Analysis
- max time kernel
149s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/10/2026, 04:22
General
- Target 2026-10-22_93d9f2428fd760df257fd2b740d2fa05_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 365KB
- Sample261024-ezqqsaec35
- SHA256 67771ced865de86f64f1dbcbb396363a01dc71d90bd5f1d760afe3d9b48da7b2
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_93d9f2428fd760df257fd2b740d2fa05_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_93d9f2428fd760df257fd2b740d2fa05_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\upmhfzxrpkhczusm.exeC:\Temp\upmhfzxrpkhczusm.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\urpjhfzusm.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\urpjhfzusm.exeC:\Temp\urpjhfzusm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_urpjhfzusm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_urpjhfzusm.exeC:\Temp\i_urpjhfzusm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpjhbzurmj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rpjhbzurmj.exeC:\Temp\rpjhbzurmj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpjhbzurmj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rpjhbzurmj.exeC:\Temp\i_rpjhbzurmj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bwtrojgebw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bwtrojgebw.exeC:\Temp\bwtrojgebw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bwtrojgebw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bwtrojgebw.exeC:\Temp\i_bwtrojgebw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jgbztrljdb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jgbztrljdb.exeC:\Temp\jgbztrljdb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jgbztrljdb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jgbztrljdb.exeC:\Temp\i_jgbztrljdb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nlgdywqoig.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nlgdywqoig.exeC:\Temp\nlgdywqoig.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nlgdywqoig.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nlgdywqoig.exeC:\Temp\i_nlgdywqoig.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvtnlfdysq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xvtnlfdysq.exeC:\Temp\xvtnlfdysq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xvtnlfdysq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xvtnlfdysq.exeC:\Temp\i_xvtnlfdysq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\snkfcxvpnh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\snkfcxvpnh.exeC:\Temp\snkfcxvpnh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_snkfcxvpnh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_snkfcxvpnh.exeC:\Temp\i_snkfcxvpnh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ausmkfcxup.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ausmkfcxup.exeC:\Temp\ausmkfcxup.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ausmkfcxup.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ausmkfcxup.exeC:\Temp\i_ausmkfcxup.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mkecxupnhf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mkecxupnhf.exeC:\Temp\mkecxupnhf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mkecxupnhf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mkecxupnhf.exeC:\Temp\i_mkecxupnhf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wurmjecwuo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wurmjecwuo.exeC:\Temp\wurmjecwuo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wurmjecwuo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wurmjecwuo.exeC:\Temp\i_wurmjecwuo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\uomgezwroj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\uomgezwroj.exeC:\Temp\uomgezwroj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_uomgezwroj.exe ups_ins3⤵
-
C:\Temp\i_uomgezwroj.exeC:\Temp\i_uomgezwroj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wtrljdbwto.exe ups_run3⤵
-
C:\Temp\wtrljdbwto.exeC:\Temp\wtrljdbwto.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wtrljdbwto.exe ups_ins3⤵
-
C:\Temp\i_wtrljdbwto.exeC:\Temp\i_wtrljdbwto.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ytqoigdbvt.exe ups_run3⤵
-
C:\Temp\ytqoigdbvt.exeC:\Temp\ytqoigdbvt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ytqoigdbvt.exe ups_ins3⤵
-
C:\Temp\i_ytqoigdbvt.exeC:\Temp\i_ytqoigdbvt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\yvtnlfdyvq.exe ups_run3⤵
-
C:\Temp\yvtnlfdyvq.exeC:\Temp\yvtnlfdyvq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_yvtnlfdyvq.exe ups_ins3⤵
-
C:\Temp\i_yvtnlfdyvq.exeC:\Temp\i_yvtnlfdyvq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vsnlfdxvqn.exe ups_run3⤵
-
C:\Temp\vsnlfdxvqn.exeC:\Temp\vsnlfdxvqn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vsnlfdxvqn.exe ups_ins3⤵
-
