Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/10/2026, 01:01
General
- Target 2026-10-22_ab8e6a89f0313f6f922c739d089c239f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 365KB
- Sample261024-bdj5bs1ybs
- SHA256 af99667f26b327c3828f2dec3adb73aa2656d5fef2eafac14bc25adb2f55ff28
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_ab8e6a89f0313f6f922c739d089c239f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_ab8e6a89f0313f6f922c739d089c239f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\gavtnlgdbqlidbvt.exeC:\Temp\gavtnlgdbqlidbvt.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dxvqoigdyv.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\dxvqoigdyv.exeC:\Temp\dxvqoigdyv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dxvqoigdyv.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dxvqoigdyv.exeC:\Temp\i_dxvqoigdyv.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vsqkigaytn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vsqkigaytn.exeC:\Temp\vsqkigaytn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vsqkigaytn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vsqkigaytn.exeC:\Temp\i_vsqkigaytn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nkicausqki.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nkicausqki.exeC:\Temp\nkicausqki.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nkicausqki.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nkicausqki.exeC:\Temp\i_nkicausqki.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fcxupnhfzu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fcxupnhfzu.exeC:\Temp\fcxupnhfzu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fcxupnhfzu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fcxupnhfzu.exeC:\Temp\i_fcxupnhfzu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\czxrpjhbzu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\czxrpjhbzu.exeC:\Temp\czxrpjhbzu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_czxrpjhbzu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_czxrpjhbzu.exeC:\Temp\i_czxrpjhbzu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\uomgezwrpj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\uomgezwrpj.exeC:\Temp\uomgezwrpj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_uomgezwrpj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_uomgezwrpj.exeC:\Temp\i_uomgezwrpj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omgeywtroj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\omgeywtroj.exeC:\Temp\omgeywtroj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omgeywtroj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_omgeywtroj.exeC:\Temp\i_omgeywtroj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tqoljdbytq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\tqoljdbytq.exeC:\Temp\tqoljdbytq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tqoljdbytq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_tqoljdbytq.exeC:\Temp\i_tqoljdbytq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dyvtoigayw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dyvtoigayw.exeC:\Temp\dyvtoigayw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dyvtoigayw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dyvtoigayw.exeC:\Temp\i_dyvtoigayw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bvtqlidayv.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bvtqlidayv.exeC:\Temp\bvtqlidayv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bvtqlidayv.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bvtqlidayv.exeC:\Temp\i_bvtqlidayv.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\avpnlfaysq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\avpnlfaysq.exeC:\Temp\avpnlfaysq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_avpnlfaysq.exe ups_ins3⤵
-
C:\Temp\i_avpnlfaysq.exeC:\Temp\i_avpnlfaysq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vsnkfdxusm.exe ups_run3⤵
-
C:\Temp\vsnkfdxusm.exeC:\Temp\vsnkfdxusm.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vsnkfdxusm.exe ups_ins3⤵
-
C:\Temp\i_vsnkfdxusm.exeC:\Temp\i_vsnkfdxusm.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ausmkeczus.exe ups_run3⤵
-
C:\Temp\ausmkeczus.exeC:\Temp\ausmkeczus.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ausmkeczus.exe ups_ins3⤵
-
C:\Temp\i_ausmkeczus.exeC:\Temp\i_ausmkeczus.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxrpkeczur.exe ups_run3⤵
-
C:\Temp\zxrpkeczur.exeC:\Temp\zxrpkeczur.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxrpkeczur.exe ups_ins3⤵
-
C:\Temp\i_zxrpkeczur.exeC:\Temp\i_zxrpkeczur.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wromjebzwu.exe ups_run3⤵
-
C:\Temp\wromjebzwu.exeC:\Temp\wromjebzwu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wromjebzwu.exe ups_ins3⤵
-
C:\Temp\i_wromjebzwu.exeC:\Temp\i_wromjebzwu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bytrljdbzt.exe ups_run3⤵
