Analysis
- max time kernel
148s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
29/10/2026, 03:52
General
- Target 2026-10-28_e3d0df06c2058cd5bde0263223acb46e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 365KB
- Sample261029-efbshsww5j
- SHA256 543198a251eed9e31ed2683af23111f456bd79ac782a87aeccd1afd2057cf73f
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-28_e3d0df06c2058cd5bde0263223acb46e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-28_e3d0df06c2058cd5bde0263223acb46e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\bvtnlgdywqoigays.exeC:\Temp\bvtnlgdywqoigays.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\davtnlxsqi.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\davtnlxsqi.exeC:\Temp\davtnlxsqi.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_davtnlxsqi.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_davtnlxsqi.exeC:\Temp\i_davtnlxsqi.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nigaxsqkif.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nigaxsqkif.exeC:\Temp\nigaxsqkif.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nigaxsqkif.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nigaxsqkif.exeC:\Temp\i_nigaxsqkif.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\spnhfcausp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\spnhfcausp.exeC:\Temp\spnhfcausp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_spnhfcausp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_spnhfcausp.exeC:\Temp\i_spnhfcausp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pkhcausmke.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pkhcausmke.exeC:\Temp\pkhcausmke.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pkhcausmke.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pkhcausmke.exeC:\Temp\i_pkhcausmke.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\czurmjecwu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\czurmjecwu.exeC:\Temp\czurmjecwu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_czurmjecwu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_czurmjecwu.exeC:\Temp\i_czurmjecwu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mjhbzurmje.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mjhbzurmje.exeC:\Temp\mjhbzurmje.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mjhbzurmje.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mjhbzurmje.exeC:\Temp\i_mjhbzurmje.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\geywtojgey.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\geywtojgey.exeC:\Temp\geywtojgey.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_geywtojgey.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_geywtojgey.exeC:\Temp\i_geywtojgey.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qoigbytrlj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qoigbytrlj.exeC:\Temp\qoigbytrlj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qoigbytrlj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qoigbytrlj.exeC:\Temp\i_qoigbytrlj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\idaysqnifd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\idaysqnifd.exeC:\Temp\idaysqnifd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_idaysqnifd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_idaysqnifd.exeC:\Temp\i_idaysqnifd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\idaysqdaus.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\idaysqdaus.exeC:\Temp\idaysqdaus.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_idaysqdaus.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_idaysqdaus.exeC:\Temp\i_idaysqdaus.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdausqkhfd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fdausqkhfd.exeC:\Temp\fdausqkhfd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdausqkhfd.exe ups_ins3⤵
-
C:\Temp\i_fdausqkhfd.exeC:\Temp\i_fdausqkhfd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pmkhcausmk.exe ups_run3⤵
-
C:\Temp\pmkhcausmk.exeC:\Temp\pmkhcausmk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pmkhcausmk.exe ups_ins3⤵
-
C:\Temp\i_pmkhcausmk.exeC:\Temp\i_pmkhcausmk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpjhczxrpj.exe ups_run3⤵
-
C:\Temp\rpjhczxrpj.exeC:\Temp\rpjhczxrpj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpjhczxrpj.exe ups_ins3⤵
-
C:\Temp\i_rpjhczxrpj.exeC:\Temp\i_rpjhczxrpj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\uomjhezwur.exe ups_run3⤵
-
C:\Temp\uomjhezwur.exeC:\Temp\uomjhezwur.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_uomjhezwur.exe ups_ins3⤵
-
C:\Temp\i_uomjhezwur.exeC:\Temp\i_uomjhezwur.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bwtomgeywr.exe ups_run3⤵
-
C:\Temp\bwtomgeywr.exeC:\Temp\bwtomgeywr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bwtomgeywr.exe ups_ins3⤵
-
