Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
13/11/2026, 01:14
General
- Target 2026-11-12_6898d7f179969c3bb80463572bfe7df7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 381KB
- Sample261113-bl2pcayv7j
- SHA256 0b2ae576c234e4419bff2bc8f4e50646888b8ebbc6dc1b62cc056f896157468b
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-12_6898d7f179969c3bb80463572bfe7df7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-12_6898d7f179969c3bb80463572bfe7df7_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\geywqomgeywrojgb.exeC:\Temp\geywqomgeywrojgb.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljebwtojew.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\ljebwtojew.exeC:\Temp\ljebwtojew.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljebwtojew.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ljebwtojew.exeC:\Temp\i_ljebwtojew.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\aywqoigayv.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\aywqoigayv.exeC:\Temp\aywqoigayv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_aywqoigayv.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_aywqoigayv.exeC:\Temp\i_aywqoigayv.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qoigaxvqni.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qoigaxvqni.exeC:\Temp\qoigaxvqni.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qoigaxvqni.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qoigaxvqni.exeC:\Temp\i_qoigaxvqni.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kidavsqkid.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kidavsqkid.exeC:\Temp\kidavsqkid.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kidavsqkid.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kidavsqkid.exeC:\Temp\i_kidavsqkid.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ausnkizxsp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ausnkizxsp.exeC:\Temp\ausnkizxsp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ausnkizxsp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ausnkizxsp.exeC:\Temp\i_ausnkizxsp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pmkecxupmk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pmkecxupmk.exeC:\Temp\pmkecxupmk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pmkecxupmk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pmkecxupmk.exeC:\Temp\i_pmkecxupmk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecwuomhezx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ecwuomhezx.exeC:\Temp\ecwuomhezx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecwuomhezx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ecwuomhezx.exeC:\Temp\i_ecwuomhezx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhbztrmjeb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jhbztrmjeb.exeC:\Temp\jhbztrmjeb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhbztrmjeb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jhbztrmjeb.exeC:\Temp\i_jhbztrmjeb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bwtrmjebwt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bwtrmjebwt.exeC:\Temp\bwtrmjebwt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bwtrmjebwt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bwtrmjebwt.exeC:\Temp\i_bwtrmjebwt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdbvtqoigd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jdbvtqoigd.exeC:\Temp\jdbvtqoigd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdbvtqoigd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jdbvtqoigd.exeC:\Temp\i_jdbvtqoigd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dyvqoigays.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dyvqoigays.exeC:\Temp\dyvqoigays.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dyvqoigays.exe ups_ins3⤵
-
C:\Temp\i_dyvqoigays.exeC:\Temp\i_dyvqoigays.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vsqlfdxvqn.exe ups_run3⤵
-
C:\Temp\vsqlfdxvqn.exeC:\Temp\vsqlfdxvqn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vsqlfdxvqn.exe ups_ins3⤵
-
C:\Temp\i_vsqlfdxvqn.exeC:\Temp\i_vsqlfdxvqn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\snkfdxvpnl.exe ups_run3⤵
-
C:\Temp\snkfdxvpnl.exeC:\Temp\snkfdxvpnl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_snkfdxvpnl.exe ups_ins3⤵
-
C:\Temp\i_snkfdxvpnl.exeC:\Temp\i_snkfdxvpnl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpnhfzxrpn.exe ups_run3⤵
-
C:\Temp\rpnhfzxrpn.exeC:\Temp\rpnhfzxrpn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpnhfzxrpn.exe ups_ins3⤵
-
C:\Temp\i_rpnhfzxrpn.exeC:\Temp\i_rpnhfzxrpn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\czxrmkecwu.exe ups_run3⤵
-
C:\Temp\czxrmkecwu.exeC:\Temp\czxrmkecwu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_czxrmkecwu.exe ups_ins3⤵
-
C:\Temp\i_czxrmkecwu.exeC:\Temp\i_czxrmkecwu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\heczurpjhe.exe ups_run3⤵
-
