Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
14/10/2026, 04:26
General
- Target 2026-10-13_d9c16790ac1b27d45b8186614936a801_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261014-e2kybav14j
- SHA256 42af9cc50bf7fb9e8f2ab2cdc85276108e414485f30b234d531e171181fa0e05
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 13 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-13_d9c16790ac1b27d45b8186614936a801_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-13_d9c16790ac1b27d45b8186614936a801_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\ezwrpjhbztrmjecw.exeC:\Temp\ezwrpjhbztrmjecw.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hbzwumjebw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\hbzwumjebw.exeC:\Temp\hbzwumjebw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hbzwumjebw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hbzwumjebw.exeC:\Temp\i_hbzwumjebw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dbztoljdbw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dbztoljdbw.exeC:\Temp\dbztoljdbw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dbztoljdbw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dbztoljdbw.exeC:\Temp\i_dbztoljdbw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdbvtnlgdy.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jdbvtnlgdy.exeC:\Temp\jdbvtnlgdy.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdbvtnlgdy.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jdbvtnlgdy.exeC:\Temp\i_jdbvtnlgdy.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dyvqnigays.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dyvqnigays.exeC:\Temp\dyvqnigays.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dyvqnigays.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dyvqnigays.exeC:\Temp\i_dyvqnigays.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qkfdxvqnig.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qkfdxvqnig.exeC:\Temp\qkfdxvqnig.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qkfdxvqnig.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qkfdxvqnig.exeC:\Temp\i_qkfdxvqnig.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnhfaxspki.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pnhfaxspki.exeC:\Temp\pnhfaxspki.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnhfaxspki.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pnhfaxspki.exeC:\Temp\i_pnhfaxspki.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnhfzxupkh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pnhfzxupkh.exeC:\Temp\pnhfzxupkh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnhfzxupkh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pnhfzxupkh.exeC:\Temp\i_pnhfzxupkh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\spkhczxupm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\spkhczxupm.exeC:\Temp\spkhczxupm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_spkhczxupm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_spkhczxupm.exeC:\Temp\i_spkhczxupm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mjhbwurmhe.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mjhbwurmhe.exeC:\Temp\mjhbwurmhe.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mjhbwurmhe.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mjhbwurmhe.exeC:\Temp\i_mjhbwurmhe.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gbywrojgbz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gbywrojgbz.exeC:\Temp\gbywrojgbz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gbywrojgbz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gbywrojgbz.exeC:\Temp\i_gbywrojgbz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qomywqoige.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qomywqoige.exeC:\Temp\qomywqoige.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qomywqoige.exe ups_ins3⤵
-
C:\Temp\i_qomywqoige.exeC:\Temp\i_qomywqoige.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dbvtolgdyw.exe ups_run3⤵
-
C:\Temp\dbvtolgdyw.exeC:\Temp\dbvtolgdyw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dbvtolgdyw.exe ups_ins3⤵
-
C:\Temp\i_dbvtolgdyw.exeC:\Temp\i_dbvtolgdyw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtqlidavtq.exe ups_run3⤵
-
C:\Temp\vtqlidavtq.exeC:\Temp\vtqlidavtq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vtqlidavtq.exe ups_ins3⤵
-
C:\Temp\i_vtqlidavtq.exeC:\Temp\i_vtqlidavtq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nifaxsqkic.exe ups_run3⤵
-
C:\Temp\nifaxsqkic.exeC:\Temp\nifaxsqkic.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nifaxsqkic.exe ups_ins3⤵
-
C:\Temp\i_nifaxsqkic.exeC:\Temp\i_nifaxsqkic.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qkifvpnkec.exe ups_run3⤵
-
C:\Temp\qkifvpnkec.exeC:\Temp\qkifvpnkec.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qkifvpnkec.exe ups_ins3⤵
