Analysis
- max time kernel
149s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
31/10/2026, 19:31
General
- Target 2026-10-30_cefdb15513a04daa2b571b7ceab3096d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 381KB
- Sample261031-x8drpadx2x
- SHA256 edc4de08c05c6ea4ec855a0bee375cbb1cbd16f4480fd4c3a5840121cdece22e
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-30_cefdb15513a04daa2b571b7ceab3096d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-30_cefdb15513a04daa2b571b7ceab3096d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\ebwuomgeywuomgez.exeC:\Temp\ebwuomgeywuomgez.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jgezwrpjgy.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\jgezwrpjgy.exeC:\Temp\jgezwrpjgy.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jgezwrpjgy.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jgezwrpjgy.exeC:\Temp\i_jgezwrpjgy.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\oigbywqoig.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\oigbywqoig.exeC:\Temp\oigbywqoig.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_oigbywqoig.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_oigbywqoig.exeC:\Temp\i_oigbywqoig.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\igaytqlgdb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\igaytqlgdb.exeC:\Temp\igaytqlgdb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_igaytqlgdb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_igaytqlgdb.exeC:\Temp\i_igaytqlgdb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ayvqnifays.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ayvqnifays.exeC:\Temp\ayvqnifays.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ayvqnifays.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ayvqnifays.exeC:\Temp\i_ayvqnifays.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\spkicausnk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\spkicausnk.exeC:\Temp\spkicausnk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_spkicausnk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_spkicausnk.exeC:\Temp\i_spkicausnk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xsqkicausn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xsqkicausn.exeC:\Temp\xsqkicausn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xsqkicausn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xsqkicausn.exeC:\Temp\i_xsqkicausn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxrpmhfzxr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zxrpmhfzxr.exeC:\Temp\zxrpmhfzxr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxrpmhfzxr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zxrpmhfzxr.exeC:\Temp\i_zxrpmhfzxr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\czurpjhecw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\czurpjhecw.exeC:\Temp\czurpjhecw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_czurpjhecw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_czurpjhecw.exeC:\Temp\i_czurpjhecw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mjhbztgbzt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mjhbztgbzt.exeC:\Temp\mjhbztgbzt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mjhbztgbzt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mjhbztgbzt.exeC:\Temp\i_mjhbztgbzt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\eywtoljeby.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\eywtoljeby.exeC:\Temp\eywtoljeby.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_eywtoljeby.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_eywtoljeby.exeC:\Temp\i_eywtoljeby.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dbvtqoigby.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dbvtqoigby.exeC:\Temp\dbvtqoigby.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dbvtqoigby.exe ups_ins3⤵
-
C:\Temp\i_dbvtqoigby.exeC:\Temp\i_dbvtqoigby.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vqoigaysql.exe ups_run3⤵
-
C:\Temp\vqoigaysql.exeC:\Temp\vqoigaysql.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vqoigaysql.exe ups_ins3⤵
-
C:\Temp\i_vqoigaysql.exeC:\Temp\i_vqoigaysql.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dxvpnlfdxv.exe ups_run3⤵
-
C:\Temp\dxvpnlfdxv.exeC:\Temp\dxvpnlfdxv.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dxvpnlfdxv.exe ups_ins3⤵
-
C:\Temp\i_dxvpnlfdxv.exeC:\Temp\i_dxvpnlfdxv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\khfaxvsnki.exe ups_run3⤵
-
C:\Temp\khfaxvsnki.exeC:\Temp\khfaxvsnki.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_khfaxvsnki.exe ups_ins3⤵
-
C:\Temp\i_khfaxvsnki.exeC:\Temp\i_khfaxvsnki.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\spnkfczusm.exe ups_run3⤵
-
C:\Temp\spnkfczusm.exeC:\Temp\spnkfczusm.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_spnkfczusm.exe ups_ins3⤵
-
C:\Temp\i_spnkfczusm.exeC:\Temp\i_spnkfczusm.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\urpjhczusm.exe ups_run3⤵
-
