Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
27/10/2026, 03:58
General
- Target 2026-10-26_e6ba49761cf756a383d60a665d8b117f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 365KB
- Sample261027-ejhegax17q
- SHA256 a71ff2457f6e9684703d4468975ea91f4a4cfd38728219bf1d7bc16ee836e2f8
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_e6ba49761cf756a383d60a665d8b117f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-26_e6ba49761cf756a383d60a665d8b117f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\lfdytqljdbykiday.exeC:\Temp\lfdytqljdbykiday.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdavtqlfdy.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\fdavtqlfdy.exeC:\Temp\fdavtqlfdy.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdavtqlfdy.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fdavtqlfdy.exeC:\Temp\i_fdavtqlfdy.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kidavsqnia.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kidavsqnia.exeC:\Temp\kidavsqnia.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kidavsqnia.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kidavsqnia.exeC:\Temp\i_kidavsqnia.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqkifayspk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\sqkifayspk.exeC:\Temp\sqkifayspk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqkifayspk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_sqkifayspk.exeC:\Temp\i_sqkifayspk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\causmkecxr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\causmkecxr.exeC:\Temp\causmkecxr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_causmkecxr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_causmkecxr.exeC:\Temp\i_causmkecxr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fzxrpmhfzx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fzxrpmhfzx.exeC:\Temp\fzxrpmhfzx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fzxrpmhfzx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fzxrpmhfzx.exeC:\Temp\i_fzxrpmhfzx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bzxuomjhcw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bzxuomjhcw.exeC:\Temp\bzxuomjhcw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bzxuomjhcw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bzxuomjhcw.exeC:\Temp\i_bzxuomjhcw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jecwtomgey.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jecwtomgey.exeC:\Temp\jecwtomgey.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jecwtomgey.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jecwtomgey.exeC:\Temp\i_jecwtomgey.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdbvtrojgb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jdbvtrojgb.exeC:\Temp\jdbvtrojgb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdbvtrojgb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jdbvtrojgb.exeC:\Temp\i_jdbvtrojgb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdysqoigav.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jdysqoigav.exeC:\Temp\jdysqoigav.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdysqoigav.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jdysqoigav.exeC:\Temp\i_jdysqoigav.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ifdyvqolgd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ifdyvqolgd.exeC:\Temp\ifdyvqolgd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ifdyvqolgd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ifdyvqolgd.exeC:\Temp\i_ifdyvqolgd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lfdavsnlfd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lfdavsnlfd.exeC:\Temp\lfdavsnlfd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lfdavsnlfd.exe ups_ins3⤵
-
C:\Temp\i_lfdavsnlfd.exeC:\Temp\i_lfdavsnlfd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fcausnhfdx.exe ups_run3⤵
-
C:\Temp\fcausnhfdx.exeC:\Temp\fcausnhfdx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fcausnhfdx.exe ups_ins3⤵
-
C:\Temp\i_fcausnhfdx.exeC:\Temp\i_fcausnhfdx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\czuspjhecx.exe ups_run3⤵
-
C:\Temp\czuspjhecx.exeC:\Temp\czuspjhecx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_czuspjhecx.exe ups_ins3⤵
-
C:\Temp\i_czuspjhecx.exeC:\Temp\i_czuspjhecx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mkecwusmke.exe ups_run3⤵
-
C:\Temp\mkecwusmke.exeC:\Temp\mkecwusmke.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mkecwusmke.exe ups_ins3⤵
-
C:\Temp\i_mkecwusmke.exeC:\Temp\i_mkecwusmke.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpjhbztrpm.exe ups_run3⤵
-
C:\Temp\rpjhbztrpm.exeC:\Temp\rpjhbztrpm.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpjhbztrpm.exe ups_ins3⤵
-
C:\Temp\i_rpjhbztrpm.exeC:\Temp\i_rpjhbztrpm.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wqomgebytq.exe ups_run3⤵
-
C:\Temp\wqomgebytq.exeC:\Temp\wqomgebytq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wqomgebytq.exe ups_ins3⤵
