Analysis
- max time kernel
149s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/10/2026, 16:15
General
- Target 2026-10-01_3d3bf6f426ae68b51d37b0d4bc270b65_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261002-tqaqjadh97
- SHA256 bc04549eea4f2ca7e5c77a05344a3ec6b8edf06836eeecde800dbd5edfc35e81
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 9 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_3d3bf6f426ae68b51d37b0d4bc270b65_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_3d3bf6f426ae68b51d37b0d4bc270b65_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\pmhfzxrpjhczusec.exeC:\Temp\pmhfzxrpjhczusec.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hbzxrpjecz.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\hbzxrpjecz.exeC:\Temp\hbzxrpjecz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hbzxrpjecz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hbzxrpjecz.exeC:\Temp\i_hbzxrpjecz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ebztrmjeuo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ebztrmjeuo.exeC:\Temp\ebztrmjeuo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ebztrmjeuo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ebztrmjeuo.exeC:\Temp\i_ebztrmjeuo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdbytqomge.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jdbytqomge.exeC:\Temp\jdbytqomge.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdbytqomge.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jdbytqomge.exeC:\Temp\i_jdbytqomge.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gaytqliday.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gaytqliday.exeC:\Temp\gaytqliday.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gaytqliday.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gaytqliday.exeC:\Temp\i_gaytqliday.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vqnifdyvqn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vqnifdyvqn.exeC:\Temp\vqnifdyvqn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vqnifdyvqn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vqnifdyvqn.exeC:\Temp\i_vqnifdyvqn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nkfdxnhfay.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nkfdxnhfay.exeC:\Temp\nkfdxnhfay.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nkfdxnhfay.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nkfdxnhfay.exeC:\Temp\i_nkfdxnhfay.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pkicausmkf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pkicausmkf.exeC:\Temp\pkicausmkf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pkicausmkf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pkicausmkf.exeC:\Temp\i_pkicausmkf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\smkecwusmk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\smkecwusmk.exeC:\Temp\smkecwusmk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_smkecwusmk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_smkecwusmk.exeC:\Temp\i_smkecwusmk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bzurmkeczu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bzurmkeczu.exeC:\Temp\bzurmkeczu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bzurmkeczu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bzurmkeczu.exeC:\Temp\i_bzurmkeczu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tjebwrojge.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\tjebwrojge.exeC:\Temp\tjebwrojge.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tjebwrojge.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_tjebwrojge.exeC:\Temp\i_tjebwrojge.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhbztqomjd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jhbztqomjd.exeC:\Temp\jhbztqomjd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhbztqomjd.exe ups_ins3⤵
-
C:\Temp\i_jhbztqomjd.exeC:\Temp\i_jhbztqomjd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dbytqoidbv.exe ups_run3⤵
-
C:\Temp\dbytqoidbv.exeC:\Temp\dbytqoidbv.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dbytqoidbv.exe ups_ins3⤵
-
C:\Temp\i_dbytqoidbv.exeC:\Temp\i_dbytqoidbv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bysqlidbvt.exe ups_run3⤵
-
C:\Temp\bysqlidbvt.exeC:\Temp\bysqlidbvt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bysqlidbvt.exe ups_ins3⤵
-
C:\Temp\i_bysqlidbvt.exeC:\Temp\i_bysqlidbvt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvsqcaxvsn.exe ups_run3⤵
-
C:\Temp\xvsqcaxvsn.exeC:\Temp\xvsqcaxvsn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xvsqcaxvsn.exe ups_ins3⤵
-
