Analysis
- max time kernel
149s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
21/10/2026, 03:39
General
- Target 2026-10-19_106f01059c80f301cdcb4b2180e5e17f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261021-d74ryayvcx
- SHA256 3dd98d45f53b836826f5dcce8db8ec6eafa8be58087719fd593e42caa57f7e65
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_106f01059c80f301cdcb4b2180e5e17f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-19_106f01059c80f301cdcb4b2180e5e17f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\nhfaxspkicaxsqkh.exeC:\Temp\nhfaxspkicaxsqkh.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vpnhfdausk.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\vpnhfdausk.exeC:\Temp\vpnhfdausk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vpnhfdausk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vpnhfdausk.exeC:\Temp\i_vpnhfdausk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pfzxupnhec.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pfzxupnhec.exeC:\Temp\pfzxupnhec.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pfzxupnhec.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pfzxupnhec.exeC:\Temp\i_pfzxupnhec.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\eczusmkhcz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\eczusmkhcz.exeC:\Temp\eczusmkhcz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_eczusmkhcz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_eczusmkhcz.exeC:\Temp\i_eczusmkhcz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ebzwromkhb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ebzwromkhb.exeC:\Temp\ebzwromkhb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ebzwromkhb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ebzwromkhb.exeC:\Temp\i_ebzwromkhb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bwtomgebwu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bwtomgebwu.exeC:\Temp\bwtomgebwu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bwtomgebwu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bwtomgebwu.exeC:\Temp\i_bwtomgebwu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\eywtoljytq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\eywtoljytq.exeC:\Temp\eywtoljytq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_eywtoljytq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_eywtoljytq.exeC:\Temp\i_eywtoljytq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\yvqolgdyvt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\yvqolgdyvt.exeC:\Temp\yvqolgdyvt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_yvqolgdyvt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_yvqolgdyvt.exeC:\Temp\i_yvqolgdyvt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ayvqnifday.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ayvqnifday.exeC:\Temp\ayvqnifday.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ayvqnifday.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ayvqnifday.exeC:\Temp\i_ayvqnifday.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vsnkfcaysq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vsnkfcaysq.exeC:\Temp\vsnkfcaysq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vsnkfcaysq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vsnkfcaysq.exeC:\Temp\i_vsnkfcaysq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xusnhfcxvp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xusnhfcxvp.exeC:\Temp\xusnhfcxvp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xusnhfcxvp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xusnhfcxvp.exeC:\Temp\i_xusnhfcxvp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vpmkhczxup.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vpmkhczxup.exeC:\Temp\vpmkhczxup.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vpmkhczxup.exe ups_ins3⤵
-
C:\Temp\i_vpmkhczxup.exeC:\Temp\i_vpmkhczxup.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ezwupmhfzx.exe ups_run3⤵
-
C:\Temp\ezwupmhfzx.exeC:\Temp\ezwupmhfzx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ezwupmhfzx.exe ups_ins3⤵
-
C:\Temp\i_ezwupmhfzx.exeC:\Temp\i_ezwupmhfzx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wuomgezwrp.exe ups_run3⤵
-
C:\Temp\wuomgezwrp.exeC:\Temp\wuomgezwrp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wuomgezwrp.exe ups_ins3⤵
-
C:\Temp\i_wuomgezwrp.exeC:\Temp\i_wuomgezwrp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zwuomgezwr.exe ups_run3⤵
-
C:\Temp\zwuomgezwr.exeC:\Temp\zwuomgezwr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zwuomgezwr.exe ups_ins3⤵
-
C:\Temp\i_zwuomgezwr.exeC:\Temp\i_zwuomgezwr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wtolgdywqo.exe ups_run3⤵
-
C:\Temp\wtolgdywqo.exeC:\Temp\wtolgdywqo.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wtolgdywqo.exe ups_ins3⤵
-
