Analysis
- max time kernel
149s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
01/11/2026, 15:00
General
- Target 2026-11-01_45aea33ba709dfcebe3247c82fea8d34_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 365KB
- Sample261101-sdf64swsds
- SHA256 df4189496b65c46571b00af1ccc28a1d1a4729bcb3f37059fddd26a073bd6e3a
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-01_45aea33ba709dfcebe3247c82fea8d34_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-01_45aea33ba709dfcebe3247c82fea8d34_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\oigbytrljdbvtolg.exeC:\Temp\oigbytrljdbvtolg.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tolgebwldb.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\tolgebwldb.exeC:\Temp\tolgebwldb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tolgebwldb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_tolgebwldb.exeC:\Temp\i_tolgebwldb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ligbvtqoig.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ligbvtqoig.exeC:\Temp\ligbvtqoig.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ligbvtqoig.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ligbvtqoig.exeC:\Temp\i_ligbvtqoig.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cavsnlfcay.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\cavsnlfcay.exeC:\Temp\cavsnlfcay.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cavsnlfcay.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_cavsnlfcay.exeC:\Temp\i_cavsnlfcay.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\axspnkfaxv.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\axspnkfaxv.exeC:\Temp\axspnkfaxv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_axspnkfaxv.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_axspnkfaxv.exeC:\Temp\i_axspnkfaxv.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\smkecwupmh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\smkecwupmh.exeC:\Temp\smkecwupmh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_smkecwupmh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_smkecwupmh.exeC:\Temp\i_smkecwupmh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\smkeczxupn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\smkeczxupn.exeC:\Temp\smkeczxupn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_smkeczxupn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_smkeczxupn.exeC:\Temp\i_smkeczxupn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rmjecwuomg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rmjecwuomg.exeC:\Temp\rmjecwuomg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rmjecwuomg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rmjecwuomg.exeC:\Temp\i_rmjecwuomg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hbwtrljebw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hbwtrljebw.exeC:\Temp\hbwtrljebw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hbwtrljebw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hbwtrljebw.exeC:\Temp\i_hbwtrljebw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtoljdbwto.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vtoljdbwto.exeC:\Temp\vtoljdbwto.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vtoljdbwto.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vtoljdbwto.exeC:\Temp\i_vtoljdbwto.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bvtoljdbvt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bvtoljdbvt.exeC:\Temp\bvtoljdbvt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bvtoljdbvt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bvtoljdbvt.exeC:\Temp\i_bvtoljdbvt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdaysqkiga.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fdaysqkiga.exeC:\Temp\fdaysqkiga.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdaysqkiga.exe ups_ins3⤵
-
C:\Temp\i_fdaysqkiga.exeC:\Temp\i_fdaysqkiga.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nkicaysqki.exe ups_run3⤵
-
C:\Temp\nkicaysqki.exeC:\Temp\nkicaysqki.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nkicaysqki.exe ups_ins3⤵
-
C:\Temp\i_nkicaysqki.exeC:\Temp\i_nkicaysqki.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\caxsqnifax.exe ups_run3⤵
-
C:\Temp\caxsqnifax.exeC:\Temp\caxsqnifax.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_caxsqnifax.exe ups_ins3⤵
-
C:\Temp\i_caxsqnifax.exeC:\Temp\i_caxsqnifax.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xrpnhfzxsp.exe ups_run3⤵
-
C:\Temp\xrpnhfzxsp.exeC:\Temp\xrpnhfzxsp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xrpnhfzxsp.exe ups_ins3⤵
-
C:\Temp\i_xrpnhfzxsp.exeC:\Temp\i_xrpnhfzxsp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bzxrpjhczu.exe ups_run3⤵
-
C:\Temp\bzxrpjhczu.exeC:\Temp\bzxrpjhczu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bzxrpjhczu.exe ups_ins3⤵
-
C:\Temp\i_bzxrpjhczu.exeC:\Temp\i_bzxrpjhczu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wuomgezwro.exe ups_run3⤵
