Analysis
- max time kernel
149s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/10/2026, 04:34
General
- Target 2026-10-01_ba6a7ae70af790b30c4d70a98ba55fe2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261002-e7fwjsxzgs
- SHA256 2bd35448dd2e7db382c71e3382c8ec64bd7a8c22a3d19b1b6c1676e047899e91
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 9 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_ba6a7ae70af790b30c4d70a98ba55fe2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_ba6a7ae70af790b30c4d70a98ba55fe2_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\gdysqlidbvtnlfdy.exeC:\Temp\gdysqlidbvtnlfdy.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gdyvqolgay.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\gdyvqolgay.exeC:\Temp\gdyvqolgay.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gdyvqolgay.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gdyvqolgay.exeC:\Temp\i_gdyvqolgay.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\idaysnlida.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\idaysnlida.exeC:\Temp\idaysnlida.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_idaysnlida.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_idaysnlida.exeC:\Temp\i_idaysnlida.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fzxspkicau.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fzxspkicau.exeC:\Temp\fzxspkicau.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fzxspkicau.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fzxspkicau.exeC:\Temp\i_fzxspkicau.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnhfcausqk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pnhfcausqk.exeC:\Temp\pnhfcausqk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnhfcausqk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pnhfcausqk.exeC:\Temp\i_pnhfcausqk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nhfxupmhfz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nhfxupmhfz.exeC:\Temp\nhfxupmhfz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nhfxupmhfz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nhfxupmhfz.exeC:\Temp\i_nhfxupmhfz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gebzurpjhe.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gebzurpjhe.exeC:\Temp\gebzurpjhe.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gebzurpjhe.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gebzurpjhe.exeC:\Temp\i_gebzurpjhe.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omgeywqojg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\omgeywqojg.exeC:\Temp\omgeywqojg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omgeywqojg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_omgeywqojg.exeC:\Temp\i_omgeywqojg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gbztrljdbw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gbztrljdbw.exeC:\Temp\gbztrljdbw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gbztrljdbw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gbztrljdbw.exeC:\Temp\i_gbztrljdbw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\igdbvtolge.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\igdbvtolge.exeC:\Temp\igdbvtolge.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_igdbvtolge.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_igdbvtolge.exeC:\Temp\i_igdbvtolge.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\avtnkidavt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\avtnkidavt.exeC:\Temp\avtnkidavt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_avtnkidavt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_avtnkidavt.exeC:\Temp\i_avtnkidavt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xsqkicavsn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xsqkicavsn.exeC:\Temp\xsqkicavsn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xsqkicavsn.exe ups_ins3⤵
-
C:\Temp\i_xsqkicavsn.exeC:\Temp\i_xsqkicavsn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvpnkfcaxv.exe ups_run3⤵
-
C:\Temp\xvpnkfcaxv.exeC:\Temp\xvpnkfcaxv.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xvpnkfcaxv.exe ups_ins3⤵
-
C:\Temp\i_xvpnkfcaxv.exeC:\Temp\i_xvpnkfcaxv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nkfzxrpnhf.exe ups_run3⤵
-
C:\Temp\nkfzxrpnhf.exeC:\Temp\nkfzxrpnhf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nkfzxrpnhf.exe ups_ins3⤵
-
C:\Temp\i_nkfzxrpnhf.exeC:\Temp\i_nkfzxrpnhf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pmhecwurmk.exe ups_run3⤵
-
C:\Temp\pmhecwurmk.exeC:\Temp\pmhecwurmk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pmhecwurmk.exe ups_ins3⤵
-