C:\Temp\i_bwtomgeywr.exeC:\Temp\i_bwtomgeywr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\oljdywqoig.exe ups_run3⤵
-
C:\Temp\oljdywqoig.exeC:\Temp\oljdywqoig.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_oljdywqoig.exe ups_ins3⤵
-
C:\Temp\i_oljdywqoig.exeC:\Temp\i_oljdywqoig.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gdywqoigay.exe ups_run3⤵
-
C:\Temp\gdywqoigay.exeC:\Temp\gdywqoigay.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gdywqoigay.exe ups_ins3⤵
-
C:\Temp\i_gdywqoigay.exeC:\Temp\i_gdywqoigay.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nlidavtnig.exe ups_run3⤵
-
C:\Temp\nlidavtnig.exeC:\Temp\nlidavtnig.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nlidavtnig.exe ups_ins3⤵
-
C:\Temp\i_nlidavtnig.exeC:\Temp\i_nlidavtnig.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdavsqnhfa.exe ups_run3⤵
-
C:\Temp\fdavsqnhfa.exeC:\Temp\fdavsqnhfa.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdavsqnhfa.exe ups_ins3⤵
-
C:\Temp\i_fdavsqnhfa.exeC:\Temp\i_fdavsqnhfa.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffdd3d0c188,0x7ffdd3d0c194,0x7ffdd3d0c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1720,i,4095801054060140896,7752413753310899290,262144 --field-trial-handle=2352,i,15596681522093836518,2881922897094413727,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,14142162057802737468,10659693688289681987,524288 --field-trial-handle=2352,i,15596681522093836518,2881922897094413727,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,12006506176483672880,1434909161606896854,524288 --field-trial-handle=2352,i,15596681522093836518,2881922897094413727,262144 --variations-seed-version --mojo-platform-channel-handle=3140 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,10550858030448956833,10642028661451144781,2097152 --field-trial-handle=2352,i,15596681522093836518,2881922897094413727,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,4193165469145597256,17876599983442220036,2097152 --field-trial-handle=2352,i,15596681522093836518,2881922897094413727,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,17281314378079200005,16647456233761531733,2097152 --field-trial-handle=2352,i,15596681522093836518,2881922897094413727,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,15497898038903970306,15339199537955293749,2097152 --field-trial-handle=2352,i,15596681522093836518,2881922897094413727,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,2446142082243114064,536349063646326627,524288 --field-trial-handle=2352,i,15596681522093836518,2881922897094413727,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,12168709106103959291,13870638159087095365,524288 --field-trial-handle=2352,i,15596681522093836518,2881922897094413727,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,271141134118561370,18356797281087603008,524288 --field-trial-handle=2352,i,15596681522093836518,2881922897094413727,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,1316024308504548002,2619885045308132047,524288 --field-trial-handle=2352,i,15596681522093836518,2881922897094413727,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,1316024308504548002,2619885045308132047,524288 --field-trial-handle=2352,i,15596681522093836518,2881922897094413727,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,3478378675249506491,12394231886539651513,524288 --field-trial-handle=2352,i,15596681522093836518,2881922897094413727,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,4973737841222654012,11430435502910090385,524288 --field-trial-handle=2352,i,15596681522093836518,2881922897094413727,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,3353518486975893884,14762556151118575559,524288 --field-trial-handle=2352,i,15596681522093836518,2881922897094413727,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,1156626594181915048,13087048807501087041,524288 --field-trial-handle=2352,i,15596681522093836518,2881922897094413727,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4916,i,3150102932198782780,14554215534959514455,524288 --field-trial-handle=2352,i,15596681522093836518,2881922897094413727,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3836,i,753645291364981244,4943154142229026959,524288 --field-trial-handle=2352,i,15596681522093836518,2881922897094413727,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3832,i,6877707819522300766,4209202126482070703,524288 --field-trial-handle=2352,i,15596681522093836518,2881922897094413727,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5564,i,6079719470352432581,8000316073479769286,524288 --field-trial-handle=2352,i,15596681522093836518,2881922897094413727,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,14659195297570171526,5905233772417565869,524288 --field-trial-handle=2352,i,15596681522093836518,2881922897094413727,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,14857733873694120230,5799084274585560540,524288 --field-trial-handle=2352,i,15596681522093836518,2881922897094413727,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6660,i,12460979909995730993,2968400920417745605,524288 --field-trial-handle=2352,i,15596681522093836518,2881922897094413727,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6004,i,7766202201495329742,10898711238469191074,262144 --field-trial-handle=2352,i,15596681522093836518,2881922897094413727,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,17722292263012975297,11858283055637452328,524288 --field-trial-handle=2352,i,15596681522093836518,2881922897094413727,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\bvtnlgdywqoigays.sysC:\Temp\bvtnlgdywqoigays.