-
C:\Temp\wuomgezwro.exeC:\Temp\wuomgezwro.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wuomgezwro.exe ups_ins3⤵
-
C:\Temp\i_wuomgezwro.exeC:\Temp\i_wuomgezwro.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\eywuomgezw.exe ups_run3⤵
-
C:\Temp\eywuomgezw.exeC:\Temp\eywuomgezw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_eywuomgezw.exe ups_ins3⤵
-
C:\Temp\i_eywuomgezw.exeC:\Temp\i_eywuomgezw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ytrligbytr.exe ups_run3⤵
-
C:\Temp\ytrligbytr.exeC:\Temp\ytrligbytr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ytrligbytr.exe ups_ins3⤵
-
C:\Temp\i_ytrligbytr.exeC:\Temp\i_ytrligbytr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\aysqoigdyv.exe ups_run3⤵
-
C:\Temp\aysqoigdyv.exeC:\Temp\aysqoigdyv.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_aysqoigdyv.exe ups_ins3⤵
-
C:\Temp\i_aysqoigdyv.exeC:\Temp\i_aysqoigdyv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\icaxvqnlfd.exe ups_run3⤵
-
C:\Temp\icaxvqnlfd.exeC:\Temp\icaxvqnlfd.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_icaxvqnlfd.exe ups_ins3⤵
-
C:\Temp\i_icaxvqnlfd.exeC:\Temp\i_icaxvqnlfd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff981f9c188,0x7ff981f9c194,0x7ff981f9c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,11016398356231442605,14637510450710658737,262144 --field-trial-handle=3028,i,11248341688986693698,1105825027751469789,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,6550259650805104213,11003509849939798356,524288 --field-trial-handle=3028,i,11248341688986693698,1105825027751469789,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,9443669000222854070,15786664510151845172,524288 --field-trial-handle=3028,i,11248341688986693698,1105825027751469789,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,10401134870328333317,16342205698348472859,2097152 --field-trial-handle=3028,i,11248341688986693698,1105825027751469789,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,14185788817749979560,12852429698726127644,2097152 --field-trial-handle=3028,i,11248341688986693698,1105825027751469789,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4304,i,15976130606510460888,2087267989500707688,2097152 --field-trial-handle=3028,i,11248341688986693698,1105825027751469789,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,528192857736527084,16865353375934232771,2097152 --field-trial-handle=3028,i,11248341688986693698,1105825027751469789,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,8804178945270144651,14042170999459023182,524288 --field-trial-handle=3028,i,11248341688986693698,1105825027751469789,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,2673525077562980227,17620236053649529955,524288 --field-trial-handle=3028,i,11248341688986693698,1105825027751469789,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,9719271046022368367,17151986920532565414,524288 --field-trial-handle=3028,i,11248341688986693698,1105825027751469789,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,4332720604481979151,12555485528070668268,524288 --field-trial-handle=3028,i,11248341688986693698,1105825027751469789,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,4332720604481979151,12555485528070668268,524288 --field-trial-handle=3028,i,11248341688986693698,1105825027751469789,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,13276347437716008050,9807993657855328340,524288 --field-trial-handle=3028,i,11248341688986693698,1105825027751469789,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,3906506941359596294,7215417402059778269,524288 --field-trial-handle=3028,i,11248341688986693698,1105825027751469789,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,11117551469651804868,11269601674935269905,524288 --field-trial-handle=3028,i,11248341688986693698,1105825027751469789,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,9586757770115803807,12877146724289093337,524288 --field-trial-handle=3028,i,11248341688986693698,1105825027751469789,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,9723416860333172280,7721375877065170471,524288 --field-trial-handle=3028,i,11248341688986693698,1105825027751469789,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,1493875016142428537,5882728058165212992,524288 --field-trial-handle=3028,i,11248341688986693698,1105825027751469789,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,14759954072040565290,12256186677817733915,524288 --field-trial-handle=3028,i,11248341688986693698,1105825027751469789,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,504422079843177896,297403439153417676,524288 --field-trial-handle=3028,i,11248341688986693698,1105825027751469789,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6936,i,13446320141442815482,191539095600481229,524288 --field-trial-handle=3028,i,11248341688986693698,1105825027751469789,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6960,i,14330883258349088067,17923172369903643111,524288 --field-trial-handle=3028,i,11248341688986693698,1105825027751469789,262144 --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,7082779622194703057,14040938344310598607,524288 --field-trial-handle=3028,i,11248341688986693698,1105825027751469789,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6248,i,15164051402609393703,8735766400862706617,262144 --field-trial-handle=3028,i,11248341688986693698,1105825027751469789,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,7019647112152365387,11981512372308846309,524288 --field-trial-handle=3028,i,11248341688986693698,1105825027751469789,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\oigbytrljdbvtolg.sysC:\Temp\oigbytrljdbvtolg.