Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
20/10/2026, 15:27
General
- Target 2026-10-19_7cd1351e631fe2c03ab00d8f6bd37a45_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 376KB
- Sample261020-svthrssx9p
- SHA256 bbd61ba85302df55d3413bdac45371c749110e5f8b099fe0f85d2a2fae0b90d5
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 18 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_7cd1351e631fe2c03ab00d8f6bd37a45_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-19_7cd1351e631fe2c03ab00d8f6bd37a45_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\jebwuomgezwuomge.exeC:\Temp\jebwuomgezwuomge.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pjhbwrpjey.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\pjhbwrpjey.exeC:\Temp\pjhbwrpjey.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pjhbwrpjey.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pjhbwrpjey.exeC:\Temp\i_pjhbwrpjey.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bztrljdbvt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bztrljdbvt.exeC:\Temp\bztrljdbvt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bztrljdbvt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bztrljdbvt.exeC:\Temp\i_bztrljdbvt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\oigdbvtnli.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\oigdbvtnli.exeC:\Temp\oigdbvtnli.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_oigdbvtnli.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_oigdbvtnli.exeC:\Temp\i_oigdbvtnli.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\idbvtnlfdy.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\idbvtnlfdy.exeC:\Temp\idbvtnlfdy.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_idbvtnlfdy.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_idbvtnlfdy.exeC:\Temp\i_idbvtnlfdy.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dxvqnifays.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dxvqnifays.exeC:\Temp\dxvqnifays.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dxvqnifays.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dxvqnifays.exeC:\Temp\i_dxvqnifays.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\auspkicaus.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\auspkicaus.exeC:\Temp\auspkicaus.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_auspkicaus.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_auspkicaus.exeC:\Temp\i_auspkicaus.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\urpkhcwusm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\urpkhcwusm.exeC:\Temp\urpkhcwusm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_urpkhcwusm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_urpkhcwusm.exeC:\Temp\i_urpkhcwusm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zurmjhecwu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zurmjhecwu.exeC:\Temp\zurmjhecwu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zurmjhecwu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zurmjhecwu.exeC:\Temp\i_zurmjhecwu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zurmjebztr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zurmjebztr.exeC:\Temp\zurmjebztr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zurmjebztr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zurmjebztr.exeC:\Temp\i_zurmjebztr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljeywrojgb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ljeywrojgb.exeC:\Temp\ljeywrojgb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljeywrojgb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ljeywrojgb.exeC:\Temp\i_ljeywrojgb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\oljdbvtolg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\oljdbvtolg.exeC:\Temp\oljdbvtolg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_oljdbvtolg.exe ups_ins3⤵
-
C:\Temp\i_oljdbvtolg.exeC:\Temp\i_oljdbvtolg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\oigayvqoig.exe ups_run3⤵
-
C:\Temp\oigayvqoig.exeC:\Temp\oigayvqoig.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_oigayvqoig.exe ups_ins3⤵
-
C:\Temp\i_oigayvqoig.exeC:\Temp\i_oigayvqoig.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qnigaysqki.exe ups_run3⤵
-
C:\Temp\qnigaysqki.exeC:\Temp\qnigaysqki.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qnigaysqki.exe ups_ins3⤵
-
C:\Temp\i_qnigaysqki.exeC:\Temp\i_qnigaysqki.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vsqkicavsn.exe ups_run3⤵
-
C:\Temp\vsqkicavsn.exeC:\Temp\vsqkicavsn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vsqkicavsn.exe ups_ins3⤵
-
C:\Temp\i_vsqkicavsn.exeC:\Temp\i_vsqkicavsn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xrpnkfcaur.exe ups_run3⤵
-
C:\Temp\xrpnkfcaur.exeC:\Temp\xrpnkfcaur.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xrpnkfcaur.exe ups_ins3⤵
-
C:\Temp\i_xrpnkfcaur.exeC:\Temp\i_xrpnkfcaur.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\czxsmkecau.exe ups_run3⤵