C:\Temp\urpjhczusm.exeC:\Temp\urpjhczusm.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_urpjhczusm.exe ups_ins3⤵
-
C:\Temp\i_urpjhczusm.exeC:\Temp\i_urpjhczusm.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cwuomkecwu.exe ups_run3⤵
-
C:\Temp\cwuomkecwu.exeC:\Temp\cwuomkecwu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cwuomkecwu.exe ups_ins3⤵
-
C:\Temp\i_cwuomkecwu.exeC:\Temp\i_cwuomkecwu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wuomgeywro.exe ups_run3⤵
-
C:\Temp\wuomgeywro.exeC:\Temp\wuomgeywro.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wuomgeywro.exe ups_ins3⤵
-
C:\Temp\i_wuomgeywro.exeC:\Temp\i_wuomgeywro.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bywqoigbyt.exe ups_run3⤵
-
C:\Temp\bywqoigbyt.exeC:\Temp\bywqoigbyt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bywqoigbyt.exe ups_ins3⤵
-
C:\Temp\i_bywqoigbyt.exeC:\Temp\i_bywqoigbyt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dbytqligay.exe ups_run3⤵
-
C:\Temp\dbytqligay.exeC:\Temp\dbytqligay.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffadbc0c188,0x7ffadbc0c194,0x7ffadbc0c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,13883314580344461886,6377347401222177571,262144 --field-trial-handle=2336,i,478521886043583102,17980466243729866265,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,428830547885064344,2628679506236337886,524288 --field-trial-handle=2336,i,478521886043583102,17980466243729866265,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2452,i,3161905811729065487,7537651191338501373,524288 --field-trial-handle=2336,i,478521886043583102,17980466243729866265,262144 --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3640,i,18190651626747984473,2749098616401459009,2097152 --field-trial-handle=2336,i,478521886043583102,17980466243729866265,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3648,i,15878224651482242994,15943046027844017089,2097152 --field-trial-handle=2336,i,478521886043583102,17980466243729866265,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4356,i,4792269520307451102,17100250416453633795,2097152 --field-trial-handle=2336,i,478521886043583102,17980466243729866265,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4376,i,10328375990230074188,5461267599468617712,2097152 --field-trial-handle=2336,i,478521886043583102,17980466243729866265,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,5209153458323432728,10260700444624178335,524288 --field-trial-handle=2336,i,478521886043583102,17980466243729866265,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,470637618844860076,5007062270716977411,524288 --field-trial-handle=2336,i,478521886043583102,17980466243729866265,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,1637762048474864348,6847195734012918060,524288 --field-trial-handle=2336,i,478521886043583102,17980466243729866265,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,2579830435604512424,8219270896199708244,524288 --field-trial-handle=2336,i,478521886043583102,17980466243729866265,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,2579830435604512424,8219270896199708244,524288 --field-trial-handle=2336,i,478521886043583102,17980466243729866265,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,6912442317210720873,4414963686163396386,524288 --field-trial-handle=2336,i,478521886043583102,17980466243729866265,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,10295751027645193336,16290379151750500405,524288 --field-trial-handle=2336,i,478521886043583102,17980466243729866265,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6820,i,8252110936323400143,17546965792064307467,524288 --field-trial-handle=2336,i,478521886043583102,17980466243729866265,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6968,i,9276261901310109487,11161574691620259849,524288 --field-trial-handle=2336,i,478521886043583102,17980466243729866265,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,10301350992063874613,7484793183187797167,524288 --field-trial-handle=2336,i,478521886043583102,17980466243729866265,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4596,i,3822235535746653884,4108809408554616455,524288 --field-trial-handle=2336,i,478521886043583102,17980466243729866265,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4584,i,4138937860755876933,6552643881901852256,524288 --field-trial-handle=2336,i,478521886043583102,17980466243729866265,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,9872266196622257113,4324265807262768851,524288 --field-trial-handle=2336,i,478521886043583102,17980466243729866265,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6812,i,5108599357556871678,8259646026808462728,524288 --field-trial-handle=2336,i,478521886043583102,17980466243729866265,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,1356201615660640529,14008348097122935792,524288 --field-trial-handle=2336,i,478521886043583102,17980466243729866265,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1156,i,16118703600903640959,11274498179360248789,524288 --field-trial-handle=2336,i,478521886043583102,17980466243729866265,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6976,i,13498995628852163423,13179145951702765961,262144 --field-trial-handle=2336,i,478521886043583102,17980466243729866265,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7020,i,3881519961928395316,17190555172078963103,524288 --field-trial-handle=2336,i,478521886043583102,17980466243729866265,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,3109932061558284542,1513315174810506412,524288 --field-trial-handle=2336,i,478521886043583102,17980466243729866265,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\ebwuomgeywuomgez.sysC:\Temp\ebwuomgeywuomgez.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\qoigbywtom.sysC:\Temp\qoigbywtom.sys1⤵
- Executes dropped EXE
-
C:\Temp\ljdbvtnljd.sysC:\Temp\ljdbvtnljd.sys1⤵
- Executes dropped EXE
-
C:\Temp\avtnlfdxvq.sysC:\Temp\avtnlfdxvq.sys1⤵
- Executes dropped EXE
-
C:\Temp\ifaxvpnifa.sysC:\Temp\ifaxvpnifa.sys1⤵
- Executes dropped EXE
-
C:\Temp\xvpnkicaus.sysC:\Temp\xvpnkicaus.sys1⤵
- Executes dropped EXE
-
C:\Temp\zxrpjhczus.sysC:\Temp\zxrpjhczus.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfrpmhezwu.sysC:\Temp\hfrpmhezwu.sys1⤵
- Executes dropped EXE
-
C:\Temp\romgezwroj.sysC:\Temp\romgezwroj.sys1⤵
- Executes dropped EXE
-
C:\Temp\hbztrojhbz.sysC:\Temp\hbztrojhbz.sys1⤵
- Executes dropped EXE
-
C:\Temp\eywqoljgay.sysC:\Temp\eywqoljgay.sys1⤵
- Executes dropped EXE
-
C:\Temp\aywtolgdyw.sysC:\Temp\aywtolgdyw.sys1⤵
-
C:\Temp\sqlidavsnl.sysC:\Temp\sqlidavsnl.sys1⤵
-
C:\Temp\qkicausnkf.sysC:\Temp\qkicausnkf.sys1⤵
-
C:\Temp\pkhfcxvpnh.sysC:\Temp\pkhfcxvpnh.sys1⤵
-
C:\Temp\hfzxspkhca.sysC:\Temp\hfzxspkhca.sys1⤵
-
C:\Temp\ezwromhezw.sysC:\Temp\ezwromhezw.sys1⤵
-
C:\Temp\zwrojgbztr.sysC:\Temp\zwrojgbztr.sys1⤵
-
C:\Temp\bwtolgeywt.sysC:\Temp\bwtolgeywt.sys1⤵
-
C:\Temp\ligeywqolg.sysC:\Temp\ligeywqolg.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
avtnlfdxvq.sys
ayvqnifays.exe
ebwuomgeywuomgez.exe
ebwuomgeywuomgez.sys
i_ayvqnifays.exe
i_igaytqlgdb.exe
i_jgezwrpjgy.exe
i_oigbywqoig.exe
i_spkicausnk.exe
ifaxvpnifa.sys
igaytqlgdb.exe
jgezwrpjgy.exe
ljdbvtnljd.sys
oigbywqoig.exe
qoigbywtom.sys
spkicausnk.exe
xsqkicausn.exe
xvpnkicaus.sys
5674a5f2-ef76-42da-8652-c4dd1f59ed89.tmp
5a6eae03-41ad-43e6-89ac-4cf8fbdcee55.tmp
9a46025c-abec-4dc6-a905-370dddec2816.tmp
settings.dat
settings.dat
322f325b-97a7-4939-a681-5eb4cf5b969a.tmp
3d59296d-b090-4b13-8790-4d6f33a76317.tmp
461bddb7-f192-4153-acfe-44eaab3ed0c7.tmp
626d8a74-3613-473c-bba8-a2e57da5c801.tmp
temp-index
d194d601-fae9-41bb-a536-10537290c25e.tmp
dasherSettingSchema.json
9e329544-1018-4d6d-9a9f-51559c8c0351.tmp
SCT Auditing Pending Reports
d5a701b6-ec4a-42e4-920a-75e47a11f9f1.tmp
sync_diagnostic.log
c7d252f3-e2fa-435a-a61b-39b6092ea1c9.tmp
ece69690-c047-4bb4-9615-0d35c2339b69.tmp
cbcdc143-0b7f-42b4-b3c3-3bccc738a15d.tmp
ae9dc8be-71fd-4a2b-af97-81f9d9215b8a.tmp
607218ec-a627-46b9-9712-767efed92dda.tmp
617920b1-6783-4aed-8c41-af4a4b9e9588.tmp
b3e08880-f5a9-4ba7-835e-600d2894c494.tmp
c1c82684-506b-4c93-b3c4-04f37bd106b5.tmp
d6373d5f-6963-4d1e-8bfc-5d253559964c.tmp
dd1f1010-426b-416c-8541-e81a0313c81f.tmp
1ce0740e-d64b-48e6-b535-221009a501b4.tmp
32081d0d-5af9-4eb5-b661-5156148f237c.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
9beb1307-979a-4618-b0e0-0f9037f16aa8.tmp
dcbfac20-7c71-4581-bb1b-a7d4ab458405.tmp
messages.json
content.js
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/252-581-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1184-721-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1920-666-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2144-506-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2144-525-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2372-654-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3008-604-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3008-576-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3120-612-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3120-518-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3128-717-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3356-698-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3644-556-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3984-577-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3984-560-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4448-678-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4564-532-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4712-745-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4932-640-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5016-62-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5016-432-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5136-741-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5924-481-0x0000000000010000-0x00000000000AB000-memory.dmp