Analysis
- max time kernel
148s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
04/05/2026, 18:15
General
- Target 2026-05-04_8e1d006c0982a5a15f08d69cdafb6024_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample260504-wv61mshx21
- SHA256 14f93f2962a443a5bb8946d10bee850d3f5da6f1ae0f8dda9dd6c1f45ec818f7
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 1 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 29 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_8e1d006c0982a5a15f08d69cdafb6024_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-04_8e1d006c0982a5a15f08d69cdafb6024_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\zxspkicausmkfcxv.exeC:\Temp\zxspkicausmkfcxv.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hfzxrpkhcz.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\hfzxrpkhcz.exeC:\Temp\hfzxrpkhcz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hfzxrpkhcz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hfzxrpkhcz.exeC:\Temp\i_hfzxrpkhcz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hezxrpjhbz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hezxrpjhbz.exeC:\Temp\hezxrpjhbz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hezxrpjhbz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hezxrpjhbz.exeC:\Temp\i_hezxrpjhbz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hbztrljebw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hbztrljebw.exeC:\Temp\hbztrljebw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hbztrljebw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hbztrljebw.exeC:\Temp\i_hbztrljebw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rmgebwuomg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rmgebwuomg.exeC:\Temp\rmgebwuomg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rmgebwuomg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rmgebwuomg.exeC:\Temp\i_rmgebwuomg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\oigbywqlgt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\oigbywqlgt.exeC:\Temp\oigbywqlgt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_oigbywqlgt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_oigbywqlgt.exeC:\Temp\i_oigbywqlgt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\idyvqoigav.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\idyvqoigav.exeC:\Temp\idyvqoigav.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_idyvqoigav.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_idyvqoigav.exeC:\Temp\i_idyvqoigav.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dxvqnlfdys.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dxvqnlfdys.exeC:\Temp\dxvqnlfdys.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dxvqnlfdys.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dxvqnlfdys.exeC:\Temp\i_dxvqnlfdys.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vqkicausnk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vqkicausnk.exeC:\Temp\vqkicausnk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vqkicausnk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vqkicausnk.exeC:\Temp\i_vqkicausnk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hfzxspkica.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hfzxspkica.exeC:\Temp\hfzxspkica.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hfzxspkica.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hfzxspkica.exeC:\Temp\i_hfzxspkica.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pkecwupmhe.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pkecwupmhe.exeC:\Temp\pkecwupmhe.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pkecwupmhe.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pkecwupmhe.exeC:\Temp\i_pkecwupmhe.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omgezwupjh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\omgezwupjh.exeC:\Temp\omgezwupjh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omgezwupjh.exe ups_ins3⤵
-
C:\Temp\i_omgezwupjh.exeC:\Temp\i_omgezwupjh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hbztrmjeuo.exe ups_run3⤵
-
C:\Temp\hbztrmjeuo.exeC:\Temp\hbztrmjeuo.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hbztrmjeuo.exe ups_ins3⤵
-
C:\Temp\i_hbztrmjeuo.exeC:\Temp\i_hbztrmjeuo.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ojdbvtolge.exe ups_run3⤵
-
C:\Temp\ojdbvtolge.exeC:\Temp\ojdbvtolge.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ojdbvtolge.exe ups_ins3⤵
-
C:\Temp\i_ojdbvtolge.exeC:\Temp\i_ojdbvtolge.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtnlfdyvqo.exe ups_run3⤵
-
C:\Temp\vtnlfdyvqo.exeC:\Temp\vtnlfdyvqo.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vtnlfdyvqo.exe ups_ins3⤵
-
