Analysis
- max time kernel
149s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
31/10/2026, 18:40
General
- Target 2026-10-30_de636c0d7d328c274eed41086dad198b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 381KB
- Sample261031-xbmnbsft7l
- SHA256 145130a6de7f96d74cfe7b261452772101377c3a702b27bbe8c9eaa3ccbcc15a
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 18 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-30_de636c0d7d328c274eed41086dad198b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-30_de636c0d7d328c274eed41086dad198b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\zwuomgezwrpjhbzt.exeC:\Temp\zwuomgezwrpjhbzt.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bzwuomgbzw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\bzwuomgbzw.exeC:\Temp\bzwuomgbzw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bzwuomgbzw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bzwuomgbzw.exeC:\Temp\i_bzwuomgbzw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ebwtomgeyw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ebwtomgeyw.exeC:\Temp\ebwtomgeyw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ebwtomgeyw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ebwtomgeyw.exeC:\Temp\i_ebwtomgeyw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lgdbvqnlgd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lgdbvqnlgd.exeC:\Temp\lgdbvqnlgd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lgdbvqnlgd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lgdbvqnlgd.exeC:\Temp\i_lgdbvqnlgd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdyvqnigay.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fdyvqnigay.exeC:\Temp\fdyvqnigay.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdyvqnigay.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fdyvqnigay.exeC:\Temp\i_fdyvqnigay.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ysqkfdxvpn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ysqkfdxvpn.exeC:\Temp\ysqkfdxvpn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ysqkfdxvpn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ysqkfdxvpn.exeC:\Temp\i_ysqkfdxvpn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vpnkfcausn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vpnkfcausn.exeC:\Temp\vpnkfcausn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vpnkfcausn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vpnkfcausn.exeC:\Temp\i_vpnkfcausn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xupmhfzxrp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xupmhfzxrp.exeC:\Temp\xupmhfzxrp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xupmhfzxrp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xupmhfzxrp.exeC:\Temp\i_xupmhfzxrp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxupkhfzus.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zxupkhfzus.exeC:\Temp\zxupkhfzus.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxupkhfzus.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zxupkhfzus.exeC:\Temp\i_zxupkhfzus.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ztrmjecwuo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ztrmjecwuo.exeC:\Temp\ztrmjecwuo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ztrmjecwuo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ztrmjecwuo.exeC:\Temp\i_ztrmjecwuo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljheywrojg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ljheywrojg.exeC:\Temp\ljheywrojg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljheywrojg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ljheywrojg.exeC:\Temp\i_ljheywrojg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jgbytqljdb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jgbytqljdb.exeC:\Temp\jgbytqljdb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jgbytqljdb.exe ups_ins3⤵
-
C:\Temp\i_jgbytqljdb.exeC:\Temp\i_jgbytqljdb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qolgdbvtql.exe ups_run3⤵
-
C:\Temp\qolgdbvtql.exeC:\Temp\qolgdbvtql.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qolgdbvtql.exe ups_ins3⤵
-
C:\Temp\i_qolgdbvtql.exeC:\Temp\i_qolgdbvtql.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lidbvsnlfa.exe ups_run3⤵
-
C:\Temp\lidbvsnlfa.exeC:\Temp\lidbvsnlfa.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lidbvsnlfa.exe ups_ins3⤵
-
C:\Temp\i_lidbvsnlfa.exeC:\Temp\i_lidbvsnlfa.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\icausnkfdx.exe ups_run3⤵
-
C:\Temp\icausnkfdx.exeC:\Temp\icausnkfdx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_icausnkfdx.exe ups_ins3⤵
-
C:\Temp\i_icausnkfdx.exeC:\Temp\i_icausnkfdx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pmkicausmk.exe ups_run3⤵
-
C:\Temp\pmkicausmk.exeC:\Temp\pmkicausmk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pmkicausmk.exe ups_ins3⤵
-
C:\Temp\i_pmkicausmk.exeC:\Temp\i_pmkicausmk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xupnhfzxrp.exe ups_run3⤵
