Analysis
- max time kernel
149s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/10/2026, 03:32
General
- Target 2026-10-22_99be23ca88eaa1a3d62cc7b305f98e5b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 376KB
- Sample261024-d3lesshv7q
- SHA256 5c061e4df6124051680d7110a84e62783d4b72802da103f5bf63a315856c21a3
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_99be23ca88eaa1a3d62cc7b305f98e5b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_99be23ca88eaa1a3d62cc7b305f98e5b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\bztrljebwtomgeyw.exeC:\Temp\bztrljebwtomgeyw.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bzwrojgbto.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\bzwrojgbto.exeC:\Temp\bzwrojgbto.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bzwrojgbto.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bzwrojgbto.exeC:\Temp\i_bzwrojgbto.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdbytrljdb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jdbytrljdb.exeC:\Temp\jdbytrljdb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdbytrljdb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jdbytrljdb.exeC:\Temp\i_jdbytrljdb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdbvtnliga.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jdbvtnliga.exeC:\Temp\jdbvtnliga.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdbvtnliga.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jdbvtnliga.exeC:\Temp\i_jdbvtnliga.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\faysqkicay.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\faysqkicay.exeC:\Temp\faysqkicay.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_faysqkicay.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_faysqkicay.exeC:\Temp\i_faysqkicay.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\caxsmkfcxv.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\caxsmkfcxv.exeC:\Temp\caxsmkfcxv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_caxsmkfcxv.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_caxsmkfcxv.exeC:\Temp\i_caxsmkfcxv.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\causpnkfcw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\causpnkfcw.exeC:\Temp\causpnkfcw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_causpnkfcw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_causpnkfcw.exeC:\Temp\i_causpnkfcw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mkfcxrpmhf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mkfcxrpmhf.exeC:\Temp\mkfcxrpmhf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mkfcxrpmhf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mkfcxrpmhf.exeC:\Temp\i_mkfcxrpmhf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\eczurmkecw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\eczurmkecw.exeC:\Temp\eczurmkecw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_eczurmkecw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_eczurmkecw.exeC:\Temp\i_eczurmkecw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywrojgbywr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ywrojgbywr.exeC:\Temp\ywrojgbywr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywrojgbywr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ywrojgbywr.exeC:\Temp\i_ywrojgbywr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rljdbvtnlg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rljdbvtnlg.exeC:\Temp\rljdbvtnlg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rljdbvtnlg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rljdbvtnlg.exeC:\Temp\i_rljdbvtnlg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rligdywqoi.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rligdywqoi.exeC:\Temp\rligdywqoi.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rligdywqoi.exe ups_ins3⤵
-
C:\Temp\i_rligdywqoi.exeC:\Temp\i_rligdywqoi.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nlgdysqkid.exe ups_run3⤵
-
C:\Temp\nlgdysqkid.exeC:\Temp\nlgdysqkid.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nlgdysqkid.exe ups_ins3⤵
-
C:\Temp\i_nlgdysqkid.exeC:\Temp\i_nlgdysqkid.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\icausnkfdx.exe ups_run3⤵
-
C:\Temp\icausnkfdx.exeC:\Temp\icausnkfdx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_icausnkfdx.exe ups_ins3⤵
-
C:\Temp\i_icausnkfdx.exeC:\Temp\i_icausnkfdx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\spkifspkhc.exe ups_run3⤵
-
C:\Temp\spkifspkhc.exeC:\Temp\spkifspkhc.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_spkifspkhc.exe ups_ins3⤵
-
C:\Temp\i_spkifspkhc.exeC:\Temp\i_spkifspkhc.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\uspkhfzxup.exe ups_run3⤵
-
C:\Temp\uspkhfzxup.exeC:\Temp\uspkhfzxup.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_uspkhfzxup.exe ups_ins3⤵
-
