Analysis
- max time kernel
149s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
21/10/2026, 01:41
General
- Target 2026-10-19_226e283ebb79cf4e9922fe069f5fbf32_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261021-b34v2adh93
- SHA256 ea6e1494b5e7b2c21861dabd1a20198c2f82781c489e4d8e646dfb9df908eaeb
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_226e283ebb79cf4e9922fe069f5fbf32_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-19_226e283ebb79cf4e9922fe069f5fbf32_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\hfausqkicausmkfc.exeC:\Temp\hfausqkicausmkfc.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nhfzxspkhc.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\nhfzxspkhc.exeC:\Temp\nhfzxspkhc.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nhfzxspkhc.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nhfzxspkhc.exeC:\Temp\i_nhfzxspkhc.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mhecwusmke.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mhecwusmke.exeC:\Temp\mhecwusmke.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mhecwusmke.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mhecwusmke.exeC:\Temp\i_mhecwusmke.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\urmbzwuomg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\urmbzwuomg.exeC:\Temp\urmbzwuomg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_urmbzwuomg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_urmbzwuomg.exeC:\Temp\i_urmbzwuomg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trojhezwro.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\trojhezwro.exeC:\Temp\trojhezwro.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trojhezwro.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_trojhezwro.exeC:\Temp\i_trojhezwro.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jgbytrljdb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jgbytrljdb.exeC:\Temp\jgbytrljdb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jgbytrljdb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jgbytrljdb.exeC:\Temp\i_jgbytrljdb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dbvtolfdyv.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dbvtolfdyv.exeC:\Temp\dbvtolfdyv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dbvtolfdyv.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dbvtolfdyv.exeC:\Temp\i_dbvtolfdyv.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bvtnlxvqni.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bvtnlxvqni.exeC:\Temp\bvtnlxvqni.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bvtnlxvqni.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bvtnlxvqni.exeC:\Temp\i_bvtnlxvqni.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvtnlifays.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xvtnlifays.exeC:\Temp\xvtnlifays.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xvtnlifays.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xvtnlifays.exeC:\Temp\i_xvtnlifays.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usmkicaxvp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\usmkicaxvp.exeC:\Temp\usmkicaxvp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usmkicaxvp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_usmkicaxvp.exeC:\Temp\i_usmkicaxvp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nkeczxupmh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nkeczxupmh.exeC:\Temp\nkeczxupmh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nkeczxupmh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nkeczxupmh.exeC:\Temp\i_nkeczxupmh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rmkecwusmk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rmkecwusmk.exeC:\Temp\rmkecwusmk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rmkecwusmk.exe ups_ins3⤵
-
C:\Temp\i_rmkecwusmk.exeC:\Temp\i_rmkecwusmk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trmjebztrm.exe ups_run3⤵
-
C:\Temp\trmjebztrm.exeC:\Temp\trmjebztrm.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trmjebztrm.exe ups_ins3⤵
-
C:\Temp\i_trmjebztrm.exeC:\Temp\i_trmjebztrm.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rojgeywroj.exe ups_run3⤵
-
C:\Temp\rojgeywroj.exeC:\Temp\rojgeywroj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rojgeywroj.exe ups_ins3⤵
-
C:\Temp\i_rojgeywroj.exeC:\Temp\i_rojgeywroj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljdbwtolge.exe ups_run3⤵
-
C:\Temp\ljdbwtolge.exeC:\Temp\ljdbwtolge.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljdbwtolge.exe ups_ins3⤵
-
C:\Temp\i_ljdbwtolge.exeC:\Temp\i_ljdbwtolge.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tnlgdytqlj.exe ups_run3⤵
-
C:\Temp\tnlgdytqlj.exeC:\Temp\tnlgdytqlj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tnlgdytqlj.exe ups_ins3⤵
-
