Analysis
- max time kernel
148s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
23/10/2026, 09:40
General
- Target 2026-10-23_933fa6b152957e2a13697035b57b10aa_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261023-lnfj1acf24
- SHA256 ddfc25d5ffa3cd75e268170e58e20dceae8a48613136b81d028dfee2c3a7bce7
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-23_933fa6b152957e2a13697035b57b10aa_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-23_933fa6b152957e2a13697035b57b10aa_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\wupmhezxrpjhczur.exeC:\Temp\wupmhezxrpjhczur.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\czusebwuom.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\czusebwuom.exeC:\Temp\czusebwuom.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_czusebwuom.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_czusebwuom.exeC:\Temp\i_czusebwuom.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rojhbztrmj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rojhbztrmj.exeC:\Temp\rojhbztrmj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rojhbztrmj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rojhbztrmj.exeC:\Temp\i_rojhbztrmj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdbvtolgey.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jdbvtolgey.exeC:\Temp\jdbvtolgey.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdbvtolgey.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jdbvtolgey.exeC:\Temp\i_jdbvtolgey.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bvtnigaysq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bvtnigaysq.exeC:\Temp\bvtnigaysq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bvtnigaysq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bvtnigaysq.exeC:\Temp\i_bvtnigaysq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lfdaysqlid.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lfdaysqlid.exeC:\Temp\lfdaysqlid.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lfdaysqlid.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lfdaysqlid.exeC:\Temp\i_lfdaysqlid.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vpnifaxvpn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vpnifaxvpn.exeC:\Temp\vpnifaxvpn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vpnifaxvpn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vpnifaxvpn.exeC:\Temp\i_vpnifaxvpn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\auspkfcavp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\auspkfcavp.exeC:\Temp\auspkfcavp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_auspkfcavp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_auspkfcavp.exeC:\Temp\i_auspkfcavp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxupnhfzxr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zxupnhfzxr.exeC:\Temp\zxupnhfzxr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxupnhfzxr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zxupnhfzxr.exeC:\Temp\i_zxupnhfzxr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\urmgecwurm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\urmgecwurm.exeC:\Temp\urmgecwurm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_urmgecwurm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_urmgecwurm.exeC:\Temp\i_urmgecwurm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rmgezwrojh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rmgezwrojh.exeC:\Temp\rmgezwrojh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rmgezwrojh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rmgezwrojh.exeC:\Temp\i_rmgezwrojh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omjdbwtomg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\omjdbwtomg.exeC:\Temp\omjdbwtomg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omjdbwtomg.exe ups_ins3⤵
-
C:\Temp\i_omjdbwtomg.exeC:\Temp\i_omjdbwtomg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wqljdbytrl.exe ups_run3⤵
-
C:\Temp\wqljdbytrl.exeC:\Temp\wqljdbytrl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wqljdbytrl.exe ups_ins3⤵
-
C:\Temp\i_wqljdbytrl.exeC:\Temp\i_wqljdbytrl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bvtnlfdavs.exe ups_run3⤵
-
C:\Temp\bvtnlfdavs.exeC:\Temp\bvtnlfdavs.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bvtnlfdavs.exe ups_ins3⤵
-
C:\Temp\i_bvtnlfdavs.exeC:\Temp\i_bvtnlfdavs.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\davtnlfdxv.exe ups_run3⤵
-
C:\Temp\davtnlfdxv.exeC:\Temp\davtnlfdxv.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_davtnlfdxv.exe ups_ins3⤵
-
C:\Temp\i_davtnlfdxv.exeC:\Temp\i_davtnlfdxv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fausqkfcav.exe ups_run3⤵
-
C:\Temp\fausqkfcav.exeC:\Temp\fausqkfcav.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fausqkfcav.exe ups_ins3⤵
-
