Analysis
- max time kernel
149s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/11/2026, 22:38
General
- Target 2026-11-02_cb33e0338b552a1ed62221d99c3e85ef_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 365KB
- Sample261102-2kqtkadw5v
- SHA256 b0e03adb3398254fbc4df8ed60e17a42517957dae08540ea0258bc362c5b33f9
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-02_cb33e0338b552a1ed62221d99c3e85ef_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-02_cb33e0338b552a1ed62221d99c3e85ef_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\ebwtomgeywqojgbz.exeC:\Temp\ebwtomgeywqojgbz.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dbvtomgewo.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\dbvtomgewo.exeC:\Temp\dbvtomgewo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dbvtomgewo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dbvtomgewo.exeC:\Temp\i_dbvtomgewo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nlidbvtnlf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nlidbvtnlf.exeC:\Temp\nlidbvtnlf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nlidbvtnlf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nlidbvtnlf.exeC:\Temp\i_nlidbvtnlf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdyvqnifdx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fdyvqnifdx.exeC:\Temp\fdyvqnifdx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdyvqnifdx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fdyvqnifdx.exeC:\Temp\i_fdyvqnifdx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hfcaupnkfd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hfcaupnkfd.exeC:\Temp\hfcaupnkfd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hfcaupnkfd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hfcaupnkfd.exeC:\Temp\i_hfcaupnkfd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usnkfdxvpn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\usnkfdxvpn.exeC:\Temp\usnkfdxvpn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usnkfdxvpn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_usnkfdxvpn.exeC:\Temp\i_usnkfdxvpn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mhfzxrpkhc.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mhfzxrpkhc.exeC:\Temp\mhfzxrpkhc.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mhfzxrpkhc.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mhfzxrpkhc.exeC:\Temp\i_mhfzxrpkhc.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhezxrpmhe.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jhezxrpmhe.exeC:\Temp\jhezxrpmhe.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhezxrpmhe.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jhezxrpmhe.exeC:\Temp\i_jhezxrpmhe.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywrojhbztr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ywrojhbztr.exeC:\Temp\ywrojhbztr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywrojhbztr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ywrojhbztr.exeC:\Temp\i_ywrojhbztr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\geywqojgbz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\geywqojgbz.exeC:\Temp\geywqojgbz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_geywqojgbz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_geywqojgbz.exeC:\Temp\i_geywqojgbz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywqoigbvtq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ywqoigbvtq.exeC:\Temp\ywqoigbvtq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywqoigbvtq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ywqoigbvtq.exeC:\Temp\i_ywqoigbvtq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qkidayvtnl.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qkidayvtnl.exeC:\Temp\qkidayvtnl.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qkidayvtnl.exe ups_ins3⤵
-
C:\Temp\i_qkidayvtnl.exeC:\Temp\i_qkidayvtnl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\axvtndxsqk.exe ups_run3⤵
-
C:\Temp\axvtndxsqk.exeC:\Temp\axvtndxsqk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_axvtndxsqk.exe ups_ins3⤵
-
C:\Temp\i_axvtndxsqk.exeC:\Temp\i_axvtndxsqk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvpnhfaxsq.exe ups_run3⤵
-
C:\Temp\xvpnhfaxsq.exeC:\Temp\xvpnhfaxsq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xvpnhfaxsq.exe ups_ins3⤵
-
C:\Temp\i_xvpnhfaxsq.exeC:\Temp\i_xvpnhfaxsq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\czxspkhczx.exe ups_run3⤵
-
C:\Temp\czxspkhczx.exeC:\Temp\czxspkhczx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_czxspkhczx.exe ups_ins3⤵
-
C:\Temp\i_czxspkhczx.exeC:\Temp\i_czxspkhczx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpjhczusmk.exe ups_run3⤵
-
C:\Temp\rpjhczusmk.exeC:\Temp\rpjhczusmk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpjhczusmk.exe ups_ins3⤵
-
C:\Temp\i_rpjhczusmk.exeC:\Temp\i_rpjhczusmk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wuomjhbzwr.exe ups_run3⤵
-