C:\Temp\i_pmhecwurmk.exeC:\Temp\i_pmhecwurmk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ojhbztrpjh.exe ups_run3⤵
-
C:\Temp\ojhbztrpjh.exeC:\Temp\ojhbztrpjh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ojhbztrpjh.exe ups_ins3⤵
-
C:\Temp\i_ojhbztrpjh.exeC:\Temp\i_ojhbztrpjh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\geywuomgey.exe ups_run3⤵
-
C:\Temp\geywuomgey.exeC:\Temp\geywuomgey.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_geywuomgey.exe ups_ins3⤵
-
C:\Temp\i_geywuomgey.exeC:\Temp\i_geywuomgey.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\geywtoljdb.exe ups_run3⤵
-
C:\Temp\geywtoljdb.exeC:\Temp\geywtoljdb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_geywtoljdb.exe ups_ins3⤵
-
C:\Temp\i_geywtoljdb.exeC:\Temp\i_geywtoljdb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gaysqlidav.exe ups_run3⤵
-
C:\Temp\gaysqlidav.exeC:\Temp\gaysqlidav.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gaysqlidav.exe ups_ins3⤵
-
C:\Temp\i_gaysqlidav.exeC:\Temp\i_gaysqlidav.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\idavtnlfdx.exe ups_run3⤵
-
C:\Temp\idavtnlfdx.exeC:\Temp\idavtnlfdx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_idavtnlfdx.exe ups_ins3⤵
-
C:\Temp\i_idavtnlfdx.exeC:\Temp\i_idavtnlfdx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kifaxsqkic.exe ups_run3⤵
-
C:\Temp\kifaxsqkic.exeC:\Temp\kifaxsqkic.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x314,0x7ffa184fc188,0x7ffa184fc194,0x7ffa184fc1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,16739454912004692350,10738246071282951908,262144 --field-trial-handle=2516,i,8248961230702886084,751882750484202905,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,4779552295928719217,6556908183757700162,524288 --field-trial-handle=2516,i,8248961230702886084,751882750484202905,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2240,i,18026259261287422636,7807454823338037855,524288 --field-trial-handle=2516,i,8248961230702886084,751882750484202905,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,14942310039876236531,5196579518957005309,2097152 --field-trial-handle=2516,i,8248961230702886084,751882750484202905,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,7882855172664760962,5558762475853019960,2097152 --field-trial-handle=2516,i,8248961230702886084,751882750484202905,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,4513365619903321116,17951032664719670664,2097152 --field-trial-handle=2516,i,8248961230702886084,751882750484202905,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,3621004426930702268,14963795101029989204,2097152 --field-trial-handle=2516,i,8248961230702886084,751882750484202905,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,1511920560743609567,12143104714285019170,524288 --field-trial-handle=2516,i,8248961230702886084,751882750484202905,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,3026694301812694262,4315884466199647987,524288 --field-trial-handle=2516,i,8248961230702886084,751882750484202905,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,17047051054197251196,18142226794696198320,524288 --field-trial-handle=2516,i,8248961230702886084,751882750484202905,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,9222971013012209166,10957698962106179364,524288 --field-trial-handle=2516,i,8248961230702886084,751882750484202905,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,9222971013012209166,10957698962106179364,524288 --field-trial-handle=2516,i,8248961230702886084,751882750484202905,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,12292375699323247918,10002440920427861058,524288 --field-trial-handle=2516,i,8248961230702886084,751882750484202905,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,5139595945844841010,9490567647013927191,524288 --field-trial-handle=2516,i,8248961230702886084,751882750484202905,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,12319041704001365237,1988044992807814257,524288 --field-trial-handle=2516,i,8248961230702886084,751882750484202905,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,1727345902177653458,9960510985231498228,524288 --field-trial-handle=2516,i,8248961230702886084,751882750484202905,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,8221354985441349878,15399544788753712793,524288 --field-trial-handle=2516,i,8248961230702886084,751882750484202905,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2848,i,4599882665402297714,14371525425032921453,524288 --field-trial-handle=2516,i,8248961230702886084,751882750484202905,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,14201419560323849526,963851124107057875,524288 --field-trial-handle=2516,i,8248961230702886084,751882750484202905,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,47543093314087334,8221274597997526900,524288 --field-trial-handle=2516,i,8248961230702886084,751882750484202905,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6728,i,17017211338283112789,2583187045259591141,524288 --field-trial-handle=2516,i,8248961230702886084,751882750484202905,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6648,i,7247826960771402129,15202915480563864048,262144 --field-trial-handle=2516,i,8248961230702886084,751882750484202905,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3496,i,1871695035253795023,13390664170383390622,524288 --field-trial-handle=2516,i,8248961230702886084,751882750484202905,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\gdysqlidbvtnlfdy.sysC:\Temp\gdysqlidbvtnlfdy.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Temp\nigaysqlid.sysC:\Temp\nigaysqlid.sys1⤵
- Executes dropped EXE
-
C:\Temp\ifaxvpnlfd.sysC:\Temp\ifaxvpnlfd.sys1⤵
- Executes dropped EXE
-
C:\Temp\nhfcausqki.sysC:\Temp\nhfcausqki.sys1⤵
- Executes dropped EXE
-
C:\Temp\smkhcaxrpk.sysC:\Temp\smkhcaxrpk.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhbzurpjhe.sysC:\Temp\jhbzurpjhe.sys1⤵
- Executes dropped EXE
-
C:\Temp\urpjhezwuo.sysC:\Temp\urpjhezwuo.sys1⤵
- Executes dropped EXE
-
C:\Temp\geywrojgey.sysC:\Temp\geywrojgey.sys1⤵
- Executes dropped EXE
-
C:\Temp\oigaytqoig.sysC:\Temp\oigaytqoig.sys1⤵
- Executes dropped EXE
-
C:\Temp\aysqligdyv.sysC:\Temp\aysqligdyv.sys1⤵
- Executes dropped EXE
-
C:\Temp\gaysqkigay.sysC:\Temp\gaysqkigay.sys1⤵
- Executes dropped EXE
-
C:\Temp\avsnkfcxvp.sysC:\Temp\avsnkfcxvp.sys1⤵
-
C:\Temp\spkhcausmk.sysC:\Temp\spkhcausmk.sys1⤵
-
C:\Temp\mkecwurpmh.sysC:\Temp\mkecwurpmh.sys1⤵
-
C:\Temp\urmkebzxrp.sysC:\Temp\urmkebzxrp.sys1⤵
-
C:\Temp\eywromgeyw.sysC:\Temp\eywromgeyw.sys1⤵
-
C:\Temp\gebwtrljdb.sysC:\Temp\gebwtrljdb.sys1⤵
-
C:\Temp\gayvqoigay.sysC:\Temp\gayvqoigay.sys1⤵
-
C:\Temp\tnlfdyvqnl.sysC:\Temp\tnlfdyvqnl.sys1⤵
-
C:\Temp\nifcavsqki.sysC:\Temp\nifcavsqki.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
fzxspkicau.exe
gdysqlidbvtnlfdy.exe
gdysqlidbvtnlfdy.sys
gdyvqolgay.exe
gebzurpjhe.exe
i_fzxspkicau.exe
i_gdyvqolgay.exe
i_idaysnlida.exe
i_nhfxupmhfz.exe
i_pnhfcausqk.exe
idaysnlida.exe
ifaxvpnlfd.sys
jhbzurpjhe.sys
nhfcausqki.sys
nhfxupmhfz.exe
nigaysqlid.sys
pnhfcausqk.exe
smkhcaxrpk.sys
2b91f7d9-ab98-4a16-b8fd-7984187f1e10.tmp
31230050-5585-4a55-8ab9-5542e4b8f34a.tmp
5d0a9c68-3aad-4b37-9420-90b39f5e6111.tmp
746a16e5-5852-4756-acbc-8a4f8400a7b8.tmp
79ea25d8-756a-46a1-9ff5-62d88dcb4fb5.tmp
settings.dat
settings.dat
0027ce6a-2f25-4057-a5e0-b74500d9f173.tmp
59b80376-052c-48cf-a6ab-389362b8fdad.tmp
90b67eeb-47e4-4ad0-9fd9-9066b816abb6.tmp
temp-index
the-real-index
27809f46-037f-464c-8f90-e1bf661aefdc.tmp
603bc5e6-b0ef-495b-9991-6eac99d9df1e.tmp
803cba88-11aa-4fee-abb4-628b096659e4.tmp
c11b6210-633f-47c5-b83f-7aed415ffa50.tmp
a975242b-b9e9-41cb-a6b1-1a41cfd3994e.tmp
cd53d9d5-7e7a-4fe3-9a73-023bebe14c52.tmp
057948d0-b6c5-4bf6-a60f-f0eef456cb3a.tmp
79cd128c-6e98-482b-bcd5-2661d1900a78.tmp
9241b40b-750e-4527-bdf3-3ce7ca44495c.tmp
a5643464-4c03-4b54-b041-43a14eb65792.tmp
57a86e11-cab5-4fa1-9d50-d145b5ba664d.tmp
62c03da4-d24d-48a9-9455-6d6c736c4c68.tmp
e89eb2b6-3691-49dd-9c86-8c1ee3456a71.tmp
content.js
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/464-273-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1092-425-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1140-327-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1260-343-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2364-483-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2372-285-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2376-349-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3348-505-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3528-245-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3560-399-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3732-196-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3744-457-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4568-462-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4568-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4872-323-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5532-487-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5700-421-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5716-379-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5736-298-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6088-445-0x0000000000010000-0x00000000000AB000-memory.dmp