Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
27/10/2026, 03:59
General
- Target 2026-10-26_e662e2ad122a07ed3f15b8957d1a4a72_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 365KB
- Sample261027-ekdsnscf52
- SHA256 db093b70eb5b7e0fca1282e4cef82fc2acbcfea1d07f5a5f097d22953c41da83
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_e662e2ad122a07ed3f15b8957d1a4a72_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-26_e662e2ad122a07ed3f15b8957d1a4a72_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\ojhbzwrpjgbzwrom.exeC:\Temp\ojhbzwrpjgbzwrom.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\olgeywtrlg.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\olgeywtrlg.exeC:\Temp\olgeywtrlg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_olgeywtrlg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_olgeywtrlg.exeC:\Temp\i_olgeywtrlg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wqojgbztql.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wqojgbztql.exeC:\Temp\wqojgbztql.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wqojgbztql.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wqojgbztql.exeC:\Temp\i_wqojgbztql.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\yvqlidbvtn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\yvqlidbvtn.exeC:\Temp\yvqlidbvtn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_yvqlidbvtn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_yvqlidbvtn.exeC:\Temp\i_yvqlidbvtn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vsqlidavtn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vsqlidavtn.exeC:\Temp\vsqlidavtn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vsqlidavtn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vsqlidavtn.exeC:\Temp\i_vsqlidavtn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nkfdxvpnhf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nkfdxvpnhf.exeC:\Temp\nkfdxvpnhf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nkfdxvpnhf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nkfdxvpnhf.exeC:\Temp\i_nkfdxvpnhf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xspnkiczxs.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xspnkiczxs.exeC:\Temp\xspnkiczxs.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xspnkiczxs.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xspnkiczxs.exeC:\Temp\i_xspnkiczxs.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cwupmhfzxr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\cwupmhfzxr.exeC:\Temp\cwupmhfzxr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cwupmhfzxr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_cwupmhfzxr.exeC:\Temp\i_cwupmhfzxr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\urmjhbzwrp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\urmjhbzwrp.exeC:\Temp\urmjhbzwrp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_urmjhbzwrp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_urmjhbzwrp.exeC:\Temp\i_urmjhbzwrp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ojgbztrljd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ojgbztrljd.exeC:\Temp\ojgbztrljd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ojgbztrljd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ojgbztrljd.exeC:\Temp\i_ojgbztrljd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qojgeywqlj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qojgeywqlj.exeC:\Temp\qojgeywqlj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qojgeywqlj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qojgeywqlj.exeC:\Temp\i_qojgeywqlj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qoigbvtrlj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qoigbvtrlj.exeC:\Temp\qoigbvtrlj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qoigbvtrlj.exe ups_ins3⤵
-
C:\Temp\i_qoigbvtrlj.exeC:\Temp\i_qoigbvtrlj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nlfdavsqni.exe ups_run3⤵
-
C:\Temp\nlfdavsqni.exeC:\Temp\nlfdavsqni.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nlfdavsqni.exe ups_ins3⤵
-
C:\Temp\i_nlfdavsqni.exeC:\Temp\i_nlfdavsqni.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kicaysnkic.exe ups_run3⤵
-
C:\Temp\kicaysnkic.exeC:\Temp\kicaysnkic.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kicaysnkic.exe ups_ins3⤵
-
C:\Temp\i_kicaysnkic.exeC:\Temp\i_kicaysnkic.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hfaxsqkica.exe ups_run3⤵
-
C:\Temp\hfaxsqkica.exeC:\Temp\hfaxsqkica.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hfaxsqkica.exe ups_ins3⤵
-
C:\Temp\i_hfaxsqkica.exeC:\Temp\i_hfaxsqkica.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nhfcxupnhf.exe ups_run3⤵
-
C:\Temp\nhfcxupnhf.exeC:\Temp\nhfcxupnhf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nhfcxupnhf.exe ups_ins3⤵
-