C:\Temp\wuomjhbzwr.exeC:\Temp\wuomjhbzwr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wuomjhbzwr.exe ups_ins3⤵
-
C:\Temp\i_wuomjhbzwr.exeC:\Temp\i_wuomjhbzwr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ebywuoljeb.exe ups_run3⤵
-
C:\Temp\ebywuoljeb.exeC:\Temp\ebywuoljeb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ebywuoljeb.exe ups_ins3⤵
-
C:\Temp\i_ebywuoljeb.exeC:\Temp\i_ebywuoljeb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gbytrljdbv.exe ups_run3⤵
-
C:\Temp\gbytrljdbv.exeC:\Temp\gbytrljdbv.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gbytrljdbv.exe ups_ins3⤵
-
C:\Temp\i_gbytrljdbv.exeC:\Temp\i_gbytrljdbv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bvtnligayw.exe ups_run3⤵
-
C:\Temp\bvtnligayw.exeC:\Temp\bvtnligayw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bvtnligayw.exe ups_ins3⤵
-
C:\Temp\i_bvtnligayw.exeC:\Temp\i_bvtnligayw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nlidayvqnl.exe ups_run3⤵
-
C:\Temp\nlidayvqnl.exeC:\Temp\nlidayvqnl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nlidayvqnl.exe ups_ins3⤵
-
C:\Temp\i_nlidayvqnl.exeC:\Temp\i_nlidayvqnl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff81f8ac188,0x7ff81f8ac194,0x7ff81f8ac1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,3862760549950023196,4997286874419148304,262144 --field-trial-handle=2320,i,15881688546246273127,1714465324337101481,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,17294224066643152871,12314064134782431601,524288 --field-trial-handle=2320,i,15881688546246273127,1714465324337101481,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2560,i,2129616024926794077,14097163273691699385,524288 --field-trial-handle=2320,i,15881688546246273127,1714465324337101481,262144 --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3616,i,16436113640794157065,8105850637412990394,2097152 --field-trial-handle=2320,i,15881688546246273127,1714465324337101481,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3624,i,8082362362343973863,17632243057459462073,2097152 --field-trial-handle=2320,i,15881688546246273127,1714465324337101481,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4360,i,4090100704092833651,16800807528620381616,2097152 --field-trial-handle=2320,i,15881688546246273127,1714465324337101481,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4348,i,13457727976998463262,9473084773894091136,2097152 --field-trial-handle=2320,i,15881688546246273127,1714465324337101481,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3788,i,5177597929473252459,125702536346013239,524288 --field-trial-handle=2320,i,15881688546246273127,1714465324337101481,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3836,i,422502643497596848,7129106864582429384,524288 --field-trial-handle=2320,i,15881688546246273127,1714465324337101481,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,11115431782057571015,7080177178240336490,524288 --field-trial-handle=2320,i,15881688546246273127,1714465324337101481,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,11286078089624703166,13510543891499455550,524288 --field-trial-handle=2320,i,15881688546246273127,1714465324337101481,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,11286078089624703166,13510543891499455550,524288 --field-trial-handle=2320,i,15881688546246273127,1714465324337101481,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,12370454776152334714,4224916083390058603,524288 --field-trial-handle=2320,i,15881688546246273127,1714465324337101481,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,3674526545928084990,4167741482121246594,524288 --field-trial-handle=2320,i,15881688546246273127,1714465324337101481,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,373719129301526416,1183997065370014755,524288 --field-trial-handle=2320,i,15881688546246273127,1714465324337101481,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6776,i,277626147729640100,18009533836382604277,524288 --field-trial-handle=2320,i,15881688546246273127,1714465324337101481,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,9964814439270174670,6580753994022514426,524288 --field-trial-handle=2320,i,15881688546246273127,1714465324337101481,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,4563989630992518591,17619014642791643030,524288 --field-trial-handle=2320,i,15881688546246273127,1714465324337101481,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4352,i,9876652429639686803,3868948001615983317,524288 --field-trial-handle=2320,i,15881688546246273127,1714465324337101481,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,7540469478135788676,12818885023173672214,524288 --field-trial-handle=2320,i,15881688546246273127,1714465324337101481,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,1440210830922036644,16463317392156633770,524288 --field-trial-handle=2320,i,15881688546246273127,1714465324337101481,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,14696163318713014789,15258857655726319036,524288 --field-trial-handle=2320,i,15881688546246273127,1714465324337101481,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2808,i,8230185673198394968,16534046096122365410,524288 --field-trial-handle=2320,i,15881688546246273127,1714465324337101481,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5044,i,13075314942204578221,13081677367189296670,262144 --field-trial-handle=2320,i,15881688546246273127,1714465324337101481,262144 --variations-seed-version --mojo-platform-channel-handle=924 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,10140979771269801422,17339099057031886585,524288 --field-trial-handle=2320,i,15881688546246273127,1714465324337101481,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\ebwtomgeywqojgbz.sysC:\Temp\ebwtomgeywqojgbz.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\tolgdyvqol.sysC:\Temp\tolgdyvqol.sys1⤵
- Executes dropped EXE
-
C:\Temp\igayvqnifa.sysC:\Temp\igayvqnifa.sys1⤵
- Executes dropped EXE
-
C:\Temp\nkfcayvpni.sysC:\Temp\nkfcayvpni.sys1⤵
- Executes dropped EXE
-
C:\Temp\xvpnhfaxsp.sysC:\Temp\xvpnhfaxsp.sys1⤵
- Executes dropped EXE
-
C:\Temp\khczxupmhe.sysC:\Temp\khczxupmhe.sys1⤵
- Executes dropped EXE
-
C:\Temp\kecwuomjhb.sysC:\Temp\kecwuomjhb.sys1⤵
- Executes dropped EXE
-
C:\Temp\hbzurmkecw.sysC:\Temp\hbzurmkecw.sys1⤵
- Executes dropped EXE
-
C:\Temp\mgeywqomje.sysC:\Temp\mgeywqomje.sys1⤵
- Executes dropped EXE
-
C:\Temp\gaytqlidbv.sysC:\Temp\gaytqlidbv.sys1⤵
- Executes dropped EXE
-
C:\Temp\ykidavsqli.sysC:\Temp\ykidavsqli.sys1⤵
- Executes dropped EXE
-
C:\Temp\dxvqnlfdbv.sysC:\Temp\dxvqnlfdbv.sys1⤵
-
C:\Temp\xvsnkfdxvp.sysC:\Temp\xvsnkfdxvp.sys1⤵
-
C:\Temp\fzxupnkfcx.sysC:\Temp\fzxupnkfcx.sys1⤵
-
C:\Temp\urpnhfzxrp.sysC:\Temp\urpnhfzxrp.sys1⤵
-
C:\Temp\ezxrpkeczu.sysC:\Temp\ezxrpkeczu.sys1⤵
-
C:\Temp\gezwrojhey.sysC:\Temp\gezwrojhey.sys1⤵
-
C:\Temp\jdbwtomgey.sysC:\Temp\jdbwtomgey.sys1⤵
-
C:\Temp\oigbytqljd.sysC:\Temp\oigbytqljd.sys1⤵
-
C:\Temp\lidayvtnli.sysC:\Temp\lidayvtnli.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
dbvtomgewo.exe
ebwtomgeywqojgbz.exe
ebwtomgeywqojgbz.sys
fdyvqnifdx.exe
hfcaupnkfd.exe
i_dbvtomgewo.exe
i_fdyvqnifdx.exe
i_hfcaupnkfd.exe
i_nlidbvtnlf.exe
i_usnkfdxvpn.exe
igayvqnifa.sys
khczxupmhe.sys
mhfzxrpkhc.exe
nkfcayvpni.sys
nlidbvtnlf.exe
tolgdyvqol.sys
usnkfdxvpn.exe
xvpnhfaxsp.sys
23864c5e-62a9-4cdc-8b77-7cee36239b83.tmp
3186a797-2a10-462c-8d1a-ad10ace9b644.tmp
737aec84-54a3-404c-87b4-de8f2c8dd122.tmp
settings.dat
settings.dat
5468d109-5f31-4e7e-aeec-9061941b121d.tmp
9bb03835-e363-4d3e-a4f4-cf5065f9a203.tmp
temp-index
the-real-index
fdb83fff-88c7-4c77-9a1b-3c4ff112a9fc.tmp
dasherSettingSchema.json
80560e63-f887-43b7-a570-ec6588a37c8c.tmp
c6400102-0929-4082-bff7-7491409f3230.tmp
d9ed90b6-02ef-4e6d-8b60-c411c45c65a5.tmp
bef325ed-bd40-4fca-a7b7-c8bbba5bd75d.tmp
dd019988-0108-42ff-8e7d-38fbe28bb88d.tmp
fffcdb16-3be5-4229-a347-1514d91f4b1c.tmp
OperationConfig
f640faba-9fcf-4977-a4fd-9d0a2baca3c4.tmp
c17936f9-2e74-4d6a-b3da-4f5241bc14d4.tmp
c7eb6bf1-550a-4da9-8c9a-454a4d388643.tmp
2099af6d-7dc7-4e37-b4a4-b3fe3807a811.tmp
436ddd9f-f540-482d-bf3b-34254b5e0634.tmp
531387bb-72af-4cf5-87f2-d2cd915a3b24.tmp
metadata.json
d6e400f1-cdd4-4c1c-b65e-654492098029.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
522c29a7-0d2b-46b1-b019-88fc4669431f.tmp
afbd888e-91c3-4e6d-8af0-c901bf6500cb.tmp
2355c8da-14fc-459b-ba5d-4de4b1a5f5ad.tmp
67c72fc3-091c-4893-ba23-efe63d1c66a3.tmp
content.js
messages.json
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/1152-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1932-585-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2236-717-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2852-713-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3036-603-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3036-581-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3500-674-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3692-483-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3840-676-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3840-662-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4292-616-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4444-566-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4444-560-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4464-687-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4580-636-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4752-650-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5100-564-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5148-523-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5500-691-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5500-735-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5692-434-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5696-536-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5896-511-0x0000000000010000-0x00000000000AB000-memory.dmp