Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
27/10/2026, 16:53
General
- Target 2026-10-26_580cfec18e5d1ac553d1307efb389e0e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 365KB
- Sample261027-vd7eeaex2v
- SHA256 dba4ee785a9803ec4279fead0462a854effb4000dc3846097ee779912c963e80
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_580cfec18e5d1ac553d1307efb389e0e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-26_580cfec18e5d1ac553d1307efb389e0e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\cwupmkhczusmjhbz.exeC:\Temp\cwupmkhczusmjhbz.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhfzxrpjhe.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\jhfzxrpjhe.exeC:\Temp\jhfzxrpjhe.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
-
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhfzxrpjhe.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jhfzxrpjhe.exeC:\Temp\i_jhfzxrpjhe.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omgecwuomg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\omgecwuomg.exeC:\Temp\omgecwuomg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omgecwuomg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_omgecwuomg.exeC:\Temp\i_omgecwuomg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ytqomgeywq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ytqomgeywq.exeC:\Temp\ytqomgeywq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ytqomgeywq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ytqomgeywq.exeC:\Temp\i_ytqomgeywq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dbytqljdyv.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dbytqljdyv.exeC:\Temp\dbytqljdyv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dbytqljdyv.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dbytqljdyv.exeC:\Temp\i_dbytqljdyv.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gayvtnlays.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gayvtnlays.exeC:\Temp\gayvtnlays.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gayvtnlays.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gayvtnlays.exeC:\Temp\i_gayvtnlays.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\davsqkicay.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\davsqkicay.exeC:\Temp\davsqkicay.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_davsqkicay.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_davsqkicay.exeC:\Temp\i_davsqkicay.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usmkfcxvpn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\usmkfcxvpn.exeC:\Temp\usmkfcxvpn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usmkfcxvpn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_usmkfcxvpn.exeC:\Temp\i_usmkfcxvpn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpmkeczxrp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rpmkeczxrp.exeC:\Temp\rpmkeczxrp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpmkeczxrp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rpmkeczxrp.exeC:\Temp\i_rpmkeczxrp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\causmkecwu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\causmkecwu.exeC:\Temp\causmkecwu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_causmkecwu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_causmkecwu.exeC:\Temp\i_causmkecwu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wuomhezwrp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wuomhezwrp.exeC:\Temp\wuomhezwrp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wuomhezwrp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wuomhezwrp.exeC:\Temp\i_wuomhezwrp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wuomgeywro.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wuomgeywro.exeC:\Temp\wuomgeywro.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wuomgeywro.exe ups_ins3⤵
-
C:\Temp\i_wuomgeywro.exeC:\Temp\i_wuomgeywro.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bvtolgdbvt.exe ups_run3⤵
-
C:\Temp\bvtolgdbvt.exeC:\Temp\bvtolgdbvt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bvtolgdbvt.exe ups_ins3⤵
-
C:\Temp\i_bvtolgdbvt.exeC:\Temp\i_bvtolgdbvt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtolgdbnlf.exe ups_run3⤵
-
C:\Temp\vtolgdbnlf.exeC:\Temp\vtolgdbnlf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vtolgdbnlf.exe ups_ins3⤵
-
C:\Temp\i_vtolgdbnlf.exeC:\Temp\i_vtolgdbnlf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\yvqnlfdays.exe ups_run3⤵
-
C:\Temp\yvqnlfdays.exeC:\Temp\yvqnlfdays.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_yvqnlfdays.exe ups_ins3⤵
-
C:\Temp\i_yvqnlfdays.exeC:\Temp\i_yvqnlfdays.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fcaxsqkica.exe ups_run3⤵
-
C:\Temp\fcaxsqkica.exeC:\Temp\fcaxsqkica.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fcaxsqkica.exe ups_ins3⤵