-
C:\Temp\i_wqomgebytq.exeC:\Temp\i_wqomgebytq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\geywqojdtr.exe ups_run3⤵
-
C:\Temp\geywqojdtr.exeC:\Temp\geywqojdtr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_geywqojdtr.exe ups_ins3⤵
-
C:\Temp\i_geywqojdtr.exeC:\Temp\i_geywqojdtr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dyvqoigays.exe ups_run3⤵
-
C:\Temp\dyvqoigays.exeC:\Temp\dyvqoigays.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dyvqoigays.exe ups_ins3⤵
-
C:\Temp\i_dyvqoigays.exeC:\Temp\i_dyvqoigays.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dayvpnlfdx.exe ups_run3⤵
-
C:\Temp\dayvpnlfdx.exeC:\Temp\dayvpnlfdx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dayvpnlfdx.exe ups_ins3⤵
-
C:\Temp\i_dayvpnlfdx.exeC:\Temp\i_dayvpnlfdx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nifaxspnif.exe ups_run3⤵
-
C:\Temp\nifaxspnif.exeC:\Temp\nifaxspnif.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7fff8cc8c188,0x7fff8cc8c194,0x7fff8cc8c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2120,i,12165991725810097012,10097135586223074168,524288 --field-trial-handle=2528,i,8860386223895132738,3498699237505188769,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1996,i,13746742588027500975,14506325420525233989,262144 --field-trial-handle=2528,i,8860386223895132738,3498699237505188769,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2672,i,2581577092940024607,8273797420591584901,524288 --field-trial-handle=2528,i,8860386223895132738,3498699237505188769,262144 --variations-seed-version --mojo-platform-channel-handle=3188 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,4285528840287054850,12131393270364004317,2097152 --field-trial-handle=2528,i,8860386223895132738,3498699237505188769,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,16546894790138357494,16252514635240583538,2097152 --field-trial-handle=2528,i,8860386223895132738,3498699237505188769,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,9307356620219591329,16287548809556263689,2097152 --field-trial-handle=2528,i,8860386223895132738,3498699237505188769,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,3829639963614698809,1694878999425036683,2097152 --field-trial-handle=2528,i,8860386223895132738,3498699237505188769,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3716,i,11554128038516060957,5635656566807737627,524288 --field-trial-handle=2528,i,8860386223895132738,3498699237505188769,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3756,i,8246310169704289222,841135374589621408,524288 --field-trial-handle=2528,i,8860386223895132738,3498699237505188769,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,15060737540816835085,2486797851476129662,524288 --field-trial-handle=2528,i,8860386223895132738,3498699237505188769,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,9508624090519333937,15397783251422049813,524288 --field-trial-handle=2528,i,8860386223895132738,3498699237505188769,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,9508624090519333937,15397783251422049813,524288 --field-trial-handle=2528,i,8860386223895132738,3498699237505188769,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,13828462591144239298,15732194125382652236,524288 --field-trial-handle=2528,i,8860386223895132738,3498699237505188769,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,16551168664665185422,2044647443741861316,524288 --field-trial-handle=2528,i,8860386223895132738,3498699237505188769,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,1623602242906443331,1813989057622506849,524288 --field-trial-handle=2528,i,8860386223895132738,3498699237505188769,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,3821711690930347645,5298072681646004878,524288 --field-trial-handle=2528,i,8860386223895132738,3498699237505188769,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1296,i,15654811705472039616,18127187747068636478,524288 --field-trial-handle=2528,i,8860386223895132738,3498699237505188769,262144 --variations-seed-version --mojo-platform-channel-handle=1208 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,13945428993219625178,7350481676994947041,524288 --field-trial-handle=2528,i,8860386223895132738,3498699237505188769,262144 --variations-seed-version --mojo-platform-channel-handle=1304 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,18117737425816359126,13459692240979398001,524288 --field-trial-handle=2528,i,8860386223895132738,3498699237505188769,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,5844434231526010089,5376349039319320618,524288 --field-trial-handle=2528,i,8860386223895132738,3498699237505188769,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,2300149499813856323,7080599036899241264,524288 --field-trial-handle=2528,i,8860386223895132738,3498699237505188769,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,14628669032839115267,6329106504698864348,524288 --field-trial-handle=2528,i,8860386223895132738,3498699237505188769,262144 --variations-seed-version --mojo-platform-channel-handle=1448 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,15868204535335835075,4810958103269104040,524288 --field-trial-handle=2528,i,8860386223895132738,3498699237505188769,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5836,i,14647453713738582530,2211510295291080892,262144 --field-trial-handle=2528,i,8860386223895132738,3498699237505188769,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,3336039422882109457,10256207294234675937,524288 --field-trial-handle=2528,i,8860386223895132738,3498699237505188769,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\lfdytqljdbykiday.sysC:\Temp\lfdytqljdbykiday.