Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
23/10/2026, 18:18
General
- Target 2026-10-22_d6a1aeed07d93a4bbccb225520547ae8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261023-wxt4vsdd39
- SHA256 c223348ea1ec6a3cac00ae44fe93b2575e20c77e0d16b7617c117592b244a40b
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_d6a1aeed07d93a4bbccb225520547ae8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_d6a1aeed07d93a4bbccb225520547ae8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\jhbwtomgeywqojgb.exeC:\Temp\jhbwtomgeywqojgb.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdbwtrljeb.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\jdbwtrljeb.exeC:\Temp\jdbwtrljeb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdbwtrljeb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jdbwtrljeb.exeC:\Temp\i_jdbwtrljeb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\oigdytqlgd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\oigdytqlgd.exeC:\Temp\oigdytqlgd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_oigdytqlgd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_oigdytqlgd.exeC:\Temp\i_oigdytqlgd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\olfdbvtnli.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\olfdbvtnli.exeC:\Temp\olfdbvtnli.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_olfdbvtnli.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_olfdbvtnli.exeC:\Temp\i_olfdbvtnli.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\faxvtqkida.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\faxvtqkida.exeC:\Temp\faxvtqkida.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_faxvtqkida.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_faxvtqkida.exeC:\Temp\i_faxvtqkida.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\spnhfaxvpn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\spnhfaxvpn.exeC:\Temp\spnhfaxvpn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_spnhfaxvpn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_spnhfaxvpn.exeC:\Temp\i_spnhfaxvpn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hfzxupnhca.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hfzxupnhca.exeC:\Temp\hfzxupnhca.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hfzxupnhca.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hfzxupnhca.exeC:\Temp\i_hfzxupnhca.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhcausmkec.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jhcausmkec.exeC:\Temp\jhcausmkec.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhcausmkec.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jhcausmkec.exeC:\Temp\i_jhcausmkec.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bzwromkecw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bzwromkecw.exeC:\Temp\bzwromkecw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bzwromkecw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bzwromkecw.exeC:\Temp\i_bzwromkecw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\romgeywuom.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\romgeywuom.exeC:\Temp\romgeywuom.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_romgeywuom.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_romgeywuom.exeC:\Temp\i_romgeywuom.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gebvtqligb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gebvtqligb.exeC:\Temp\gebvtqligb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gebvtqligb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gebvtqligb.exeC:\Temp\i_gebvtqligb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tqlidbytql.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\tqlidbytql.exeC:\Temp\tqlidbytql.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tqlidbytql.exe ups_ins3⤵
-
C:\Temp\i_tqlidbytql.exeC:\Temp\i_tqlidbytql.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tnlfdxvqni.exe ups_run3⤵
-
C:\Temp\tnlfdxvqni.exeC:\Temp\tnlfdxvqni.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tnlfdxvqni.exe ups_ins3⤵
-
C:\Temp\i_tnlfdxvqni.exeC:\Temp\i_tnlfdxvqni.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nhfaxsqkic.exe ups_run3⤵
-
C:\Temp\nhfaxsqkic.exeC:\Temp\nhfaxsqkic.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nhfaxsqkic.exe ups_ins3⤵
-
C:\Temp\i_nhfaxsqkic.exeC:\Temp\i_nhfaxsqkic.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\upkicausmk.exe ups_run3⤵
-
C:\Temp\upkicausmk.exeC:\Temp\upkicausmk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_upkicausmk.exe ups_ins3⤵
-
C:\Temp\i_upkicausmk.exeC:\Temp\i_upkicausmk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecausmkecx.exe ups_run3⤵
-
C:\Temp\ecausmkecx.exeC:\Temp\ecausmkecx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecausmkecx.exe ups_ins3⤵
-
C:\Temp\i_ecausmkecx.exeC:\Temp\i_ecausmkecx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xromhezxrm.exe ups_run3⤵
