Analysis
- max time kernel
150s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
26/10/2026, 03:50
General
- Target 2026-10-26_47b121c2532b9f2dc9d892c26dd6d7d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261026-eec9ysds5p
- SHA256 a67bae26494183613a3867810ba05ce57efd34d63a19f4df964296b23b74e0ab
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_47b121c2532b9f2dc9d892c26dd6d7d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-26_47b121c2532b9f2dc9d892c26dd6d7d5_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\eywqojdbztrljdbw.exeC:\Temp\eywqojdbztrljdbw.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gbztrljgbt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\gbztrljgbt.exeC:\Temp\gbztrljgbt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gbztrljgbt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gbztrljgbt.exeC:\Temp\i_gbztrljgbt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qligdyvtnl.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qligdyvtnl.exeC:\Temp\qligdyvtnl.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qligdyvtnl.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qligdyvtnl.exeC:\Temp\i_qligdyvtnl.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kfdavsnlfd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kfdavsnlfd.exeC:\Temp\kfdavsnlfd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kfdavsnlfd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kfdavsnlfd.exeC:\Temp\i_kfdavsnlfd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nlfdaqkifa.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nlfdaqkifa.exeC:\Temp\nlfdaqkifa.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nlfdaqkifa.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nlfdaqkifa.exeC:\Temp\i_nlfdaqkifa.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\caumkicaus.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\caumkicaus.exeC:\Temp\caumkicaus.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_caumkicaus.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_caumkicaus.exeC:\Temp\i_caumkicaus.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hfzxrpnhec.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hfzxrpnhec.exeC:\Temp\hfzxrpnhec.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hfzxrpnhec.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hfzxrpnhec.exeC:\Temp\i_hfzxrpnhec.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hecwurpjeb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hecwurpjeb.exeC:\Temp\hecwurpjeb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hecwurpjeb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hecwurpjeb.exeC:\Temp\i_hecwurpjeb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecwurmjecw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ecwurmjecw.exeC:\Temp\ecwurmjecw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecwurmjecw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ecwurmjecw.exeC:\Temp\i_ecwurmjecw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gbztrljdbw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gbztrljdbw.exeC:\Temp\gbztrljdbw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gbztrljdbw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gbztrljdbw.exeC:\Temp\i_gbztrljdbw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gdywqoigay.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gdywqoigay.exeC:\Temp\gdywqoigay.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gdywqoigay.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gdywqoigay.exeC:\Temp\i_gdywqoigay.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\yvqnigaysq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\yvqnigaysq.exeC:\Temp\yvqnigaysq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_yvqnigaysq.exe ups_ins3⤵
-
C:\Temp\i_yvqnigaysq.exeC:\Temp\i_yvqnigaysq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dxvqnifays.exe ups_run3⤵
-
C:\Temp\dxvqnifays.exeC:\Temp\dxvqnifays.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dxvqnifays.exe ups_ins3⤵
-
C:\Temp\i_dxvqnifays.exeC:\Temp\i_dxvqnifays.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usnkfdxvpn.exe ups_run3⤵
-
C:\Temp\usnkfdxvpn.exeC:\Temp\usnkfdxvpn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usnkfdxvpn.exe ups_ins3⤵
-
C:\Temp\i_usnkfdxvpn.exeC:\Temp\i_usnkfdxvpn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\smkecxupnk.exe ups_run3⤵
-
C:\Temp\smkecxupnk.exeC:\Temp\smkecxupnk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_smkecxupnk.exe ups_ins3⤵
-
C:\Temp\i_smkecxupnk.exeC:\Temp\i_smkecxupnk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\uomkhczxrp.exe ups_run3⤵
-
C:\Temp\uomkhczxrp.exeC:\Temp\uomkhczxrp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_uomkhczxrp.exe ups_ins3⤵
-
C:\Temp\i_uomkhczxrp.exeC:\Temp\i_uomkhczxrp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hecwurpmhe.exe ups_run3⤵
-
C:\Temp\hecwurpmhe.exeC:\Temp\hecwurpmhe.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hecwurpmhe.exe ups_ins3⤵
-
C:\Temp\i_hecwurpmhe.exeC:\Temp\i_hecwurpmhe.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mgecwuomeb.exe ups_run3⤵
-
C:\Temp\mgecwuomeb.exeC:\Temp\mgecwuomeb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mgecwuomeb.exe ups_ins3⤵
-
C:\Temp\i_mgecwuomeb.exeC:\Temp\i_mgecwuomeb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dbywqojgby.exe ups_run3⤵
-
C:\Temp\dbywqojgby.exeC:\Temp\dbywqojgby.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dbywqojgby.exe ups_ins3⤵
-
C:\Temp\i_dbywqojgby.exeC:\Temp\i_dbywqojgby.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lidbvtnlfd.exe ups_run3⤵
-
C:\Temp\lidbvtnlfd.exeC:\Temp\lidbvtnlfd.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lidbvtnlfd.exe ups_ins3⤵
-
C:\Temp\i_lidbvtnlfd.exeC:\Temp\i_lidbvtnlfd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kidayvqolg.exe ups_run3⤵
-
