Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
14/10/2026, 04:04
General
- Target 2026-10-13_dd5256d4c3133dc5226dc1997e140e71_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261014-em11zsyscy
- SHA256 a48be4e050abcf0ecd5a8ac30535aad0594a712c77216e3074239877fe26d455
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 9 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-13_dd5256d4c3133dc5226dc1997e140e71_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-13_dd5256d4c3133dc5226dc1997e140e71_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\tnlfdxsqkidavsnl.exeC:\Temp\tnlfdxsqkidavsnl.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vsnkfdxvni.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\vsnkfdxvni.exeC:\Temp\vsnkfdxvni.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vsnkfdxvni.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vsnkfdxvni.exeC:\Temp\i_vsnkfdxvni.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnhfdxvpnh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pnhfdxvpnh.exeC:\Temp\pnhfdxvpnh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnhfdxvpnh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pnhfdxvpnh.exeC:\Temp\i_pnhfdxvpnh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecwupmhfcw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ecwupmhfcw.exeC:\Temp\ecwupmhfcw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecwupmhfcw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ecwupmhfcw.exeC:\Temp\i_ecwupmhfcw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wurmjecwuo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wurmjecwuo.exeC:\Temp\wurmjecwuo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wurmjecwuo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wurmjecwuo.exeC:\Temp\i_wurmjecwuo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cwuomhezwj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\cwuomhezwj.exeC:\Temp\cwuomhezwj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cwuomhezwj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_cwuomhezwj.exeC:\Temp\i_cwuomhezwj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\toljgbywqo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\toljgbywqo.exeC:\Temp\toljgbywqo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_toljgbywqo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_toljgbywqo.exeC:\Temp\i_toljgbywqo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bywqoigbyt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bywqoigbyt.exeC:\Temp\bywqoigbyt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bywqoigbyt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bywqoigbyt.exeC:\Temp\i_bywqoigbyt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gaysqoigay.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gaysqoigay.exeC:\Temp\gaysqoigay.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gaysqoigay.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gaysqoigay.exeC:\Temp\i_gaysqoigay.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\icavsnkida.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\icavsnkida.exeC:\Temp\icavsnkida.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_icavsnkida.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_icavsnkida.exeC:\Temp\i_icavsnkida.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnifdxvpni.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pnifdxvpni.exeC:\Temp\pnifdxvpni.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnifdxvpni.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pnifdxvpni.exeC:\Temp\i_pnifdxvpni.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kecxupmkhc.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kecxupmkhc.exeC:\Temp\kecxupmkhc.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kecxupmkhc.exe ups_ins3⤵
-
C:\Temp\i_kecxupmkhc.exeC:\Temp\i_kecxupmkhc.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mhecwupmhe.exe ups_run3⤵
-
C:\Temp\mhecwupmhe.exeC:\Temp\mhecwupmhe.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mhecwupmhe.exe ups_ins3⤵
-
C:\Temp\i_mhecwupmhe.exeC:\Temp\i_mhecwupmhe.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trpjhcwuom.exe ups_run3⤵
-
C:\Temp\trpjhcwuom.exeC:\Temp\trpjhcwuom.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trpjhcwuom.exe ups_ins3⤵
-
C:\Temp\i_trpjhcwuom.exeC:\Temp\i_trpjhcwuom.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mjebzwrojh.exe ups_run3⤵
-
C:\Temp\mjebzwrojh.exeC:\Temp\mjebzwrojh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mjebzwrojh.exe ups_ins3⤵
-
C:\Temp\i_mjebzwrojh.exeC:\Temp\i_mjebzwrojh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tolgeytroj.exe ups_run3⤵