C:\Temp\i_uspkhfzxup.exeC:\Temp\i_uspkhfzxup.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xrpjhbzurm.exe ups_run3⤵
-
C:\Temp\xrpjhbzurm.exeC:\Temp\xrpjhbzurm.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xrpjhbzurm.exe ups_ins3⤵
-
C:\Temp\i_xrpjhbzurm.exeC:\Temp\i_xrpjhbzurm.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywuomhbztr.exe ups_run3⤵
-
C:\Temp\ywuomhbztr.exeC:\Temp\ywuomhbztr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywuomhbztr.exe ups_ins3⤵
-
C:\Temp\i_ywuomhbztr.exeC:\Temp\i_ywuomhbztr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jheywtoljh.exe ups_run3⤵
-
C:\Temp\jheywtoljh.exeC:\Temp\jheywtoljh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jheywtoljh.exe ups_ins3⤵
-
C:\Temp\i_jheywtoljh.exeC:\Temp\i_jheywtoljh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\olgdbvqoig.exe ups_run3⤵
-
C:\Temp\olgdbvqoig.exeC:\Temp\olgdbvqoig.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_olgdbvqoig.exe ups_ins3⤵
-
C:\Temp\i_olgdbvqoig.exeC:\Temp\i_olgdbvqoig.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qligaytnlf.exe ups_run3⤵
-
C:\Temp\qligaytnlf.exeC:\Temp\qligaytnlf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffd10d5c188,0x7ffd10d5c194,0x7ffd10d5c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,8103096717025761837,8682526503844600238,262144 --field-trial-handle=2336,i,7505901422542670881,12376007531579960344,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,2317399467733913844,15865618699232365634,524288 --field-trial-handle=2336,i,7505901422542670881,12376007531579960344,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2392,i,11059054841858762275,3932032871036364719,524288 --field-trial-handle=2336,i,7505901422542670881,12376007531579960344,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3660,i,15232973150205230966,13673754397005548009,2097152 --field-trial-handle=2336,i,7505901422542670881,12376007531579960344,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3648,i,15521823829648318191,10237823060710623874,2097152 --field-trial-handle=2336,i,7505901422542670881,12376007531579960344,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4328,i,1859368992899926790,1428624186163575694,2097152 --field-trial-handle=2336,i,7505901422542670881,12376007531579960344,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,4179851982073748542,6268312257116818832,2097152 --field-trial-handle=2336,i,7505901422542670881,12376007531579960344,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3912,i,14814907632876554511,13927852023709077271,524288 --field-trial-handle=2336,i,7505901422542670881,12376007531579960344,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3892,i,8534506141698328912,4567185273429681079,524288 --field-trial-handle=2336,i,7505901422542670881,12376007531579960344,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3876,i,15324932334859713437,12649498574251890539,524288 --field-trial-handle=2336,i,7505901422542670881,12376007531579960344,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,10608567843989756583,18074602406330295010,524288 --field-trial-handle=2336,i,7505901422542670881,12376007531579960344,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,10608567843989756583,18074602406330295010,524288 --field-trial-handle=2336,i,7505901422542670881,12376007531579960344,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,18176264937630244334,7167419458987546055,524288 --field-trial-handle=2336,i,7505901422542670881,12376007531579960344,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,2664251770056795463,11502569062942714794,524288 --field-trial-handle=2336,i,7505901422542670881,12376007531579960344,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,7476578704016691373,16361611424643988239,524288 --field-trial-handle=2336,i,7505901422542670881,12376007531579960344,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,16376536177527759406,11998876742264269742,524288 --field-trial-handle=2336,i,7505901422542670881,12376007531579960344,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,2473211008167547643,11527354055471550109,524288 --field-trial-handle=2336,i,7505901422542670881,12376007531579960344,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,9328719824374055900,11206313630936596363,524288 --field-trial-handle=2336,i,7505901422542670881,12376007531579960344,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,17801304955690684613,3916403339713030759,524288 --field-trial-handle=2336,i,7505901422542670881,12376007531579960344,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,11439555478503983839,5957524877391845615,524288 --field-trial-handle=2336,i,7505901422542670881,12376007531579960344,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,7075591538004960590,12298484289076875277,524288 --field-trial-handle=2336,i,7505901422542670881,12376007531579960344,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2104,i,2179123290604363795,5546241995565628809,524288 --field-trial-handle=2336,i,7505901422542670881,12376007531579960344,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,15268664725090292707,17430778914684459477,524288 --field-trial-handle=2336,i,7505901422542670881,12376007531579960344,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6240,i,4730475898545031711,771318787345828140,262144 --field-trial-handle=2336,i,7505901422542670881,12376007531579960344,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1204,i,7784537444580535968,12984584783024176914,524288 --field-trial-handle=2336,i,7505901422542670881,12376007531579960344,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\bztrljebwtomgeyw.sysC:\Temp\bztrljebwtomgeyw.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\qojgbztroj.sysC:\Temp\qojgbztroj.sys1⤵
- Executes dropped EXE
-
C:\Temp\tqlgdywqoi.sysC:\Temp\tqlgdywqoi.sys1⤵
- Executes dropped EXE
-
C:\Temp\davtnlfdav.sysC:\Temp\davtnlfdav.sys1⤵
- Executes dropped EXE
-
C:\Temp\kicavpnkfa.sysC:\Temp\kicavpnkfa.sys1⤵
- Executes dropped EXE
-
C:\Temp\kfcauspnhf.sysC:\Temp\kfcauspnhf.sys1⤵
- Executes dropped EXE
-
C:\Temp\pmhfzusmke.sysC:\Temp\pmhfzusmke.sys1⤵
- Executes dropped EXE
-
C:\Temp\hbztrmjhbz.sysC:\Temp\hbztrmjhbz.sys1⤵
- Executes dropped EXE
-
C:\Temp\gebwtrljdb.sysC:\Temp\gebwtrljdb.sys1⤵
- Executes dropped EXE
-
C:\Temp\bwtomgeywq.sysC:\Temp\bwtomgeywq.sys1⤵
- Executes dropped EXE
-
C:\Temp\tqljdbytql.sysC:\Temp\tqljdbytql.sys1⤵
- Executes dropped EXE
-
C:\Temp\ysnlidbvto.sysC:\Temp\ysnlidbvto.sys1⤵
-
C:\Temp\tndxvsnkic.sysC:\Temp\tndxvsnkic.sys1⤵
-
C:\Temp\spkicausqk.sysC:\Temp\spkicausqk.sys1⤵
-
C:\Temp\usnhfzxusm.sysC:\Temp\usnhfzxusm.sys1⤵
-
C:\Temp\zxrpmkecwu.sysC:\Temp\zxrpmkecwu.sys1⤵
-
C:\Temp\hezwrpjhbz.sysC:\Temp\hezwrpjhbz.sys1⤵
-
C:\Temp\hbzwroljgb.sysC:\Temp\hbzwroljgb.sys1⤵
-
C:\Temp\trljgeywqo.sysC:\Temp\trljgeywqo.sys1⤵
-
C:\Temp\qoigaywqoi.sysC:\Temp\qoigaywqoi.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
bztrljebwtomgeyw.exe
bztrljebwtomgeyw.sys
bzwrojgbto.exe
causpnkfcw.exe
caxsmkfcxv.exe
davtnlfdav.sys
faysqkicay.exe
i_bzwrojgbto.exe
i_caxsmkfcxv.exe
i_faysqkicay.exe
i_jdbvtnliga.exe
i_jdbytrljdb.exe
jdbvtnliga.exe
jdbytrljdb.exe
kfcauspnhf.sys
kicavpnkfa.sys
qojgbztroj.sys
tqlgdywqoi.sys
295aa68c-45e9-46f1-befe-8068fa3094a0.tmp
settings.dat
settings.dat
16f6efe9-15d1-48e4-8ee7-df246e5dfd89.tmp
244bf136-efd6-46e3-a2c4-a327dc9e18ed.tmp
3a4d9541-40c9-46d8-975d-0bf758479945.tmp
78514600-26da-48d9-9edd-e4a0ca67d802.tmp
9424d114-c2b6-4049-856c-e72fa03f0a05.tmp
BookmarkMergedSurfaceOrdering
temp-index
a6acfdb8-8896-4e2d-9968-77148bb30ed0.tmp
dasherSettingSchema.json
988000f3-9194-4485-ba39-e45ac1465310.tmp
SCT Auditing Pending Reports
b09bd05e-6e32-4ddf-a3b2-9531bd4e2c46.tmp
sync_diagnostic.log
205d23d4-aa8a-4773-bf12-d4fc8556429e.tmp
OperationConfig
cda2259f-7e4f-45b2-8540-1d4661d37b1f.tmp
6147f903-8920-4bd6-b220-1f144a39f228.tmp
9cdf1bce-7313-4084-bd41-d0cad214c752.tmp
metadata.json
d48ed35e-0eff-423a-b243-90fcd1473ee5.tmp
edd1659f-eb2d-422a-821a-017db3192b8f.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
612a6cba-03e4-472e-8e2a-6ba5d0751526.tmp
9d9d994c-05db-4cfc-87c9-fdc136c6f98a.tmp
f46cca65-51dd-4374-86dc-cbdd139f3596.tmp
fabd4222-8833-4b26-ad99-4ddd13328671.tmp
82d5ddd6-8936-4255-a047-c7a5a03d0d6d.tmp
bd6c6287-b42c-4934-8944-ab10d82f4778.tmp
messages.json
content.js
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/1348-654-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1520-708-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1640-479-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1640-510-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1796-558-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1816-666-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2328-642-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2356-504-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2436-517-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2600-62-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3520-430-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3724-726-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3828-703-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3920-628-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4316-705-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4332-678-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4640-530-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4900-578-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4968-608-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5816-574-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5832-554-0x0000000000010000-0x00000000000AB000-memory.dmp