C:\Temp\i_vsnlfdxvqn.exeC:\Temp\i_vsnlfdxvqn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xspnhfdxvp.exe ups_run3⤵
-
C:\Temp\xspnhfdxvp.exeC:\Temp\xspnhfdxvp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xspnhfdxvp.exe ups_ins3⤵
-
C:\Temp\i_xspnhfdxvp.exeC:\Temp\i_xspnhfdxvp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mkecxusmke.exe ups_run3⤵
-
C:\Temp\mkecxusmke.exeC:\Temp\mkecxusmke.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mkecxusmke.exe ups_ins3⤵
-
C:\Temp\i_mkecxusmke.exeC:\Temp\i_mkecxusmke.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhbzxrpmke.exe ups_run3⤵
-
C:\Temp\jhbzxrpmke.exeC:\Temp\jhbzxrpmke.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhbzxrpmke.exe ups_ins3⤵
-
C:\Temp\i_jhbzxrpmke.exeC:\Temp\i_jhbzxrpmke.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wurmjwuomg.exe ups_run3⤵
-
C:\Temp\wurmjwuomg.exeC:\Temp\wurmjwuomg.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wurmjwuomg.exe ups_ins3⤵
-
C:\Temp\i_wurmjwuomg.exeC:\Temp\i_wurmjwuomg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ezwromgeyw.exe ups_run3⤵
-
C:\Temp\ezwromgeyw.exeC:\Temp\ezwromgeyw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff86541c188,0x7ff86541c194,0x7ff86541c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,3489366004393004634,6318431547696632446,262144 --field-trial-handle=2560,i,9183741077490555230,5306358472685778927,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,6092181532154481651,14990908367982151008,524288 --field-trial-handle=2560,i,9183741077490555230,5306358472685778927,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2224,i,5734494362542007406,13124269574957318372,524288 --field-trial-handle=2560,i,9183741077490555230,5306358472685778927,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3540,i,3048567273005958957,18262548156000369972,2097152 --field-trial-handle=2560,i,9183741077490555230,5306358472685778927,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,17167498297590679519,9725201495840667103,2097152 --field-trial-handle=2560,i,9183741077490555230,5306358472685778927,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,13246187714674775037,16465839772960601561,2097152 --field-trial-handle=2560,i,9183741077490555230,5306358472685778927,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,12022271448132153193,8398769869615754247,2097152 --field-trial-handle=2560,i,9183741077490555230,5306358472685778927,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,7848150813681046186,498738274075706167,524288 --field-trial-handle=2560,i,9183741077490555230,5306358472685778927,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,153723254918274681,16300089841746155679,524288 --field-trial-handle=2560,i,9183741077490555230,5306358472685778927,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,5567945211540422515,8710698855991143232,524288 --field-trial-handle=2560,i,9183741077490555230,5306358472685778927,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,11704317981918131578,16943821170623471772,524288 --field-trial-handle=2560,i,9183741077490555230,5306358472685778927,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,11704317981918131578,16943821170623471772,524288 --field-trial-handle=2560,i,9183741077490555230,5306358472685778927,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,15450579072502540961,8533377329444576366,524288 --field-trial-handle=2560,i,9183741077490555230,5306358472685778927,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,17725744860397340985,2275641112999568602,524288 --field-trial-handle=2560,i,9183741077490555230,5306358472685778927,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,5811505463848604798,16831279741970647430,524288 --field-trial-handle=2560,i,9183741077490555230,5306358472685778927,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,7589969276717321909,3400446858965026967,524288 --field-trial-handle=2560,i,9183741077490555230,5306358472685778927,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,3315972867086073327,16682325056139642170,524288 --field-trial-handle=2560,i,9183741077490555230,5306358472685778927,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4700,i,11997392935997308962,17162093627615522571,524288 --field-trial-handle=2560,i,9183741077490555230,5306358472685778927,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,6708669408605335807,13016446607773832957,524288 --field-trial-handle=2560,i,9183741077490555230,5306358472685778927,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,17321168022061801165,12440329589949501873,524288 --field-trial-handle=2560,i,9183741077490555230,5306358472685778927,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,1513190655439410415,12817796363239566510,524288 --field-trial-handle=2560,i,9183741077490555230,5306358472685778927,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3408,i,17133680051659607108,15333172809967368052,524288 --field-trial-handle=2560,i,9183741077490555230,5306358472685778927,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,13169180965571059784,8024655791772483274,524288 --field-trial-handle=2560,i,9183741077490555230,5306358472685778927,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6084,i,6391812950800454915,8637849586395048373,262144 --field-trial-handle=2560,i,9183741077490555230,5306358472685778927,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,11907539518402366817,12046872353911987574,524288 --field-trial-handle=2560,i,9183741077490555230,5306358472685778927,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\upmhfzxrpkhczusm.sysC:\Temp\upmhfzxrpkhczusm.