Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
31/10/2026, 17:06
General
- Target 2026-10-30_f6dff182a0720553632a91096c31af8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 381KB
- Sample261031-vmn97aex5k
- SHA256 4712840580fa954f8b13ccf7d6dbd0d471f50e7a0b5d572df271b91eb351c187
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-30_f6dff182a0720553632a91096c31af8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-30_f6dff182a0720553632a91096c31af8c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\uomgezwrpjhbztrm.exeC:\Temp\uomgezwrpjhbztrm.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\uomjezwulh.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\uomjezwulh.exeC:\Temp\uomjezwulh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_uomjezwulh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_uomjezwulh.exeC:\Temp\i_uomjezwulh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bwtomgeywq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bwtomgeywq.exeC:\Temp\bwtomgeywq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bwtomgeywq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bwtomgeywq.exeC:\Temp\i_bwtomgeywq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lgdywqoigb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lgdywqoigb.exeC:\Temp\lgdywqoigb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lgdywqoigb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lgdywqoigb.exeC:\Temp\i_lgdywqoigb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdxvqnifay.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fdxvqnifay.exeC:\Temp\fdxvqnifay.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdxvqnifay.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fdxvqnifay.exeC:\Temp\i_fdxvqnifay.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\avsnlfdxvp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\avsnlfdxvp.exeC:\Temp\avsnlfdxvp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_avsnlfdxvp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_avsnlfdxvp.exeC:\Temp\i_avsnlfdxvp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\spkhfzxspk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\spkhfzxspk.exeC:\Temp\spkhfzxspk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_spkhfzxspk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_spkhfzxspk.exeC:\Temp\i_spkhfzxspk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\upmhfzxrpj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\upmhfzxrpj.exeC:\Temp\upmhfzxrpj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_upmhfzxrpj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_upmhfzxrpj.exeC:\Temp\i_upmhfzxrpj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wurpjhbzur.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wurpjhbzur.exeC:\Temp\wurpjhbzur.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wurpjhbzur.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wurpjhbzur.exeC:\Temp\i_wurpjhbzur.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zwrpjhezwr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zwrpjhezwr.exeC:\Temp\zwrpjhezwr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zwrpjhezwr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zwrpjhezwr.exeC:\Temp\i_zwrpjhezwr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rojgeywqoj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rojgeywqoj.exeC:\Temp\rojgeywqoj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rojgeywqoj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rojgeywqoj.exeC:\Temp\i_rojgeywqoj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tnljdbytrl.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\tnljdbytrl.exeC:\Temp\tnljdbytrl.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tnljdbytrl.exe ups_ins3⤵
-
C:\Temp\i_tnljdbytrl.exeC:\Temp\i_tnljdbytrl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\aysqlidavt.exe ups_run3⤵
-
C:\Temp\aysqlidavt.exeC:\Temp\aysqlidavt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_aysqlidavt.exe ups_ins3⤵
-
C:\Temp\i_aysqlidavt.exeC:\Temp\i_aysqlidavt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gaxvtnlida.exe ups_run3⤵
-
C:\Temp\gaxvtnlida.exeC:\Temp\gaxvtnlida.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gaxvtnlida.exe ups_ins3⤵
-
C:\Temp\i_gaxvtnlida.exeC:\Temp\i_gaxvtnlida.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\icausnkfca.exe ups_run3⤵
-
C:\Temp\icausnkfca.exeC:\Temp\icausnkfca.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_icausnkfca.exe ups_ins3⤵
-
C:\Temp\i_icausnkfca.exeC:\Temp\i_icausnkfca.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nhfcxvsmkh.exe ups_run3⤵
-
C:\Temp\nhfcxvsmkh.exeC:\Temp\nhfcxvsmkh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nhfcxvsmkh.exe ups_ins3⤵
-
C:\Temp\i_nhfcxvsmkh.exeC:\Temp\i_nhfcxvsmkh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxrpmkeczu.exe ups_run3⤵
