Analysis
- max time kernel
148s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
23/10/2026, 11:18
General
- Target 2026-10-23_665ddae929e36d266c7aaad477c332fe_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261023-nerl1sbs8y
- SHA256 9732a7c1fd84c682aebfebb039c5b9d83488a93f43d517f72061562e6efae3be
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-23_665ddae929e36d266c7aaad477c332fe_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-23_665ddae929e36d266c7aaad477c332fe_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\fdxvqnigaysqnifd.exeC:\Temp\fdxvqnigaysqnifd.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nlfdxvqnig.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\nlfdxvqnig.exeC:\Temp\nlfdxvqnig.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nlfdxvqnig.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nlfdxvqnig.exeC:\Temp\i_nlfdxvqnig.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xspkicaxvp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xspkicaxvp.exeC:\Temp\xspkicaxvp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xspkicaxvp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xspkicaxvp.exeC:\Temp\i_xspkicaxvp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xspnhfzxsp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xspnhfzxsp.exeC:\Temp\xspnhfzxsp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xspnhfzxsp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xspnhfzxsp.exeC:\Temp\i_xspnhfzxsp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\urpjhcaupm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\urpjhcaupm.exeC:\Temp\urpjhcaupm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_urpjhcaupm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_urpjhcaupm.exeC:\Temp\i_urpjhcaupm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mkecwrpjhb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mkecwrpjhb.exeC:\Temp\mkecwrpjhb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mkecwrpjhb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mkecwrpjhb.exeC:\Temp\i_mkecwrpjhb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bztrljebwt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bztrljebwt.exeC:\Temp\bztrljebwt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bztrljebwt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bztrljebwt.exeC:\Temp\i_bztrljebwt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rojgbywqoj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rojgbywqoj.exeC:\Temp\rojgbywqoj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rojgbywqoj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rojgbywqoj.exeC:\Temp\i_rojgbywqoj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywqljdbytr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ywqljdbytr.exeC:\Temp\ywqljdbytr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywqljdbytr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ywqljdbytr.exeC:\Temp\i_ywqljdbytr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vqligaysql.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vqligaysql.exeC:\Temp\vqligaysql.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vqligaysql.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vqligaysql.exeC:\Temp\i_vqligaysql.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qnifaysqca.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qnifaysqca.exeC:\Temp\qnifaysqca.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qnifaysqca.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qnifaysqca.exeC:\Temp\i_qnifaysqca.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qnhfaxvsnk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qnhfaxvsnk.exeC:\Temp\qnhfaxvsnk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qnhfaxvsnk.exe ups_ins3⤵
-
C:\Temp\i_qnhfaxvsnk.exeC:\Temp\i_qnhfaxvsnk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnhfzxupnh.exe ups_run3⤵
-
C:\Temp\pnhfzxupnh.exeC:\Temp\pnhfzxupnh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnhfzxupnh.exe ups_ins3⤵
-
C:\Temp\i_pnhfzxupnh.exeC:\Temp\i_pnhfzxupnh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\upmhezxrpj.exe ups_run3⤵
-
C:\Temp\upmhezxrpj.exeC:\Temp\upmhezxrpj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_upmhezxrpj.exe ups_ins3⤵
-
C:\Temp\i_upmhezxrpj.exeC:\Temp\i_upmhezxrpj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zwuomjhezw.exe ups_run3⤵
-
C:\Temp\zwuomjhezw.exeC:\Temp\zwuomjhezw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zwuomjhezw.exe ups_ins3⤵
-
C:\Temp\i_zwuomjhezw.exeC:\Temp\i_zwuomjhezw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hbztrljhbw.exe ups_run3⤵
-
C:\Temp\hbztrljhbw.exeC:\Temp\hbztrljhbw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hbztrljhbw.exe ups_ins3⤵
-
C:\Temp\i_hbztrljhbw.exeC:\Temp\i_hbztrljhbw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\eywolgdywq.exe ups_run3⤵