-
C:\Temp\xromhezxrm.exeC:\Temp\xromhezxrm.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xromhezxrm.exe ups_ins3⤵
-
C:\Temp\i_xromhezxrm.exeC:\Temp\i_xromhezxrm.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rmjebztrmj.exe ups_run3⤵
-
C:\Temp\rmjebztrmj.exeC:\Temp\rmjebztrmj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rmjebztrmj.exe ups_ins3⤵
-
C:\Temp\i_rmjebztrmj.exeC:\Temp\i_rmjebztrmj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\oigeywtomg.exe ups_run3⤵
-
C:\Temp\oigeywtomg.exeC:\Temp\oigeywtomg.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_oigeywtomg.exe ups_ins3⤵
-
C:\Temp\i_oigeywtomg.exeC:\Temp\i_oigeywtomg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qolgdywqol.exe ups_run3⤵
-
C:\Temp\qolgdywqol.exeC:\Temp\qolgdywqol.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qolgdywqol.exe ups_ins3⤵
-
C:\Temp\i_qolgdywqol.exeC:\Temp\i_qolgdywqol.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dywqoigayt.exe ups_run3⤵
-
C:\Temp\dywqoigayt.exeC:\Temp\dywqoigayt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffb1324c188,0x7ffb1324c194,0x7ffb1324c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,18267608770352957232,3661442159624619427,262144 --field-trial-handle=2328,i,14006257943027545976,198982282137552441,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,3166428764276094856,4241239694457550293,524288 --field-trial-handle=2328,i,14006257943027545976,198982282137552441,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,9380691121026687276,16109741052305532480,524288 --field-trial-handle=2328,i,14006257943027545976,198982282137552441,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,89516901169124289,7844247540106021483,2097152 --field-trial-handle=2328,i,14006257943027545976,198982282137552441,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,4604405618014568761,17051845299411596802,2097152 --field-trial-handle=2328,i,14006257943027545976,198982282137552441,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,1245827346050755423,12019569746623529548,2097152 --field-trial-handle=2328,i,14006257943027545976,198982282137552441,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,9154001872430176124,11192484522351105937,2097152 --field-trial-handle=2328,i,14006257943027545976,198982282137552441,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,11573911572621926085,712909117585617134,524288 --field-trial-handle=2328,i,14006257943027545976,198982282137552441,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,12439016614852966145,15693433955694439495,524288 --field-trial-handle=2328,i,14006257943027545976,198982282137552441,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,2487780629619130748,9336454668794456334,524288 --field-trial-handle=2328,i,14006257943027545976,198982282137552441,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,13413054060333589188,3080520969381577674,524288 --field-trial-handle=2328,i,14006257943027545976,198982282137552441,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,13413054060333589188,3080520969381577674,524288 --field-trial-handle=2328,i,14006257943027545976,198982282137552441,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,15830508536283195953,2890788101946073698,524288 --field-trial-handle=2328,i,14006257943027545976,198982282137552441,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,12466583898713601171,10666608736308992170,524288 --field-trial-handle=2328,i,14006257943027545976,198982282137552441,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,9896109820842903288,4137338907047507136,524288 --field-trial-handle=2328,i,14006257943027545976,198982282137552441,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,6037375964711712752,11700583828031844151,524288 --field-trial-handle=2328,i,14006257943027545976,198982282137552441,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,4388433775755015569,18200117967215359232,524288 --field-trial-handle=2328,i,14006257943027545976,198982282137552441,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,11489625310084179769,11868743806119023377,524288 --field-trial-handle=2328,i,14006257943027545976,198982282137552441,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,3720103634052733398,15014286007380618470,524288 --field-trial-handle=2328,i,14006257943027545976,198982282137552441,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,10877955636329163430,1081962976466214570,524288 --field-trial-handle=2328,i,14006257943027545976,198982282137552441,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,391269589547831350,14354707112116120007,524288 --field-trial-handle=2328,i,14006257943027545976,198982282137552441,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,1350894550655427274,17932733765955994636,524288 --field-trial-handle=2328,i,14006257943027545976,198982282137552441,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,18301099374906463912,12065188711656364922,524288 --field-trial-handle=2328,i,14006257943027545976,198982282137552441,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6536,i,10784706937421026670,17943072898596077251,262144 --field-trial-handle=2328,i,14006257943027545976,198982282137552441,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3228,i,9814349289455655561,18389574196736177189,524288 --field-trial-handle=2328,i,14006257943027545976,198982282137552441,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\jhbwtomgeywqojgb.sysC:\Temp\jhbwtomgeywqojgb.