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\nlfdavtnlf.sysC:\Temp\nlfdavtnlf.sys1⤵
- Executes dropped EXE
-
C:\Temp\xusnkfdavs.sysC:\Temp\xusnkfdavs.sys1⤵
- Executes dropped EXE
-
C:\Temp\axspkicaus.sysC:\Temp\axspkicaus.sys1⤵
- Executes dropped EXE
-
C:\Temp\khfzxrpkhf.sysC:\Temp\khfzxrpkhf.sys1⤵
- Executes dropped EXE
-
C:\Temp\ecwuomkecz.sysC:\Temp\ecwuomkecz.sys1⤵
- Executes dropped EXE
-
C:\Temp\hbztrlgebw.sysC:\Temp\hbztrlgebw.sys1⤵
- Executes dropped EXE
-
C:\Temp\ljdbvtolge.sysC:\Temp\ljdbvtolge.sys1⤵
- Executes dropped EXE
-
C:\Temp\qolgdbvtqo.sysC:\Temp\qolgdbvtqo.sys1⤵
- Executes dropped EXE
-
C:\Temp\nlfdyvqoig.sysC:\Temp\nlfdyvqoig.sys1⤵
- Executes dropped EXE
-
C:\Temp\ifaxvtnkic.sysC:\Temp\ifaxvtnkic.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfdxvpnhfa.sysC:\Temp\hfdxvpnhfa.sys1⤵
-
C:\Temp\khcaxspnkf.sysC:\Temp\khcaxspnkf.sys1⤵
-
C:\Temp\khbzxrpmhf.sysC:\Temp\khbzxrpmhf.sys1⤵
-
C:\Temp\xromgezwrp.sysC:\Temp\xromgezwrp.sys1⤵
-
C:\Temp\ebwuoebztr.sysC:\Temp\ebwuoebztr.sys1⤵
-
C:\Temp\eywtrljdbz.sysC:\Temp\eywtrljdbz.sys1⤵
-
C:\Temp\gdywqoigby.sysC:\Temp\gdywqoigby.sys1⤵
-
C:\Temp\daysqoifdx.sysC:\Temp\daysqoifdx.sys1⤵
-
C:\Temp\sqkicavsnl.sysC:\Temp\sqkicavsnl.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
axspkicaus.sys
bzxuomjhcw.exe
causmkecxr.exe
ecwuomkecz.sys
fdavtqlfdy.exe
fzxrpmhfzx.exe
i_causmkecxr.exe
i_fdavtqlfdy.exe
i_fzxrpmhfzx.exe
i_kidavsqnia.exe
i_sqkifayspk.exe
khfzxrpkhf.sys
kidavsqnia.exe
lfdytqljdbykiday.exe
lfdytqljdbykiday.sys
nlfdavtnlf.sys
sqkifayspk.exe
xusnkfdavs.sys
0086806f-2c49-432c-bbee-60daecf9496d.tmp
43c005ef-675c-4b37-8d65-96ad689eeef3.tmp
95e0f6b7-d4d3-427f-abeb-c40205e8da30.tmp
settings.dat
settings.dat
333b5a69-847c-49a9-af42-0db485dac739.tmp
41528979-f83d-47a7-a8c5-d3e8e527ea58.tmp
438ae5e1-3037-412c-9600-4a564e6e196f.tmp
9ee29dd2-d6db-4bbd-b4f3-cb9a05a72a5f.tmp
temp-index
the-real-index
0a453723-7f85-4e26-b465-8dd7eceff3dc.tmp
dasherSettingSchema.json
98fa5f7c-851f-416f-b03f-a7d6db950334.tmp
SCT Auditing Pending Reports
a7db2594-201c-42ff-b7d2-18be4f701614.tmp
sync_diagnostic.log
a4c304c6-bda2-4beb-ad9d-639fdece38b9.tmp
e236c379-828a-46eb-ae41-24e7caedfa64.tmp
9b912647-ebdc-4b6c-88d1-8545c5e00f52.tmp
OperationConfig
aa611eb6-caa9-4d35-adcc-ed475d31b5d7.tmp
c276463a-c7ba-40e6-84e8-5e7f6fb004e6.tmp
13fc07d6-3a65-4ace-81ef-5b36e12aa4f3.tmp
560186d2-413a-4165-9861-f6dc33f80b6d.tmp
68b3017d-6318-4318-82dc-c5e5d5be1030.tmp
d4283909-2b09-4432-b978-8c674627d552.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
ca49e6a5-c525-45d8-9f7a-5d4ff78fb301.tmp
metadata.json
57293b1a-4d07-441c-8031-88c2b9dc681f.tmp
7b7a05c1-59a3-4b91-b0be-f7e45532170c.tmp
messages.json
content.js
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/364-699-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/620-565-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/816-483-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1372-585-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1396-616-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1672-628-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2576-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2684-560-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2820-662-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3176-602-0x0000000000FB0000-0x0000000001010000-memory.dmp
memory/3216-695-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3416-650-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3416-672-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3448-724-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3792-742-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3868-683-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3924-562-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3924-537-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4688-523-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5100-434-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5444-720-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5500-530-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5500-511-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5924-569-0x0000000000010000-0x00000000000AB000-memory.dmp