C:\Temp\i_tnlgdytqlj.exeC:\Temp\i_tnlgdytqlj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kidavsnlfd.exe ups_run3⤵
-
C:\Temp\kidavsnlfd.exeC:\Temp\kidavsnlfd.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kidavsnlfd.exe ups_ins3⤵
-
C:\Temp\i_kidavsnlfd.exeC:\Temp\i_kidavsnlfd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\faxspnifax.exe ups_run3⤵
-
C:\Temp\faxspnifax.exeC:\Temp\faxspnifax.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_faxspnifax.exe ups_ins3⤵
-
C:\Temp\i_faxspnifax.exeC:\Temp\i_faxspnifax.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ausmkfcxvp.exe ups_run3⤵
-
C:\Temp\ausmkfcxvp.exeC:\Temp\ausmkfcxvp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ausmkfcxvp.exe ups_ins3⤵
-
C:\Temp\i_ausmkfcxvp.exeC:\Temp\i_ausmkfcxvp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hcausmkfcx.exe ups_run3⤵
-
C:\Temp\hcausmkfcx.exeC:\Temp\hcausmkfcx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hcausmkfcx.exe ups_ins3⤵
-
C:\Temp\i_hcausmkfcx.exeC:\Temp\i_hcausmkfcx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ezwurpjhbz.exe ups_run3⤵
-
C:\Temp\ezwurpjhbz.exeC:\Temp\ezwurpjhbz.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7fff489ec188,0x7fff489ec194,0x7fff489ec1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,13468630738647664532,5278807831481225025,262144 --field-trial-handle=2292,i,17029850118957682396,16662421102829893603,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,7980168181334157392,1987955252629406432,524288 --field-trial-handle=2292,i,17029850118957682396,16662421102829893603,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,14081643345058008759,6221230259286798104,524288 --field-trial-handle=2292,i,17029850118957682396,16662421102829893603,262144 --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,12926803009432790340,10335041284804207236,2097152 --field-trial-handle=2292,i,17029850118957682396,16662421102829893603,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3568,i,2097584227459540358,14340076905776290225,2097152 --field-trial-handle=2292,i,17029850118957682396,16662421102829893603,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,13451488205622556283,282202065554703088,2097152 --field-trial-handle=2292,i,17029850118957682396,16662421102829893603,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,13107625571801247100,3506613638338878908,2097152 --field-trial-handle=2292,i,17029850118957682396,16662421102829893603,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,8181281794110767981,12087981659659035456,524288 --field-trial-handle=2292,i,17029850118957682396,16662421102829893603,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,13837967153406729271,10517093585634867152,524288 --field-trial-handle=2292,i,17029850118957682396,16662421102829893603,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,3508264056321323536,11099551075409971535,524288 --field-trial-handle=2292,i,17029850118957682396,16662421102829893603,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,3068573826082304614,322628624240302027,524288 --field-trial-handle=2292,i,17029850118957682396,16662421102829893603,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,3068573826082304614,322628624240302027,524288 --field-trial-handle=2292,i,17029850118957682396,16662421102829893603,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,9713769929002988349,13970542250253462656,524288 --field-trial-handle=2292,i,17029850118957682396,16662421102829893603,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,368312776307471242,18436234723874382038,524288 --field-trial-handle=2292,i,17029850118957682396,16662421102829893603,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,16380150803368413423,13006250997628187222,524288 --field-trial-handle=2292,i,17029850118957682396,16662421102829893603,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,10958002878166143374,1379268669981242994,524288 --field-trial-handle=2292,i,17029850118957682396,16662421102829893603,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,4399932346493506225,12690589428822633161,524288 --field-trial-handle=2292,i,17029850118957682396,16662421102829893603,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,15531957902090601563,7033446200296723505,524288 --field-trial-handle=2292,i,17029850118957682396,16662421102829893603,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,4449735723064641512,6208064838164067759,524288 --field-trial-handle=2292,i,17029850118957682396,16662421102829893603,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,6451852850269739771,12527371735843627897,524288 --field-trial-handle=2292,i,17029850118957682396,16662421102829893603,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4208,i,14969997932900548281,9621698819038722523,524288 --field-trial-handle=2292,i,17029850118957682396,16662421102829893603,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,3251169775616617567,3342654076930973256,524288 --field-trial-handle=2292,i,17029850118957682396,16662421102829893603,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6880,i,8511761797296216486,5871337912098713956,524288 --field-trial-handle=2292,i,17029850118957682396,16662421102829893603,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6436,i,10581136667607118891,10094150175565411861,262144 --field-trial-handle=2292,i,17029850118957682396,16662421102829893603,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,1778116967533367949,2780135225130331316,524288 --field-trial-handle=2292,i,17029850118957682396,16662421102829893603,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\hfausqkicausmkfc.sysC:\Temp\hfausqkicausmkfc.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Temp\xrpnhfzpmh.sysC:\Temp\xrpnhfzpmh.sys1⤵
- Executes dropped EXE
-
C:\Temp\zurmjhbzxr.sysC:\Temp\zurmjhbzxr.sys1⤵
- Executes dropped EXE
-
C:\Temp\romgezwuom.sysC:\Temp\romgezwuom.sys1⤵
- Executes dropped EXE
-
C:\Temp\omgeywqojg.sysC:\Temp\omgeywqojg.sys1⤵
- Executes dropped EXE
-
C:\Temp\geywlgdbvt.sysC:\Temp\geywlgdbvt.sys1⤵
- Executes dropped EXE
-
C:\Temp\dbvtnlfdyv.sysC:\Temp\dbvtnlfdyv.sys1⤵
- Executes dropped EXE
-
C:\Temp\yvqnlfdavs.sysC:\Temp\yvqnlfdavs.sys1⤵
- Executes dropped EXE
-
C:\Temp\causmkfcxu.sysC:\Temp\causmkfcxu.sys1⤵
- Executes dropped EXE
-
C:\Temp\xvpnhfdxup.sysC:\Temp\xvpnhfdxup.sys1⤵
- Executes dropped EXE
-
C:\Temp\xrpjhczusm.sysC:\Temp\xrpjhczusm.sys1⤵
- Executes dropped EXE
-
C:\Temp\urmkecwuom.sysC:\Temp\urmkecwuom.sys1⤵
-
C:\Temp\urljdbywuo.sysC:\Temp\urljdbywuo.sys1⤵
-
C:\Temp\tromgeywqo.sysC:\Temp\tromgeywqo.sys1⤵
-
C:\Temp\ytrljdbvto.sysC:\Temp\ytrljdbvto.sys1⤵
-
C:\Temp\qkifdyvqni.sysC:\Temp\qkifdyvqni.sys1⤵
-
C:\Temp\fdxvpnifay.sysC:\Temp\fdxvpnifay.sys1⤵
-
C:\Temp\fdxvsmkica.sysC:\Temp\fdxvsmkica.sys1⤵
-
C:\Temp\khczusmkec.sysC:\Temp\khczusmkec.sys1⤵
-
C:\Temp\hezxrpjhbz.sysC:\Temp\hezxrpjhbz.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
dbvtolfdyv.exe
geywlgdbvt.sys
hfausqkicausmkfc.exe
hfausqkicausmkfc.sys
i_jgbytrljdb.exe
i_mhecwusmke.exe
i_nhfzxspkhc.exe
i_trojhezwro.exe
i_urmbzwuomg.exe
jgbytrljdb.exe
mhecwusmke.exe
nhfzxspkhc.exe
omgeywqojg.sys
romgezwuom.sys
trojhezwro.exe
urmbzwuomg.exe
xrpnhfzpmh.sys
zurmjhbzxr.sys
31af45a7-1ec7-4694-9026-7cd07d361134.tmp
395a9064-0e58-4b26-a15d-839941bc5927.tmp
4caa1faf-3a85-4cc8-982d-2c1fcf5e2f1c.tmp
settings.dat
settings.dat
32a22e32-ee10-44c5-9c72-f5174f8ccffd.tmp
71f12e40-7e76-4f93-a829-f1651552b467.tmp
7c76875b-cc5f-4566-8e0a-a0b217f53303.tmp
8ac8da2b-76a9-45f4-bbe0-7a148146c95b.tmp
temp-index
the-real-index
a33ac8f8-f9bb-4ece-8eea-7839a6c08ab3.tmp
dasherSettingSchema.json
4d98c2b8-aa05-4618-80a4-9e574b682cde.tmp
a2d154db-196b-4388-9993-d393603a8563.tmp
ee31c787-4ab9-4acc-9b62-a8ab387e4c99.tmp
sync_diagnostic.log
bf84ab88-5581-4aed-91ce-d4b22c74547c.tmp
faa2dc4e-144e-4737-a7e3-9e973ee7f5e0.tmp
2837de5e-2366-4b8e-9c4e-cd3d9daa4728.tmp
Local State
cdcd34eb-a29b-45bf-84d1-4f568353af33.tmp
2f9f8e58-f15c-48f3-b584-8570923f2a4f.tmp
73f4786c-78ef-4771-8a86-e152453d0d7b.tmp
9c024fe8-b3da-4802-82a4-b21e94fe619e.tmp
372c75ef-3304-442d-96ad-d8b36b10a5ad.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
e732329e-8fd5-4aff-bed3-5063b5502f6b.tmp
f7318317-bb37-4966-b38d-3433e987e220.tmp
7692cb1f-c792-4ea5-85e6-f0843028f0d7.tmp
d6a51024-0049-428b-982a-fd3556e6c830.tmp
messages.json
content.js
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/1928-521-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2004-432-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2012-694-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2028-577-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2064-481-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2612-63-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2640-610-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2960-534-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2980-612-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3564-657-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3912-719-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4176-561-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4204-653-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4232-509-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4320-631-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4584-737-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4644-689-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4932-557-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5848-715-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6044-677-0x0000000000010000-0x00000000000AB000-memory.dmp