Analysis
- max time kernel
148s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/10/2026, 03:25
General
- Target 2026-10-01_c4802445f579c7c5f43e73c486b7cefd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261002-dys9vazz7p
- SHA256 1367292d6d5fb90a8e1147d7a7d1c9985060203cf3251e52ce41ff602aa9932b
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 9 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_c4802445f579c7c5f43e73c486b7cefd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_c4802445f579c7c5f43e73c486b7cefd_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\ecxupnhfzxrpkhca.exeC:\Temp\ecxupnhfzxrpkhca.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecxusnhfcx.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\ecxusnhfcx.exeC:\Temp\ecxusnhfcx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecxusnhfcx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ecxusnhfcx.exeC:\Temp\i_ecxusnhfcx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mkecwusmke.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mkecwusmke.exeC:\Temp\mkecwusmke.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mkecwusmke.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mkecwusmke.exeC:\Temp\i_mkecwusmke.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hbztrmjebw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hbztrmjebw.exeC:\Temp\hbztrmjebw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hbztrmjebw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hbztrmjebw.exeC:\Temp\i_hbztrmjebw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\eywrojhtrl.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\eywrojhtrl.exeC:\Temp\eywrojhtrl.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_eywrojhtrl.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_eywrojhtrl.exeC:\Temp\i_eywrojhtrl.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\oigbytrljd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\oigbytrljd.exeC:\Temp\oigbytrljd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_oigbytrljd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_oigbytrljd.exeC:\Temp\i_oigbytrljd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wqoigaytql.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wqoigaytql.exeC:\Temp\wqoigaytql.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wqoigaytql.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wqoigaytql.exeC:\Temp\i_wqoigaytql.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\igdyvpnkig.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\igdyvpnkig.exeC:\Temp\igdyvpnkig.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_igdyvpnkig.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_igdyvpnkig.exeC:\Temp\i_igdyvpnkig.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\aysqkicaqk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\aysqkicaqk.exeC:\Temp\aysqkicaqk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_aysqkicaqk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_aysqkicaqk.exeC:\Temp\i_aysqkicaqk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\smkfcxvpnh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\smkfcxvpnh.exeC:\Temp\smkfcxvpnh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_smkfcxvpnh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_smkfcxvpnh.exeC:\Temp\i_smkfcxvpnh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\czusmkecwu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\czusmkecwu.exeC:\Temp\czusmkecwu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_czusmkecwu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_czusmkecwu.exeC:\Temp\i_czusmkecwu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wuomgezwrp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wuomgezwrp.exeC:\Temp\wuomgezwrp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wuomgezwrp.exe ups_ins3⤵
-
C:\Temp\i_wuomgezwrp.exeC:\Temp\i_wuomgezwrp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mgezwjgbzt.exe ups_run3⤵
-
C:\Temp\mgezwjgbzt.exeC:\Temp\mgezwjgbzt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mgezwjgbzt.exe ups_ins3⤵
-
C:\Temp\i_mgezwjgbzt.exeC:\Temp\i_mgezwjgbzt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bztrljebwt.exe ups_run3⤵
-
C:\Temp\bztrljebwt.exeC:\Temp\bztrljebwt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bztrljebwt.exe ups_ins3⤵
-
C:\Temp\i_bztrljebwt.exeC:\Temp\i_bztrljebwt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qljdbvtnlj.exe ups_run3⤵
-
C:\Temp\qljdbvtnlj.exeC:\Temp\qljdbvtnlj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qljdbvtnlj.exe ups_ins3⤵
-
C:\Temp\i_qljdbvtnlj.exeC:\Temp\i_qljdbvtnlj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qkidavtnlf.exe ups_run3⤵
-