-
C:\Temp\xupnhfzxrp.exeC:\Temp\xupnhfzxrp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xupnhfzxrp.exe ups_ins3⤵
-
C:\Temp\i_xupnhfzxrp.exeC:\Temp\i_xupnhfzxrp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xromhbzxrp.exe ups_run3⤵
-
C:\Temp\xromhbzxrp.exeC:\Temp\xromhbzxrp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xromhbzxrp.exe ups_ins3⤵
-
C:\Temp\i_xromhbzxrp.exeC:\Temp\i_xromhbzxrp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trpjhbztrm.exe ups_run3⤵
-
C:\Temp\trpjhbztrm.exeC:\Temp\trpjhbztrm.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trpjhbztrm.exe ups_ins3⤵
-
C:\Temp\i_trpjhbztrm.exeC:\Temp\i_trpjhbztrm.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trljgeywto.exe ups_run3⤵
-
C:\Temp\trljgeywto.exeC:\Temp\trljgeywto.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trljgeywto.exe ups_ins3⤵
-
C:\Temp\i_trljgeywto.exeC:\Temp\i_trljgeywto.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bywqoigayt.exe ups_run3⤵
-
C:\Temp\bywqoigayt.exeC:\Temp\bywqoigayt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x300,0x7ffe6881c188,0x7ffe6881c194,0x7ffe6881c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,14074462894477571266,11515182527462814285,262144 --field-trial-handle=2324,i,6364406953344397203,16008134475701792559,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,11134351322811288110,5422316502701086462,524288 --field-trial-handle=2324,i,6364406953344397203,16008134475701792559,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2348,i,16073048156516779045,10877084340049535042,524288 --field-trial-handle=2324,i,6364406953344397203,16008134475701792559,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,6951880963295127347,4104059750319282016,2097152 --field-trial-handle=2324,i,6364406953344397203,16008134475701792559,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,1316956266617691579,10665744634574546807,2097152 --field-trial-handle=2324,i,6364406953344397203,16008134475701792559,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,203414076925565122,956017656786921808,2097152 --field-trial-handle=2324,i,6364406953344397203,16008134475701792559,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,10411141456618785484,3446740378021357781,2097152 --field-trial-handle=2324,i,6364406953344397203,16008134475701792559,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,13180825090053868801,8129465746014221386,524288 --field-trial-handle=2324,i,6364406953344397203,16008134475701792559,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,1204276834369571148,7044019141903297705,524288 --field-trial-handle=2324,i,6364406953344397203,16008134475701792559,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,968084171559239329,1018267807708455018,524288 --field-trial-handle=2324,i,6364406953344397203,16008134475701792559,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,930234919227456320,12610682636692171058,524288 --field-trial-handle=2324,i,6364406953344397203,16008134475701792559,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,930234919227456320,12610682636692171058,524288 --field-trial-handle=2324,i,6364406953344397203,16008134475701792559,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,17713052250107526907,11191289912840670364,524288 --field-trial-handle=2324,i,6364406953344397203,16008134475701792559,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,681627991966397949,513652871394793138,524288 --field-trial-handle=2324,i,6364406953344397203,16008134475701792559,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6808,i,5462345157499881384,10678084365010089833,524288 --field-trial-handle=2324,i,6364406953344397203,16008134475701792559,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6968,i,317265150773331572,12922501580765666075,524288 --field-trial-handle=2324,i,6364406953344397203,16008134475701792559,262144 --variations-seed-version --mojo-platform-channel-handle=6960 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,8943881350066710745,9663689609022617221,524288 --field-trial-handle=2324,i,6364406953344397203,16008134475701792559,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4744,i,4138249208264395326,454279203450709063,524288 --field-trial-handle=2324,i,6364406953344397203,16008134475701792559,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,18241242314790943564,6210802572000195944,524288 --field-trial-handle=2324,i,6364406953344397203,16008134475701792559,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,11540637483847609747,12686102121772920754,524288 --field-trial-handle=2324,i,6364406953344397203,16008134475701792559,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7060,i,2505355041290809159,4947614501126310280,524288 --field-trial-handle=2324,i,6364406953344397203,16008134475701792559,262144 --variations-seed-version --mojo-platform-channel-handle=7048 