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Temp\pnifdxvpni.sysC:\Temp\pnifdxvpni.sys1⤵
- Executes dropped EXE
-
C:\Temp\xspkifdxus.sysC:\Temp\xspkifdxus.sys1⤵
- Executes dropped EXE
-
C:\Temp\pjhczusmke.sysC:\Temp\pjhczusmke.sys1⤵
- Executes dropped EXE
-
C:\Temp\mkecwupmhe.sysC:\Temp\mkecwupmhe.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhezwurmje.sysC:\Temp\jhezwurmje.sys1⤵
- Executes dropped EXE
-
C:\Temp\jgbztrljdb.sysC:\Temp\jgbztrljdb.sys1⤵
- Executes dropped EXE
-
C:\Temp\trljdbvtol.sysC:\Temp\trljdbvtol.sys1⤵
- Executes dropped EXE
-
C:\Temp\vqoigdbolf.sysC:\Temp\vqoigdbolf.sys1⤵
- Executes dropped EXE
-
C:\Temp\qlidavtnlf.sysC:\Temp\qlidavtnlf.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfaxspnkic.sysC:\Temp\hfaxspnkic.sys1⤵
- Executes dropped EXE
-
C:\Temp\pnhfzxuspk.sysC:\Temp\pnhfzxuspk.sys1⤵
-
C:\Temp\ecwupmhfzx.sysC:\Temp\ecwupmhfzx.sys1⤵
-
C:\Temp\xrpmhezwuo.sysC:\Temp\xrpmhezwuo.sys1⤵
-
C:\Temp\cwuoljebwr.sysC:\Temp\cwuoljebwr.sys1⤵
-
C:\Temp\wtomgeywqo.sysC:\Temp\wtomgeywqo.sys1⤵
-
C:\Temp\qolgdyvtqo.sysC:\Temp\qolgdyvtqo.sys1⤵
-
C:\Temp\nlidbvtnlf.sysC:\Temp\nlidbvtnlf.sys1⤵
-
C:\Temp\nkfcavsnli.sysC:\Temp\nkfcavsnli.sys1⤵
-
C:\Temp\hfaxspkica.sysC:\Temp\hfaxspkica.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
bvtnlgdywqoigays.exe
bvtnlgdywqoigays.sys
czurmjecwu.exe
davtnlxsqi.exe
i_czurmjecwu.exe
i_davtnlxsqi.exe
i_nigaxsqkif.exe
i_pkhcausmke.exe
i_spnhfcausp.exe
jhezwurmje.sys
mjhbzurmje.exe
mkecwupmhe.sys
nigaxsqkif.exe
pjhczusmke.sys
pkhcausmke.exe
pnifdxvpni.sys
spnhfcausp.exe
xspkifdxus.sys
1a4d4a6e-d4ee-41c2-88d3-28a66593a7f7.tmp
6518fd9f-9a0f-4f04-9ad3-5ff1fece1d18.tmp
settings.dat
settings.dat
205155b7-2400-4b58-852d-827e34c9940a.tmp
temp-index
the-real-index
a8bd701a-7be0-4a44-83c8-30f3926dca35.tmp
dasherSettingSchema.json
7a0db476-b1a0-443d-a8c4-3f37b96eace0.tmp
de931677-a32e-4b2b-8570-33d63b712b9d.tmp
fe51b93a-0ce9-463e-ab0c-9b3f845aa3c6.tmp
af4200de-71d8-43f0-af1a-db1cf74d2bc9.tmp
cb9ace5e-2a2e-4942-a947-93f40a7b5829.tmp
e124f16f-207f-4ae9-a030-0a5909965abc.tmp
e4ea0cf4-ae77-4ea5-a953-04d44b0797d4.tmp
6a79d564-0513-4c78-a057-a7542c4c533d.tmp
OperationConfig
Local State
ce19d7b7-782c-4f7b-bde2-457ca9a91c70.tmp
087c58e4-2214-4e1d-8c59-1e08f7734bc3.tmp
ac5e9f2d-bda0-44ea-bde3-a6e9e8946164.tmp
d5de66ca-2864-4f53-af80-552feab14169.tmp
e0fec399-205c-4ed1-88a1-86497c776aa6.tmp
efe5e633-b544-49f8-8e26-2e488abca51d.tmp
3463cf84-62f6-43f8-8c36-d69d085332ea.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
metadata.json
1cb00ab1-c020-4908-989a-2191e7b03adc.tmp
1e9b669c-3ff3-465f-bcd7-e46e1049546b.tmp
messages.json
content.js
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/1080-707-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1080-714-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1132-564-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1508-686-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1576-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1576-467-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2624-731-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2672-712-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2764-537-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2804-662-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4080-560-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4080-650-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4148-580-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4148-607-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4368-523-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4380-482-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4380-516-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4456-585-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4488-636-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4604-735-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4628-674-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5060-616-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5256-510-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5256-530-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5328-432-0x0000000000010000-0x00000000000AB000-memory.dmp