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\vtnlgdywqo.sysC:\Temp\vtnlgdywqo.sys1⤵
- Executes dropped EXE
-
C:\Temp\fdavtnlfdy.sysC:\Temp\fdavtnlfdy.sys1⤵
- Executes dropped EXE
-
C:\Temp\xvpnkfdxvs.sysC:\Temp\xvpnkfdxvs.sys1⤵
- Executes dropped EXE
-
C:\Temp\causmkfcxu.sysC:\Temp\causmkfcxu.sys1⤵
- Executes dropped EXE
-
C:\Temp\rpmhfcxupm.sysC:\Temp\rpmhfcxupm.sys1⤵
- Executes dropped EXE
-
C:\Temp\omkeczurmj.sysC:\Temp\omkeczurmj.sys1⤵
- Executes dropped EXE
-
C:\Temp\bztrljdbwt.sysC:\Temp\bztrljdbwt.sys1⤵
- Executes dropped EXE
-
C:\Temp\ljebwtomge.sysC:\Temp\ljebwtomge.sys1⤵
- Executes dropped EXE
-
C:\Temp\gaytqljday.sysC:\Temp\gaytqljday.sys1⤵
- Executes dropped EXE
-
C:\Temp\gaysqkiday.sysC:\Temp\gaysqkiday.sys1⤵
- Executes dropped EXE
-
C:\Temp\pnlidaysqn.sysC:\Temp\pnlidaysqn.sys1⤵
-
C:\Temp\fdxvpnifax.sysC:\Temp\fdxvpnifax.sys1⤵
-
C:\Temp\cxupmkhcau.sysC:\Temp\cxupmkhcau.sys1⤵
-
C:\Temp\zxuomkecwu.sysC:\Temp\zxuomkecwu.sys1⤵
-
C:\Temp\mkecwupmhe.sysC:\Temp\mkecwupmhe.sys1⤵
-
C:\Temp\ecwuomjebw.sysC:\Temp\ecwuomjebw.sys1⤵
-
C:\Temp\bytrljdbvt.sysC:\Temp\bytrljdbvt.sys1⤵
-
C:\Temp\yvtnlfdbvt.sysC:\Temp\yvtnlfdbvt.sys1⤵
-
C:\Temp\qkigdbvtql.sysC:\Temp\qkigdbvtql.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
axspnkfaxv.exe
causmkfcxu.sys
cavsnlfcay.exe
fdavtnlfdy.sys
i_axspnkfaxv.exe
i_cavsnlfcay.exe
i_ligbvtqoig.exe
i_smkecwupmh.exe
i_tolgebwldb.exe
ligbvtqoig.exe
oigbytrljdbvtolg.exe
oigbytrljdbvtolg.sys
rpmhfcxupm.sys
smkecwupmh.exe
smkeczxupn.exe
tolgebwldb.exe
vtnlgdywqo.sys
xvpnkfdxvs.sys
3428a8eb-47a8-4b18-bc0d-b5d3135dbb81.tmp
46ad8c8b-4e20-4e35-b459-3434e187c3d6.tmp
8daf6da4-d481-48df-af84-9a2eb03f2ed9.tmp
settings.dat
settings.dat
603452df-c555-45b1-949b-3cbb05f8a222.tmp
6b4dbef4-6a7e-4a3a-9db4-e87603c1d19c.tmp
82ca3c8f-faf9-4eda-a48e-d06fb05f2a04.tmp
temp-index
316b18f7-dcfe-4dc9-ac75-5dbe95f055f3.tmp
dasherSettingSchema.json
80187238-6d2c-491d-890c-4a6bd5e19809.tmp
c3af1863-c762-433d-8e97-57bad9bc7145.tmp
f6616f4d-aea5-48bc-817f-f81b3c50d109.tmp
sync_diagnostic.log
ac10aaa4-cdae-427d-a487-6961b215a887.tmp
bdcf9658-89f1-40b7-b4a4-0199ec75bee1.tmp
d585e80a-1598-4db2-9414-55b5c7808487.tmp
496faeb3-3c02-4eb4-9a43-da4a05cfbe55.tmp
ab600b7f-44cd-45b8-8287-0d9e8134994f.tmp
ae7f2b87-5f67-48c3-bf23-550a1de6dd65.tmp
285b2cb3-fb74-4411-9a90-dd6a94257bef.tmp
39fd42a0-93b3-487d-9616-04b652ee2418.tmp
4942a1ff-8c34-48fa-8462-776571b2aa72.tmp
c615c909-7036-4f60-a511-da12c3bcb989.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
4900fdf6-e549-440b-9d5c-87172c8f94e8.tmp
metadata.json
3cf0b9de-e3eb-4250-9374-edf512da8e87.tmp
cdfe483e-7804-447c-983e-de01d3b45296.tmp
messages.json
content.js
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/952-512-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/952-481-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1104-631-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1140-645-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2216-677-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2328-532-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2424-62-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2916-726-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2928-746-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3372-519-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3372-553-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3372-612-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3372-580-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3404-432-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3456-556-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3508-702-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3860-506-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5000-722-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5392-560-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5436-682-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5572-665-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5572-678-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6008-576-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6064-610-0x0000000000010000-0x00000000000AB000-memory.dmp