Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
13/11/2026, 02:25
General
- Target 2026-11-12_5a0d96e962634af4b11aea1745141c59_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 381KB
- Sample261113-cwtbdsey7s
- SHA256 8e99acbe2b5337eb2c208aa2ced7e6e8e05d6605eda435ddc827b073f9036fdb
Score
10/10
Malware Config
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-12_5a0d96e962634af4b11aea1745141c59_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-12_5a0d96e962634af4b11aea1745141c59_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\jeuomgeywrojhbzt.exeC:\Temp\jeuomgeywrojhbzt.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ebwtolgeyw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\ebwtolgeyw.exeC:\Temp\ebwtolgeyw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ebwtolgeyw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ebwtolgeyw.exeC:\Temp\i_ebwtolgeyw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lgdyvqoigd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lgdyvqoigd.exeC:\Temp\lgdyvqoigd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lgdyvqoigd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lgdyvqoigd.exeC:\Temp\i_lgdyvqoigd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qnlfdbysqo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qnlfdbysqo.exeC:\Temp\qnlfdbysqo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qnlfdbysqo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qnlfdbysqo.exeC:\Temp\i_qnlfdbysqo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qkidavtnlf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qkidavtnlf.exeC:\Temp\qkidavtnlf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qkidavtnlf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qkidavtnlf.exeC:\Temp\i_qkidavtnlf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fcxvpnhfax.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fcxvpnhfax.exeC:\Temp\fcxvpnhfax.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fcxvpnhfax.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fcxvpnhfax.exeC:\Temp\i_fcxvpnhfax.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\caxspkhcau.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\caxspkhcau.exeC:\Temp\caxspkhcau.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_caxspkhcau.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_caxspkhcau.exeC:\Temp\i_caxspkhcau.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nhfzxrpkhc.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nhfzxrpkhc.exeC:\Temp\nhfzxrpkhc.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nhfzxrpkhc.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nhfzxrpkhc.exeC:\Temp\i_nhfzxrpkhc.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hbzurmkecw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hbzurmkecw.exeC:\Temp\hbzurmkecw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hbzurmkecw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hbzurmkecw.exeC:\Temp\i_hbzurmkecw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zwqojhbztr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zwqojhbztr.exeC:\Temp\zwqojhbztr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zwqojhbztr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zwqojhbztr.exeC:\Temp\i_zwqojhbztr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rojytrljdb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rojytrljdb.exeC:\Temp\rojytrljdb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rojytrljdb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rojytrljdb.exeC:\Temp\i_rojytrljdb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wqoigaytrl.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wqoigaytrl.exeC:\Temp\wqoigaytrl.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wqoigaytrl.exe ups_ins3⤵
-
C:\Temp\i_wqoigaytrl.exeC:\Temp\i_wqoigaytrl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ysqligaysq.exe ups_run3⤵
-
C:\Temp\ysqligaysq.exeC:\Temp\ysqligaysq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ysqligaysq.exe ups_ins3⤵
-
C:\Temp\i_ysqligaysq.exeC:\Temp\i_ysqligaysq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqkicavsnk.exe ups_run3⤵
-
C:\Temp\sqkicavsnk.exeC:\Temp\sqkicavsnk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqkicavsnk.exe ups_ins3⤵
-
C:\Temp\i_sqkicavsnk.exeC:\Temp\i_sqkicavsnk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mkhfzxusmk.exe ups_run3⤵
-
C:\Temp\mkhfzxusmk.exeC:\Temp\mkhfzxusmk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mkhfzxusmk.exe ups_ins3⤵
-
C:\Temp\i_mkhfzxusmk.exeC:\Temp\i_mkhfzxusmk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cxupnhfzxs.exe ups_run3⤵
-
C:\Temp\cxupnhfzxs.exeC:\Temp\cxupnhfzxs.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cxupnhfzxs.exe ups_ins3⤵
-
C:\Temp\i_cxupnhfzxs.exeC:\Temp\i_cxupnhfzxs.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bzurmkecwu.exe ups_run3⤵
-