-
C:\Temp\eywolgdywq.exeC:\Temp\eywolgdywq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_eywolgdywq.exe ups_ins3⤵
-
C:\Temp\i_eywolgdywq.exeC:\Temp\i_eywolgdywq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtqlidbvtq.exe ups_run3⤵
-
C:\Temp\vtqlidbvtq.exeC:\Temp\vtqlidbvtq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vtqlidbvtq.exe ups_ins3⤵
-
C:\Temp\i_vtqlidbvtq.exeC:\Temp\i_vtqlidbvtq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\aysqlidxvt.exe ups_run3⤵
-
C:\Temp\aysqlidxvt.exeC:\Temp\aysqlidxvt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_aysqlidxvt.exe ups_ins3⤵
-
C:\Temp\i_aysqlidxvt.exeC:\Temp\i_aysqlidxvt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vsqkifdxvs.exe ups_run3⤵
-
C:\Temp\vsqkifdxvs.exeC:\Temp\vsqkifdxvs.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vsqkifdxvs.exe ups_ins3⤵
-
C:\Temp\i_vsqkifdxvs.exeC:\Temp\i_vsqkifdxvs.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ausnkfcxup.exe ups_run3⤵
-
C:\Temp\ausnkfcxup.exeC:\Temp\ausnkfcxup.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffa50f8c188,0x7ffa50f8c194,0x7ffa50f8c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,11401587201719067062,10646075495663996902,262144 --field-trial-handle=2348,i,18276245940802697029,1020487693113900732,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,11655310222272796179,13940461591615608024,524288 --field-trial-handle=2348,i,18276245940802697029,1020487693113900732,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,15844858394537497073,8461852301036983076,524288 --field-trial-handle=2348,i,18276245940802697029,1020487693113900732,262144 --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3636,i,4089779320371014923,10036424664455391463,2097152 --field-trial-handle=2348,i,18276245940802697029,1020487693113900732,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,12605712405601748621,13571252511381827531,2097152 --field-trial-handle=2348,i,18276245940802697029,1020487693113900732,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,1875604161086660035,5091563540178085622,2097152 --field-trial-handle=2348,i,18276245940802697029,1020487693113900732,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,5294091671170759797,7015301724135447574,2097152 --field-trial-handle=2348,i,18276245940802697029,1020487693113900732,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,131218827258210920,3062137381450505414,524288 --field-trial-handle=2348,i,18276245940802697029,1020487693113900732,262144 --variations-seed-version --mojo-platform-channel-handle=3888 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,14556158549592064210,1563365762243409633,524288 --field-trial-handle=2348,i,18276245940802697029,1020487693113900732,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,5366703268392402066,8660532317168816174,524288 --field-trial-handle=2348,i,18276245940802697029,1020487693113900732,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,15263196288434018250,13253313318036508583,524288 --field-trial-handle=2348,i,18276245940802697029,1020487693113900732,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,15263196288434018250,13253313318036508583,524288 --field-trial-handle=2348,i,18276245940802697029,1020487693113900732,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3876,i,8929156509132404402,17670968997489677851,524288 --field-trial-handle=2348,i,18276245940802697029,1020487693113900732,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,4809337354369596446,13441512874192513645,524288 --field-trial-handle=2348,i,18276245940802697029,1020487693113900732,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3876,i,16479136927127928086,18184551088940099291,524288 --field-trial-handle=2348,i,18276245940802697029,1020487693113900732,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,15181311896902189598,2195279704581616476,524288 --field-trial-handle=2348,i,18276245940802697029,1020487693113900732,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3912,i,11268033017812126517,5620717207457678296,524288 --field-trial-handle=2348,i,18276245940802697029,1020487693113900732,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4248,i,9607100941612690462,17107305715761870219,524288 --field-trial-handle=2348,i,18276245940802697029,1020487693113900732,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,10711514105233229230,2015782291867197421,524288 --field-trial-handle=2348,i,18276245940802697029,1020487693113900732,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,660026327680494198,11235295813546621692,524288 --field-trial-handle=2348,i,18276245940802697029,1020487693113900732,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,10266052838805427782,10687308709793982693,524288 --field-trial-handle=2348,i,18276245940802697029,1020487693113900732,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,11929833721336032554,13007318249276017862,524288 --field-trial-handle=2348,i,18276245940802697029,1020487693113900732,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,996673894330035394,2719593753183804738,524288 --field-trial-handle=2348,i,18276245940802697029,1020487693113900732,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5716,i,3052059186624159691,15008584503787555557,262144 --field-trial-handle=2348,i,18276245940802697029,1020487693113900732,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3332,i,12213281017307395253,11740733446191335894,524288 --field-trial-handle=2348,i,18276245940802697029,1020487693113900732,262144 --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\fdxvqnigaysqnifd.sysC:\Temp\fdxvqnigaysqnifd.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Temp\qnigavsnlf.sysC:\Temp\qnigavsnlf.sys1⤵
- Executes dropped EXE
-
C:\Temp\zxvpnhfzxs.sysC:\Temp\zxvpnhfzxs.sys1⤵
- Executes dropped EXE
-
C:\Temp\rpmhfcxusm.sysC:\Temp\rpmhfcxusm.sys1⤵
- Executes dropped EXE
-
C:\Temp\rpmhezxuom.sysC:\Temp\rpmhezxuom.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhbzwromhe.sysC:\Temp\jhbzwromhe.sys1⤵
- Executes dropped EXE
-
C:\Temp\ljgbzwtrlj.sysC:\Temp\ljgbzwtrlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\eywqoigayt.sysC:\Temp\eywqoigayt.sys1⤵
- Executes dropped EXE
-
C:\Temp\gaytnljdbn.sysC:\Temp\gaytnljdbn.sys1⤵
- Executes dropped EXE
-
C:\Temp\vqnlfdxvqn.sysC:\Temp\vqnlfdxvqn.sys1⤵
- Executes dropped EXE
-
C:\Temp\sqkicavsqk.sysC:\Temp\sqkicavsqk.sys1⤵
- Executes dropped EXE
-
C:\Temp\pmkicaxspk.sysC:\Temp\pmkicaxspk.sys1⤵
-
C:\Temp\zxrpnhfzxr.sysC:\Temp\zxrpnhfzxr.sys1⤵
-
C:\Temp\cwuomkebzx.sysC:\Temp\cwuomkebzx.sys1⤵
-
C:\Temp\jhbzwuomge.sysC:\Temp\jhbzwuomge.sys1⤵
-
C:\Temp\geytrojgbz.sysC:\Temp\geytrojgbz.sys1⤵
-
C:\Temp\gdbvtnljdb.sysC:\Temp\gdbvtnljdb.sys1⤵
-
C:\Temp\dbvtnlgdyv.sysC:\Temp\dbvtnlgdyv.sys1⤵
-
C:\Temp\xvtnlfdays.sysC:\Temp\xvtnlfdays.sys1⤵
-
C:\Temp\ausmkicavp.sysC:\Temp\ausmkicavp.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
bztrljebwt.exe
fdxvqnigaysqnifd.exe
fdxvqnigaysqnifd.sys
i_mkecwrpjhb.exe
i_nlfdxvqnig.exe
i_urpjhcaupm.exe
i_xspkicaxvp.exe
i_xspnhfzxsp.exe
jhbzwromhe.sys
mkecwrpjhb.exe
nlfdxvqnig.exe
qnigavsnlf.sys
rpmhezxuom.sys
rpmhfcxusm.sys
urpjhcaupm.exe
xspkicaxvp.exe
xspnhfzxsp.exe
zxvpnhfzxs.sys
51db183c-8b69-46c3-8842-c93e7c6ecaa4.tmp
54210599-09a4-4e16-b5aa-2b492746eb01.tmp
62d2777d-35d4-41f5-977a-3dc069342ed8.tmp
82fa83bb-d169-4342-a6e1-700bfecaed83.tmp
settings.dat
settings.dat
599bf0e2-d847-41e7-8695-7b3dacaaace3.tmp
8741e400-3099-497e-8007-d228b984397b.tmp
temp-index
f2fb1b5d-c392-4511-a484-4ccfc1ffa9fc.tmp
dasherSettingSchema.json
3ac6d447-b3dd-410d-9bcc-2d704057a565.tmp
3e273208-a9e0-4b88-8f24-3c2029c357d2.tmp
ce3a1ebe-1e55-491b-8182-8ba677ba7d5f.tmp
sync_diagnostic.log
bfd18783-68c5-4100-95c5-be5fadd32774.tmp
c167013b-427e-46be-ab7c-f7257818abee.tmp
e7e9989c-aad8-4aec-8198-a6124010f54f.tmp
f573185d-a0e7-409a-be6c-1ef8c7816e1e.tmp
7ed37087-0d1e-49af-8453-abb4aca0c9aa.tmp
af8d09ba-8f61-4804-afd9-05a125f16590.tmp
4363b067-d269-446a-bb66-02a3176f5e47.tmp
738cdb9b-eadf-4c5a-8ad0-6122bac5e0a8.tmp
7cc1c7b1-1cf0-497c-aeeb-0aaa801827e1.tmp
d04d3473-2b15-4d7d-95d0-5ed6d6f4cb4d.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
fd95703e-08af-4b81-8371-db6a4c3afa65.tmp
metadata.json
663c84a7-04f5-4114-ba2c-a7e98c1fe825.tmp
6d37dba7-077f-4c17-ad93-78cc44e52153.tmp
content.js
messages.json
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/1280-481-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1832-62-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1864-691-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2152-558-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2152-575-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2832-518-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3008-599-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3008-695-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3008-574-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3012-432-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3196-639-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3620-679-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3856-659-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3888-531-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4400-554-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4436-612-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4492-721-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4644-739-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4812-625-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5252-717-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5464-506-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5748-614-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5748-581-0x0000000000010000-0x00000000000AB000-memory.dmp