C:\Temp\qkidavtnlf.exeC:\Temp\qkidavtnlf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qkidavtnlf.exe ups_ins3⤵
-
C:\Temp\i_qkidavtnlf.exeC:\Temp\i_qkidavtnlf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ysqdavsnlf.exe ups_run3⤵
-
C:\Temp\ysqdavsnlf.exeC:\Temp\ysqdavsnlf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ysqdavsnlf.exe ups_ins3⤵
-
C:\Temp\i_ysqdavsnlf.exeC:\Temp\i_ysqdavsnlf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nkfdxvpnhf.exe ups_run3⤵
-
C:\Temp\nkfdxvpnhf.exeC:\Temp\nkfdxvpnhf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nkfdxvpnhf.exe ups_ins3⤵
-
C:\Temp\i_nkfdxvpnhf.exeC:\Temp\i_nkfdxvpnhf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\iczurpnkfc.exe ups_run3⤵
-
C:\Temp\iczurpnkfc.exeC:\Temp\iczurpnkfc.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_iczurpnkfc.exe ups_ins3⤵
-
C:\Temp\i_iczurpnkfc.exeC:\Temp\i_iczurpnkfc.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bzxrpjhbzx.exe ups_run3⤵
-
C:\Temp\bzxrpjhbzx.exeC:\Temp\bzxrpjhbzx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bzxrpjhbzx.exe ups_ins3⤵
-
C:\Temp\i_bzxrpjhbzx.exeC:\Temp\i_bzxrpjhbzx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ff93465c188,0x7ff93465c194,0x7ff93465c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1792,i,14106160367711928452,9252377754667186581,262144 --field-trial-handle=2416,i,13880639223435497893,11828486273006773579,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,8505414726339824244,12988737410337843587,524288 --field-trial-handle=2416,i,13880639223435497893,11828486273006773579,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,12083449632450688028,17735807478466408967,524288 --field-trial-handle=2416,i,13880639223435497893,11828486273006773579,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3372,i,4572922754158019239,12065261202887615150,2097152 --field-trial-handle=2416,i,13880639223435497893,11828486273006773579,262144 --variations-seed-version --mojo-platform-channel-handle=3148 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3368,i,13820796217883021586,1963158989390416610,2097152 --field-trial-handle=2416,i,13880639223435497893,11828486273006773579,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,8899548160319214646,5519345993639887561,2097152 --field-trial-handle=2416,i,13880639223435497893,11828486273006773579,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,11485641829158728795,14417728291317105023,2097152 --field-trial-handle=2416,i,13880639223435497893,11828486273006773579,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,3537784216503217582,2647194139152920650,524288 --field-trial-handle=2416,i,13880639223435497893,11828486273006773579,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4108,i,7283064792590073170,3159137509246689795,524288 --field-trial-handle=2416,i,13880639223435497893,11828486273006773579,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4104,i,10971298754000365686,14708502130067615110,524288 --field-trial-handle=2416,i,13880639223435497893,11828486273006773579,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,13814106434932634304,10891905925107433296,524288 --field-trial-handle=2416,i,13880639223435497893,11828486273006773579,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,13814106434932634304,10891905925107433296,524288 --field-trial-handle=2416,i,13880639223435497893,11828486273006773579,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,5126795659772728339,13634978669605901577,524288 --field-trial-handle=2416,i,13880639223435497893,11828486273006773579,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,17952058058246399890,2103545264970205028,524288 --field-trial-handle=2416,i,13880639223435497893,11828486273006773579,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,905988929641472500,7538980693757370557,524288 --field-trial-handle=2416,i,13880639223435497893,11828486273006773579,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,11493774226553269751,15414527327288500393,524288 --field-trial-handle=2416,i,13880639223435497893,11828486273006773579,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4276,i,17644756370592098137,2584811687661347995,524288 --field-trial-handle=2416,i,13880639223435497893,11828486273006773579,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6816,i,15390033986001473726,13086277819259961599,524288 --field-trial-handle=2416,i,13880639223435497893,11828486273006773579,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,5618048490731133242,6549050904093387932,524288 --field-trial-handle=2416,i,13880639223435497893,11828486273006773579,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,4710265810617169397,12878211578063511406,524288 --field-trial-handle=2416,i,13880639223435497893,11828486273006773579,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,15230307580320641933,5744429900755973693,524288 --field-trial-handle=2416,i,13880639223435497893,11828486273006773579,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6196,i,8843319169884133948,4653708097507207510,262144 --field-trial-handle=2416,i,13880639223435497893,11828486273006773579,262144 --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,12772683398388419373,11285152907282672366,524288 --field-trial-handle=2416,i,13880639223435497893,11828486273006773579,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\ecxupnhfzxrpkhca.sysC:\Temp\ecxupnhfzxrpkhca.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\zxrpjhczus.sysC:\Temp\zxrpjhczus.sys1⤵
