Analysis
- max time kernel
149s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
21/10/2026, 01:56
General
- Target 2026-10-19_2034af159ed68378b2a0c35633e51288_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 365KB
- Sample261021-cczdasea32
- SHA256 8007506ff3de47611bc5b8db5b0472d040725d0908e73f17b6600c84c659fab3
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_2034af159ed68378b2a0c35633e51288_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-19_2034af159ed68378b2a0c35633e51288_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\olgeywqojgbytrlj.exeC:\Temp\olgeywqojgbytrlj.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trljdbwtrm.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\trljdbwtrm.exeC:\Temp\trljdbwtrm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trljdbwtrm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_trljdbwtrm.exeC:\Temp\i_trljdbwtrm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ligbyvtnlj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ligbyvtnlj.exeC:\Temp\ligbyvtnlj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ligbyvtnlj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ligbyvtnlj.exeC:\Temp\i_ligbyvtnlj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tnlfdayvqn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\tnlfdayvqn.exeC:\Temp\tnlfdayvqn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tnlfdayvqn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_tnlfdayvqn.exeC:\Temp\i_tnlfdayvqn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ausnkfdxvs.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ausnkfdxvs.exeC:\Temp\ausnkfdxvs.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ausnkfdxvs.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ausnkfdxvs.exeC:\Temp\i_ausnkfdxvs.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nhfzxspkic.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nhfzxspkic.exeC:\Temp\nhfzxspkic.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nhfzxspkic.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nhfzxspkic.exeC:\Temp\i_nhfzxspkic.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mkecxupmke.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mkecxupmke.exeC:\Temp\mkecxupmke.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mkecxupmke.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mkecxupmke.exeC:\Temp\i_mkecxupmke.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpjhezxrpj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rpjhezxrpj.exeC:\Temp\rpjhezxrpj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpjhezxrpj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rpjhezxrpj.exeC:\Temp\i_rpjhezxrpj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wurmjecwuo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wurmjecwuo.exeC:\Temp\wurmjecwuo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wurmjecwuo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wurmjecwuo.exeC:\Temp\i_wurmjecwuo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywuomgebol.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ywuomgebol.exeC:\Temp\ywuomgebol.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywuomgebol.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ywuomgebol.exeC:\Temp\i_ywuomgebol.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtrljdbytr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vtrljdbytr.exeC:\Temp\vtrljdbytr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vtrljdbytr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vtrljdbytr.exeC:\Temp\i_vtrljdbytr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ayvtoigays.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ayvtoigays.exeC:\Temp\ayvtoigays.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ayvtoigays.exe ups_ins3⤵
-
C:\Temp\i_ayvtoigays.exeC:\Temp\i_ayvtoigays.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\faysqkicay.exe ups_run3⤵
-
C:\Temp\faysqkicay.exeC:\Temp\faysqkicay.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_faysqkicay.exe ups_ins3⤵
-
C:\Temp\i_faysqkicay.exeC:\Temp\i_faysqkicay.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kicaysqkif.exe ups_run3⤵
-
C:\Temp\kicaysqkif.exeC:\Temp\kicaysqkif.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kicaysqkif.exe ups_ins3⤵
-
C:\Temp\i_kicaysqkif.exeC:\Temp\i_kicaysqkif.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\caxspkhfzu.exe ups_run3⤵
-
C:\Temp\caxspkhfzu.exeC:\Temp\caxspkhfzu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_caxspkhfzu.exe ups_ins3⤵
-
C:\Temp\i_caxspkhfzu.exeC:\Temp\i_caxspkhfzu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\uspkhczxus.exe ups_run3⤵
-
C:\Temp\uspkhczxus.exeC:\Temp\uspkhczxus.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_uspkhczxus.exe ups_ins3⤵
-
C:\Temp\i_uspkhczxus.exeC:\Temp\i_uspkhczxus.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wromjecwuo.exe ups_run3⤵