-
C:\Temp\tolgeytroj.exeC:\Temp\tolgeytroj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tolgeytroj.exe ups_ins3⤵
-
C:\Temp\i_tolgeytroj.exeC:\Temp\i_tolgeytroj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\olgdbvtnlf.exe ups_run3⤵
-
C:\Temp\olgdbvtnlf.exeC:\Temp\olgdbvtnlf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_olgdbvtnlf.exe ups_ins3⤵
-
C:\Temp\i_olgdbvtnlf.exeC:\Temp\i_olgdbvtnlf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qkidavtnlf.exe ups_run3⤵
-
C:\Temp\qkidavtnlf.exeC:\Temp\qkidavtnlf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qkidavtnlf.exe ups_ins3⤵
-
C:\Temp\i_qkidavtnlf.exeC:\Temp\i_qkidavtnlf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lidavsnlfd.exe ups_run3⤵
-
C:\Temp\lidavsnlfd.exeC:\Temp\lidavsnlfd.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lidavsnlfd.exe ups_ins3⤵
-
C:\Temp\i_lidavsnlfd.exeC:\Temp\i_lidavsnlfd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvpnkfdxvp.exe ups_run3⤵
-
C:\Temp\xvpnkfdxvp.exeC:\Temp\xvpnkfdxvp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xvpnkfdxvp.exe ups_ins3⤵
-
C:\Temp\i_xvpnkfdxvp.exeC:\Temp\i_xvpnkfdxvp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xupmhfzxrp.exe ups_run3⤵
-
C:\Temp\xupmhfzxrp.exeC:\Temp\xupmhfzxrp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffbdf8ac188,0x7ffbdf8ac194,0x7ffbdf8ac1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1896,i,12745451824917214591,9642907998869544401,262144 --field-trial-handle=2392,i,632815000781980411,11642598467251514217,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2036,i,13049343558836936380,5210908421015915217,524288 --field-trial-handle=2392,i,632815000781980411,11642598467251514217,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,17312063130634214574,11030294259076598131,524288 --field-trial-handle=2392,i,632815000781980411,11642598467251514217,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,7194118684724925044,7015328418908819695,2097152 --field-trial-handle=2392,i,632815000781980411,11642598467251514217,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,16784438991140273082,6148966989106628432,2097152 --field-trial-handle=2392,i,632815000781980411,11642598467251514217,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,17458726532736883779,15016776876970054941,2097152 --field-trial-handle=2392,i,632815000781980411,11642598467251514217,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,15374651508542591319,2529525392923801008,2097152 --field-trial-handle=2392,i,632815000781980411,11642598467251514217,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,11938859403991883606,4961788552145791050,524288 --field-trial-handle=2392,i,632815000781980411,11642598467251514217,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,12128800688332039557,8928072242313097685,524288 --field-trial-handle=2392,i,632815000781980411,11642598467251514217,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,16091811511689159692,8744602346037734361,524288 --field-trial-handle=2392,i,632815000781980411,11642598467251514217,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,2740845513652586119,15187209944114085806,524288 --field-trial-handle=2392,i,632815000781980411,11642598467251514217,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,2740845513652586119,15187209944114085806,524288 --field-trial-handle=2392,i,632815000781980411,11642598467251514217,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,16173953439414298915,15308461880595900265,524288 --field-trial-handle=2392,i,632815000781980411,11642598467251514217,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,7928146241793564673,16712461370925444216,524288 --field-trial-handle=2392,i,632815000781980411,11642598467251514217,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,17026846643929984474,13611479568851933439,524288 --field-trial-handle=2392,i,632815000781980411,11642598467251514217,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,16592931812051531167,14521417999308851829,524288 --field-trial-handle=2392,i,632815000781980411,11642598467251514217,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,8532484485011904845,500534330190059013,524288 --field-trial-handle=2392,i,632815000781980411,11642598467251514217,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,13658318595903790817,17615944387798515702,524288 --field-trial-handle=2392,i,632815000781980411,11642598467251514217,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,2548404739062960800,3736399047762892993,524288 --field-trial-handle=2392,i,632815000781980411,11642598467251514217,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,15205779560346758603,8201553289100926033,524288 --field-trial-handle=2392,i,632815000781980411,11642598467251514217,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,8055826489564868881,3479974142468595655,524288 --field-trial-handle=2392,i,632815000781980411,11642598467251514217,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5740,i,599512209732556785,13823326829991649823,262144 --field-trial-handle=2392,i,632815000781980411,11642598467251514217,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,6484933212929862786,1955677706382683548,524288 --field-trial-handle=2392,i,632815000781980411,11642598467251514217,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\tnlfdxsqkidavsnl.sysC:\Temp\tnlfdxsqkidavsnl.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Temp\usnkfdxvpn.sysC:\Temp\usnkfdxvpn.sys1⤵
- Executes dropped EXE
-
C:\Temp\keczusmkec.sysC:\Temp\keczusmkec.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfzxupjher.sysC:\Temp\hfzxupjher.sys1⤵
- Executes dropped EXE
-
C:\Temp\ecwuomhezx.sysC:\Temp\ecwuomhezx.sys1⤵
- Executes dropped EXE
-
C:\Temp\trmgeywtro.sysC:\Temp\trmgeywtro.sys1⤵
- Executes dropped EXE
-
C:\Temp\bwtqlidbyw.sysC:\Temp\bwtqlidbyw.sys1⤵
- Executes dropped EXE
-
C:\Temp\qljdbvtolg.sysC:\Temp\qljdbvtolg.sys1⤵
- Executes dropped EXE
-
C:\Temp\nlidavsnlf.sysC:\Temp\nlidavsnlf.sys1⤵
- Executes dropped EXE
-
C:\Temp\vsnkicausn.sysC:\Temp\vsnkicausn.sys1⤵
- Executes dropped EXE
-
C:\Temp\mkfcxupnkf.sysC:\Temp\mkfcxupnkf.sys1⤵
- Executes dropped EXE
-
C:\Temp\xupnkecwup.sysC:\Temp\xupnkecwup.sys1⤵
-
C:\Temp\usmjecwuom.sysC:\Temp\usmjecwuom.sys1⤵
-
C:\Temp\mgebwtromg.sysC:\Temp\mgebwtromg.sys1⤵
-
C:\Temp\trljdbvtol.sysC:\Temp\trljdbvtol.sys1⤵
-
C:\Temp\ywqolgdbwt.sysC:\Temp\ywqolgdbwt.sys1⤵
-
C:\Temp\tnlidbvtnl.sysC:\Temp\tnlidbvtnl.sys1⤵
-
C:\Temp\nlfaxvqnif.sysC:\Temp\nlfaxvqnif.sys1⤵
-
C:\Temp\ausmkfcaxs.sysC:\Temp\ausmkfcaxs.sys1⤵
-
C:\Temp\hfzuspkhca.sysC:\Temp\hfzuspkhca.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
cwuomhezwj.exe
ecwuomhezx.sys
ecwupmhfcw.exe
hfzxupjher.sys
i_cwuomhezwj.exe
i_ecwupmhfcw.exe
i_pnhfdxvpnh.exe
i_vsnkfdxvni.exe
i_wurmjecwuo.exe
keczusmkec.sys
pnhfdxvpnh.exe
tnlfdxsqkidavsnl.exe
tnlfdxsqkidavsnl.sys
toljgbywqo.exe
trmgeywtro.sys
usnkfdxvpn.sys
vsnkfdxvni.exe
wurmjecwuo.exe
15fd153b-59c4-4030-951f-499dee0e5cab.tmp
23b7946f-0733-48a0-b365-4f37afcbe31e.tmp
3d36b567-b49a-45b2-af73-f4ff21a9d413.tmp
508aaf8e-dba6-4bc4-80c9-79765cb81cf4.tmp
settings.dat
settings.dat
913ef63c-0a85-4a8c-91b9-a7d049f0f4d7.tmp
9e6fe651-0c0c-4185-9143-2080fbd23208.tmp
temp-index
the-real-index
b58b85d8-107a-432f-a401-1187f5fcb40d.tmp
9163ec66-f96e-474d-a6e5-c1b901e647cd.tmp
Network Persistent State
a980d80a-5c9b-4637-a956-515c42fe12e2.tmp
Preferences
c4dff7b2-76fa-42c7-89a0-f2cda778777e.tmp
fdba60dd-c579-49f2-ac13-25920054da43.tmp
45d584d8-43ab-44a1-9163-897717660771.tmp
OperationConfig
00111ad0-9956-41f0-b341-d6b2ebb2ba85.tmp
02a5a9f3-5a70-42a2-b45d-f672706f2b93.tmp
47c4fd35-6bf7-41ff-bd9b-bd1810d58e87.tmp
ecea246f-76d6-4212-a320-7adc4027f27c.tmp
ff53649a-fab0-453e-8e2d-52db1b58ae70.tmp
fc43ae3c-0d21-474f-a5fa-6977361060a6.tmp
54350dee-b9dc-4e31-927f-901fc7eef956.tmp
545eb478-3083-48ae-a1a6-92c35fba04f1.tmp
content.js
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/448-421-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1576-349-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2032-196-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2684-343-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2716-505-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2920-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3768-487-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3768-458-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3808-446-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3848-298-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3908-426-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4748-423-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4748-391-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4976-463-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5092-327-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5492-245-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5760-273-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5824-323-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5924-483-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5996-379-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6100-285-0x0000000000010000-0x00000000000AB000-memory.dmp