C:\Temp\bzurmkecwu.exeC:\Temp\bzurmkecwu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bzurmkecwu.exe ups_ins3⤵
-
C:\Temp\i_bzurmkecwu.exeC:\Temp\i_bzurmkecwu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rojebwurmj.exe ups_run3⤵
-
C:\Temp\rojebwurmj.exeC:\Temp\rojebwurmj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rojebwurmj.exe ups_ins3⤵
-
C:\Temp\i_rojebwurmj.exeC:\Temp\i_rojebwurmj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bomgeywqoj.exe ups_run3⤵
-
C:\Temp\bomgeywqoj.exeC:\Temp\bomgeywqoj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bomgeywqoj.exe ups_ins3⤵
-
C:\Temp\i_bomgeywqoj.exeC:\Temp\i_bomgeywqoj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywqolgdywq.exe ups_run3⤵
-
C:\Temp\ywqolgdywq.exeC:\Temp\ywqolgdywq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywqolgdywq.exe ups_ins3⤵
-
C:\Temp\i_ywqolgdywq.exeC:\Temp\i_ywqolgdywq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqlidbvtnl.exe ups_run3⤵
-
C:\Temp\sqlidbvtnl.exeC:\Temp\sqlidbvtnl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffa0035c188,0x7ffa0035c194,0x7ffa0035c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1940,i,18001421357991589683,3178890095005154398,262144 --field-trial-handle=2508,i,10356086405350035492,17229083381294033385,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2152,i,17299894298631465902,13639000784376332323,524288 --field-trial-handle=2508,i,10356086405350035492,17229083381294033385,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2652,i,8397380714982225103,9075171728938138331,524288 --field-trial-handle=2508,i,10356086405350035492,17229083381294033385,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,3346343342173583718,13822067940185055041,2097152 --field-trial-handle=2508,i,10356086405350035492,17229083381294033385,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,11915056704495538932,8977985323284419236,2097152 --field-trial-handle=2508,i,10356086405350035492,17229083381294033385,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,16755806712137168732,17636910493827856850,2097152 --field-trial-handle=2508,i,10356086405350035492,17229083381294033385,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,1438861268247879962,13088182292846699346,2097152 --field-trial-handle=2508,i,10356086405350035492,17229083381294033385,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,13346049798201896950,17009539506683227193,524288 --field-trial-handle=2508,i,10356086405350035492,17229083381294033385,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,8148701924402712727,12378176274811266751,524288 --field-trial-handle=2508,i,10356086405350035492,17229083381294033385,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,1627853685799135886,192514666196965459,524288 --field-trial-handle=2508,i,10356086405350035492,17229083381294033385,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,4531075457275020813,6706868025435379210,524288 --field-trial-handle=2508,i,10356086405350035492,17229083381294033385,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,4531075457275020813,6706868025435379210,524288 --field-trial-handle=2508,i,10356086405350035492,17229083381294033385,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,5291697816149623796,16370111934078639854,524288 --field-trial-handle=2508,i,10356086405350035492,17229083381294033385,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,1015391817342032951,12040677313829070055,524288 --field-trial-handle=2508,i,10356086405350035492,17229083381294033385,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,8259079192619345256,14360660633530850306,524288 --field-trial-handle=2508,i,10356086405350035492,17229083381294033385,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6808,i,6130978206172615305,12102675856966699084,524288 --field-trial-handle=2508,i,10356086405350035492,17229083381294033385,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1208,i,1548631160437248073,4053281083271740738,524288 --field-trial-handle=2508,i,10356086405350035492,17229083381294033385,262144 --variations-seed-version --mojo-platform-channel-handle=1288 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1300,i,10737327682321594945,17467371508386162666,524288 --field-trial-handle=2508,i,10356086405350035492,17229083381294033385,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1304,i,14757423642799986831,14594968360693105525,524288 --field-trial-handle=2508,i,10356086405350035492,17229083381294033385,262144 --variations-seed-version --mojo-platform-channel-handle=1452 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,12348274592944055357,9738977421800928718,524288 --field-trial-handle=2508,i,10356086405350035492,17229083381294033385,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,3888494358117956168,748188924604633379,524288 --field-trial-handle=2508,i,10356086405350035492,17229083381294033385,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,868844707908711305,4729627288532564872,524288 --field-trial-handle=2508,i,10356086405350035492,17229083381294033385,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,17599760977216658600,4659710437266562731,524288 --field-trial-handle=2508,i,10356086405350035492,17229083381294033385,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6768,i,4729667409237539874,9730915193167851050,262144 --field-trial-handle=2508,i,10356086405350035492,17229083381294033385,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,6051467466304134321,1595558766943055918,524288 --field-trial-handle=2508,i,10356086405350035492,17229083381294033385,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\jeuomgeywrojhbzt.sysC:\Temp\jeuomgeywrojhbzt.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\vtomgeywqo.sysC:\Temp\vtomgeywqo.sys1⤵
- Executes dropped EXE
-
C:\Temp\wqoigayvqo.sysC:\Temp\wqoigayvqo.sys1⤵
- Executes dropped EXE
-
C:\Temp\snkifaysqk.sysC:\Temp\snkifaysqk.sys1⤵
- Executes dropped EXE
-
C:\Temp\kfdxvpnhfd.sysC:\Temp\kfdxvpnhfd.sys1⤵
- Executes dropped EXE
-
C:\Temp\kicausqkhf.sysC:\Temp\kicausqkhf.sys1⤵
- Executes dropped EXE
-
C:\Temp\khcausmkhc.sysC:\Temp\khcausmkhc.sys1⤵
- Executes dropped EXE
-
C:\Temp\mhezxrpmhe.sysC:\Temp\mhezxrpmhe.sys1⤵
- Executes dropped EXE
-
C:\Temp\omgecwjgby.sysC:\Temp\omgecwjgby.sys1⤵
- Executes dropped EXE
-
C:\Temp\wrojhbztro.sysC:\Temp\wrojhbztro.sys1⤵
- Executes dropped EXE
-
C:\Temp\tqljdbvtol.sysC:\Temp\tqljdbvtol.sys1⤵
- Executes dropped EXE
-
C:\Temp\aysqoigays.sysC:\Temp\aysqoigays.sys1⤵
-
C:\Temp\xvqnifaysq.sysC:\Temp\xvqnifaysq.sys1⤵
-
C:\Temp\vpnhfcaxsp.sysC:\Temp\vpnhfcaxsp.sys1⤵
-
C:\Temp\caupmhfzxr.sysC:\Temp\caupmhfzxr.sys1⤵
-
C:\Temp\hfzxrpjhcz.sysC:\Temp\hfzxrpjhcz.sys1⤵
-
C:\Temp\cwuomgeywr.sysC:\Temp\cwuomgeywr.sys1⤵
-
C:\Temp\bwuomgeywu.sysC:\Temp\bwuomgeywu.sys1⤵
-
C:\Temp\bywtolgdbv.sysC:\Temp\bywtolgdbv.sys1⤵
-
C:\Temp\sqlidbvtnl.sysC:\Temp\sqlidbvtnl.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
caxspkhcau.exe
ebwtolgeyw.exe
fcxvpnhfax.exe
i_ebwtolgeyw.exe
i_fcxvpnhfax.exe
i_lgdyvqoigd.exe
i_qkidavtnlf.exe
i_qnlfdbysqo.exe
jeuomgeywrojhbzt.exe
jeuomgeywrojhbzt.sys
kfdxvpnhfd.sys
kicausqkhf.sys
lgdyvqoigd.exe
qkidavtnlf.exe
qnlfdbysqo.exe
snkifaysqk.sys
vtomgeywqo.sys
wqoigayvqo.sys
1317add1-9735-4185-9f7e-782e96b23371.tmp
23cd4761-60be-4b13-91c9-d618321aed1e.tmp
5cb33163-08f4-4889-ac2d-fde113132e58.tmp
66f1a3df-f960-43fd-88c7-65de1717b823.tmp
87aac617-00d4-4cb1-bd53-51de5c8fb307.tmp
settings.dat
settings.dat
350d274c-a374-4a2a-800b-dfda155133ec.tmp
4da4909a-0b3b-42c7-a2b7-21081cd46902.tmp
956d3309-93cf-46ec-a89a-cc0c6b76b4ae.tmp
temp-index
the-real-index
f25a110a-491d-49ab-9c51-df5cd72ce61e.tmp
dasherSettingSchema.json
6df9cc7e-0782-4c96-9a3e-bf189573af16.tmp
77312510-b212-403e-93ad-846f43a5a116.tmp
e3e0fcdb-5f59-496d-a114-1a186dff4407.tmp
bcc71829-839c-426d-b3f1-f272d6967c98.tmp
ec2b11c4-a104-4598-be49-16ba317f7396.tmp
e88c548f-ef2c-4c68-8735-fd02e4eaf6c5.tmp
manifest.json
manifest.json
manifest.json
abdbc42f-c63f-46cf-95ae-5e94090085da.tmp
33854414-1619-4c1e-aca5-e9535ec36416.tmp
a06874b6-352f-40ca-ad52-07fa34d9aa00.tmp
dd485ce2-44e1-4993-882b-140d434fcf68.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
a7ce2214-cc2b-4f18-a686-4bc6aaf647d1.tmp
metadata.json
f2bcbff4-ed0d-4eeb-a726-b8d22c786e48.tmp
messages.json
9d85ae44-91c3-4c1e-a29b-8a0249d27cd1.tmp
content.js
nav_config.json
llm_user_input_extractor_config.json
office_endpoints_list.json
smart_switch_list.json
manifest.json
protocols.json
CreateProcess.exe
memory/616-688-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1052-724-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1504-729-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1656-663-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1656-685-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2600-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2752-514-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2908-587-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3112-437-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3664-756-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4360-667-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4420-583-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4464-618-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4780-567-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4804-539-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4804-564-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4876-638-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4904-752-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4952-526-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5600-562-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5616-486-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5732-703-0x0000000000010000-0x00000000000AB000-memory.dmp