C:\Temp\i_vtnlfdyvqo.exeC:\Temp\i_vtnlfdyvqo.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dxvpnigavt.exe ups_run3⤵
-
C:\Temp\dxvpnigavt.exeC:\Temp\dxvpnigavt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dxvpnigavt.exe ups_ins3⤵
-
C:\Temp\i_dxvpnigavt.exeC:\Temp\i_dxvpnigavt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nifaysqkfd.exe ups_run3⤵
-
C:\Temp\nifaysqkfd.exeC:\Temp\nifaysqkfd.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nifaysqkfd.exe ups_ins3⤵
-
C:\Temp\i_nifaysqkfd.exeC:\Temp\i_nifaysqkfd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\causnkfcxv.exe ups_run3⤵
-
C:\Temp\causnkfcxv.exeC:\Temp\causnkfcxv.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_causnkfcxv.exe ups_ins3⤵
-
C:\Temp\i_causnkfcxv.exeC:\Temp\i_causnkfcxv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pjhczusmke.exe ups_run3⤵
-
C:\Temp\pjhczusmke.exeC:\Temp\pjhczusmke.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pjhczusmke.exe ups_ins3⤵
-
C:\Temp\i_pjhczusmke.exeC:\Temp\i_pjhczusmke.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hbztrmjecw.exe ups_run3⤵
-
C:\Temp\hbztrmjecw.exeC:\Temp\hbztrmjecw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hbztrmjecw.exe ups_ins3⤵
-
C:\Temp\i_hbztrmjecw.exeC:\Temp\i_hbztrmjecw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x20c,0x7ffa81c1c188,0x7ffa81c1c194,0x7ffa81c1c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,3407235297865896973,5228128720994151181,524288 --field-trial-handle=2096,i,12550228576861093687,15456235396070841135,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2368,i,5809331337120403599,16499072058734278135,524288 --field-trial-handle=2096,i,12550228576861093687,15456235396070841135,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1560,i,13763761720802795339,16571857919083472012,262144 --field-trial-handle=2096,i,12550228576861093687,15456235396070841135,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,4918753385911793813,1371695453109242716,2097152 --field-trial-handle=2096,i,12550228576861093687,15456235396070841135,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,1999948089507345938,4718439693789965390,2097152 --field-trial-handle=2096,i,12550228576861093687,15456235396070841135,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,10218098014375407883,4132953023655626623,524288 --field-trial-handle=2096,i,12550228576861093687,15456235396070841135,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,7620798706379727687,16415805047750596078,524288 --field-trial-handle=2096,i,12550228576861093687,15456235396070841135,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,11649358701036372983,3922383198691224361,524288 --field-trial-handle=2096,i,12550228576861093687,15456235396070841135,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,3579008541047601993,989168725790176080,524288 --field-trial-handle=2096,i,12550228576861093687,15456235396070841135,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:144⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11285⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,11649358701036372983,3922383198691224361,524288 --field-trial-handle=2096,i,12550228576861093687,15456235396070841135,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,6617792330351828735,13595183341704905260,524288 --field-trial-handle=2096,i,12550228576861093687,15456235396070841135,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,14517891799171349313,4417337157403614930,524288 --field-trial-handle=2096,i,12550228576861093687,15456235396070841135,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,5607397773131483077,5732761168661418203,524288 --field-trial-handle=2096,i,12550228576861093687,15456235396070841135,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,7455073547089197094,1345021577430230889,524288 --field-trial-handle=2096,i,12550228576861093687,15456235396070841135,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,12932767016233029015,18050533065455364852,524288 --field-trial-handle=2096,i,12550228576861093687,15456235396070841135,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,9112562200256578007,12973984083019501683,524288 --field-trial-handle=2096,i,12550228576861093687,15456235396070841135,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,4620124900843938886,12170649908467248200,524288 --field-trial-handle=2096,i,12550228576861093687,15456235396070841135,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,15519571346890997759,3964739909296771359,524288 --field-trial-handle=2096,i,12550228576861093687,15456235396070841135,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,11399598941004206824,1676181258975380710,524288 --field-trial-handle=2096,i,12550228576861093687,15456235396070841135,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,2444848865958662041,5704665811629378521,524288 --field-trial-handle=2096,i,12550228576861093687,15456235396070841135,262144 --variations-seed-version --mojo-platform-channel-handle=880 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6088,i,14360751741415700328,3588276105623651476,262144 --field-trial-handle=2096,i,12550228576861093687,15456235396070841135,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2012,i,13691519579025787064,11749247889297319325,524288 --field-trial-handle=2096,i,12550228576861093687,15456235396070841135,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\zxspkicausmkfcxv.sysC:\Temp\zxspkicausmkfcxv.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\cxupnhxsmk.sysC:\Temp\cxupnhxsmk.sys1⤵
- Executes dropped EXE
-
C:\Temp\zwrpjhczur.sysC:\Temp\zwrpjhczur.sys1⤵
- Executes dropped EXE
-
C:\Temp\ywuomgeywr.sysC:\Temp\ywuomgeywr.sys1⤵
- Executes dropped EXE
-
C:\Temp\bvtomgeywr.sysC:\Temp\bvtomgeywr.sys1⤵
- Executes dropped EXE
-
C:\Temp\tnlfdyvqoi.sysC:\Temp\tnlfdyvqoi.sys1⤵
- Executes dropped EXE
-
C:\Temp\vqkidavtqk.sysC:\Temp\vqkidavtqk.sys1⤵
- Executes dropped EXE
-
C:\Temp\dausnkfdxv.sysC:\Temp\dausnkfdxv.sys1⤵
- Executes dropped EXE
-
C:\Temp\snkfcxvpni.sysC:\Temp\snkfcxvpni.sys1⤵
- Executes dropped EXE
-
C:\Temp\uspjhczusm.sysC:\Temp\uspjhczusm.sys1⤵
- Executes dropped EXE
-
C:\Temp\hczurmkhcz.sysC:\Temp\hczurmkhcz.sys1⤵
- Executes dropped EXE
-
C:\Temp\rpjhbztrmj.sysC:\Temp\rpjhbztrmj.sys1⤵
-
C:\Temp\trljdbvtol.sysC:\Temp\trljdbvtol.sys1⤵
-
C:\Temp\igdytqlfdy.sysC:\Temp\igdytqlfdy.sys1⤵
-
C:\Temp\sqlavtnlfd.sysC:\Temp\sqlavtnlfd.sys1⤵
-
C:\Temp\dxvpnifays.sysC:\Temp\dxvpnifays.sys1⤵
-
C:\Temp\nhfzxspkic.sysC:\Temp\nhfzxspkic.sys1⤵
-
C:\Temp\ausmkecxup.sysC:\Temp\ausmkecxup.sys1⤵
-
C:\Temp\omkecwuomh.sysC:\Temp\omkecwuomh.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CreateProcess.exe
bvtomgeywr.sys
cxupnhxsmk.sys
hbztrljebw.exe
hezxrpjhbz.exe
hfzxrpkhcz.exe
i_hbztrljebw.exe
i_hezxrpjhbz.exe
i_hfzxrpkhcz.exe
i_idyvqoigav.exe
i_oigbywqlgt.exe
i_rmgebwuomg.exe
idyvqoigav.exe
oigbywqlgt.exe
rmgebwuomg.exe
tnlfdyvqoi.sys
ywuomgeywr.sys
zwrpjhczur.sys
zxspkicausmkfcxv.exe
zxspkicausmkfcxv.sys
autofill_bypass_cache_forms.json
edge_autofill_global_block_list.json
v1FieldTypes.json
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
SiteList-Enterprise.json
HubApps
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
CURRENT
MANIFEST-000001
domain_actions.dll
data.txt
Local State
Local State
Local State
Local State
Local State
Local State
keys.json
metadata.json
metadata.json
metadata.json
metadata.json
3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
metadata.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
dasherSettingSchema.json
manifest.json
service_worker_bin_prod.js
manifest.json
128.png
messages.json
manifest.json
manifest.json
manifest.json
manifest.json
memory/484-1082-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/700-1070-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1532-1102-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1548-261-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1972-798-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2084-894-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2440-646-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2828-60-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2840-230-0x000001FE25000000-0x000001FE25378000-memory.dmp
memory/2840-229-0x000001FE25000000-0x000001FE25378000-memory.dmp
memory/3624-1036-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3624-1004-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3732-204-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4588-1026-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4652-983-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4988-882-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4988-842-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5016-241-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5180-852-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5180-830-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5304-1001-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5304-969-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5476-933-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5476-978-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5696-89-0x000002A985FA0000-0x000002A985FA9000-memory.dmp
memory/5696-88-0x000002A985E20000-0x000002A985F0A000-memory.dmp
memory/5872-1047-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6088-855-0x0000000000010000-0x00000000000AB000-memory.dmp