- Executes dropped EXE
-
C:\Temp\urmkhczurp.sysC:\Temp\urmkhczurp.sys1⤵
- Executes dropped EXE
-
C:\Temp\eywrojhezw.sysC:\Temp\eywrojhezw.sys1⤵
- Executes dropped EXE
-
C:\Temp\rljebvtrlj.sysC:\Temp\rljebvtrlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\ywqoigdywq.sysC:\Temp\ywqoigdywq.sys1⤵
- Executes dropped EXE
-
C:\Temp\ysqlavtnki.sysC:\Temp\ysqlavtnki.sys1⤵
- Executes dropped EXE
-
C:\Temp\avsqnifays.sysC:\Temp\avsqnifays.sys1⤵
- Executes dropped EXE
-
C:\Temp\vpnkfdxvpn.sysC:\Temp\vpnkfdxvpn.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfcxupmhfz.sysC:\Temp\hfcxupmhfz.sys1⤵
- Executes dropped EXE
-
C:\Temp\hczusmkeuo.sysC:\Temp\hczusmkeuo.sys1⤵
- Executes dropped EXE
-
C:\Temp\rpjhbzurmj.sysC:\Temp\rpjhbzurmj.sys1⤵
-
C:\Temp\jhbztrojhb.sysC:\Temp\jhbztrojhb.sys1⤵
-
C:\Temp\rligeywqoi.sysC:\Temp\rligeywqoi.sys1⤵
-
C:\Temp\aykidavtnl.sysC:\Temp\aykidavtnl.sys1⤵
-
C:\Temp\xvtnlidays.sysC:\Temp\xvtnlidays.sys1⤵
-
C:\Temp\vsqkicavsn.sysC:\Temp\vsqkicavsn.sys1⤵
-
C:\Temp\kicausmkhf.sysC:\Temp\kicausmkhf.sys1⤵
-
C:\Temp\pmhfzxjhcz.sysC:\Temp\pmhfzxjhcz.sys1⤵
-
C:\Temp\hbzurpmkec.sysC:\Temp\hbzurpmkec.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ecxupnhfzxrpkhca.exe
ecxupnhfzxrpkhca.sys
ecxusnhfcx.exe
eywrojhezw.sys
eywrojhtrl.exe
hbztrmjebw.exe
i_ecxusnhfcx.exe
i_eywrojhtrl.exe
i_hbztrmjebw.exe
i_mkecwusmke.exe
i_oigbytrljd.exe
i_wqoigaytql.exe
mkecwusmke.exe
oigbytrljd.exe
rljebvtrlj.sys
urmkhczurp.sys
wqoigaytql.exe
ywqoigdywq.sys
zxrpjhczus.sys
02dbc2a2-7649-4b74-9f36-e64fec86743f.tmp
4f701d39-c565-49d3-aeb9-28ee32380fd8.tmp
5d7dcb35-f8bc-47df-b036-699fb1776752.tmp
settings.dat
settings.dat
0003c6f0-f962-47f0-a088-c5c961119ee5.tmp
0969ffaf-3dfe-43b8-8989-7db59b95128d.tmp
76fa4f68-a4e7-4326-a867-f2aadf3ea784.tmp
temp-index
e8713c3f-c00d-4055-8c4a-70b44695bf44.tmp
28dd6af5-151a-4749-adde-e21ca5cb06e3.tmp
457f70be-0dc2-4dea-b2ce-725accc62705.tmp
70a53818-6635-4958-a723-464d192d96d4.tmp
sync_diagnostic.log
ccd03c4b-b029-45f3-973e-1c17a1a4b5ab.tmp
e0d95353-e5bc-4cc6-8321-87bca1f6b44e.tmp
e0ee6f49-a9ee-4869-b300-ccdfce92f30a.tmp
8f5ecfb1-74c6-461b-a1e6-fb47161c9b7a.tmp
OperationConfig
a996703d-44da-4059-8732-6fc70dd74e9d.tmp
c6bbe182-206d-4a46-ba9d-2912d3db4169.tmp
33afe415-b4cc-4d10-b2e5-bae2a14b9156.tmp
d1ba1d29-d8fe-4a6c-9118-bd3c84afef97.tmp
f1bce7a9-c66d-4a16-b705-5d23e12e4bed.tmp
c065f62b-53e1-415c-9165-66401e442f15.tmp
4f2cd8f6-a89f-4489-a461-e2492e0b1b7b.tmp
c875c6de-79a6-4c15-97e1-d6055cce48d3.tmp
content.js
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/1316-504-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1884-245-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2008-457-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2008-443-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2252-68-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2276-455-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2780-194-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2940-419-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3132-321-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3132-327-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3172-295-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3364-233-0x0000020423B40000-0x0000020423EFB000-memory.dmp
memory/3364-242-0x0000020423B40000-0x0000020423EFB000-memory.dmp
memory/3608-423-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4396-396-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4572-482-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4788-270-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4808-346-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4984-325-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5108-397-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5232-486-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5328-282-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5588-369-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5588-342-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5612-461-0x0000000000010000-0x00000000000AB000-memory.dmp