-
C:\Temp\bytrljdbzt.exeC:\Temp\bytrljdbzt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bytrljdbzt.exe ups_ins3⤵
-
C:\Temp\i_bytrljdbzt.exeC:\Temp\i_bytrljdbzt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gwtolgdbvq.exe ups_run3⤵
-
C:\Temp\gwtolgdbvq.exeC:\Temp\gwtolgdbvq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gwtolgdbvq.exe ups_ins3⤵
-
C:\Temp\i_gwtolgdbvq.exeC:\Temp\i_gwtolgdbvq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ayvqligbyt.exe ups_run3⤵
-
C:\Temp\ayvqligbyt.exeC:\Temp\ayvqligbyt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ayvqligbyt.exe ups_ins3⤵
-
C:\Temp\i_ayvqligbyt.exeC:\Temp\i_ayvqligbyt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fayvqnlfdx.exe ups_run3⤵
-
C:\Temp\fayvqnlfdx.exeC:\Temp\fayvqnlfdx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fayvqnlfdx.exe ups_ins3⤵
-
C:\Temp\i_fayvqnlfdx.exeC:\Temp\i_fayvqnlfdx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\daysqkicav.exe ups_run3⤵
-
C:\Temp\daysqkicav.exeC:\Temp\daysqkicav.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7fff8cc8c188,0x7fff8cc8c194,0x7fff8cc8c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,17439600576634861686,413916699239293680,524288 --field-trial-handle=2300,i,11792155702581982722,12844770492330908112,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,2189837778319803695,1682093331938517119,524288 --field-trial-handle=2300,i,11792155702581982722,12844770492330908112,262144 --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,1136441622908683431,2791312691350350163,262144 --field-trial-handle=2300,i,11792155702581982722,12844770492330908112,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,6701681936691943371,1351961043002331569,2097152 --field-trial-handle=2300,i,11792155702581982722,12844770492330908112,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,17600452688088703157,6588285563510281248,2097152 --field-trial-handle=2300,i,11792155702581982722,12844770492330908112,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4356,i,17910555562942496546,10980935255062757529,2097152 --field-trial-handle=2300,i,11792155702581982722,12844770492330908112,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4364,i,615897294208436621,705955073097111251,2097152 --field-trial-handle=2300,i,11792155702581982722,12844770492330908112,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3780,i,17305210456353601084,12011392525626290795,524288 --field-trial-handle=2300,i,11792155702581982722,12844770492330908112,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,1363360003021827741,9256746079995334079,524288 --field-trial-handle=2300,i,11792155702581982722,12844770492330908112,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3788,i,11190828300939392426,349501564724096474,524288 --field-trial-handle=2300,i,11792155702581982722,12844770492330908112,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,10201475272781432095,4373226824526673356,524288 --field-trial-handle=2300,i,11792155702581982722,12844770492330908112,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,10201475272781432095,4373226824526673356,524288 --field-trial-handle=2300,i,11792155702581982722,12844770492330908112,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,3736531863338542321,16768267786051006441,524288 --field-trial-handle=2300,i,11792155702581982722,12844770492330908112,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,8286514367323544444,18304525735935889973,524288 --field-trial-handle=2300,i,11792155702581982722,12844770492330908112,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,17122000797395211069,621267917172409319,524288 --field-trial-handle=2300,i,11792155702581982722,12844770492330908112,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,11695759555437249976,8686224604535989131,524288 --field-trial-handle=2300,i,11792155702581982722,12844770492330908112,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,6483180636144354215,1281044176806100818,524288 --field-trial-handle=2300,i,11792155702581982722,12844770492330908112,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,11864887999421613884,9025960171712996960,524288 --field-trial-handle=2300,i,11792155702581982722,12844770492330908112,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,11335990279729310478,5398061456403252918,524288 --field-trial-handle=2300,i,11792155702581982722,12844770492330908112,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2828,i,5275577158437099188,10687697622235034898,524288 --field-trial-handle=2300,i,11792155702581982722,12844770492330908112,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,13486972196827471117,10147343941813069849,524288 --field-trial-handle=2300,i,11792155702581982722,12844770492330908112,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,13023168982673481679,7350915802729164511,524288 --field-trial-handle=2300,i,11792155702581982722,12844770492330908112,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,4942887052798316181,995669059285765820,524288 --field-trial-handle=2300,i,11792155702581982722,12844770492330908112,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,1224241784993644612,12805430614442229927,524288 --field-trial-handle=2300,i,11792155702581982722,12844770492330908112,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6248,i,9295113666881356467,8933318188717913801,262144 --field-trial-handle=2300,i,11792155702581982722,12844770492330908112,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,2910411481799709758,11026038335368952166,524288 --field-trial-handle=2300,i,11792155702581982722,12844770492330908112,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\gavtnlgdbqlidbvt.sysC:\Temp\gavtnlgdbqlidbvt.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\xvqnlfdxvt.sysC:\Temp\xvqnlfdxvt.sys1⤵
- Executes dropped EXE
-
C:\Temp\pnkfaxvsnk.sysC:\Temp\pnkfaxvsnk.sys1⤵
- Executes dropped EXE
-
C:\Temp\icausmkica.sysC:\Temp\icausmkica.sys1⤵
- Executes dropped EXE
-
C:\Temp\khfzxrpmkh.sysC:\Temp\khfzxrpmkh.sys1⤵
- Executes dropped EXE
-
C:\Temp\rmjhfzxrpj.sysC:\Temp\rmjhfzxrpj.sys1⤵
- Executes dropped EXE
-
C:\Temp\omgebwuomj.sysC:\Temp\omgebwuomj.sys1⤵
- Executes dropped EXE
-
C:\Temp\rojgeyvtro.sysC:\Temp\rojgeyvtro.sys1⤵
- Executes dropped EXE
-
C:\Temp\lgebwqoigb.sysC:\Temp\lgebwqoigb.sys1⤵
- Executes dropped EXE
-
C:\Temp\fdbvtnlfdb.sysC:\Temp\fdbvtnlfdb.sys1⤵
- Executes dropped EXE
-
C:\Temp\aysqkicavs.sysC:\Temp\aysqkicavs.sys1⤵
- Executes dropped EXE
-
C:\Temp\auspkicaxs.sysC:\Temp\auspkicaxs.sys1⤵
-
C:\Temp\fcxusmkhfz.sysC:\Temp\fcxusmkhfz.sys1⤵
-
C:\Temp\czurmjhczx.sysC:\Temp\czurmjhczx.sys1⤵
-
C:\Temp\wuomjhbztr.sysC:\Temp\wuomjhbztr.sys1⤵
-
C:\Temp\ebztrljeyw.sysC:\Temp\ebztrljeyw.sys1⤵
-
C:\Temp\igbywqojgb.sysC:\Temp\igbywqojgb.sys1⤵
-
C:\Temp\gdyvqolgdy.sysC:\Temp\gdyvqolgdy.sys1⤵
-
C:\Temp\lfdxvqniga.sysC:\Temp\lfdxvqniga.sys1⤵
-
C:\Temp\ifayvpnkav.sysC:\Temp\ifayvpnkav.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
czxrpjhbzu.exe
dxvqoigdyv.exe
fcxupnhfzu.exe
gavtnlgdbqlidbvt.exe
gavtnlgdbqlidbvt.sys
i_czxrpjhbzu.exe
i_dxvqoigdyv.exe
i_fcxupnhfzu.exe
i_nkicausqki.exe
i_vsqkigaytn.exe
icausmkica.sys
khfzxrpmkh.sys
nkicausqki.exe
pnkfaxvsnk.sys
rmjhfzxrpj.sys
uomgezwrpj.exe
vsqkigaytn.exe
xvqnlfdxvt.sys
0f68f759-e6e2-4744-bf72-e3851ae8b083.tmp
61f0efa2-daae-4f55-a5f9-20437a30f335.tmp
83d1b615-9e3a-479c-8354-c0a7ce9904bf.tmp
settings.dat
settings.dat
05fd6e77-a791-4f7d-8bb4-b035d05e1531.tmp
149d8023-0c77-456c-995e-8312fa99d784.tmp
346fae64-9c43-4dd7-a679-8a5241c5208a.tmp
6c84f036-c56e-4e09-a478-c6f88c1764ec.tmp
792963b8-c55f-4ebb-b00c-505a02c00450.tmp
LOG.old
temp-index
the-real-index
99e00aea-bca6-4de2-9145-f1923b061949.tmp
dasherSettingSchema.json
68f87235-9645-4681-9e3d-dbc9cd0db4c8.tmp
879892c8-5b7b-4359-be41-cb29746396ae.tmp
bf6ae621-7f7d-424d-ae1d-6fe9d4e4d2cd.tmp
sync_diagnostic.log
b9179b36-8aab-483a-acb5-3a70010b9f34.tmp
d5fae1c3-d133-4c3d-8024-146ddea8d5f7.tmp
a9cf425b-d87f-48b9-b6c9-d95cd5a57cbc.tmp
b511e002-2c7d-4796-bb70-938a8eb3e1c7.tmp
cfedd691-14ba-46ac-85f4-08c3eba10808.tmp
8d24d15d-8899-4b8c-8475-a8fe995078da.tmp
a3c0df63-361f-4847-b1df-13219b2c2ca3.tmp
e07dc84a-7cc8-496d-9020-91b8caf8ab45.tmp
1cf944e4-de1b-439b-9512-1059fdf7f42b.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
metadata.json
a735db05-e46f-4156-a108-554b3afb9bd3.tmp
abd9c9c9-ba1c-46d9-a91c-1d83918374c2.tmp
messages.json
content.js
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/1052-481-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1052-515-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1340-612-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2288-698-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2528-724-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2800-534-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3044-720-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3104-566-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3120-694-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3524-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3732-562-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3748-509-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4272-662-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4936-558-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5252-682-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5468-582-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5476-646-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5476-742-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5488-522-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5976-624-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6096-432-0x0000000000010000-0x00000000000AB000-memory.dmp