-
C:\Temp\wromjecwuo.exeC:\Temp\wromjecwuo.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wromjecwuo.exe ups_ins3⤵
-
C:\Temp\i_wromjecwuo.exeC:\Temp\i_wromjecwuo.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gebwtomjeb.exe ups_run3⤵
-
C:\Temp\gebwtomjeb.exeC:\Temp\gebwtomjeb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gebwtomjeb.exe ups_ins3⤵
-
C:\Temp\i_gebwtomjeb.exeC:\Temp\i_gebwtomjeb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dbztroigeb.exe ups_run3⤵
-
C:\Temp\dbztroigeb.exeC:\Temp\dbztroigeb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dbztroigeb.exe ups_ins3⤵
-
C:\Temp\i_dbztroigeb.exeC:\Temp\i_dbztroigeb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tolgdyvtnl.exe ups_run3⤵
-
C:\Temp\tolgdyvtnl.exeC:\Temp\tolgdyvtnl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tolgdyvtnl.exe ups_ins3⤵
-
C:\Temp\i_tolgdyvtnl.exeC:\Temp\i_tolgdyvtnl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vqnigayvqo.exe ups_run3⤵
-
C:\Temp\vqnigayvqo.exeC:\Temp\vqnigayvqo.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x144,0x148,0x14c,0x140,0x300,0x7ffb4c7ec188,0x7ffb4c7ec194,0x7ffb4c7ec1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2012,i,14579545735276873262,6454056685886358944,262144 --field-trial-handle=2768,i,7220697059804610259,8902069821058329173,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2168,i,8173129317553046204,13059717417349198850,524288 --field-trial-handle=2768,i,7220697059804610259,8902069821058329173,262144 --variations-seed-version --mojo-platform-channel-handle=2796 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,3073438311830673691,9456684781730218674,524288 --field-trial-handle=2768,i,7220697059804610259,8902069821058329173,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3564,i,12986341584509054415,1639010017180460171,2097152 --field-trial-handle=2768,i,7220697059804610259,8902069821058329173,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3568,i,3407320634258185877,11504766434358535684,2097152 --field-trial-handle=2768,i,7220697059804610259,8902069821058329173,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,3690314596618046637,4277393191485449045,2097152 --field-trial-handle=2768,i,7220697059804610259,8902069821058329173,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,7765682678643914406,13297660373509527454,2097152 --field-trial-handle=2768,i,7220697059804610259,8902069821058329173,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,8614830577189240233,8007026704515105827,524288 --field-trial-handle=2768,i,7220697059804610259,8902069821058329173,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,14394267720566556737,3690037664768770518,524288 --field-trial-handle=2768,i,7220697059804610259,8902069821058329173,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,5901661316389391372,14473923064151020589,524288 --field-trial-handle=2768,i,7220697059804610259,8902069821058329173,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,2397500848935016167,11696467125480232996,524288 --field-trial-handle=2768,i,7220697059804610259,8902069821058329173,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,2397500848935016167,11696467125480232996,524288 --field-trial-handle=2768,i,7220697059804610259,8902069821058329173,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,2059893313917183714,422606209591961845,524288 --field-trial-handle=2768,i,7220697059804610259,8902069821058329173,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,248212474443335297,13727878029345834579,524288 --field-trial-handle=2768,i,7220697059804610259,8902069821058329173,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,10639260022371228807,5102640878576922197,524288 --field-trial-handle=2768,i,7220697059804610259,8902069821058329173,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6820,i,400612638456925237,6888113522950883388,524288 --field-trial-handle=2768,i,7220697059804610259,8902069821058329173,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1272,i,6652760670810076900,15994742755626718830,524288 --field-trial-handle=2768,i,7220697059804610259,8902069821058329173,262144 --variations-seed-version --mojo-platform-channel-handle=1268 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1276,i,8126517866265496243,18431558440668100772,524288 --field-trial-handle=2768,i,7220697059804610259,8902069821058329173,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,3527380574124010261,1571442157743669693,524288 --field-trial-handle=2768,i,7220697059804610259,8902069821058329173,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,14907133925661028752,7134732917422406132,524288 --field-trial-handle=2768,i,7220697059804610259,8902069821058329173,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,3576622787595870741,743917404920268802,524288 --field-trial-handle=2768,i,7220697059804610259,8902069821058329173,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,1238732335297694400,17077257081465323775,524288 --field-trial-handle=2768,i,7220697059804610259,8902069821058329173,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,9579459365296669822,9957210429087248102,524288 --field-trial-handle=2768,i,7220697059804610259,8902069821058329173,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6532,i,5578566667916893440,2526411931773780326,262144 --field-trial-handle=2768,i,7220697059804610259,8902069821058329173,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,1569020329863143002,17480301099473175081,524288 --field-trial-handle=2768,i,7220697059804610259,8902069821058329173,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,9531947015166853496,57209682720672890,524288 --field-trial-handle=2768,i,7220697059804610259,8902069821058329173,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\olgeywqojgbytrlj.sysC:\Temp\olgeywqojgbytrlj.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Temp\ljdbvtnljg.sysC:\Temp\ljdbvtnljg.sys1⤵
- Executes dropped EXE
-
C:\Temp\vtnlfdaysq.sysC:\Temp\vtnlfdaysq.sys1⤵
- Executes dropped EXE
-
C:\Temp\ausnkfdxvp.sysC:\Temp\ausnkfdxvp.sys1⤵
- Executes dropped EXE
-
C:\Temp\xvpnkfdxvp.sysC:\Temp\xvpnkfdxvp.sys1⤵
- Executes dropped EXE
-
C:\Temp\rmkhcauspk.sysC:\Temp\rmkhcauspk.sys1⤵
- Executes dropped EXE
-
C:\Temp\pmhfcwupmh.sysC:\Temp\pmhfcwupmh.sys1⤵
- Executes dropped EXE
-
C:\Temp\czurmjzwuo.sysC:\Temp\czurmjzwuo.sys1⤵
- Executes dropped EXE
-
C:\Temp\jebztrljdb.sysC:\Temp\jebztrljdb.sys1⤵
- Executes dropped EXE
-
C:\Temp\bwtoljdbwt.sysC:\Temp\bwtoljdbwt.sys1⤵
- Executes dropped EXE
-
C:\Temp\yvtqlidayv.sysC:\Temp\yvtqlidayv.sys1⤵
- Executes dropped EXE
-
C:\Temp\qligaysqli.sysC:\Temp\qligaysqli.sys1⤵
-
C:\Temp\kifaxsqkif.sysC:\Temp\kifaxsqkif.sys1⤵
-
C:\Temp\kfcxvsmkfc.sysC:\Temp\kfcxvsmkfc.sys1⤵
-
C:\Temp\urpkhcausm.sysC:\Temp\urpkhcausm.sys1⤵
-
C:\Temp\hezwupmkhc.sysC:\Temp\hezwupmkhc.sys1⤵
-
C:\Temp\jebwuomgez.sysC:\Temp\jebwuomgez.sys1⤵
-
C:\Temp\geywrojgeb.sysC:\Temp\geywrojgeb.sys1⤵
-
C:\Temp\qoigeyvtnl.sysC:\Temp\qoigeyvtnl.sys1⤵
-
C:\Temp\aytqoigdyw.sysC:\Temp\aytqoigdyw.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ausnkfdxvp.sys
ausnkfdxvs.exe
i_ausnkfdxvs.exe
i_ligbyvtnlj.exe
i_nhfzxspkic.exe
i_tnlfdayvqn.exe
i_trljdbwtrm.exe
ligbyvtnlj.exe
ljdbvtnljg.sys
mkecxupmke.exe
nhfzxspkic.exe
olgeywqojgbytrlj.exe
olgeywqojgbytrlj.sys
rmkhcauspk.sys
tnlfdayvqn.exe
trljdbwtrm.exe
vtnlfdaysq.sys
xvpnkfdxvp.sys
602067c4-2135-47cc-9da2-2a496edd0ca7.tmp
63a363dc-3a4f-41df-8bfa-24b83a560564.tmp
7836e6ce-4b0d-418c-be72-7def128a8a77.tmp
settings.dat
settings.dat
10c84fc4-dcfa-47e0-a1f0-910baa614ce6.tmp
37e0b29f-84c9-4e88-b6e1-9e0598c88021.tmp
479a5a32-7012-4056-aa02-cd8c14682fc5.tmp
6de9aeff-01aa-47e2-b011-d081a4a25552.tmp
temp-index
the-real-index
46c34674-3f65-4598-b1b0-995fcd85dad5.tmp
dasherSettingSchema.json
263a7166-4148-4016-841b-79509dee4281.tmp
2b6ead25-4b3a-4d9f-87fb-9c2053b86a3e.tmp
c1c0fde1-9275-4e3a-aed7-8501b5a31d52.tmp
f73cf341-3dd7-44f0-90a8-9f9f7f88f7b5.tmp
cfd40e9e-f45c-4e35-a262-bf5319da5299.tmp
af35458a-a8b8-4853-80e3-26815361115a.tmp
052aae38-b66f-44ca-9384-0d0ce0de9a56.tmp
0c025a5f-ca14-4926-947d-736c3dea677e.tmp
4ab97639-d853-4f2d-9226-25fa5eeeb7d9.tmp
5c25bded-590a-4c48-8829-51e0616f11fb.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
738235ae-0f46-4f41-a025-0120c412d2bf.tmp
eacb4b53-5c19-49c8-bf92-c1ce3753ab69.tmp
f0bbb802-c862-4d04-86b1-093e5417e1fe.tmp
ff285b51-1383-4baf-bf8b-af7e1005add9.tmp
298c780c-c50a-4316-956d-5183632978ae.tmp
6f95ed30-0c39-47fd-bfa6-edcde6c18af8.tmp
messages.json
content.js
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/1404-658-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2408-748-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2408-726-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2488-564-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2496-586-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2536-644-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2796-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3416-537-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3436-751-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3644-682-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3884-616-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4188-524-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4352-434-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4772-670-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5076-580-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5292-702-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5376-707-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5404-512-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5564-484-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5880-746-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6092-560-0x0000000000010000-0x00000000000AB000-memory.dmp