-
C:\Temp\zxrpmkeczu.exeC:\Temp\zxrpmkeczu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxrpmkeczu.exe ups_ins3⤵
-
C:\Temp\i_zxrpmkeczu.exeC:\Temp\i_zxrpmkeczu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wuomheczuo.exe ups_run3⤵
-
C:\Temp\wuomheczuo.exeC:\Temp\wuomheczuo.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wuomheczuo.exe ups_ins3⤵
-
C:\Temp\i_wuomheczuo.exeC:\Temp\i_wuomheczuo.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\romgebztro.exe ups_run3⤵
-
C:\Temp\romgebztro.exeC:\Temp\romgebztro.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_romgebztro.exe ups_ins3⤵
-
C:\Temp\i_romgebztro.exeC:\Temp\i_romgebztro.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wtoljdbwto.exe ups_run3⤵
-
C:\Temp\wtoljdbwto.exeC:\Temp\wtoljdbwto.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wtoljdbwto.exe ups_ins3⤵
-
C:\Temp\i_wtoljdbwto.exeC:\Temp\i_wtoljdbwto.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bvtrljdbvt.exe ups_run3⤵
-
C:\Temp\bvtrljdbvt.exeC:\Temp\bvtrljdbvt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x31c,0x7ff84edfc188,0x7ff84edfc194,0x7ff84edfc1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,1620204500567630981,9579328799200385629,262144 --field-trial-handle=2224,i,10952968077873870343,2353868049045008079,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,14367422899975202714,13859564259194091321,524288 --field-trial-handle=2224,i,10952968077873870343,2353868049045008079,262144 --variations-seed-version --mojo-platform-channel-handle=3172 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,1938186011076472158,1392850986063673038,524288 --field-trial-handle=2224,i,10952968077873870343,2353868049045008079,262144 --variations-seed-version --mojo-platform-channel-handle=3308 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,378071886989968497,4060069375772524867,2097152 --field-trial-handle=2224,i,10952968077873870343,2353868049045008079,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,3493316765533728554,12836135604471870213,2097152 --field-trial-handle=2224,i,10952968077873870343,2353868049045008079,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4304,i,4449703570840694794,5199635427011393678,2097152 --field-trial-handle=2224,i,10952968077873870343,2353868049045008079,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,6780572766857257380,3429530817010136235,2097152 --field-trial-handle=2224,i,10952968077873870343,2353868049045008079,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,13427811384899641066,7125792299431464529,524288 --field-trial-handle=2224,i,10952968077873870343,2353868049045008079,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,15246585047979806257,6240950744758297179,524288 --field-trial-handle=2224,i,10952968077873870343,2353868049045008079,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,12729846184206291077,11048156621068321537,524288 --field-trial-handle=2224,i,10952968077873870343,2353868049045008079,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,453175325651966822,3294589556384740384,524288 --field-trial-handle=2224,i,10952968077873870343,2353868049045008079,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,453175325651966822,3294589556384740384,524288 --field-trial-handle=2224,i,10952968077873870343,2353868049045008079,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,5815713942754765636,644613690517666129,524288 --field-trial-handle=2224,i,10952968077873870343,2353868049045008079,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,17504001805490114156,12061158391186688570,524288 --field-trial-handle=2224,i,10952968077873870343,2353868049045008079,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,5769462775131663899,1378624331792105086,524288 --field-trial-handle=2224,i,10952968077873870343,2353868049045008079,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,12791762554615298184,7708967099346161073,524288 --field-trial-handle=2224,i,10952968077873870343,2353868049045008079,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,8120494466405825236,13485627070407287317,524288 --field-trial-handle=2224,i,10952968077873870343,2353868049045008079,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3564,i,14961663605724715074,1144948351629285098,524288 --field-trial-handle=2224,i,10952968077873870343,2353868049045008079,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,10565655633173720331,3616175906316291381,524288 --field-trial-handle=2224,i,10952968077873870343,2353868049045008079,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,8934208232822694666,11216993419497510436,524288 --field-trial-handle=2224,i,10952968077873870343,2353868049045008079,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,9454620289046227321,17630091275699739001,524288 --field-trial-handle=2224,i,10952968077873870343,2353868049045008079,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,6151306211827380548,2628321977019163357,524288 --field-trial-handle=2224,i,10952968077873870343,2353868049045008079,262144 --variations-seed-version --mojo-platform-channel-handle=944 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,10302451624807955481,18314417999374578242,524288 --field-trial-handle=2224,i,10952968077873870343,2353868049045008079,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5752,i,16871232425385170436,3408819468230138611,262144 --field-trial-handle=2224,i,10952968077873870343,2353868049045008079,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3300,i,13645491114575479802,6861228276756557406,524288 --field-trial-handle=2224,i,10952968077873870343,2353868049045008079,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\uomgezwrpjhbztrm.sysC:\Temp\uomgezwrpjhbztrm.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\ywqomgeywq.sysC:\Temp\ywqomgeywq.sys1⤵
- Executes dropped EXE
-
C:\Temp\lgdyvtqlig.sysC:\Temp\lgdyvtqlig.sys1⤵
- Executes dropped EXE
-
C:\Temp\lfdbywqoig.sysC:\Temp\lfdbywqoig.sys1⤵
- Executes dropped EXE
-
C:\Temp\fdxvpnifay.sysC:\Temp\fdxvpnifay.sys1⤵
- Executes dropped EXE
-
C:\Temp\sqkhfzxspn.sysC:\Temp\sqkhfzxspn.sys1⤵
- Executes dropped EXE
-
C:\Temp\upmhfzxrpj.sysC:\Temp\upmhfzxrpj.sys1⤵
- Executes dropped EXE
-
C:\Temp\fzxupmkhfz.sysC:\Temp\fzxupmkhfz.sys1⤵
- Executes dropped EXE
-
C:\Temp\hbzwuomhez.sysC:\Temp\hbzwuomhez.sys1⤵
- Executes dropped EXE
-
C:\Temp\wtomgeywto.sysC:\Temp\wtomgeywto.sys1⤵
- Executes dropped EXE
-
C:\Temp\qljgbywqoi.sysC:\Temp\qljgbywqoi.sys1⤵
- Executes dropped EXE
-
C:\Temp\igaytqljdb.sysC:\Temp\igaytqljdb.sys1⤵
-
C:\Temp\idayvqnlfd.sysC:\Temp\idayvqnlfd.sys1⤵
-
C:\Temp\kicausnkfd.sysC:\Temp\kicausnkfd.sys1⤵
-
C:\Temp\xvpnhfspkh.sysC:\Temp\xvpnhfspkh.sys1⤵
-
C:\Temp\xuspkhczus.sysC:\Temp\xuspkhczus.sys1⤵
-
C:\Temp\zxrpjhczus.sysC:\Temp\zxrpjhczus.sys1⤵
-
C:\Temp\trmjecztrl.sysC:\Temp\trmjecztrl.sys1⤵
-
C:\Temp\geywtomgeb.sysC:\Temp\geywtomgeb.sys1⤵
-
C:\Temp\yvtolgeywq.sysC:\Temp\yvtolgeywq.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
avsnlfdxvp.exe
bwtomgeywq.exe
fdxvpnifay.sys
fdxvqnifay.exe
i_avsnlfdxvp.exe
i_bwtomgeywq.exe
i_fdxvqnifay.exe
i_lgdywqoigb.exe
i_uomjezwulh.exe
lfdbywqoig.sys
lgdyvtqlig.sys
lgdywqoigb.exe
spkhfzxspk.exe
sqkhfzxspn.sys
uomgezwrpjhbztrm.exe
uomgezwrpjhbztrm.sys
uomjezwulh.exe
ywqomgeywq.sys
4dfd04e4-fd8f-49fb-8cf8-112e72907fff.tmp
932abad9-d00c-46d2-b412-fd9e8910136b.tmp
settings.dat
settings.dat
6b3bbe24-e279-4687-862b-2d58776160d7.tmp
79fd97c7-0c9c-4b16-a263-6bac5ec0066a.tmp
temp-index
the-real-index
2ed4e0a6-7ee0-4e76-ab22-f81f31ff048e.tmp
dasherSettingSchema.json
1f55b44b-be5a-4b46-883e-103c206ecec8.tmp
2922e60c-fcee-4b09-951f-35086c02bbd2.tmp
41018f28-d1ec-4a10-ad58-bb9fccb90362.tmp
b9439cec-b41e-4069-b26d-2ff04d096d8c.tmp
d651d07a-4fdb-4393-a55d-13904387bf0b.tmp
d862b344-8265-4d41-957f-315761bc6351.tmp
58400859-c565-4d5d-b4f4-0d4753cc745e.tmp
a5932b38-3551-4668-8c06-6fe1e7e9567b.tmp
af50ec2a-5887-463f-95a8-1f1274324b7d.tmp
bac33ebd-b2f1-443b-984f-6e485dcaf164.tmp
c89f5613-3c6b-4940-a1f6-30248668e9a9.tmp
edd8eafb-2e62-436c-bade-414e6eac41a4.tmp
ef462a9e-e747-44ec-948f-ce55f9657605.tmp
0bc258a6-f7b8-4b08-b1a2-f9e64a15970a.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
metadata.json
f3fd3aad-9212-453e-8cce-23508e851e81.tmp
116f5582-24e2-4162-b48e-d68cd15ce612.tmp
7a11f8b4-13f4-4333-bdf1-e1afd1d9ce81.tmp
messages.json
content.js
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/936-647-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/936-579-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/936-613-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1720-657-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1720-625-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2652-536-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2760-723-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2952-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3208-583-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3336-559-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3852-563-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4128-680-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4332-693-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4492-741-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4928-682-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4928-697-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4928-660-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5284-523-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5500-483-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5844-434-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6020-719-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6100-511-0x0000000000010000-0x00000000000AB000-memory.dmp