C:\Temp\i_wtolgdywqo.exeC:\Temp\i_wtolgdywqo.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqlidbvtnl.exe ups_run3⤵
-
C:\Temp\sqlidbvtnl.exeC:\Temp\sqlidbvtnl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqlidbvtnl.exe ups_ins3⤵
-
C:\Temp\i_sqlidbvtnl.exeC:\Temp\i_sqlidbvtnl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qkicaysqki.exe ups_run3⤵
-
C:\Temp\qkicaysqki.exeC:\Temp\qkicaysqki.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qkicaysqki.exe ups_ins3⤵
-
C:\Temp\i_qkicaysqki.exeC:\Temp\i_qkicaysqki.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ifdxvpnhfa.exe ups_run3⤵
-
C:\Temp\ifdxvpnhfa.exeC:\Temp\ifdxvpnhfa.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ifdxvpnhfa.exe ups_ins3⤵
-
C:\Temp\i_ifdxvpnhfa.exeC:\Temp\i_ifdxvpnhfa.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\icausmkfcx.exe ups_run3⤵
-
C:\Temp\icausmkfcx.exeC:\Temp\icausmkfcx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_icausmkfcx.exe ups_ins3⤵
-
C:\Temp\i_icausmkfcx.exeC:\Temp\i_icausmkfcx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecwupmkhfz.exe ups_run3⤵
-
C:\Temp\ecwupmkhfz.exeC:\Temp\ecwupmkhfz.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffdbd9dc188,0x7ffdbd9dc194,0x7ffdbd9dc1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1848,i,6971025746634895082,1513552478085359410,262144 --field-trial-handle=2456,i,8643617164618890792,4491783952875023020,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2128,i,11565743741730542418,3492219039832525011,524288 --field-trial-handle=2456,i,8643617164618890792,4491783952875023020,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2668,i,690727449784515304,598745729949790735,524288 --field-trial-handle=2456,i,8643617164618890792,4491783952875023020,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3352,i,6167010988584977807,18054507937482897851,2097152 --field-trial-handle=2456,i,8643617164618890792,4491783952875023020,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3356,i,3851092949386591893,12017983656862962043,2097152 --field-trial-handle=2456,i,8643617164618890792,4491783952875023020,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,1973252310447631935,2537173037713407202,2097152 --field-trial-handle=2456,i,8643617164618890792,4491783952875023020,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,2545469872333885573,5089171877398279647,2097152 --field-trial-handle=2456,i,8643617164618890792,4491783952875023020,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,525994488266053620,8699563715915102854,524288 --field-trial-handle=2456,i,8643617164618890792,4491783952875023020,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,5155662666984425242,12901783774949429580,524288 --field-trial-handle=2456,i,8643617164618890792,4491783952875023020,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,10827063937748562832,10316671092190686882,524288 --field-trial-handle=2456,i,8643617164618890792,4491783952875023020,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,16812447585962165652,13602717327283708053,524288 --field-trial-handle=2456,i,8643617164618890792,4491783952875023020,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,16812447585962165652,13602717327283708053,524288 --field-trial-handle=2456,i,8643617164618890792,4491783952875023020,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,4789459161860060687,97436090951035598,524288 --field-trial-handle=2456,i,8643617164618890792,4491783952875023020,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,2013000106114966813,17546641247844426191,524288 --field-trial-handle=2456,i,8643617164618890792,4491783952875023020,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,15263300206589133570,14273620614437682545,524288 --field-trial-handle=2456,i,8643617164618890792,4491783952875023020,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,17845819849630756284,8432947117550314883,524288 --field-trial-handle=2456,i,8643617164618890792,4491783952875023020,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4732,i,16074211130134780303,3921160805766189085,524288 --field-trial-handle=2456,i,8643617164618890792,4491783952875023020,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,4314553529525989017,14569580114111288102,524288 --field-trial-handle=2456,i,8643617164618890792,4491783952875023020,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,15993041632486771096,1056593026290012876,524288 --field-trial-handle=2456,i,8643617164618890792,4491783952875023020,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4832,i,16304239482405944558,3001924360882992130,524288 --field-trial-handle=2456,i,8643617164618890792,4491783952875023020,262144 --variations-seed-version --mojo-platform-channel-handle=1548 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,9528635500657397161,2266325524449115957,524288 --field-trial-handle=2456,i,8643617164618890792,4491783952875023020,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,6240188291747272796,4487542846244681899,524288 --field-trial-handle=2456,i,8643617164618890792,4491783952875023020,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,7175889776115910691,14489363787497505613,524288 --field-trial-handle=2456,i,8643617164618890792,4491783952875023020,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6940,i,18271459725170931570,12111462045273291600,262144 --field-trial-handle=2456,i,8643617164618890792,4491783952875023020,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,12467307846247629108,1161390242974816299,524288 --field-trial-handle=2456,i,8643617164618890792,4491783952875023020,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\nhfaxspkicaxsqkh.sysC:\Temp\nhfaxspkicaxsqkh.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Temp\spkifaxspk.sysC:\Temp\spkifaxspk.sys1⤵
- Executes dropped EXE
-
C:\Temp\khfzxrpkhc.sysC:\Temp\khfzxrpkhc.sys1⤵
- Executes dropped EXE
-
C:\Temp\bzxrpjhecz.sysC:\Temp\bzxrpjhecz.sys1⤵
- Executes dropped EXE
-
C:\Temp\mjhbztjebw.sysC:\Temp\mjhbztjebw.sys1⤵
- Executes dropped EXE
-
C:\Temp\dbwtoljebw.sysC:\Temp\dbwtoljebw.sys1⤵
- Executes dropped EXE
-
C:\Temp\ywqolgdywq.sysC:\Temp\ywqolgdywq.sys1⤵
- Executes dropped EXE
-
C:\Temp\dxvqnifdyv.sysC:\Temp\dxvqnifdyv.sys1⤵
- Executes dropped EXE
-
C:\Temp\lidayvqnig.sysC:\Temp\lidayvqnig.sys1⤵
- Executes dropped EXE
-
C:\Temp\dxvpnifaxs.sysC:\Temp\dxvpnifaxs.sys1⤵
- Executes dropped EXE
-
C:\Temp\uspkhfzxrp.sysC:\Temp\uspkhfzxrp.sys1⤵
- Executes dropped EXE
-
C:\Temp\zwupmhezxr.sysC:\Temp\zwupmhezxr.sys1⤵
-
C:\Temp\ebzurmjebz.sysC:\Temp\ebzurmjebz.sys1⤵
-
C:\Temp\wtromgebzw.sysC:\Temp\wtromgebzw.sys1⤵
-
C:\Temp\bvtrljdbvt.sysC:\Temp\bvtrljdbvt.sys1⤵
-
C:\Temp\vtqlidbywq.sysC:\Temp\vtqlidbywq.sys1⤵
-
C:\Temp\aysqoigays.sysC:\Temp\aysqoigays.sys1⤵
-
C:\Temp\nlfdxvpnhf.sysC:\Temp\nlfdxvpnhf.sys1⤵
-
C:\Temp\mkfcaupnhf.sysC:\Temp\mkfcaupnhf.sys1⤵
-
C:\Temp\hczuspkhcz.sysC:\Temp\hczuspkhcz.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
bwtomgebwu.exe
bzxrpjhecz.sys
dbwtoljebw.sys
ebzwromkhb.exe
eczusmkhcz.exe
eywtoljytq.exe
i_bwtomgebwu.exe
i_ebzwromkhb.exe
i_eczusmkhcz.exe
i_pfzxupnhec.exe
i_vpnhfdausk.exe
khfzxrpkhc.sys
mjhbztjebw.sys
nhfaxspkicaxsqkh.exe
nhfaxspkicaxsqkh.sys
pfzxupnhec.exe
spkifaxspk.sys
vpnhfdausk.exe
04d866c1-5752-45d8-b319-22a62bea1f46.tmp
4f642d20-129b-4587-b0f0-9b5004d7572e.tmp
settings.dat
settings.dat
1a5fdc3b-3a3a-4f3a-8ff5-f62d88fadc64.tmp
2b005404-64ba-41da-91b9-a85df998bb74.tmp
3177f65e-7ad6-4e86-8bb1-30667f359570.tmp
5e77ec4b-f0d2-4a5a-9118-c56a18d07806.tmp
temp-index
the-real-index
332553ad-995b-4f85-a0bf-b04ada58d481.tmp
dasherSettingSchema.json
842734e4-db8e-4545-9380-41a734e5789d.tmp
9b1d6cb8-1823-4eab-b421-eeabc6267c9c.tmp
cb085415-6816-4857-b87b-b06d3bf3e742.tmp
a8de997e-e57d-4277-aa09-443cfd3fbf0d.tmp
2fa0f87c-4a82-403a-8bf4-835b8b314bba.tmp
a92d51a9-9e9d-45e5-a546-503eabf6001d.tmp
cd7291f6-9411-4875-a23a-b081bb35b8e3.tmp
8503a6d8-112a-4887-97f8-530734ee5ba3.tmp
c13eb772-900d-4591-a7ae-a3842623d7d9.tmp
f36c884f-9633-421d-89bc-1513e3647a79.tmp
d58aba4e-d0bc-4645-b49a-43f996cf19fb.tmp
de877f05-2fa9-41ae-baee-6d3d8c7503d7.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
66333914-fb56-44be-9840-36627535fef4.tmp
metadata.json
8838aa30-9be5-4f61-b263-094d717013ca.tmp
9af08c9a-81c3-4998-a1dd-6b196d50a551.tmp
content.js
messages.json
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/1412-587-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1624-700-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2240-725-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2360-566-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3052-637-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3132-525-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3172-683-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3360-582-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3740-721-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3836-743-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4416-470-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4416-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4444-538-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4512-513-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4924-617-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4940-695-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4940-485-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5116-562-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5328-651-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5744-663-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6032-434-0x0000000000010000-0x00000000000AB000-memory.dmp