxsp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ausmkfzxsp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ausmkfzxsp.exeC:\Temp\i_ausmkfzxsp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rmkecwuomh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rmkecwuomh.exeC:\Temp\rmkecwuomh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rmkecwuomh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rmkecwuomh.exeC:\Temp\i_rmkecwuomh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hbzwrpjebw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hbzwrpjebw.exeC:\Temp\hbzwrpjebw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hbzwrpjebw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hbzwrpjebw.exeC:\Temp\i_hbzwrpjebw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\uomgeywroj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\uomgeywroj.exeC:\Temp\uomgeywroj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_uomgeywroj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_uomgeywroj.exeC:\Temp\i_uomgeywroj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rlgdbvtolg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rlgdbvtolg.exeC:\Temp\rlgdbvtolg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rlgdbvtolg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rlgdbvtolg.exeC:\Temp\i_rlgdbvtolg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gdytqoigay.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gdytqoigay.exeC:\Temp\gdytqoigay.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gdytqoigay.exe ups_ins3⤵
-
C:\Temp\i_gdytqoigay.exeC:\Temp\i_gdytqoigay.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\yvqnifaysq.exe ups_run3⤵
-
C:\Temp\yvqnifaysq.exeC:\Temp\yvqnifaysq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_yvqnifaysq.exe ups_ins3⤵
-
C:\Temp\i_yvqnifaysq.exeC:\Temp\i_yvqnifaysq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qkicausnkf.exe ups_run3⤵
-
C:\Temp\qkicausnkf.exeC:\Temp\qkicausnkf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qkicausnkf.exe ups_ins3⤵
-
C:\Temp\i_qkicausnkf.exeC:\Temp\i_qkicausnkf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mkicausnkf.exe ups_run3⤵
-
C:\Temp\mkicausnkf.exeC:\Temp\mkicausnkf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mkicausnkf.exe ups_ins3⤵
-
C:\Temp\i_mkicausnkf.exeC:\Temp\i_mkicausnkf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cwupmhfzxr.exe ups_run3⤵
-
C:\Temp\cwupmhfzxr.exeC:\Temp\cwupmhfzxr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cwupmhfzxr.exe ups_ins3⤵
-
C:\Temp\i_cwupmhfzxr.exeC:\Temp\i_cwupmhfzxr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hbwuomhezx.exe ups_run3⤵
-
C:\Temp\hbwuomhezx.exeC:\Temp\hbwuomhezx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hbwuomhezx.exe ups_ins3⤵
-
C:\Temp\i_hbwuomhezx.exeC:\Temp\i_hbwuomhezx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ztrmjebwuo.exe ups_run3⤵
-
C:\Temp\ztrmjebwuo.exeC:\Temp\ztrmjebwuo.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ztrmjebwuo.exe ups_ins3⤵
-
C:\Temp\i_ztrmjebwuo.exeC:\Temp\i_ztrmjebwuo.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trljdbwtom.exe ups_run3⤵
-
C:\Temp\trljdbwtom.exeC:\Temp\trljdbwtom.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trljdbwtom.exe ups_ins3⤵
-
C:\Temp\i_trljdbwtom.exeC:\Temp\i_trljdbwtom.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qoigbytqlj.exe ups_run3⤵
-
C:\Temp\qoigbytqlj.exeC:\Temp\qoigbytqlj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qoigbytqlj.exe ups_ins3⤵
-
C:\Temp\i_qoigbytqlj.exeC:\Temp\i_qoigbytqlj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffbc15bc188,0x7ffbc15bc194,0x7ffbc15bc1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,5390693920108687679,17075944018630548508,524288 --field-trial-handle=2148,i,12846540785287721741,16594184829423533301,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,15734215970562562180,15600855126358253135,262144 --field-trial-handle=2148,i,12846540785287721741,16594184829423533301,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,11583390524487856935,3417247153858918865,524288 --field-trial-handle=2148,i,12846540785287721741,16594184829423533301,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,2269520105822964677,7788729107030399520,2097152 --field-trial-handle=2148,i,12846540785287721741,16594184829423533301,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,16358515876233896954,145135697898652102,2097152 --field-trial-handle=2148,i,12846540785287721741,16594184829423533301,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4784,i,17963592233087895369,13970079463891283152,524288 --field-trial-handle=2148,i,12846540785287721741,16594184829423533301,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,7870093885453563013,14254141018252416329,524288 --field-trial-handle=2148,i,12846540785287721741,16594184829423533301,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,11804690925536263649,9224724985181892099,524288 --field-trial-handle=2148,i,12846540785287721741,16594184829423533301,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,11804690925536263649,9224724985181892099,524288 --field-trial-handle=2148,i,12846540785287721741,16594184829423533301,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,9360958961283340734,10586888758845253726,524288 --field-trial-handle=2148,i,12846540785287721741,16594184829423533301,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:144⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11405⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,642455318107023284,3387821973146254865,524288 --field-trial-handle=2148,i,12846540785287721741,16594184829423533301,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,13145913722121790631,15101926750461859931,524288 --field-trial-handle=2148,i,12846540785287721741,16594184829423533301,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,11272627167169407355,1236167779496965917,524288 --field-trial-handle=2148,i,12846540785287721741,16594184829423533301,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,9404364924323726543,4851670523440195767,524288 --field-trial-handle=2148,i,12846540785287721741,16594184829423533301,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,12218872550821048185,12384900183850315731,524288 --field-trial-handle=2148,i,12846540785287721741,16594184829423533301,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=280,i,5121440654820782871,11782490176558693980,524288 --field-trial-handle=2148,i,12846540785287721741,16594184829423533301,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5756,i,15134723314209603342,15384431288681237442,262144 --field-trial-handle=2148,i,12846540785287721741,16594184829423533301,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,16883477340675944901,1162471686218842294,524288 --field-trial-handle=2148,i,12846540785287721741,16594184829423533301,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\ojhbwtoeywqoigby.sysC:\Temp\ojhbwtoeywqoigby.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\rljdbvtolg.sysC:\Temp\rljdbvtolg.sys1⤵
- Executes dropped EXE
-
C:\Temp\fdyvqoigay.sysC:\Temp\fdyvqoigay.sys1⤵
- Executes dropped EXE
-
C:\Temp\ysnlfdxvqn.sysC:\Temp\ysnlfdxvqn.sys1⤵
- Executes dropped EXE
-
C:\Temp\snhfaxsqki.sysC:\Temp\snhfaxsqki.sys1⤵
- Executes dropped EXE
-
C:\Temp\khcausmkec.sysC:\Temp\khcausmkec.sys1⤵
- Executes dropped EXE
-
C:\Temp\zurmkeczur.sysC:\Temp\zurmkeczur.sys1⤵
- Executes dropped EXE
-
C:\Temp\rmjebwuomg.sysC:\Temp\rmjebwuomg.sys1⤵
- Executes dropped EXE
-
C:\Temp\ljebwuomge.sysC:\Temp\ljebwuomge.sys1⤵
- Executes dropped EXE
-
C:\Temp\bvtolgeywq.sysC:\Temp\bvtolgeywq.sys1⤵
- Executes dropped EXE
-
C:\Temp\qoigaytqlg.sysC:\Temp\qoigaytqlg.sys1⤵
- Executes dropped EXE
-
C:\Temp\idavqnifay.sysC:\Temp\idavqnifay.sys1⤵
-
C:\Temp\ifaysqkida.sysC:\Temp\ifaysqkida.sys1⤵
-
C:\Temp\xvpnhfaxsq.sysC:\Temp\xvpnhfaxsq.sys1⤵
-
C:\Temp\mkecxupmhf.sysC:\Temp\mkecxupmhf.sys1⤵
-
C:\Temp\ojhbztrmke.sysC:\Temp\ojhbztrmke.sys1⤵
-
C:\Temp\rmjecwrpjh.sysC:\Temp\rmjecwrpjh.sys1⤵
-
C:\Temp\ebwtomgeyw.sysC:\Temp\ebwtomgeyw.sys1⤵
-
C:\Temp\trljdbvtol.sysC:\Temp\trljdbvtol.sys1⤵
-
C:\Temp\idavtnlfdy.sysC:\Temp\idavtnlfdy.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
ausmkfzxsp.exe
fdyvqoigay.sys
gbytolgeyw.exe
i_ausmkfzxsp.exe
i_gbytolgeyw.exe
i_nifaysqkic.exe
i_rljdywqojb.exe
i_ysqkidavtn.exe
i_zxspkicaup.exe
khcausmkec.sys
nifaysqkic.exe
ojhbwtoeywqoigby.exe
ojhbwtoeywqoigby.sys
rljdbvtolg.sys
rljdywqojb.exe
snhfaxsqki.sys
ysnlfdxvqn.sys
ysqkidavtn.exe
zurmkeczur.sys
zxspkicaup.exe
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
SiteList-Enterprise.json
HubApps
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
Local State
Local State
Local State
Local State
Local State
typosquatting_list.pb
metadata.json
metadata.json
manifest.json
manifest.json
data.txt
manifest.json
memory/440-488-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/440-466-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/648-445-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/808-251-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/964-303-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1184-525-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1704-340-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2456-491-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2468-210-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2532-410-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2532-433-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2976-230-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3164-316-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3240-357-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3464-478-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3464-492-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3936-380-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4304-398-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4824-275-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4896-198-0x000002A78F990000-0x000002A790990000-memory.dmp
memory/5432-328-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5676-173-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5804-432-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6084-64-0x0000000000010000-0x00000000000AB000-memory.dmp