Analysis
- max time kernel
149s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
27/10/2026, 02:53
General
- Target 2026-10-26_ef4673120638f8a707ee9252a48d297a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 365KB
- Sample261027-ddkrzaaz7l
- SHA256 054770c53550226190e8c752eed9e433fcc72018c25ac887f916f1d15bbd55d9
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_ef4673120638f8a707ee9252a48d297a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-26_ef4673120638f8a707ee9252a48d297a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\pjhbzurmbwuomgez.exeC:\Temp\pjhbzurmbwuomgez.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gezwrpjezu.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\gezwrpjezu.exeC:\Temp\gezwrpjezu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gezwrpjezu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gezwrpjezu.exeC:\Temp\i_gezwrpjezu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trmjeuolge.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\trmjeuolge.exeC:\Temp\trmjeuolge.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trmjeuolge.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_trmjeuolge.exeC:\Temp\i_trmjeuolge.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljdbvtolge.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ljdbvtolge.exeC:\Temp\ljdbvtolge.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljdbvtolge.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ljdbvtolge.exeC:\Temp\i_ljdbvtolge.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\igdbvtqlfd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\igdbvtqlfd.exeC:\Temp\igdbvtqlfd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_igdbvtqlfd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_igdbvtqlfd.exeC:\Temp\i_igdbvtqlfd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\davtnlfdys.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\davtnlfdys.exeC:\Temp\davtnlfdys.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_davtnlfdys.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_davtnlfdys.exeC:\Temp\i_davtnlfdys.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vspnlfdaqk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vspnlfdaqk.exeC:\Temp\vspnlfdaqk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vspnlfdaqk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vspnlfdaqk.exeC:\Temp\i_vspnlfdaqk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\causmkfcxv.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\causmkfcxv.exeC:\Temp\causmkfcxv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_causmkfcxv.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_causmkfcxv.exeC:\Temp\i_causmkfcxv.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\causmkhfcx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\causmkhfcx.exeC:\Temp\causmkhfcx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_causmkhfcx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_causmkhfcx.exeC:\Temp\i_causmkhfcx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wurmjecwup.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wurmjecwup.exeC:\Temp\wurmjecwup.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wurmjecwup.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wurmjecwup.exeC:\Temp\i_wurmjecwup.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ztrmjhbzwr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ztrmjhbzwr.exeC:\Temp\ztrmjhbzwr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ztrmjhbzwr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ztrmjhbzwr.exeC:\Temp\i_ztrmjhbzwr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hbzwtolgeb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hbzwtolgeb.exeC:\Temp\hbzwtolgeb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hbzwtolgeb.exe ups_ins3⤵
-
C:\Temp\i_hbzwtolgeb.exeC:\Temp\i_hbzwtolgeb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gdyvtolgey.exe ups_run3⤵
-
C:\Temp\gdyvtolgey.exeC:\Temp\gdyvtolgey.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gdyvtolgey.exe ups_ins3⤵
-
C:\Temp\i_gdyvtolgey.exeC:\Temp\i_gdyvtolgey.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdyvqnligb.exe ups_run3⤵
-
C:\Temp\fdyvqnligb.exeC:\Temp\fdyvqnligb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdyvqnligb.exe ups_ins3⤵
-
C:\Temp\i_fdyvqnligb.exeC:\Temp\i_fdyvqnligb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lfdxvpnifa.exe ups_run3⤵
-
C:\Temp\lfdxvpnifa.exeC:\Temp\lfdxvpnifa.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lfdxvpnifa.exe ups_ins3⤵
-
C:\Temp\i_lfdxvpnifa.exeC:\Temp\i_lfdxvpnifa.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ausqkicaus.exe ups_run3⤵
-
C:\Temp\ausqkicaus.exeC:\Temp\ausqkicaus.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ausqkicaus.exe ups_ins3⤵
-
C:\Temp\i_ausqkicaus.exeC:\Temp\i_ausqkicaus.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hfzxspkecx.exe ups_run3⤵
-