C:\Temp\i_nhfcxupnhf.exeC:\Temp\i_nhfcxupnhf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rmkecwuomh.exe ups_run3⤵
-
C:\Temp\rmkecwuomh.exeC:\Temp\rmkecwuomh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rmkecwuomh.exe ups_ins3⤵
-
C:\Temp\i_rmkecwuomh.exeC:\Temp\i_rmkecwuomh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rljhbzwrpj.exe ups_run3⤵
-
C:\Temp\rljhbzwrpj.exeC:\Temp\rljhbzwrpj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rljhbzwrpj.exe ups_ins3⤵
-
C:\Temp\i_rljhbzwrpj.exeC:\Temp\i_rljhbzwrpj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywuomgeywr.exe ups_run3⤵
-
C:\Temp\ywuomgeywr.exeC:\Temp\ywuomgeywr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywuomgeywr.exe ups_ins3⤵
-
C:\Temp\i_ywuomgeywr.exeC:\Temp\i_ywuomgeywr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tqljdbytqo.exe ups_run3⤵
-
C:\Temp\tqljdbytqo.exeC:\Temp\tqljdbytqo.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tqljdbytqo.exe ups_ins3⤵
-
C:\Temp\i_tqljdbytqo.exeC:\Temp\i_tqljdbytqo.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tqlidaysql.exe ups_run3⤵
-
C:\Temp\tqlidaysql.exeC:\Temp\tqlidaysql.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffc3a51c188,0x7ffc3a51c194,0x7ffc3a51c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,13025931191225122667,4470808936586360201,262144 --field-trial-handle=3044,i,12029888065266026616,4598889417446578265,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,6175313842968974513,2485088913938081314,524288 --field-trial-handle=3044,i,12029888065266026616,4598889417446578265,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,320956919326370153,3178689542673842009,524288 --field-trial-handle=3044,i,12029888065266026616,4598889417446578265,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3380,i,2102512612063837583,17667293524157550462,2097152 --field-trial-handle=3044,i,12029888065266026616,4598889417446578265,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3396,i,7614470835047404256,1665774888308832424,2097152 --field-trial-handle=3044,i,12029888065266026616,4598889417446578265,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,15248360102180068153,17404751538545870559,2097152 --field-trial-handle=3044,i,12029888065266026616,4598889417446578265,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,8984486007257168263,3335096994348521534,2097152 --field-trial-handle=3044,i,12029888065266026616,4598889417446578265,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,16089056582244693191,4487640900890560284,524288 --field-trial-handle=3044,i,12029888065266026616,4598889417446578265,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,6779038470216936766,9596877757838010277,524288 --field-trial-handle=3044,i,12029888065266026616,4598889417446578265,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,4491447296922777230,10331327313907711862,524288 --field-trial-handle=3044,i,12029888065266026616,4598889417446578265,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,4009937058330659581,8754490280513418432,524288 --field-trial-handle=3044,i,12029888065266026616,4598889417446578265,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,4009937058330659581,8754490280513418432,524288 --field-trial-handle=3044,i,12029888065266026616,4598889417446578265,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,6821953457610589255,17782675317325356923,524288 --field-trial-handle=3044,i,12029888065266026616,4598889417446578265,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,5275355645196462929,11143892682827765222,524288 --field-trial-handle=3044,i,12029888065266026616,4598889417446578265,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,12566025870945053535,11107919222075503692,524288 --field-trial-handle=3044,i,12029888065266026616,4598889417446578265,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,1903343529916083241,1270711510570391758,524288 --field-trial-handle=3044,i,12029888065266026616,4598889417446578265,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4776,i,11072992543518519228,4467631544995546538,524288 --field-trial-handle=3044,i,12029888065266026616,4598889417446578265,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4800,i,8206947225609037058,10359628228357605750,524288 --field-trial-handle=3044,i,12029888065266026616,4598889417446578265,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,10904651447121925501,13892860657597485098,524288 --field-trial-handle=3044,i,12029888065266026616,4598889417446578265,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,14005483718835246483,905836510643341635,524288 --field-trial-handle=3044,i,12029888065266026616,4598889417446578265,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,3698494014504370019,1883668798293921719,524288 --field-trial-handle=3044,i,12029888065266026616,4598889417446578265,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3384,i,10687813993326381700,6961025724668273597,524288 --field-trial-handle=3044,i,12029888065266026616,4598889417446578265,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,2698952666211921159,12986566274597115618,524288 --field-trial-handle=3044,i,12029888065266026616,4598889417446578265,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6520,i,17115339563848278991,6805625344623790702,262144 --field-trial-handle=3044,i,12029888065266026616,4598889417446578265,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,16112415092514509597,8489249446702251684,524288 --field-trial-handle=3044,i,12029888065266026616,4598889417446578265,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\ojhbzwrpjgbzwrom.sysC:\Temp\ojhbzwrpjgbzwrom.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\ywqojgbytr.sysC:\Temp\ywqojgbytr.sys1⤵
- Executes dropped EXE
-
C:\Temp\gbytqljdbv.sysC:\Temp\gbytqljdbv.sys1⤵
- Executes dropped EXE
-
C:\Temp\vtnlicavsn.sysC:\Temp\vtnlicavsn.sys1⤵
- Executes dropped EXE
-
C:\Temp\xvsqkidavt.sysC:\Temp\xvsqkidavt.sys1⤵
- Executes dropped EXE
-
C:\Temp\usqkiczxvs.sysC:\Temp\usqkiczxvs.sys1⤵
- Executes dropped EXE
-
C:\Temp\fzxrpjhczu.sysC:\Temp\fzxrpjhczu.sys1⤵
- Executes dropped EXE
-
C:\Temp\wrpjhecwur.sysC:\Temp\wrpjhecwur.sys1⤵
- Executes dropped EXE
-
C:\Temp\zwurmjezwu.sysC:\Temp\zwurmjezwu.sys1⤵
- Executes dropped EXE
-
C:\Temp\wqojgbzwqo.sysC:\Temp\wqojgbzwqo.sys1⤵
- Executes dropped EXE
-
C:\Temp\oligaywqoi.sysC:\Temp\oligaywqoi.sys1⤵
- Executes dropped EXE
-
C:\Temp\nligaysqoi.sysC:\Temp\nligaysqoi.sys1⤵
-
C:\Temp\vtnlidavtn.sysC:\Temp\vtnlidavtn.sys1⤵
-
C:\Temp\nkicausnkf.sysC:\Temp\nkicausnkf.sys1⤵
-
C:\Temp\khfcxvpnhe.sysC:\Temp\khfcxvpnhe.sys1⤵
-
C:\Temp\rpmhfzxrpj.sysC:\Temp\rpmhfzxrpj.sys1⤵
-
C:\Temp\zwuomkecwu.sysC:\Temp\zwuomkecwu.sys1⤵
-
C:\Temp\ztrljhbztr.sysC:\Temp\ztrljhbztr.sys1⤵
-
C:\Temp\wtoigbywqo.sysC:\Temp\wtoigbywqo.sys1⤵
-
C:\Temp\vtqljdbvtn.sysC:\Temp\vtqljdbvtn.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
gbytqljdbv.sys
i_nkfdxvpnhf.exe
i_olgeywtrlg.exe
i_vsqlidavtn.exe
i_wqojgbztql.exe
i_yvqlidbvtn.exe
nkfdxvpnhf.exe
ojhbzwrpjgbzwrom.exe
ojhbzwrpjgbzwrom.sys
olgeywtrlg.exe
usqkiczxvs.sys
vsqlidavtn.exe
vtnlicavsn.sys
wqojgbztql.exe
xspnkiczxs.exe
xvsqkidavt.sys
yvqlidbvtn.exe
ywqojgbytr.sys
49a94ef2-c6ef-48fd-963d-cbddf63247fd.tmp
6d53ce55-38d3-4f37-b6c2-bcd9cd6ee427.tmp
74ad376c-569c-4736-a255-b40364e9f0a7.tmp
8570de27-8e0a-4ce4-909f-33c3fbcd9ab2.tmp
settings.dat
settings.dat
3e23d6bd-5d79-4416-b161-2b6c1a59caa1.tmp
8bcf536f-acf5-49c7-9d61-7b4c1e9d423c.tmp
temp-index
the-real-index
e5661d3f-5808-4320-871e-586a8f9ad1db.tmp
dasherSettingSchema.json
27d5272d-94ac-4398-bc26-d89bd51ab37d.tmp
8ee599c3-0b62-4341-b14f-3c1338072869.tmp
90a99888-776b-440b-8369-3a62f6719f16.tmp
a9069c0a-9548-4ab3-8a2d-ca4039135843.tmp
b3ec7f73-3317-48cc-8cb6-ec7dc95f6a9b.tmp
c78ec1e6-b40a-48e2-ba91-8c6c3d9b6081.tmp
395ea9d3-e3a1-44dd-8b57-d8407f6741f3.tmp
OperationConfig
6bd87159-11d0-496d-b0d2-c656f50d9384.tmp
708d4abe-c0c2-4384-b01f-d101b19d2058.tmp
a9e8108d-9d5e-479a-a288-56a99c6c32b9.tmp
f9680d7c-b1fb-4fa5-ab9c-26278818c96a.tmp
dc455f0e-e156-4fb6-9afb-6dc38f05dcd9.tmp
e87ae94f-171f-417b-9211-cb07e2097551.tmp
2df42bf9-c477-491d-b2a7-5e66c2adeaa5.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
a2b43a1f-9861-4432-a73a-ffae5d570122.tmp
85cc0eec-2f4d-4645-9f5f-514789f380fd.tmp
bf2eca10-3ea5-4d71-8473-0beb69a58cf8.tmp
content.js
messages.json
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/1456-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2132-578-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2132-605-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2244-691-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2612-738-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2816-716-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2900-482-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2928-632-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3416-562-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3632-582-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3644-535-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3720-655-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3932-720-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3968-659-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4224-433-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4680-510-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4876-696-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5516-558-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5604-679-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5672-522-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5932-633-0x0000000000010000-0x00000000000AB000-memory.dmp