C:\Temp\i_xvsqcaxvsn.exeC:\Temp\i_xvsqcaxvsn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\snkfdxvpnh.exe ups_run3⤵
-
C:\Temp\snkfdxvpnh.exeC:\Temp\snkfdxvpnh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_snkfdxvpnh.exe ups_ins3⤵
-
C:\Temp\i_snkfdxvpnh.exeC:\Temp\i_snkfdxvpnh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pkhczurpmk.exe ups_run3⤵
-
C:\Temp\pkhczurpmk.exeC:\Temp\pkhczurpmk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pkhczurpmk.exe ups_ins3⤵
-
C:\Temp\i_pkhczurpmk.exeC:\Temp\i_pkhczurpmk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\eczusmhecw.exe ups_run3⤵
-
C:\Temp\eczusmhecw.exeC:\Temp\eczusmhecw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_eczusmhecw.exe ups_ins3⤵
-
C:\Temp\i_eczusmhecw.exeC:\Temp\i_eczusmhecw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hcztromcwu.exe ups_run3⤵
-
C:\Temp\hcztromcwu.exeC:\Temp\hcztromcwu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hcztromcwu.exe ups_ins3⤵
-
C:\Temp\i_hcztromcwu.exeC:\Temp\i_hcztromcwu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bwurljdbwt.exe ups_run3⤵
-
C:\Temp\bwurljdbwt.exeC:\Temp\bwurljdbwt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bwurljdbwt.exe ups_ins3⤵
-
C:\Temp\i_bwurljdbwt.exeC:\Temp\i_bwurljdbwt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ff851a5c188,0x7ff851a5c194,0x7ff851a5c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,14105130999933750613,16019058979487716850,262144 --field-trial-handle=2432,i,9436962521414798974,2889527238124471178,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,3049792074251084513,16244287261034771753,524288 --field-trial-handle=2432,i,9436962521414798974,2889527238124471178,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,13608531248307904082,407117451840483869,524288 --field-trial-handle=2432,i,9436962521414798974,2889527238124471178,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,4193463467016188887,6061715802613643962,2097152 --field-trial-handle=2432,i,9436962521414798974,2889527238124471178,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,15640321963708667343,4822392260666295510,2097152 --field-trial-handle=2432,i,9436962521414798974,2889527238124471178,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,10839358533360301388,14674783934990843426,2097152 --field-trial-handle=2432,i,9436962521414798974,2889527238124471178,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,12040429396892266812,3090118224063513781,2097152 --field-trial-handle=2432,i,9436962521414798974,2889527238124471178,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3888,i,9913146333112815310,10278790578770737055,524288 --field-trial-handle=2432,i,9436962521414798974,2889527238124471178,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5564,i,13385038990201767125,10712981842133169311,524288 --field-trial-handle=2432,i,9436962521414798974,2889527238124471178,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,8930708140574985929,1529263705895800845,524288 --field-trial-handle=2432,i,9436962521414798974,2889527238124471178,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,15436917507103402834,1756688405076163013,524288 --field-trial-handle=2432,i,9436962521414798974,2889527238124471178,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,15436917507103402834,1756688405076163013,524288 --field-trial-handle=2432,i,9436962521414798974,2889527238124471178,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,16832796963329115464,5011317646292839141,524288 --field-trial-handle=2432,i,9436962521414798974,2889527238124471178,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,7865342406978428170,16575576776142149698,524288 --field-trial-handle=2432,i,9436962521414798974,2889527238124471178,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,13345352995683191080,8667795824878044652,524288 --field-trial-handle=2432,i,9436962521414798974,2889527238124471178,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,4215058690837192276,4696265249122927148,524288 --field-trial-handle=2432,i,9436962521414798974,2889527238124471178,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,8666594111151464415,18389790353385836836,524288 --field-trial-handle=2432,i,9436962521414798974,2889527238124471178,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,7040345081802076890,16173675410210755830,524288 --field-trial-handle=2432,i,9436962521414798974,2889527238124471178,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,9351588116656894200,16230184700056250731,524288 --field-trial-handle=2432,i,9436962521414798974,2889527238124471178,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,4019128731235271938,9543861812114626190,524288 --field-trial-handle=2432,i,9436962521414798974,2889527238124471178,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,805709305145920082,14413547279670941234,524288 --field-trial-handle=2432,i,9436962521414798974,2889527238124471178,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,5979750603097806406,2610775245985587599,524288 --field-trial-handle=2432,i,9436962521414798974,2889527238124471178,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4312,i,4428760760400431273,5821757439460245572,262144 --field-trial-handle=2432,i,9436962521414798974,2889527238124471178,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,3750346821166299055,10072118254856056715,524288 --field-trial-handle=2432,i,9436962521414798974,2889527238124471178,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\pmhfzxrpjhczusec.sysC:\Temp\pmhfzxrpjhczusec.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\jhbztrljhb.sysC:\Temp\jhbztrljhb.sys1⤵
- Executes dropped EXE
-
C:\Temp\jdbywqojge.sysC:\Temp\jdbywqojge.sys1⤵
- Executes dropped EXE
-
C:\Temp\daytqljdbv.sysC:\Temp\daytqljdbv.sys1⤵
- Executes dropped EXE
-
C:\Temp\idavtnlxvt.sysC:\Temp\idavtnlxvt.sys1⤵
- Executes dropped EXE
-
C:\Temp\nlfdxvpnif.sysC:\Temp\nlfdxvpnif.sys1⤵
- Executes dropped EXE
-
C:\Temp\khfaxsqkic.sysC:\Temp\khfaxsqkic.sys1⤵
- Executes dropped EXE
-
C:\Temp\wurpnhfcxu.sysC:\Temp\wurpnhfcxu.sys1⤵
- Executes dropped EXE
-
C:\Temp\upmhfrpjhb.sysC:\Temp\upmhfrpjhb.sys1⤵
- Executes dropped EXE
-
C:\Temp\wrojgecwuo.sysC:\Temp\wrojgecwuo.sys1⤵
- Executes dropped EXE
-
C:\Temp\mjebwtomge.sysC:\Temp\mjebwtomge.sys1⤵
- Executes dropped EXE
-
C:\Temp\dbytqolgdb.sysC:\Temp\dbytqolgdb.sys1⤵
-
C:\Temp\qljdbnlfdy.sysC:\Temp\qljdbnlfdy.sys1⤵
-
C:\Temp\ysqkidaxvt.sysC:\Temp\ysqkidaxvt.sys1⤵
-
C:\Temp\spnhfaxsqk.sysC:\Temp\spnhfaxsqk.sys1⤵
-
C:\Temp\mkfcxuspkh.sysC:\Temp\mkfcxuspkh.sys1⤵
-
C:\Temp\rpmkeczuke.sysC:\Temp\rpmkeczuke.sys1⤵
-
C:\Temp\hbzxrpjhbz.sysC:\Temp\hbzxrpjhbz.sys1⤵
-
C:\Temp\ywuomjebzw.sysC:\Temp\ywuomjebzw.sys1⤵
-
C:\Temp\bwtolgeywq.sysC:\Temp\bwtolgeywq.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
daytqljdbv.sys
ebztrmjeuo.exe
gaytqliday.exe
hbzxrpjecz.exe
i_ebztrmjeuo.exe
i_gaytqliday.exe
i_hbzxrpjecz.exe
i_jdbytqomge.exe
i_vqnifdyvqn.exe
idavtnlxvt.sys
jdbytqomge.exe
jdbywqojge.sys
jhbztrljhb.sys
nkfdxnhfay.exe
nlfdxvpnif.sys
pmhfzxrpjhczusec.exe
pmhfzxrpjhczusec.sys
vqnifdyvqn.exe
1277beed-248b-4e3f-ba26-7b795eac08da.tmp
17682f1b-a4a2-483e-923e-001518dbf9b9.tmp
726529ee-b4d6-4de0-953e-4b2ab1a56cc0.tmp
93c16ac8-6800-4b1c-9cff-2b63af4f3960.tmp
settings.dat
settings.dat
00054bb2-820e-437b-addd-8ee74d290b7a.tmp
0b335581-e9eb-4175-a468-3e646cce38e1.tmp
99b680af-9d2a-43c7-ac19-9caf2248b887.tmp
LOG.old
temp-index
the-real-index
300786df-1bfe-4134-a228-455315ab68c4.tmp
5c542b25-b8a3-4b0f-a761-a4c132f72198.tmp
c53eae25-7a71-4d5a-8340-1bdeb60de937.tmp
f9326b15-f1db-462c-ad20-08c815b380fe.tmp
a90f538e-4184-4946-8a57-18f9d81c8068.tmp
f2fd6849-f716-4c3e-9629-b0a94828b59d.tmp
63bc566c-f824-4468-8572-5f3ddde6f232.tmp
a5a61d80-99d0-42da-b44f-26a77aaa3735.tmp
05427eb9-f623-405b-acf8-f136eafe8c61.tmp
a12dd4ce-73b5-4a5b-9ef2-a0628120bf0c.tmp
d2778076-a7fc-4c37-9caf-48725716a2d0.tmp
a10411cc-8b19-4e74-8fc4-f73fbc06b917.tmp
abc0e3af-7fb0-47fb-a144-c679bdc39f16.tmp
ecf73600-1dde-488f-bda1-c40cd40e42bc.tmp
content.js
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/1156-272-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2132-418-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2404-195-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2436-484-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2488-244-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2992-488-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3020-297-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3184-463-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4048-506-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4284-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4336-458-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4372-446-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4520-346-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4540-376-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4772-284-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4796-342-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4840-326-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5176-322-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5536-396-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5744-426-0x0000000000010000-0x00000000000AB000-memory.dmp