C:\Temp\i_fausqkfcav.exeC:\Temp\i_fausqkfcav.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\smkecxupnh.exe ups_run3⤵
-
C:\Temp\smkecxupnh.exeC:\Temp\smkecxupnh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_smkecxupnh.exe ups_ins3⤵
-
C:\Temp\i_smkecxupnh.exeC:\Temp\i_smkecxupnh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecwupmhfzx.exe ups_run3⤵
-
C:\Temp\ecwupmhfzx.exeC:\Temp\ecwupmhfzx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecwupmhfzx.exe ups_ins3⤵
-
C:\Temp\i_ecwupmhfzx.exeC:\Temp\i_ecwupmhfzx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecwuomhezx.exe ups_run3⤵
-
C:\Temp\ecwuomhezx.exeC:\Temp\ecwuomhezx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecwuomhezx.exe ups_ins3⤵
-
C:\Temp\i_ecwuomhezx.exeC:\Temp\i_ecwuomhezx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ytromgeywu.exe ups_run3⤵
-
C:\Temp\ytromgeywu.exeC:\Temp\ytromgeywu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ytromgeywu.exe ups_ins3⤵
-
C:\Temp\i_ytromgeywu.exeC:\Temp\i_ytromgeywu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffd764ac188,0x7ffd764ac194,0x7ffd764ac1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,12872266445371009637,1020433354610345152,524288 --field-trial-handle=2392,i,10188395310773664389,9431644189188840646,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,4136467526235033712,96844932990764591,262144 --field-trial-handle=2392,i,10188395310773664389,9431644189188840646,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2408,i,11898446134952206703,18440203704087536371,524288 --field-trial-handle=2392,i,10188395310773664389,9431644189188840646,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,9091368192718511659,2227388446457646086,2097152 --field-trial-handle=2392,i,10188395310773664389,9431644189188840646,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,11708673311190963240,10046623847689431397,2097152 --field-trial-handle=2392,i,10188395310773664389,9431644189188840646,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4404,i,11814565077908279508,16581839633134137029,2097152 --field-trial-handle=2392,i,10188395310773664389,9431644189188840646,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4416,i,8926143274924750257,10327025406187765097,2097152 --field-trial-handle=2392,i,10188395310773664389,9431644189188840646,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,3133565878754933329,6205174961853592372,524288 --field-trial-handle=2392,i,10188395310773664389,9431644189188840646,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,7627092248358883171,9911232821260638921,524288 --field-trial-handle=2392,i,10188395310773664389,9431644189188840646,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,10776114369370564737,15671502252236343407,524288 --field-trial-handle=2392,i,10188395310773664389,9431644189188840646,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,3916273424106774540,8582225658892032002,524288 --field-trial-handle=2392,i,10188395310773664389,9431644189188840646,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,3916273424106774540,8582225658892032002,524288 --field-trial-handle=2392,i,10188395310773664389,9431644189188840646,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,15077318710885109971,9499953707163257659,524288 --field-trial-handle=2392,i,10188395310773664389,9431644189188840646,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,3957633225070313491,15640099550384247892,524288 --field-trial-handle=2392,i,10188395310773664389,9431644189188840646,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6832,i,12926203189848634747,7241697513263146092,524288 --field-trial-handle=2392,i,10188395310773664389,9431644189188840646,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6968,i,16684886662837885375,14108131983875156327,524288 --field-trial-handle=2392,i,10188395310773664389,9431644189188840646,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,4754257225023128994,15118015494097577789,524288 --field-trial-handle=2392,i,10188395310773664389,9431644189188840646,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,7370277827908348,11501369194843950732,524288 --field-trial-handle=2392,i,10188395310773664389,9431644189188840646,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,17154746134786574351,17671796082244329451,524288 --field-trial-handle=2392,i,10188395310773664389,9431644189188840646,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,18207107708673111471,12942886989349105651,524288 --field-trial-handle=2392,i,10188395310773664389,9431644189188840646,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2976,i,1894798742935314347,8185183591151180176,524288 --field-trial-handle=2392,i,10188395310773664389,9431644189188840646,262144 --variations-seed-version --mojo-platform-channel-handle=4080 