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\rpjhbztrpm.sysC:\Temp\rpjhbztrpm.sys1⤵
- Executes dropped EXE
-
C:\Temp\hbzwromjeb.sysC:\Temp\hbzwromjeb.sys1⤵
- Executes dropped EXE
-
C:\Temp\lgdbwtomge.sysC:\Temp\lgdbwtomge.sys1⤵
- Executes dropped EXE
-
C:\Temp\sqligaytqo.sysC:\Temp\sqligaytqo.sys1⤵
- Executes dropped EXE
-
C:\Temp\daysqkfdav.sysC:\Temp\daysqkfdav.sys1⤵
- Executes dropped EXE
-
C:\Temp\xvtnkifdxv.sysC:\Temp\xvtnkifdxv.sys1⤵
- Executes dropped EXE
-
C:\Temp\ausnkfdxvp.sysC:\Temp\ausnkfdxvp.sys1⤵
- Executes dropped EXE
-
C:\Temp\pnhfcwusmk.sysC:\Temp\pnhfcwusmk.sys1⤵
- Executes dropped EXE
-
C:\Temp\bzurmkebwu.sysC:\Temp\bzurmkebwu.sys1⤵
- Executes dropped EXE
-
C:\Temp\bztrmjhbzt.sysC:\Temp\bztrmjhbzt.sys1⤵
- Executes dropped EXE
-
C:\Temp\wtrljgeywq.sysC:\Temp\wtrljgeywq.sys1⤵
-
C:\Temp\bytqljdbvt.sysC:\Temp\bytqljdbvt.sys1⤵
-
C:\Temp\dbvtnlfdav.sysC:\Temp\dbvtnlfdav.sys1⤵
-
C:\Temp\kidavsnlfd.sysC:\Temp\kidavsnlfd.sys1⤵
-
C:\Temp\avsnlfcxvs.sysC:\Temp\avsnlfcxvs.sys1⤵
-
C:\Temp\spkhfzxspk.sysC:\Temp\spkhfzxspk.sys1⤵
-
C:\Temp\keczurmjhc.sysC:\Temp\keczurmjhc.sys1⤵
-
C:\Temp\urpjhecwur.sysC:\Temp\urpjhecwur.sys1⤵
-
C:\Temp\ebwuomgezw.sysC:\Temp\ebwuomgezw.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
bwtrojgebw.exe
daysqkfdav.sys
hbzwromjeb.sys
i_bwtrojgebw.exe
i_jgbztrljdb.exe
i_nlgdywqoig.exe
i_rpjhbzurmj.exe
i_urpjhfzusm.exe
jgbztrljdb.exe
lgdbwtomge.sys
nlgdywqoig.exe
rpjhbztrpm.sys
rpjhbzurmj.exe
sqligaytqo.sys
upmhfzxrpkhczusm.exe
upmhfzxrpkhczusm.sys
urpjhfzusm.exe
xvtnlfdysq.exe
1b801c33-dd15-4eb7-afd8-c1612842d552.tmp
51f7faa6-5f3e-4bdc-b462-9c381b1fb306.tmp
68df0319-c867-4c56-89ea-c28d852ae79b.tmp
6a3e1f90-e3f2-4355-900d-67bd87039eed.tmp
7c60ffc0-ebbe-403d-9a78-1677b0a5bd04.tmp
settings.dat
settings.dat
748ab564-d2c7-4a51-b902-9dd81f6b6af5.tmp
7c902cea-559e-44d0-b599-48be9f304cb6.tmp
temp-index
the-real-index
67e7337d-5344-4e2e-9fa1-70ec209e1f2f.tmp
dasherSettingSchema.json
89437e9e-3499-4f8d-8e60-cf449c66eb17.tmp
9e422a36-0e31-42dc-bdc8-5ba9efd9c2a3.tmp
f7b81efb-1429-48dc-b86e-8cb826a6bfd1.tmp
c058df42-b32e-482c-b0ac-3739ef2767db.tmp
e204982c-ed94-46eb-8f7f-4761bfa44d77.tmp
e8ce6356-00a7-4373-9027-c4c5f00b029e.tmp
6f024a30-296d-4055-8a36-e17d4e08d97c.tmp
OperationConfig
44ac3ec4-a571-4952-a6e0-f3adbe2814d7.tmp
46775c28-48a4-4c60-9f7c-d248b8545248.tmp
545cb50e-1cbe-4caa-afd3-37d449b5a7de.tmp
c74e8f80-bbe2-4fe8-b446-8501ad7b56df.tmp
d203af64-8278-41e3-b955-aeb1cd18ddf1.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
ede16aeb-5222-4c0a-933b-6ff448974530.tmp
metadata.json
58f779af-e8fd-403f-b5cb-21aa9ef3ae4f.tmp
ee68f64f-ecbf-49c8-8432-c4080eba569e.tmp
content.js
messages.json
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/1624-746-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2016-722-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2068-640-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2160-534-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2256-699-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2340-578-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2372-64-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2420-612-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3080-742-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3080-747-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3828-583-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3968-678-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4516-562-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4884-527-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4884-508-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5056-679-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5056-666-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5064-718-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5416-432-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5628-654-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5684-520-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5736-481-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5832-558-0x0000000000010000-0x00000000000AB000-memory.dmp