Analysis
- max time kernel
150s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
29/10/2026, 08:10
General
- Target 2026-10-29_d0affb1b37d3319ae06f225a9281a6e1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 365KB
- Sample261029-j2sqdaav5z
- SHA256 5cbf836999fe5de09c4369a196d4e14b4ff2b2aa7a5f32c2d5652fbad131294e
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-29_d0affb1b37d3319ae06f225a9281a6e1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-29_d0affb1b37d3319ae06f225a9281a6e1_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\ebwuomgezwromgeb.exeC:\Temp\ebwuomgezwromgeb.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gerojebwtr.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\gerojebwtr.exeC:\Temp\gerojebwtr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gerojebwtr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gerojebwtr.exeC:\Temp\i_gerojebwtr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wtolgbytjd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wtolgbytjd.exeC:\Temp\wtolgbytjd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wtolgbytjd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wtolgbytjd.exeC:\Temp\i_wtolgbytjd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bysqoigbvt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bysqoigbvt.exeC:\Temp\bysqoigbvt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bysqoigbvt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bysqoigbvt.exeC:\Temp\i_bysqoigbvt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\avtnlfdxvq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\avtnlfdxvq.exeC:\Temp\avtnlfdxvq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_avtnlfdxvq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_avtnlfdxvq.exeC:\Temp\i_avtnlfdxvq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nkicausqni.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nkicausqni.exeC:\Temp\nkicausqni.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nkicausqni.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nkicausqni.exeC:\Temp\i_nkicausqni.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nkfdxusmzx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nkfdxusmzx.exeC:\Temp\nkfdxusmzx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nkfdxusmzx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nkfdxusmzx.exeC:\Temp\i_nkfdxusmzx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pmkeczxupm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pmkeczxupm.exeC:\Temp\pmkeczxupm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pmkeczxupm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pmkeczxupm.exeC:\Temp\i_pmkeczxupm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wurmjhbztr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wurmjhbztr.exeC:\Temp\wurmjhbztr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wurmjhbztr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wurmjhbztr.exeC:\Temp\i_wurmjhbztr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mjdbwtomge.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mjdbwtomge.exeC:\Temp\mjdbwtomge.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mjdbwtomge.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mjdbwtomge.exeC:\Temp\i_mjdbwtomge.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qoljebztqo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qoljebztqo.exeC:\Temp\qoljebztqo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qoljebztqo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qoljebztqo.exeC:\Temp\i_qoljebztqo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trljdbvtol.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\trljdbvtol.exeC:\Temp\trljdbvtol.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trljdbvtol.exe ups_ins3⤵
-
C:\Temp\i_trljdbvtol.exeC:\Temp\i_trljdbvtol.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ysqkidavtn.exe ups_run3⤵
-
C:\Temp\ysqkidavtn.exeC:\Temp\ysqkidavtn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ysqkidavtn.exe ups_ins3⤵
-
C:\Temp\i_ysqkidavtn.exeC:\Temp\i_ysqkidavtn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\licavsqkif.exe ups_run3⤵
-
C:\Temp\licavsqkif.exeC:\Temp\licavsqkif.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_licavsqkif.exe ups_ins3⤵
-
C:\Temp\i_licavsqkif.exeC:\Temp\i_licavsqkif.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nkfspkhfzx.exe ups_run3⤵
-
C:\Temp\nkfspkhfzx.exeC:\Temp\nkfspkhfzx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nkfspkhfzx.exe ups_ins3⤵
-
C:\Temp\i_nkfspkhfzx.exeC:\Temp\i_nkfspkhfzx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hfzxupmkhf.exe ups_run3⤵
-
C:\Temp\hfzxupmkhf.exeC:\Temp\hfzxupmkhf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hfzxupmkhf.exe ups_ins3⤵
-
C:\Temp\i_hfzxupmkhf.exeC:\Temp\i_hfzxupmkhf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kecwupmhbz.exe ups_run3⤵