-
C:\Temp\i_fcaxsqkica.exeC:\Temp\i_fcaxsqkica.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kfcxvpnhfz.exe ups_run3⤵
-
C:\Temp\kfcxvpnhfz.exeC:\Temp\kfcxvpnhfz.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kfcxvpnhfz.exe ups_ins3⤵
-
C:\Temp\i_kfcxvpnhfz.exeC:\Temp\i_kfcxvpnhfz.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpnhfzxrpk.exe ups_run3⤵
-
C:\Temp\rpnhfzxrpk.exeC:\Temp\rpnhfzxrpk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpnhfzxrpk.exe ups_ins3⤵
-
C:\Temp\i_rpnhfzxrpk.exeC:\Temp\i_rpnhfzxrpk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wusmkecwup.exe ups_run3⤵
-
C:\Temp\wusmkecwup.exeC:\Temp\wusmkecwup.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wusmkecwup.exe ups_ins3⤵
-
C:\Temp\i_wusmkecwup.exeC:\Temp\i_wusmkecwup.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wuomgezwuo.exe ups_run3⤵
-
C:\Temp\wuomgezwuo.exeC:\Temp\wuomgezwuo.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wuomgezwuo.exe ups_ins3⤵
-
C:\Temp\i_wuomgezwuo.exeC:\Temp\i_wuomgezwuo.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ztrljgbytr.exe ups_run3⤵
-
C:\Temp\ztrljgbytr.exeC:\Temp\ztrljgbytr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x394,0x7ffed3d7c188,0x7ffed3d7c194,0x7ffed3d7c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,7331821010835868057,13266009976258419299,524288 --field-trial-handle=2876,i,6477086156514816069,1079936172865756012,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,18332456704153266067,17103109984407046520,262144 --field-trial-handle=2876,i,6477086156514816069,1079936172865756012,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,2465469249951990346,3758273953476456442,524288 --field-trial-handle=2876,i,6477086156514816069,1079936172865756012,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,12474568279207842276,12109021048383897279,2097152 --field-trial-handle=2876,i,6477086156514816069,1079936172865756012,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3540,i,6123474145644193767,4758462396521454564,2097152 --field-trial-handle=2876,i,6477086156514816069,1079936172865756012,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,657634291760847736,3007302691010169396,2097152 --field-trial-handle=2876,i,6477086156514816069,1079936172865756012,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,7561398695239426203,3987697158935699632,2097152 --field-trial-handle=2876,i,6477086156514816069,1079936172865756012,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,17109950487552800547,6335420024650080446,524288 --field-trial-handle=2876,i,6477086156514816069,1079936172865756012,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,4679056156894965410,2476048162192641141,524288 --field-trial-handle=2876,i,6477086156514816069,1079936172865756012,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,10726466386443792118,6017576053182383201,524288 --field-trial-handle=2876,i,6477086156514816069,1079936172865756012,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,7197870996691173574,3842870938154598601,524288 --field-trial-handle=2876,i,6477086156514816069,1079936172865756012,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,7197870996691173574,3842870938154598601,524288 --field-trial-handle=2876,i,6477086156514816069,1079936172865756012,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,14544374796897081216,8918571740735619792,524288 --field-trial-handle=2876,i,6477086156514816069,1079936172865756012,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,17892852895414577110,16029931802108658708,524288 --field-trial-handle=2876,i,6477086156514816069,1079936172865756012,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,14817651512668231429,7791542886141666639,524288 --field-trial-handle=2876,i,6477086156514816069,1079936172865756012,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,17003041772967949042,7564564741579829896,524288 --field-trial-handle=2876,i,6477086156514816069,1079936172865756012,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4764,i,15721853512948523301,11581676604023519911,524288 --field-trial-handle=2876,i,6477086156514816069,1079936172865756012,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,15726827549575177487,12662180389619213746,524288 --field-trial-handle=2876,i,6477086156514816069,1079936172865756012,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,7519145431046860788,14618391939872700119,524288 --field-trial-handle=2876,i,6477086156514816069,1079936172865756012,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,16878977273021823182,2513929825960929510,524288 --field-trial-handle=2876,i,6477086156514816069,1079936172865756012,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,4577761615269074117,6099605698415077450,524288 --field-trial-handle=2876,i,6477086156514816069,1079936172865756012,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,3081903815806701178,17465191727082512363,524288 --field-trial-handle=2876,i,6477086156514816069,1079936172865756012,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,1842171741508407266,8177091872230944358,524288 --field-trial-handle=2876,i,6477086156514816069,1079936172865756012,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5852,i,13184523532629263909,12432906233381044188,262144 --field-trial-handle=2876,i,6477086156514816069,1079936172865756012,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,1407385289904165474,8642003772924071719,524288 --field-trial-handle=2876,i,6477086156514816069,1079936172865756012,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\cwupmkhczusmjhbz.sysC:\Temp\cwupmkhczusmjhbz.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\trljebwurm.sysC:\Temp\trljebwurm.sys1⤵
- Executes dropped EXE
-
C:\Temp\ztqolgeywt.sysC:\Temp\ztqolgeywt.sys1⤵
- Executes dropped EXE
-
C:\Temp\ljdbytjdbv.sysC:\Temp\ljdbytjdbv.sys1⤵
- Executes dropped EXE
-
C:\Temp\igdyvtniga.sysC:\Temp\igdyvtniga.sys1⤵
- Executes dropped EXE
-
C:\Temp\fayvqnigay.sysC:\Temp\fayvqnigay.sys1⤵
- Executes dropped EXE
-
C:\Temp\avsnkfdxvp.sysC:\Temp\avsnkfdxvp.sys1⤵
- Executes dropped EXE
-
C:\Temp\causmkifdx.sysC:\Temp\causmkifdx.sys1⤵
- Executes dropped EXE
-
C:\Temp\hczusmkecw.sysC:\Temp\hczusmkecw.sys1⤵
- Executes dropped EXE
-
C:\Temp\ztrpjhecwu.sysC:\Temp\ztrpjhecwu.sys1⤵
- Executes dropped EXE
-
C:\Temp\ztrljdbwto.sysC:\Temp\ztrljdbwto.sys1⤵
- Executes dropped EXE
-
C:\Temp\jdbwtomgeb.sysC:\Temp\jdbwtomgeb.sys1⤵
-
C:\Temp\gdbytqliga.sysC:\Temp\gdbytqliga.sys1⤵
-
C:\Temp\aysqoigays.sysC:\Temp\aysqoigays.sys1⤵
-
C:\Temp\ifdxvpnkic.sysC:\Temp\ifdxvpnkic.sys1⤵
-
C:\Temp\sqkicaupnk.sysC:\Temp\sqkicaupnk.sys1⤵
-
C:\Temp\usmkeczxvp.sysC:\Temp\usmkeczxvp.sys1⤵
-
C:\Temp\cxrpjhbzur.sysC:\Temp\cxrpjhbzur.sys1⤵
-
C:\Temp\ztrmjebwuo.sysC:\Temp\ztrmjebwuo.sys1⤵
-
C:\Temp\geywuomjdb.sysC:\Temp\geywuomjdb.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
cwupmkhczusmjhbz.exe
cwupmkhczusmjhbz.sys
davsqkicay.exe
dbytqljdyv.exe
fayvqnigay.sys
gayvtnlays.exe
i_dbytqljdyv.exe
i_gayvtnlays.exe
i_jhfzxrpjhe.exe
i_omgecwuomg.exe
i_ytqomgeywq.exe
igdyvtniga.sys
jhfzxrpjhe.exe
ljdbytjdbv.sys
omgecwuomg.exe
trljebwurm.sys
ytqomgeywq.exe
ztqolgeywt.sys
361a2dff-0b33-4045-ab0f-dbc424d54e80.tmp
8c54a08a-dbe3-4382-9977-900bf1dcbb95.tmp
settings.dat
settings.dat
118deb81-8db0-4240-b117-497aa2236afa.tmp
97a6d2db-ef79-4c71-9844-0dc14fd8dcd3.tmp
temp-index
the-real-index
1bdf704e-8490-4879-a1a9-ee464c7ab50b.tmp
dasherSettingSchema.json
79edf4a2-a67e-4aea-88e7-286a1b117aac.tmp
b82c46df-a4da-473e-b3d2-e56755d2e16a.tmp
d834b14f-be84-42d7-80be-34b00c9c70d5.tmp
Preferences
sync_diagnostic.log
b0433182-5847-4444-b73e-2d4669980d86.tmp
b42ef70a-410b-4abe-86b1-2eb759dadf72.tmp
48fe818a-9de3-48c1-92da-7f968073671e.tmp
OperationConfig
b3b9c939-8145-4d06-a579-c3671612027d.tmp
2b4a1c7b-6cb7-4912-92c8-d66062123c4c.tmp
a23528d2-4472-48fc-8f0c-496e40b83272.tmp
c45eed56-5a01-4715-b663-2fd1417bf12f.tmp
e2570cea-f7f9-4edf-a6dc-a741bc46a81a.tmp
e6804dae-3f47-4a8e-bc65-24bfb608b14e.tmp
27bda76c-70df-410d-860d-164d1643a8ee.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
metadata.json
f4506538-2a90-45f7-ae49-4bf50e201b58.tmp
05bdb0c6-0772-45bc-a31e-79b03d522897.tmp
0ea35f49-9de0-415b-9181-37d8b35598f3.tmp
messages.json
content.js
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/936-529-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1864-516-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2080-670-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2764-681-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3044-427-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3284-551-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3948-626-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4276-504-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4652-728-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4684-645-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4884-706-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4992-575-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5020-730-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5164-60-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5268-708-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5640-476-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5712-624-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5724-555-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5932-668-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6084-571-0x0000000000010000-0x00000000000AB000-memory.dmp