-
C:\Temp\i_qkifvpnkec.exeC:\Temp\i_qkifvpnkec.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnhfcxupnh.exe ups_run3⤵
-
C:\Temp\pnhfcxupnh.exeC:\Temp\pnhfcxupnh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnhfcxupnh.exe ups_ins3⤵
-
C:\Temp\i_pnhfcxupnh.exeC:\Temp\i_pnhfcxupnh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhczusmkec.exe ups_run3⤵
-
C:\Temp\jhczusmkec.exeC:\Temp\jhczusmkec.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhczusmkec.exe ups_ins3⤵
-
C:\Temp\i_jhczusmkec.exeC:\Temp\i_jhczusmkec.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhbztrljeb.exe ups_run3⤵
-
C:\Temp\jhbztrljeb.exeC:\Temp\jhbztrljeb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhbztrljeb.exe ups_ins3⤵
-
C:\Temp\i_jhbztrljeb.exeC:\Temp\i_jhbztrljeb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhbztrojgb.exe ups_run3⤵
-
C:\Temp\jhbztrojgb.exeC:\Temp\jhbztrojgb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhbztrojgb.exe ups_ins3⤵
-
C:\Temp\i_jhbztrojgb.exeC:\Temp\i_jhbztrojgb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywqoigbywr.exe ups_run3⤵
-
C:\Temp\ywqoigbywr.exeC:\Temp\ywqoigbywr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7fff450fc188,0x7fff450fc194,0x7fff450fc1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1976,i,11608078752510776486,12397303353425131264,262144 --field-trial-handle=2508,i,16622304292235378504,5839935094946754670,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2172,i,13344268520221523420,17787423123350712212,524288 --field-trial-handle=2508,i,16622304292235378504,5839935094946754670,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,14270920372514804866,18107446851978148995,524288 --field-trial-handle=2508,i,16622304292235378504,5839935094946754670,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,16784724719712167282,15888576355456123235,2097152 --field-trial-handle=2508,i,16622304292235378504,5839935094946754670,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,14106084212322012537,11951005073588967580,2097152 --field-trial-handle=2508,i,16622304292235378504,5839935094946754670,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,17974780227703292558,13650824399880133154,2097152 --field-trial-handle=2508,i,16622304292235378504,5839935094946754670,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,4795204823728980594,10742349964174570268,2097152 --field-trial-handle=2508,i,16622304292235378504,5839935094946754670,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,12536705450249969110,3475215166820064758,524288 --field-trial-handle=2508,i,16622304292235378504,5839935094946754670,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,2445545018829737532,3864293036607273145,524288 --field-trial-handle=2508,i,16622304292235378504,5839935094946754670,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,12562168875052430678,14202097540418573011,524288 --field-trial-handle=2508,i,16622304292235378504,5839935094946754670,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,14311270911896984871,17835764684058132386,524288 --field-trial-handle=2508,i,16622304292235378504,5839935094946754670,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,14311270911896984871,17835764684058132386,524288 --field-trial-handle=2508,i,16622304292235378504,5839935094946754670,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,15550135736958177610,9438903865270604878,524288 --field-trial-handle=2508,i,16622304292235378504,5839935094946754670,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,7618551168081280670,13612803115455895960,524288 --field-trial-handle=2508,i,16622304292235378504,5839935094946754670,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1440,i,14047238081078413349,5218283661944533204,524288 --field-trial-handle=2508,i,16622304292235378504,5839935094946754670,262144 --variations-seed-version --mojo-platform-channel-handle=1300 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1448,i,15013365887070280087,4733569748772811384,524288 --field-trial-handle=2508,i,16622304292235378504,5839935094946754670,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1456,i,8764052013672839927,14301757895904353754,524288 --field-trial-handle=2508,i,16622304292235378504,5839935094946754670,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,18223377648347941626,8613876666337984871,524288 --field-trial-handle=2508,i,16622304292235378504,5839935094946754670,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,215554695526287899,10562138737243066273,524288 --field-trial-handle=2508,i,16622304292235378504,5839935094946754670,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,1256786766223384119,3256408974436709207,524288 --field-trial-handle=2508,i,16622304292235378504,5839935094946754670,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=928,i,8176561052011221657,4865546550022143223,524288 --field-trial-handle=2508,i,16622304292235378504,5839935094946754670,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6536,i,18041550289946931229,5537977320399974229,262144 --field-trial-handle=2508,i,16622304292235378504,5839935094946754670,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,10912765058579806400,977461713340630589,524288 --field-trial-handle=2508,i,16622304292235378504,5839935094946754670,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,2430774934641351900,10687623837796547627,524288 --field-trial-handle=2508,i,16622304292235378504,5839935094946754670,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\ezwrpjhbztrmjecw.sysC:\Temp\ezwrpjhbztrmjecw.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\jdbwtoljeb.sysC:\Temp\jdbwtoljeb.sys1⤵
- Executes dropped EXE
-
C:\Temp\wqojgbztqo.sysC:\Temp\wqojgbztqo.sys1⤵
- Executes dropped EXE
-
C:\Temp\jdaysqoiga.sysC:\Temp\jdaysqoiga.sys1⤵
- Executes dropped EXE
-
C:\Temp\sqlidavtnl.sysC:\Temp\sqlidavtnl.sys1⤵
- Executes dropped EXE
-
C:\Temp\pnhfaxvsnk.sysC:\Temp\pnhfaxvsnk.sys1⤵
- Executes dropped EXE
-
C:\Temp\ausnkfcxvp.sysC:\Temp\ausnkfcxvp.sys1⤵
- Executes dropped EXE
-
C:\Temp\usmkecxupm.sysC:\Temp\usmkecxupm.sys1⤵
- Executes dropped EXE
-
C:\Temp\xrpjhczurm.sysC:\Temp\xrpjhczurm.sys1⤵
- Executes dropped EXE
-
C:\Temp\jebwuomjdb.sysC:\Temp\jebwuomjdb.sys1⤵
- Executes dropped EXE
-
C:\Temp\rojgeywtrl.sysC:\Temp\rojgeywtrl.sys1⤵
- Executes dropped EXE
-
C:\Temp\igaytqljdb.sysC:\Temp\igaytqljdb.sys1⤵
-
C:\Temp\aysqkigayv.sysC:\Temp\aysqkigayv.sys1⤵
-
C:\Temp\vtndavpnif.sysC:\Temp\vtndavpnif.sys1⤵
-
C:\Temp\pnhfaxvpnk.sysC:\Temp\pnhfaxvpnk.sys1⤵
-
C:\Temp\upmkfcxusm.sysC:\Temp\upmkfcxusm.sys1⤵
-
C:\Temp\khcwupmkeb.sysC:\Temp\khcwupmkeb.sys1⤵
-
C:\Temp\rmjhcztrmj.sysC:\Temp\rmjhcztrmj.sys1⤵
-
C:\Temp\ojgbztrojh.sysC:\Temp\ojgbztrojh.sys1⤵
-
C:\Temp\gbytqoigby.sysC:\Temp\gbytqoigby.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
dbztoljdbw.exe
dyvqnigays.exe
ezwrpjhbztrmjecw.exe
ezwrpjhbztrmjecw.sys
hbzwumjebw.exe
i_dbztoljdbw.exe
i_dyvqnigays.exe
i_hbzwumjebw.exe
i_jdbvtnlgdy.exe
i_qkfdxvqnig.exe
jdaysqoiga.sys
jdbvtnlgdy.exe
jdbwtoljeb.sys
pnhfaxspki.exe
pnhfaxvsnk.sys
qkfdxvqnig.exe
sqlidavtnl.sys
wqojgbztqo.sys
50c61659-f7d3-4786-98c6-533eb4bbc3d5.tmp
621dfa34-6465-4c88-8de6-cf000559f72b.tmp
7a291fa9-f4ce-49f1-bcc7-b4a3a4c8fa60.tmp
settings.dat
settings.dat
3b7038df-192f-4694-b7c2-951f5449d9a8.tmp
8265df4e-bf45-46f7-854d-8416835eb37e.tmp
temp-index
60629bc2-76aa-4183-a55f-96b1bc000c5b.tmp
5bbdac51-d4c6-4145-8684-da8c498f5391.tmp
649f5cea-956f-480a-834d-34484046fa20.tmp
6c742ad0-c792-4de8-accb-9619626c7eed.tmp
sync_diagnostic.log
adaa65f1-cb1b-4c4b-855c-56956150c9ce.tmp
d5416a10-fc95-42e7-903f-1073c140c971.tmp
eb35cf34-55e6-4e9c-a049-bba4790b02a6.tmp
f5fbee6a-8b6b-4c8b-8bbf-8dcb1df121ae.tmp
b4bf0e1e-7db6-4a8c-8f30-a877f6d45409.tmp
b188a6f0-fa04-48d5-9510-9c67fc08ee0b.tmp
1606428a-eafc-44dd-a67e-587b5a3445c2.tmp
3f75db75-3773-4b8e-ad27-c9e6bf3c8735.tmp
554c9ab9-b753-4da3-97e6-86fcd86b968a.tmp
62a9fec7-6e1a-4cc8-840e-7272e3589030.tmp
ed9ed035-b141-42fc-8194-b5b381201e5a.tmp
08426671-c2b0-4bfc-a59a-a26f133b98ce.tmp
f164f4b0-6bbd-4ea7-8297-caecab646e26.tmp
e1986a36-60c9-483b-a583-71222821f192.tmp
e40f91c8-90a2-477c-9295-9a11bfa3321e.tmp
content.js
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/252-412-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1424-475-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2480-62-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2552-278-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2684-477-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2684-456-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2888-336-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2924-291-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3600-241-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4204-316-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4312-266-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4320-505-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4648-370-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4760-481-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4952-340-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5412-424-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5536-398-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5872-436-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5972-501-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6020-192-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6032-320-0x0000000000010000-0x00000000000AB000-memory.dmp