-
C:\Temp\kecwupmhbz.exeC:\Temp\kecwupmhbz.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kecwupmhbz.exe ups_ins3⤵
-
C:\Temp\i_kecwupmhbz.exeC:\Temp\i_kecwupmhbz.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ztrljebwur.exe ups_run3⤵
-
C:\Temp\ztrljebwur.exeC:\Temp\ztrljebwur.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ztrljebwur.exe ups_ins3⤵
-
C:\Temp\i_ztrljebwur.exeC:\Temp\i_ztrljebwur.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywtrljgebo.exe ups_run3⤵
-
C:\Temp\ywtrljgebo.exeC:\Temp\ywtrljgebo.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywtrljgebo.exe ups_ins3⤵
-
C:\Temp\i_ywtrljgebo.exeC:\Temp\i_ywtrljgebo.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\geywqojgby.exe ups_run3⤵
-
C:\Temp\geywqojgby.exeC:\Temp\geywqojgby.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_geywqojgby.exe ups_ins3⤵
-
C:\Temp\i_geywqojgby.exeC:\Temp\i_geywqojgby.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x398,0x7ffa6217c188,0x7ffa6217c194,0x7ffa6217c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,12804920159125394978,864892446567450539,262144 --field-trial-handle=2296,i,18135916713755024184,232997217336524623,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,14686555630930251781,2437262530639569220,524288 --field-trial-handle=2296,i,18135916713755024184,232997217336524623,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2520,i,13641988558059137320,16733238729715716519,524288 --field-trial-handle=2296,i,18135916713755024184,232997217336524623,262144 --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,8903434774464735178,14259557458427732969,2097152 --field-trial-handle=2296,i,18135916713755024184,232997217336524623,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,8559625151269782017,17969919207670852654,2097152 --field-trial-handle=2296,i,18135916713755024184,232997217336524623,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,4468357858088910928,11585368753493917769,2097152 --field-trial-handle=2296,i,18135916713755024184,232997217336524623,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,8653914570478810758,1016993373699640438,2097152 --field-trial-handle=2296,i,18135916713755024184,232997217336524623,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,1337747433395395953,16644343822167712928,524288 --field-trial-handle=2296,i,18135916713755024184,232997217336524623,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,372361106310581086,6866057802693015482,524288 --field-trial-handle=2296,i,18135916713755024184,232997217336524623,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,12473237129074677468,6300781179674151472,524288 --field-trial-handle=2296,i,18135916713755024184,232997217336524623,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,4359355345880077587,17621434341263070877,524288 --field-trial-handle=2296,i,18135916713755024184,232997217336524623,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,4359355345880077587,17621434341263070877,524288 --field-trial-handle=2296,i,18135916713755024184,232997217336524623,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,2104473394938889284,2029734547224486273,524288 --field-trial-handle=2296,i,18135916713755024184,232997217336524623,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,9304416572061975378,2734369942364876521,524288 --field-trial-handle=2296,i,18135916713755024184,232997217336524623,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,14250140464493528971,3142633293789336756,524288 --field-trial-handle=2296,i,18135916713755024184,232997217336524623,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,14456564436325334020,2517472593878923017,524288 --field-trial-handle=2296,i,18135916713755024184,232997217336524623,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4608,i,13708909462622378377,17617312950441853136,524288 --field-trial-handle=2296,i,18135916713755024184,232997217336524623,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,10258647483593419043,9444376151347636762,524288 --field-trial-handle=2296,i,18135916713755024184,232997217336524623,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,569734761040714163,2861468673671837384,524288 --field-trial-handle=2296,i,18135916713755024184,232997217336524623,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,16498022736577442188,13170693566156465565,524288 --field-trial-handle=2296,i,18135916713755024184,232997217336524623,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,13677573004619613081,15924026536581142490,524288 --field-trial-handle=2296,i,18135916713755024184,232997217336524623,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6872,i,2687299235298868909,12965638740224835041,524288 --field-trial-handle=2296,i,18135916713755024184,232997217336524623,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,6442496153800524581,10548009614243422290,524288 --field-trial-handle=2296,i,18135916713755024184,232997217336524623,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6376,i,14593199356937725348,14595954911348670259,262144 --field-trial-handle=2296,i,18135916713755024184,232997217336524623,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6728,i,18118620375413711640,5066181922833209222,524288 --field-trial-handle=2296,i,18135916713755024184,232997217336524623,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,10958338580051833646,17875001586433733726,524288 --field-trial-handle=2296,i,18135916713755024184,232997217336524623,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\ebwuomgezwromgeb.sysC:\Temp\ebwuomgezwromgeb.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\geytqoigby.sysC:\Temp\geytqoigby.sys1⤵
- Executes dropped EXE
-
C:\Temp\bywqolfdyv.sysC:\Temp\bywqolfdyv.sys1⤵
- Executes dropped EXE
-
C:\Temp\avsnlfdxvp.sysC:\Temp\avsnlfdxvp.sys1⤵
- Executes dropped EXE
-
C:\Temp\avsqkifaqk.sysC:\Temp\avsqkifaqk.sys1⤵
- Executes dropped EXE
-
C:\Temp\snkfcxvpnh.sysC:\Temp\snkfcxvpnh.sys1⤵
- Executes dropped EXE
-
C:\Temp\mkecxupmkh.sysC:\Temp\mkecxupmkh.sys1⤵
- Executes dropped EXE
-
C:\Temp\wrpjhecwur.sysC:\Temp\wrpjhecwur.sys1⤵
- Executes dropped EXE
-
C:\Temp\bztrpjhbzt.sysC:\Temp\bztrpjhbzt.sys1⤵
- Executes dropped EXE
-
C:\Temp\qojgebwtro.sysC:\Temp\qojgebwtro.sys1⤵
- Executes dropped EXE
-
C:\Temp\tqljdaytql.sysC:\Temp\tqljdaytql.sys1⤵
- Executes dropped EXE
-
C:\Temp\bysnlidbvt.sysC:\Temp\bysnlidbvt.sys1⤵
-
C:\Temp\ysqcausqki.sysC:\Temp\ysqcausqki.sys1⤵
-
C:\Temp\nkfcaxsqkf.sysC:\Temp\nkfcaxsqkf.sys1⤵
-
C:\Temp\kicausmkfc.sysC:\Temp\kicausmkfc.sys1⤵
-
C:\Temp\khbzxrpmhe.sysC:\Temp\khbzxrpmhe.sys1⤵
-
C:\Temp\mkeczurmcw.sysC:\Temp\mkeczurmcw.sys1⤵
-
C:\Temp\bwurmjdbyw.sysC:\Temp\bwurmjdbyw.sys1⤵
-
C:\Temp\gebztrljdb.sysC:\Temp\gebztrljdb.sys1⤵
-
C:\Temp\lidbvtnlgd.sysC:\Temp\lidbvtnlgd.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
avsnlfdxvp.sys
avsqkifaqk.sys
avtnlfdxvq.exe
bysqoigbvt.exe
bywqolfdyv.sys
ebwuomgezwromgeb.exe
ebwuomgezwromgeb.sys
gerojebwtr.exe
geytqoigby.sys
i_avtnlfdxvq.exe
i_bysqoigbvt.exe
i_gerojebwtr.exe
i_nkicausqni.exe
i_wtolgbytjd.exe
nkfdxusmzx.exe
nkicausqni.exe
snkfcxvpnh.sys
wtolgbytjd.exe
012eaffa-98cb-4067-82b8-05f13b807080.tmp
17c4ba67-8181-465c-81a7-608ab3880502.tmp
5694061e-2fe5-4cc9-a974-ced9324081c8.tmp
73c7edc1-1fda-4d57-a924-fa09bf6187a5.tmp
settings.dat
settings.dat
11f94ba2-9c7b-4b4c-8f00-cd84ce071056.tmp
2a2a0962-bf1f-48e9-bdc9-8698c91c1dc9.tmp
450f0670-845b-4a34-903a-2149666a2d0c.tmp
temp-index
0eb1f60a-ef5b-47bb-8d1f-587cdb6cdaf6.tmp
dasherSettingSchema.json
17898ced-837e-41f5-87d2-c27562a6a10a.tmp
f449a865-f9e2-421e-aa59-e8fcb32b20a5.tmp
f54ebd37-c683-4b66-ac05-9ee31b70cd30.tmp
sync_diagnostic.log
b90707b2-60e6-4757-b1d9-7383b9dd48d8.tmp
bc38192b-8363-4ed1-9ed7-83a0f362359e.tmp
cb874986-f3da-43ad-8334-37d79f095c6e.tmp
OperationConfig
ee394194-a8ad-4d8a-8bf5-03a98598a82a.tmp
b25438af-debe-4546-bf12-8c10f51094ff.tmp
b757dc6e-7383-4c43-9d56-ff9ac682a3ba.tmp
1a3b5c95-d50b-42a6-848f-f52082784357.tmp
4279bbfb-21a6-4b3a-ad2a-7be766579146.tmp
6c492f6b-549f-4862-9035-cfc7c81062f2.tmp
875039b5-c606-43f6-9df4-bbb71d4a662e.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
5897c0b2-a47e-4efd-94f5-b61a2fb2b822.tmp
metadata.json
76dba8c3-3f14-40fa-a811-1b15f006b2cc.tmp
e023f302-09e1-40ae-997b-c8d20939a19d.tmp
messages.json
content.js
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/1368-582-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1716-669-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1848-553-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2072-635-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2512-530-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2564-674-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2652-430-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2852-516-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2956-60-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3152-657-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3152-671-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3196-741-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3692-713-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4232-737-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4544-573-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4544-479-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5660-607-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5736-557-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5880-694-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5960-518-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5960-504-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6092-717-0x0000000000010000-0x00000000000AB000-memory.dmp