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,18409615329894832510,5666831553347039252,524288 --field-trial-handle=2392,i,10188395310773664389,9431644189188840646,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,16382734067792584130,11166316618182706650,524288 --field-trial-handle=2392,i,10188395310773664389,9431644189188840646,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7004,i,12469738863730477280,9987557829578291534,262144 --field-trial-handle=2392,i,10188395310773664389,9431644189188840646,262144 --variations-seed-version --mojo-platform-channel-handle=7104 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,5486568852850894451,13691178014478430916,524288 --field-trial-handle=2392,i,10188395310773664389,9431644189188840646,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\wupmhezxrpjhczur.sysC:\Temp\wupmhezxrpjhczur.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\ztrmjebwuo.sysC:\Temp\ztrmjebwuo.sys1⤵
- Executes dropped EXE
-
C:\Temp\geywtrojgb.sysC:\Temp\geywtrojgb.sys1⤵
- Executes dropped EXE
-
C:\Temp\bvtnlgdywq.sysC:\Temp\bvtnlgdywq.sys1⤵
- Executes dropped EXE
-
C:\Temp\yvtnlfaysq.sysC:\Temp\yvtnlfaysq.sys1⤵
- Executes dropped EXE
-
C:\Temp\sqnifdaysp.sysC:\Temp\sqnifdaysp.sys1⤵
- Executes dropped EXE
-
C:\Temp\dxvpnhfaxs.sysC:\Temp\dxvpnhfaxs.sys1⤵
- Executes dropped EXE
-
C:\Temp\cxupmhecau.sysC:\Temp\cxupmhecau.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhczurpkhf.sysC:\Temp\jhczurpkhf.sys1⤵
- Executes dropped EXE
-
C:\Temp\wurmjezwrp.sysC:\Temp\wurmjezwrp.sys1⤵
- Executes dropped EXE
-
C:\Temp\ljhbzwrojg.sysC:\Temp\ljhbzwrojg.sys1⤵
- Executes dropped EXE
-
C:\Temp\tnlgdywqoi.sysC:\Temp\tnlgdywqoi.sys1⤵
-
C:\Temp\nlgdywqolg.sysC:\Temp\nlgdywqolg.sys1⤵
-
C:\Temp\idbvtnkida.sysC:\Temp\idbvtnkida.sys1⤵
-
C:\Temp\faxvsnkfdx.sysC:\Temp\faxvsnkfdx.sys1⤵
-
C:\Temp\usmkhcausm.sysC:\Temp\usmkhcausm.sys1⤵
-
C:\Temp\usmkfcxupn.sysC:\Temp\usmkfcxupn.sys1⤵
-
C:\Temp\kecwuomhfz.sysC:\Temp\kecwuomhfz.sys1⤵
-
C:\Temp\cwuomjebzw.sysC:\Temp\cwuomjebzw.sys1⤵
-
C:\Temp\wqojgbzwqo.sysC:\Temp\wqojgbzwqo.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
bvtnigaysq.exe
bvtnlgdywq.sys
czusebwuom.exe
geywtrojgb.sys
i_bvtnigaysq.exe
i_czusebwuom.exe
i_jdbvtolgey.exe
i_lfdaysqlid.exe
i_rojhbztrmj.exe
jdbvtolgey.exe
lfdaysqlid.exe
rojhbztrmj.exe
sqnifdaysp.sys
vpnifaxvpn.exe
wupmhezxrpjhczur.exe
wupmhezxrpjhczur.sys
yvtnlfaysq.sys
ztrmjebwuo.sys
05f927e1-70d4-4424-a301-8150c3b21b44.tmp
09be5577-2c9d-4d43-9a6b-d6b916117274.tmp
0e00569d-5004-473f-b456-4fd6601b852b.tmp
3525b762-d7cd-4815-b42f-0b768c2340a8.tmp
71acae95-396f-46c3-8f05-b05fbebe72de.tmp
settings.dat
settings.dat
3dfd0532-f84b-4e11-bc9f-b6a085ec8854.tmp
the-real-index
1fb9758e-ebea-4d33-8746-c8cf104c2917.tmp
dasherSettingSchema.json
85040636-6862-4277-b666-ac86899021ba.tmp
a480c5cb-f753-49d3-ad95-69dbd6e98227.tmp
b6e53182-3bbe-47e4-8e36-ffd6b472a10c.tmp
sync_diagnostic.log
a0b50983-2e41-4b34-bdaa-6d53f9cc6ed0.tmp
a625513d-3558-40ed-bd54-5462f61ab335.tmp
ba4c5eb7-3edc-4bb1-aa94-606911341ed9.tmp
c28849d8-2050-4313-ac6c-5a8f2f4d2e43.tmp
d1d37a2f-3ef4-4bbb-b948-5759f1b01145.tmp
50eb608a-19b6-4343-8917-056974500408.tmp
OperationConfig
7ba22007-b12b-42ac-b9de-03228cae2ae1.tmp
8c655470-b5b5-4291-98a5-e2573fb17c4d.tmp
a0623b70-ad62-4423-989e-bc22496ee456.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
a4b9fe7a-ac60-417d-a1d9-910587ef6945.tmp
c3e39e31-d0f5-411a-89f8-2319ab2f8abc.tmp
0ecf6dbd-b329-4293-82ab-637ed786fc29.tmp
fe3ac08f-36ec-46b2-b790-e0378f83dee9.tmp
messages.json
content.js
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/472-574-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1108-734-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1120-608-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1144-691-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1940-654-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2036-530-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2492-558-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3048-578-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3160-686-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3856-432-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4272-650-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4296-674-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4316-554-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4540-517-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4576-62-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4604-628-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4676-716-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4776-481-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5660-712-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5912-505-0x0000000000010000-0x00000000000AB000-memory.dmp