C:\Temp\hfzxspkecx.exeC:\Temp\hfzxspkecx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hfzxspkecx.exe ups_ins3⤵
-
C:\Temp\i_hfzxspkecx.exeC:\Temp\i_hfzxspkecx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kecwuomkez.exe ups_run3⤵
-
C:\Temp\kecwuomkez.exeC:\Temp\kecwuomkez.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kecwuomkez.exe ups_ins3⤵
-
C:\Temp\i_kecwuomkez.exeC:\Temp\i_kecwuomkez.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpjhbzxrpj.exe ups_run3⤵
-
C:\Temp\rpjhbzxrpj.exeC:\Temp\rpjhbzxrpj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpjhbzxrpj.exe ups_ins3⤵
-
C:\Temp\i_rpjhbzxrpj.exeC:\Temp\i_rpjhbzxrpj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wuomgeywro.exe ups_run3⤵
-
C:\Temp\wuomgeywro.exeC:\Temp\wuomgeywro.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wuomgeywro.exe ups_ins3⤵
-
C:\Temp\i_wuomgeywro.exeC:\Temp\i_wuomgeywro.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wqoigbywqo.exe ups_run3⤵
-
C:\Temp\wqoigbywqo.exeC:\Temp\wqoigbywqo.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x300,0x7ffa4301c188,0x7ffa4301c194,0x7ffa4301c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2096,i,8155980170624005407,4690979609722687213,524288 --field-trial-handle=2496,i,4623678081911777161,14870588532168328489,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1900,i,8542295660707549033,2365385160577204819,262144 --field-trial-handle=2496,i,4623678081911777161,14870588532168328489,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2660,i,17078724581352786640,14855199412198300631,524288 --field-trial-handle=2496,i,4623678081911777161,14870588532168328489,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,10422127494351362157,15161470580063326962,2097152 --field-trial-handle=2496,i,4623678081911777161,14870588532168328489,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,18269775325283853118,6005333670176429532,2097152 --field-trial-handle=2496,i,4623678081911777161,14870588532168328489,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,7012939539759397554,4320626619082045770,2097152 --field-trial-handle=2496,i,4623678081911777161,14870588532168328489,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,13552200423666737073,3077572223400592680,2097152 --field-trial-handle=2496,i,4623678081911777161,14870588532168328489,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,4238470549716884820,14774282094644425762,524288 --field-trial-handle=2496,i,4623678081911777161,14870588532168328489,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,5445941408383348482,4725371270937299149,524288 --field-trial-handle=2496,i,4623678081911777161,14870588532168328489,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3744,i,18105231389553985574,6460491698802595496,524288 --field-trial-handle=2496,i,4623678081911777161,14870588532168328489,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,5532571826248974905,13929438415887699221,524288 --field-trial-handle=2496,i,4623678081911777161,14870588532168328489,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,5532571826248974905,13929438415887699221,524288 --field-trial-handle=2496,i,4623678081911777161,14870588532168328489,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,11271112305930119918,4370057335742844109,524288 --field-trial-handle=2496,i,4623678081911777161,14870588532168328489,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,8257549566500425671,16387915143470035557,524288 --field-trial-handle=2496,i,4623678081911777161,14870588532168328489,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6820,i,12969746759006096475,9509522243099587793,524288 --field-trial-handle=2496,i,4623678081911777161,14870588532168328489,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6848,i,11703243213399520163,16070873732430705972,524288 --field-trial-handle=2496,i,4623678081911777161,14870588532168328489,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1292,i,1624780783511832172,15026226305620070402,524288 --field-trial-handle=2496,i,4623678081911777161,14870588532168328489,262144 --variations-seed-version --mojo-platform-channel-handle=1420 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1296,i,15340849332441284331,8740654579526977942,524288 --field-trial-handle=2496,i,4623678081911777161,14870588532168328489,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1300,i,1929719559961832515,8368202763231542214,524288 --field-trial-handle=2496,i,4623678081911777161,14870588532168328489,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,14316494966502691515,13982371056961262324,524288 --field-trial-handle=2496,i,4623678081911777161,14870588532168328489,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,11772718964826066298,14319358126921634914,524288 --field-trial-handle=2496,i,4623678081911777161,14870588532168328489,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,1060204000967688961,3982679322687171689,524288 --field-trial-handle=2496,i,4623678081911777161,14870588532168328489,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,4077408215481221512,3580537797076028986,524288 --field-trial-handle=2496,i,4623678081911777161,14870588532168328489,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7080,i,13213157086630185920,7751829795591845034,524288 --field-trial-handle=2496,i,4623678081911777161,14870588532168328489,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7048,i,6213992496767675701,14358474684980437699,262144 --field-trial-handle=2496,i,4623678081911777161,14870588532168328489,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6744,i,8339340369500082618,923302566796747977,524288 --field-trial-handle=2496,i,4623678081911777161,14870588532168328489,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\pjhbzurmbwuomgez.sysC:\Temp\pjhbzurmbwuomgez.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\ywrojhbztr.sysC:\Temp\ywrojhbztr.sys1⤵
- Executes dropped EXE
-
C:\Temp\ljdbvtrljg.sysC:\Temp\ljdbvtrljg.sys1⤵
- Executes dropped EXE
-
C:\Temp\ljdbvtqljg.sysC:\Temp\ljdbvtqljg.sys1⤵
- Executes dropped EXE
-
C:\Temp\qligaysqla.sysC:\Temp\qligaysqla.sys1⤵
- Executes dropped EXE
-
C:\Temp\aysqnlfdxv.sysC:\Temp\aysqnlfdxv.sys1⤵
- Executes dropped EXE
-
C:\Temp\caxspkicau.sysC:\Temp\caxspkicau.sys1⤵
- Executes dropped EXE
-
C:\Temp\ecxusmkfcx.sysC:\Temp\ecxusmkfcx.sys1⤵
- Executes dropped EXE
-
C:\Temp\heczxrpmke.sysC:\Temp\heczxrpmke.sys1⤵
- Executes dropped EXE
-
C:\Temp\cwuomkecwu.sysC:\Temp\cwuomkecwu.sys1⤵
- Executes dropped EXE
-
C:\Temp\eywroljdby.sysC:\Temp\eywroljdby.sys1⤵
- Executes dropped EXE
-
C:\Temp\jgaywqoigb.sysC:\Temp\jgaywqoigb.sys1⤵
-
C:\Temp\olgdyvtnli.sysC:\Temp\olgdyvtnli.sys1⤵
-
C:\Temp\nigaysqlid.sysC:\Temp\nigaysqlid.sys1⤵
-
C:\Temp\fdxvpnifax.sysC:\Temp\fdxvpnifax.sys1⤵
-
C:\Temp\fcxvpmkfcx.sysC:\Temp\fcxvpmkfcx.sys1⤵
-
C:\Temp\upnhfzxrpn.sysC:\Temp\upnhfzxrpn.sys1⤵
-
C:\Temp\smkecwurpj.sysC:\Temp\smkecwurpj.sys1⤵
-
C:\Temp\wromgezwro.sysC:\Temp\wromgezwro.sys1⤵
-
C:\Temp\bztrljdbwt.sysC:\Temp\bztrljdbwt.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
aysqnlfdxv.sys
davtnlfdys.exe
gezwrpjezu.exe
i_davtnlfdys.exe
i_gezwrpjezu.exe
i_igdbvtqlfd.exe
i_ljdbvtolge.exe
i_trmjeuolge.exe
igdbvtqlfd.exe
ljdbvtolge.exe
ljdbvtqljg.sys
ljdbvtrljg.sys
pjhbzurmbwuomgez.exe
pjhbzurmbwuomgez.sys
qligaysqla.sys
trmjeuolge.exe
vspnlfdaqk.exe
ywrojhbztr.sys
0c528b48-1522-4203-b153-53c01ffe5d65.tmp
0da747e8-751a-478f-8bf0-0f55745304c7.tmp
141b8427-d082-4b69-826c-a504a939e566.tmp
402cad02-42cd-4979-bd0b-4d2e33dfa51a.tmp
5c84374b-b674-475a-8428-2a7c805118df.tmp
settings.dat
settings.dat
4d69ba8b-89ea-4acc-aac3-6d0fb2c04182.tmp
9fb04eb7-0a08-4f5c-b61a-fe7edbe456a9.tmp
temp-index
994a0b1e-dd46-4bb5-b8ae-03b14c441fd8.tmp
dasherSettingSchema.json
16f12afb-7f3c-4db1-b149-41605bcb54c1.tmp
e17727fb-0ed3-4acb-9624-83a432b65264.tmp
e2486b6d-5725-40ce-b674-7fa4ebea9d30.tmp
sync_diagnostic.log
aad41998-e160-40ea-b506-cc7bb35e9f4b.tmp
cdcf5672-fbf5-4df3-9d63-98b817974cbd.tmp
efeae81d-800d-44a1-85e3-84cce381ba26.tmp
fc868a7e-d5b6-44a4-99f4-7828a3808b9f.tmp
0c8ef27c-6146-4dd5-91c9-af5d55e435e8.tmp
c0f2fd2e-33dc-43ba-b1f8-49511643f8ac.tmp
09c4e50a-55e8-4697-b30f-d7742ed4c7c6.tmp
1ecb76fb-3a16-4f8c-b206-89760cb62660.tmp
97a4f51f-8609-4123-a7aa-d93d98f25e30.tmp
edc74840-1b4e-470b-9954-eac95bc1e9b4.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
b925781d-c7a7-4b91-964a-41b52f6be82d.tmp
f28bedec-cc7f-473a-88b2-88d11e2179df.tmp
71be1cc3-eabd-4193-9dc8-d5a00d46fd1f.tmp
f2ef0583-546f-4ecd-9431-89e498b2907f.tmp
messages.json
content.js
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/400-715-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/616-432-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/712-519-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/744-744-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/988-740-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1448-559-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2744-637-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2856-660-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2864-720-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2916-62-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2916-467-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2928-676-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3156-579-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3512-532-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3772-575-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3840-609-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3840-639-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4476-555-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4504-507-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4616-672-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5256-482-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5720-696-0x0000000000010000-0x00000000000AB000-memory.dmp