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7032,i,709722727284258602,11800094670154522480,524288 --field-trial-handle=2324,i,6364406953344397203,16008134475701792559,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,15130960065214160320,3971724976654618342,524288 --field-trial-handle=2324,i,6364406953344397203,16008134475701792559,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6740,i,9990953866845663183,11962604786545502617,262144 --field-trial-handle=2324,i,6364406953344397203,16008134475701792559,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3424,i,16598720376159685662,3167905992889944248,524288 --field-trial-handle=2324,i,6364406953344397203,16008134475701792559,262144 --variations-seed-version --mojo-platform-channel-handle=924 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,13856588342833889475,6013411132004988394,524288 --field-trial-handle=2324,i,6364406953344397203,16008134475701792559,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\zwuomgezwrpjhbzt.sysC:\Temp\zwuomgezwrpjhbzt.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\ljebwtoljd.sysC:\Temp\ljebwtoljd.sys1⤵
- Executes dropped EXE
-
C:\Temp\toljdbywqo.sysC:\Temp\toljdbywqo.sys1⤵
- Executes dropped EXE
-
C:\Temp\oigavtnljd.sysC:\Temp\oigavtnljd.sys1⤵
- Executes dropped EXE
-
C:\Temp\dxvqnifayv.sysC:\Temp\dxvqnifayv.sys1⤵
- Executes dropped EXE
-
C:\Temp\pnhfcaxspn.sysC:\Temp\pnhfcaxspn.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfdxvpnhfa.sysC:\Temp\hfdxvpnhfa.sys1⤵
- Executes dropped EXE
-
C:\Temp\czxrpkhfzx.sysC:\Temp\czxrpkhfzx.sys1⤵
- Executes dropped EXE
-
C:\Temp\ecwurpjhbw.sysC:\Temp\ecwurpjhbw.sys1⤵
- Executes dropped EXE
-
C:\Temp\bwuoljgbyw.sysC:\Temp\bwuoljgbyw.sys1⤵
- Executes dropped EXE
-
C:\Temp\trligdyvto.sysC:\Temp\trligdyvto.sys1⤵
-
C:\Temp\sqkidavtnl.sysC:\Temp\sqkidavtnl.sys1⤵
-
C:\Temp\kicavsnkfd.sysC:\Temp\kicavsnkfd.sys1⤵
-
C:\Temp\spnkicausp.sysC:\Temp\spnkicausp.sys1⤵
-
C:\Temp\xrpkhczusm.sysC:\Temp\xrpkhczusm.sys1⤵
-
C:\Temp\zurmkeczur.sysC:\Temp\zurmkeczur.sys1⤵
-
C:\Temp\wromhezwro.sysC:\Temp\wromhezwro.sys1⤵
-
C:\Temp\bztrljebwt.sysC:\Temp\bztrljebwt.sys1⤵
-
C:\Temp\dbywqojgby.sysC:\Temp\dbywqojgby.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
bzwuomgbzw.exe
dxvqnifayv.sys
ebwtomgeyw.exe
fdyvqnigay.exe
i_bzwuomgbzw.exe
i_ebwtomgeyw.exe
i_fdyvqnigay.exe
i_lgdbvqnlgd.exe
i_ysqkfdxvpn.exe
lgdbvqnlgd.exe
ljebwtoljd.sys
oigavtnljd.sys
pnhfcaxspn.sys
toljdbywqo.sys
vpnkfcausn.exe
ysqkfdxvpn.exe
zwuomgezwrpjhbzt.exe
zwuomgezwrpjhbzt.sys
07bf8fc8-625d-434f-a81b-2d6257f8be75.tmp
5a00a054-d21b-45aa-a0a4-29bd5daec810.tmp
8058bba9-baac-4cd2-855f-4067af41a197.tmp
38784217-4d6c-46d6-8e9b-8995f0c9ce78.tmp
settings.dat
settings.dat
037b177e-cb22-472d-96c6-8ed94aeb218f.tmp
03ad3c7c-222b-4d30-8e91-374d648b1070.tmp
4067942d-3f35-4049-8024-9563feb884e2.tmp
8afc7d7c-e165-41df-9417-e7d6d7a23da3.tmp
8bb811f6-3900-4851-80a3-877a29f1b83a.tmp
the-real-index
the-real-index
7dfdbe83-dd63-42c4-811f-4a4292a8bedd.tmp
dasherSettingSchema.json
5072bd1c-9680-45bf-9295-00d829f1d456.tmp
6ad4445d-8de8-4217-bc0b-a9edd11e6fff.tmp
a94a23f3-66e1-4093-afb3-644106488ba6.tmp
sync_diagnostic.log
bf6ba97b-926e-4e69-a26f-65b63b285805.tmp
a5650fae-8ba9-45a7-a2c6-5f40fd4768ae.tmp
Local State
a8984446-e776-4c26-af2c-9a7eae8c7517.tmp
b2093cb6-f5b4-4eb2-8c43-42074a74274f.tmp
0cab424b-94f9-47c7-a2b0-5d095dd8bbbc.tmp
421e9cbd-5ec0-4cbd-a25d-2f21fe12c566.tmp
b77ad9e5-cefb-4c9e-a3df-a3bde478197c.tmp
metadata.json
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
87780a72-6deb-4c48-b0ff-40a0225fd57f.tmp
metadata.json
60222010-f83e-493d-b1a9-7e82a9f00685.tmp
e764f8aa-3a09-4a4c-8211-828f58275c62.tmp
content.js
messages.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/976-486-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1136-436-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1212-562-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1456-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1456-668-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1636-700-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1804-725-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2288-582-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3400-680-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3400-702-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3416-749-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3508-648-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3720-526-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4464-614-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4660-566-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4752-539-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4832-514-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5948-745-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5960-642-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6052-720-0x0000000000010000-0x00000000000AB000-memory.dmp