C:\Temp\heczurpjhe.exeC:\Temp\heczurpjhe.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_heczurpjhe.exe ups_ins3⤵
-
C:\Temp\i_heczurpjhe.exeC:\Temp\i_heczurpjhe.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hbztrmjhbz.exe ups_run3⤵
-
C:\Temp\hbztrmjhbz.exeC:\Temp\hbztrmjhbz.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hbztrmjhbz.exe ups_ins3⤵
-
C:\Temp\i_hbztrmjhbz.exeC:\Temp\i_hbztrmjhbz.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gbytrljdbw.exe ups_run3⤵
-
C:\Temp\gbytrljdbw.exeC:\Temp\gbytrljdbw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gbytrljdbw.exe ups_ins3⤵
-
C:\Temp\i_gbytrljdbw.exeC:\Temp\i_gbytrljdbw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ndaywqnlgd.exe ups_run3⤵
-
C:\Temp\ndaywqnlgd.exeC:\Temp\ndaywqnlgd.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ndaywqnlgd.exe ups_ins3⤵
-
C:\Temp\i_ndaywqnlgd.exeC:\Temp\i_ndaywqnlgd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tnlfdxvtni.exe ups_run3⤵
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff8ac69c188,0x7ff8ac69c194,0x7ff8ac69c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,84562143615913818,9284216014270157584,524288 --field-trial-handle=2372,i,15120171423036159715,13108102855270352103,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1728,i,12138413690241339912,4413952158106637995,262144 --field-trial-handle=2372,i,15120171423036159715,13108102855270352103,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2452,i,15259973037284857301,14820857161236043889,524288 --field-trial-handle=2372,i,15120171423036159715,13108102855270352103,262144 --variations-seed-version --mojo-platform-channel-handle=2828 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,2345369519474638269,2316204508113058029,2097152 --field-trial-handle=2372,i,15120171423036159715,13108102855270352103,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,8290085501182038502,4602514429755288983,2097152 --field-trial-handle=2372,i,15120171423036159715,13108102855270352103,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4352,i,2821484460676897640,6183637891724537316,2097152 --field-trial-handle=2372,i,15120171423036159715,13108102855270352103,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4332,i,3492197061024884450,1652497472846228383,2097152 --field-trial-handle=2372,i,15120171423036159715,13108102855270352103,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,10702272866984306720,10540829297944210854,524288 --field-trial-handle=2372,i,15120171423036159715,13108102855270352103,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,13974108487921283862,3440647498736318031,524288 --field-trial-handle=2372,i,15120171423036159715,13108102855270352103,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3764,i,14056124119871320434,5909123304126441884,524288 --field-trial-handle=2372,i,15120171423036159715,13108102855270352103,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,13209255364428912046,4184084278557491008,524288 --field-trial-handle=2372,i,15120171423036159715,13108102855270352103,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,13209255364428912046,4184084278557491008,524288 --field-trial-handle=2372,i,15120171423036159715,13108102855270352103,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,14279613470328138409,4553684173482620569,524288 --field-trial-handle=2372,i,15120171423036159715,13108102855270352103,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,15727595406548467305,2633283295983883925,524288 --field-trial-handle=2372,i,15120171423036159715,13108102855270352103,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,11930662666575108742,11060544170878273202,524288 --field-trial-handle=2372,i,15120171423036159715,13108102855270352103,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6908,i,14861474616597354445,4366352072148675229,524288 --field-trial-handle=2372,i,15120171423036159715,13108102855270352103,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4372,i,17136311348571354996,915033345443555102,524288 --field-trial-handle=2372,i,15120171423036159715,13108102855270352103,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4724,i,8128203070487513975,2073462112061578871,524288 --field-trial-handle=2372,i,15120171423036159715,13108102855270352103,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,18059459776700779546,5442488247701323043,524288 --field-trial-handle=2372,i,15120171423036159715,13108102855270352103,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2176,i,18167706556826955440,2849167180857690100,524288 --field-trial-handle=2372,i,15120171423036159715,13108102855270352103,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,788384119514362678,15733445131537517056,524288 --field-trial-handle=2372,i,15120171423036159715,13108102855270352103,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,5819160831740484171,16429312608255885691,524288 --field-trial-handle=2372,i,15120171423036159715,13108102855270352103,262144 --variations-seed-version --mojo-platform-channel-handle=940 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,13311066186143226501,10076734674205241556,524288 --field-trial-handle=2372,i,15120171423036159715,13108102855270352103,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6660,i,8155345851654422666,15357916056512441917,262144 --field-trial-handle=2372,i,15120171423036159715,13108102855270352103,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1220,i,2009619668508553504,5742251127384382352,524288 --field-trial-handle=2372,i,15120171423036159715,13108102855270352103,262144 --variations-seed-version --mojo-platform-channel-handle=1224 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\geywqomgeywrojgb.sysC:\Temp\geywqomgeywrojgb.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\dbvtnlgdyw.sysC:\Temp\dbvtnlgdyw.sys1⤵
- Executes dropped EXE
-
C:\Temp\davtnlfdyv.sysC:\Temp\davtnlfdyv.sys1⤵
- Executes dropped EXE
-
C:\Temp\nifaysqkif.sysC:\Temp\nifaysqkif.sys1⤵
- Executes dropped EXE
-
C:\Temp\icausnkfdx.sysC:\Temp\icausnkfdx.sys1⤵
- Executes dropped EXE
-
C:\Temp\pmkhczusmk.sysC:\Temp\pmkhczusmk.sys1⤵
- Executes dropped EXE
-
C:\Temp\pkhczurmke.sysC:\Temp\pkhczurmke.sys1⤵
- Executes dropped EXE
-
C:\Temp\mgezwromke.sysC:\Temp\mgezwromke.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhbztrojgb.sysC:\Temp\jhbztrojgb.sys1⤵
- Executes dropped EXE
-
C:\Temp\ligbytqoig.sysC:\Temp\ligbytqoig.sys1⤵
- Executes dropped EXE
-
C:\Temp\oljdywqolg.sysC:\Temp\oljdywqolg.sys1⤵
- Executes dropped EXE
-
C:\Temp\ysqlidbvtn.sysC:\Temp\ysqlidbvtn.sys1⤵
-
C:\Temp\axsqkhfaus.sysC:\Temp\axsqkhfaus.sys1⤵
-
C:\Temp\xspkhfzxvs.sysC:\Temp\xspkhfzxvs.sys1⤵
-
C:\Temp\hfcxrpjhcz.sysC:\Temp\hfcxrpjhcz.sys1⤵
-
C:\Temp\mhfzxrpjhb.sysC:\Temp\mhfzxrpjhb.sys1⤵
-
C:\Temp\jgeywuomge.sysC:\Temp\jgeywuomge.sys1⤵
-
C:\Temp\dbwtolgebw.sysC:\Temp\dbwtolgebw.sys1⤵
-
C:\Temp\oigeywqoig.sysC:\Temp\oigeywqoig.sys1⤵
-
C:\Temp\vtnlfdyvqo.sysC:\Temp\vtnlfdyvqo.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ausnkizxsp.exe
aywqoigayv.exe
davtnlfdyv.sys
dbvtnlgdyw.sys
geywqomgeywrojgb.exe
geywqomgeywrojgb.sys
i_ausnkizxsp.exe
i_aywqoigayv.exe
i_kidavsqkid.exe
i_ljebwtojew.exe
i_qoigaxvqni.exe
icausnkfdx.sys
kidavsqkid.exe
ljebwtojew.exe
nifaysqkif.sys
pmkecxupmk.exe
pmkhczusmk.sys
qoigaxvqni.exe
0e5542cd-143b-4cac-b358-5cdbd589c509.tmp
1cb73ff0-18dc-46a7-8e01-49d33f1ec376.tmp
3900ccaf-c41e-4a73-b151-22530ece9d7c.tmp
5d63eb8f-3b77-4ca6-9fae-063b7c833ab1.tmp
8dbb202a-2964-4700-83a2-eb4d0035816c.tmp
manifest.json
settings.dat
settings.dat
01a0b2e0-bf0e-4a48-83dd-4e53c6e14258.tmp
3fce2197-9ddc-4bf8-a5e7-b5fd9ed57b55.tmp
temp-index
the-real-index
0a1e8fe6-7175-40ae-b267-6bf00e4a4e9c.tmp
dasherSettingSchema.json
9cc70267-b4a2-4b2b-8b89-0e5af2432bd8.tmp
db97abdb-d668-46ee-95f5-07aae96b4f72.tmp
dbf95c85-480f-4577-896b-68b63b39f2a7.tmp
c8544a86-b630-4ac6-a138-f9fb221e87e6.tmp
ee341407-aaa8-4f90-a097-5d2d46bdfbfe.tmp
f25bc7f8-8ce6-49da-938a-48a3969404f8.tmp
13d31bd1-7584-4093-9369-2cdc309ddb70.tmp
OperationConfig
llm_user_input_extractor_config.json
manifest.json
manifest.json
manifest.json
01d3607c-cef8-429f-a791-8a7513040a14.tmp
95ec87fb-a36b-430b-b034-0ac75f146327.tmp
dd76b615-9c05-4e04-a566-25411aa4a603.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
92a360d3-a465-42b9-8ea2-505d0d208980.tmp
metadata.json
44549c2a-a023-4e7e-9554-e61a53345bbc.tmp
messages.json
content.js
baf633c8-0f66-4ff0-a8fc-ac1b1a4a0d91.tmp
office_endpoints_list.json
smart_switch_list.json
nav_config.json
protocols.json
CreateProcess.exe
memory/780-729-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1952-619-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2492-541-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2796-584-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3324-568-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3400-688-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3536-473-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3536-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4300-664-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4356-724-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4372-438-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4384-596-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4428-639-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4556-668-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4736-488-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4844-528-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5656-756-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5768-564-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5824-703-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5972-516-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5988-752-0x0000000000010000-0x00000000000AB000-memory.dmp