-
C:\Temp\czxsmkecau.exeC:\Temp\czxsmkecau.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_czxsmkecau.exe ups_ins3⤵
-
C:\Temp\i_czxsmkecau.exeC:\Temp\i_czxsmkecau.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecwurmjecw.exe ups_run3⤵
-
C:\Temp\ecwurmjecw.exeC:\Temp\ecwurmjecw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecwurmjecw.exe ups_ins3⤵
-
C:\Temp\i_ecwurmjecw.exeC:\Temp\i_ecwurmjecw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bztomgecwu.exe ups_run3⤵
-
C:\Temp\bztomgecwu.exeC:\Temp\bztomgecwu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bztomgecwu.exe ups_ins3⤵
-
C:\Temp\i_bztomgecwu.exeC:\Temp\i_bztomgecwu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jgbztrljdb.exe ups_run3⤵
-
C:\Temp\jgbztrljdb.exeC:\Temp\jgbztrljdb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jgbztrljdb.exe ups_ins3⤵
-
C:\Temp\i_jgbztrljdb.exeC:\Temp\i_jgbztrljdb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljgbytqolg.exe ups_run3⤵
-
C:\Temp\ljgbytqolg.exeC:\Temp\ljgbytqolg.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffcf36bc188,0x7ffcf36bc194,0x7ffcf36bc1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2020,i,16967758417017332737,16304769843343180505,524288 --field-trial-handle=2764,i,17726746499487421256,15236426067281671050,262144 --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2024,i,13025350327409855039,18311993401862165994,524288 --field-trial-handle=2764,i,17726746499487421256,15236426067281671050,262144 --variations-seed-version --mojo-platform-channel-handle=2832 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1924,i,5498435438368259390,17826065135046647057,262144 --field-trial-handle=2764,i,17726746499487421256,15236426067281671050,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,10331014408813103600,7638222452553625684,2097152 --field-trial-handle=2764,i,17726746499487421256,15236426067281671050,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,11738884770583459657,11236318306986176439,2097152 --field-trial-handle=2764,i,17726746499487421256,15236426067281671050,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,16089475280328327613,8834915564958131928,2097152 --field-trial-handle=2764,i,17726746499487421256,15236426067281671050,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,11553746296345706698,10004182377504446413,2097152 --field-trial-handle=2764,i,17726746499487421256,15236426067281671050,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,7244892022300726564,17617219713327827401,524288 --field-trial-handle=2764,i,17726746499487421256,15236426067281671050,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,6359395765828038926,11275679402857394963,524288 --field-trial-handle=2764,i,17726746499487421256,15236426067281671050,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,4075595290090618147,2658317544173463394,524288 --field-trial-handle=2764,i,17726746499487421256,15236426067281671050,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,4523312621419577519,11716311498533269555,524288 --field-trial-handle=2764,i,17726746499487421256,15236426067281671050,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,4523312621419577519,11716311498533269555,524288 --field-trial-handle=2764,i,17726746499487421256,15236426067281671050,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,18517970154000453,6877601613985961780,524288 --field-trial-handle=2764,i,17726746499487421256,15236426067281671050,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,3399945343989846694,9584510199659967025,524288 --field-trial-handle=2764,i,17726746499487421256,15236426067281671050,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6832,i,5598151174459739223,4264548536317090574,524288 --field-trial-handle=2764,i,17726746499487421256,15236426067281671050,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6984,i,12021837574151240148,13641989324834718377,524288 --field-trial-handle=2764,i,17726746499487421256,15236426067281671050,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,18330837904137105236,1825017467212784224,524288 --field-trial-handle=2764,i,17726746499487421256,15236426067281671050,262144 --variations-seed-version --mojo-platform-channel-handle=1408 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,9461205605570720754,16554029656948223523,524288 --field-trial-handle=2764,i,17726746499487421256,15236426067281671050,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,8040696172758000368,3393916109559955415,524288 --field-trial-handle=2764,i,17726746499487421256,15236426067281671050,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1460,i,11327584717535944636,11355574170920389806,524288 --field-trial-handle=2764,i,17726746499487421256,15236426067281671050,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,13469039451658243749,12453995200895568140,524288 --field-trial-handle=2764,i,17726746499487421256,15236426067281671050,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6520,i,5748507191953246842,14963074692934633689,524288 --field-trial-handle=2764,i,17726746499487421256,15236426067281671050,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1472,i,10127075305487325491,15724488579886349739,524288 --field-trial-handle=2764,i,17726746499487421256,15236426067281671050,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,926718785742470834,13339623904012344136,524288 --field-trial-handle=2764,i,17726746499487421256,15236426067281671050,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5084,i,4615877633341587709,1505442708706694505,262144 --field-trial-handle=2764,i,17726746499487421256,15236426067281671050,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,3899968602689893385,14676602474827576936,524288 --field-trial-handle=2764,i,17726746499487421256,15236426067281671050,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\jebwuomgezwuomge.sysC:\Temp\jebwuomgezwuomge.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\bywqojgbyt.sysC:\Temp\bywqojgbyt.sys1⤵
- Executes dropped EXE
-
C:\Temp\qoigaywqoi.sysC:\Temp\qoigaywqoi.sys1⤵
- Executes dropped EXE
-
C:\Temp\qligdyvqoi.sysC:\Temp\qligdyvqoi.sys1⤵
- Executes dropped EXE
-
C:\Temp\faysqkigay.sysC:\Temp\faysqkigay.sys1⤵
- Executes dropped EXE
-
C:\Temp\auspkifaxv.sysC:\Temp\auspkifaxv.sys1⤵
- Executes dropped EXE
-
C:\Temp\xrpkhfzxrp.sysC:\Temp\xrpkhfzxrp.sys1⤵
- Executes dropped EXE
-
C:\Temp\hezwrpjhez.sysC:\Temp\hezwrpjhez.sys1⤵
- Executes dropped EXE
-
C:\Temp\omgeywuomj.sysC:\Temp\omgeywuomj.sys1⤵
- Executes dropped EXE
-
C:\Temp\oljdbytqlj.sysC:\Temp\oljdbytqlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\ytqlidbvtn.sysC:\Temp\ytqlidbvtn.sys1⤵
-
C:\Temp\vqnlfdbvtn.sysC:\Temp\vqnlfdbvtn.sys1⤵
-
C:\Temp\xvsnlfdxvp.sysC:\Temp\xvsnlfdxvp.sys1⤵
-
C:\Temp\cxvpnkfusp.sysC:\Temp\cxvpnkfusp.sys1⤵
-
C:\Temp\fzxusmkhca.sysC:\Temp\fzxusmkhca.sys1⤵
-
C:\Temp\mkecwupmhe.sysC:\Temp\mkecwupmhe.sys1⤵
-
C:\Temp\zwurmjhbzt.sysC:\Temp\zwurmjhbzt.sys1⤵
-
C:\Temp\rojhbztrlj.sysC:\Temp\rojhbztrlj.sys1⤵
-
C:\Temp\lgdbytqolj.sysC:\Temp\lgdbytqolj.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
auspkicaus.exe
auspkifaxv.sys
bywqojgbyt.sys
bztrljdbvt.exe
dxvqnifays.exe
faysqkigay.sys
i_bztrljdbvt.exe
i_dxvqnifays.exe
i_idbvtnlfdy.exe
i_oigdbvtnli.exe
i_pjhbwrpjey.exe
idbvtnlfdy.exe
jebwuomgezwuomge.exe
jebwuomgezwuomge.sys
oigdbvtnli.exe
pjhbwrpjey.exe
qligdyvqoi.sys
qoigaywqoi.sys
0770d111-ae9d-43c1-9b51-422f135812e3.tmp
35abbdfc-88f2-459a-9eb9-ba7dbc1a8440.tmp
6473fa50-5cb9-439d-ad3d-0e2b904ce768.tmp
settings.dat
settings.dat
37fd3a85-f309-4758-96fc-1a47bcfef8f9.tmp
99302df4-c626-40ba-ae7d-d502bc460199.tmp
the-real-index
the-real-index
2a3b73d0-99a2-4c1a-9263-9fe696ef69d8.tmp
dasherSettingSchema.json
4640f7c8-2a70-4e4b-a1c9-9af5f7031651.tmp
72d45f4d-6851-4766-85b1-88b0334ee08a.tmp
8091ff4b-e0ae-4f93-b551-c1635e6df682.tmp
b21dbc3a-7a51-4e3c-b876-8cd3dcc91f03.tmp
d2ef7593-f25f-4bcd-9887-7d0e765ab340.tmp
db4b75be-aa81-4af5-904d-e99a49244be7.tmp
57fb43f1-8ede-4a11-88e4-6667270fe5b5.tmp
OperationConfig
a9a9e92b-f237-4907-b27b-e4c3ad20dd64.tmp
aa440249-8665-4526-85d1-09b002f345a7.tmp
abb75521-779c-4176-ac91-a4b598c1d51a.tmp
aec7ed4b-d780-48ef-86ba-6d1b2b4d499d.tmp
b87c8a52-de0c-4fd8-8619-aee742bdc889.tmp
d2896d37-5749-4866-83f0-7c54b7055d0f.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
3d2ea2f8-f021-442c-b570-fbe99479ce41.tmp
9d01c15c-3703-4c9a-bc85-158c1a1077c2.tmp
771c93bc-28b9-4b97-a415-05164b9d2ab7.tmp
f11aec27-853e-4eef-8b01-65015362f504.tmp
content.js
messages.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/712-696-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/712-717-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1072-637-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1592-521-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1944-716-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2084-528-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2084-508-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2148-697-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2388-431-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2588-480-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2588-514-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2652-722-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3016-558-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3276-742-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3284-535-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3472-639-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4232-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4352-664-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4616-746-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4932-673-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4932-652-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5264-580-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5596-576-0x0000000000010000-0x00000000000AB000-memory.dmp