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\ytrljdbwto.sysC:\Temp\ytrljdbwto.sys1⤵
- Executes dropped EXE
-
C:\Temp\oigdyvtnlj.sysC:\Temp\oigdyvtnlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\gaysqkifda.sysC:\Temp\gaysqkifda.sys1⤵
- Executes dropped EXE
-
C:\Temp\yspkicaxsq.sysC:\Temp\yspkicaxsq.sys1⤵
- Executes dropped EXE
-
C:\Temp\qkiczxspnh.sysC:\Temp\qkiczxspnh.sys1⤵
- Executes dropped EXE
-
C:\Temp\khcausmkec.sysC:\Temp\khcausmkec.sys1⤵
- Executes dropped EXE
-
C:\Temp\ezwurmjhez.sysC:\Temp\ezwurmjhez.sys1⤵
- Executes dropped EXE
-
C:\Temp\bwuomjebwt.sysC:\Temp\bwuomjebwt.sys1⤵
- Executes dropped EXE
-
C:\Temp\rljdbzwqom.sysC:\Temp\rljdbzwqom.sys1⤵
- Executes dropped EXE
-
C:\Temp\qoljdbvtnl.sysC:\Temp\qoljdbvtnl.sys1⤵
- Executes dropped EXE
-
C:\Temp\vqnifdbysq.sysC:\Temp\vqnifdbysq.sys1⤵
-
C:\Temp\vsnkfdxvpn.sysC:\Temp\vsnkfdxvpn.sys1⤵
-
C:\Temp\fcxvsqkica.sysC:\Temp\fcxvsqkica.sys1⤵
-
C:\Temp\hcaxspkica.sysC:\Temp\hcaxspkica.sys1⤵
-
C:\Temp\zurpjhczur.sysC:\Temp\zurpjhczur.sys1⤵
-
C:\Temp\wromjhbztr.sysC:\Temp\wromjhbztr.sys1⤵
-
C:\Temp\wqojgbzwro.sysC:\Temp\wqojgbzwro.sys1⤵
-
C:\Temp\vtolgdbytq.sysC:\Temp\vtolgdbytq.sys1⤵
-
C:\Temp\dyvtnlfdys.sysC:\Temp\dyvtnlfdys.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
faxvtqkida.exe
gaysqkifda.sys
hfzxupnhca.exe
i_faxvtqkida.exe
i_jdbwtrljeb.exe
i_oigdytqlgd.exe
i_olfdbvtnli.exe
i_spnhfaxvpn.exe
jdbwtrljeb.exe
jhbwtomgeywqojgb.exe
jhbwtomgeywqojgb.sys
oigdytqlgd.exe
oigdyvtnlj.sys
olfdbvtnli.exe
qkiczxspnh.sys
spnhfaxvpn.exe
yspkicaxsq.sys
ytrljdbwto.sys
3c6f29be-2a40-4cb2-b44f-8c5c99e727d0.tmp
762a479c-0379-48e3-8b6d-89a85ba29a96.tmp
settings.dat
settings.dat
1961d396-88b7-4c03-b9dd-5ae0a8348a58.tmp
2c30415a-d93a-4001-a667-09c18ce133a3.tmp
95dc0802-6ee9-4636-b430-eb3d99445920.tmp
the-real-index
6c84f1c8-e265-446a-9224-eead0d539a4f.tmp
dasherSettingSchema.json
c25a4830-612d-4a2c-af22-92fc35eae994.tmp
dfc7ae52-c73d-4595-a8d6-17156759af8a.tmp
f5bbeca6-d368-44d6-8252-4782b5d4ed3f.tmp
sync_diagnostic.log
adceeef4-b3c0-4f16-854b-532ab7700477.tmp
b7c0b55b-51ec-455a-a85a-a9531d92cdfc.tmp
e2b8a36e-96a4-4aea-b6ac-436f5e913e5c.tmp
e105c948-8508-4059-9900-aeb546635ca8.tmp
Local State
ca7a6cff-18ab-4cda-9a43-69ff7862e5ff.tmp
2adeea9f-0b72-462a-a5f8-2e4d3d4d270d.tmp
2b87ac8f-ddfa-48a1-8b60-3770e30a7615.tmp
ac8d4141-be1f-44cc-89f0-da94aba96f38.tmp
dcec7b2f-df5c-4b13-807f-7f7301045218.tmp
e9456d7e-d048-44ad-bcdb-68e75b3c18ce.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
5311aa77-8451-4e60-b5a5-19dfbee4b6e4.tmp
7f6805d2-6dc4-4c36-98fe-46271e811426.tmp
f3ac15f0-e610-4151-84cf-52e13b278f86.tmp
66378631-32aa-4923-8acd-463d8202dc46.tmp
b159ebc1-b292-48a7-989c-37f2f9e4eb26.tmp
messages.json
content.js
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/244-727-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1364-607-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1388-557-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1848-531-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1948-577-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2884-518-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3064-649-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3264-431-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3332-466-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3452-699-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3528-473-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3564-678-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3572-665-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4016-724-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4016-704-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4676-667-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4676-653-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4844-627-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5392-573-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5804-722-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5804-728-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5840-553-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5992-506-0x0000000000010000-0x00000000000AB000-memory.dmp