C:\Temp\kidayvqolg.exeC:\Temp\kidayvqolg.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff9ef84c188,0x7ff9ef84c194,0x7ff9ef84c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,350918196141586621,6299531554153359739,524288 --field-trial-handle=2632,i,17220781723919641891,6090401881271287760,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,9311888593228948360,2064384022871213024,262144 --field-trial-handle=2632,i,17220781723919641891,6090401881271287760,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2128,i,17944444064594638438,8633841874464321106,524288 --field-trial-handle=2632,i,17220781723919641891,6090401881271287760,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,758357877543710455,8053140052070446213,2097152 --field-trial-handle=2632,i,17220781723919641891,6090401881271287760,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,13214513772178498186,874015072956557158,2097152 --field-trial-handle=2632,i,17220781723919641891,6090401881271287760,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4336,i,15972506552842440054,11427890580245941694,2097152 --field-trial-handle=2632,i,17220781723919641891,6090401881271287760,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4356,i,5457655264767888337,6297902362669890889,2097152 --field-trial-handle=2632,i,17220781723919641891,6090401881271287760,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3764,i,2444418761977364101,6161762527298815966,524288 --field-trial-handle=2632,i,17220781723919641891,6090401881271287760,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,3405601136191787858,11748087802296266090,524288 --field-trial-handle=2632,i,17220781723919641891,6090401881271287760,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,15270091156436350746,16641308891276298105,524288 --field-trial-handle=2632,i,17220781723919641891,6090401881271287760,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,8142200631051794504,16832025316523621145,524288 --field-trial-handle=2632,i,17220781723919641891,6090401881271287760,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,8142200631051794504,16832025316523621145,524288 --field-trial-handle=2632,i,17220781723919641891,6090401881271287760,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,4714627319157146688,2165275748279531126,524288 --field-trial-handle=2632,i,17220781723919641891,6090401881271287760,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,9767568482681240522,5445442980611065244,524288 --field-trial-handle=2632,i,17220781723919641891,6090401881271287760,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,438396980752723696,13497011287227294252,524288 --field-trial-handle=2632,i,17220781723919641891,6090401881271287760,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6552,i,16315094841353423282,3458257892824848515,524288 --field-trial-handle=2632,i,17220781723919641891,6090401881271287760,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,16139140473869103438,120166592201507421,524288 --field-trial-handle=2632,i,17220781723919641891,6090401881271287760,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,17800430718161552859,10532216854770196001,524288 --field-trial-handle=2632,i,17220781723919641891,6090401881271287760,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,11640605313325639261,14296736196761177965,524288 --field-trial-handle=2632,i,17220781723919641891,6090401881271287760,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,17511460161932359879,8187003758614671223,524288 --field-trial-handle=2632,i,17220781723919641891,6090401881271287760,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,10123101051293296331,8369529023692840036,524288 --field-trial-handle=2632,i,17220781723919641891,6090401881271287760,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=916,i,10017123232694018877,15503874807850433423,524288 --field-trial-handle=2632,i,17220781723919641891,6090401881271287760,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3060,i,1791128257686150273,1936362455466884124,524288 --field-trial-handle=2632,i,17220781723919641891,6090401881271287760,262144 --variations-seed-version --mojo-platform-channel-handle=916 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6456,i,7708927232260198861,9168816840840298542,262144 --field-trial-handle=2632,i,17220781723919641891,6090401881271287760,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1224,i,11930655105997699572,15683638747526636384,524288 --field-trial-handle=2632,i,17220781723919641891,6090401881271287760,262144 --variations-seed-version --mojo-platform-channel-handle=1672 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\eywqojdbztrljdbw.sysC:\Temp\eywqojdbztrljdbw.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\ytqljdaytq.sysC:\Temp\ytqljdaytq.sys1⤵
- Executes dropped EXE
-
C:\Temp\bvtnlyvqni.sysC:\Temp\bvtnlyvqni.sys1⤵
- Executes dropped EXE
-
C:\Temp\vtnlfdxvpn.sysC:\Temp\vtnlfdxvpn.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfdxvqkifa.sysC:\Temp\hfdxvqkifa.sys1⤵
- Executes dropped EXE
-
C:\Temp\hczxrpkhfz.sysC:\Temp\hczxrpkhfz.sys1⤵
- Executes dropped EXE
-
C:\Temp\mkeczxupmk.sysC:\Temp\mkeczxupmk.sys1⤵
- Executes dropped EXE
-
C:\Temp\hbztrmjebw.sysC:\Temp\hbztrmjebw.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhbztrljdb.sysC:\Temp\jhbztrljdb.sys1⤵
- Executes dropped EXE
-
C:\Temp\dbytqoljdb.sysC:\Temp\dbytqoljdb.sys1⤵
- Executes dropped EXE
-
C:\Temp\tnljdbvtnl.sysC:\Temp\tnljdbvtnl.sys1⤵
- Executes dropped EXE
-
C:\Temp\fdyvqnifay.sysC:\Temp\fdyvqnifay.sys1⤵
-
C:\Temp\faxsqkicav.sysC:\Temp\faxsqkicav.sys1⤵
-
C:\Temp\usmkfcxrpk.sysC:\Temp\usmkfcxrpk.sys1⤵
-
C:\Temp\cxupmhecau.sysC:\Temp\cxupmhecau.sys1⤵
-
C:\Temp\hecwurpmhe.sysC:\Temp\hecwurpmhe.sys1⤵
-
C:\Temp\omgezwrojh.sysC:\Temp\omgezwrojh.sys1⤵
-
C:\Temp\eywtrljgey.sysC:\Temp\eywtrljgey.sys1⤵
-
C:\Temp\vtrljdbvtn.sysC:\Temp\vtrljdbvtn.sys1⤵
-
C:\Temp\qlidavtnlf.sysC:\Temp\qlidavtnlf.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
bvtnlyvqni.sys
caumkicaus.exe
eywqojdbztrljdbw.exe
eywqojdbztrljdbw.sys
gbztrljgbt.exe
hczxrpkhfz.sys
hfdxvqkifa.sys
hfzxrpnhec.exe
i_caumkicaus.exe
i_gbztrljgbt.exe
i_kfdavsnlfd.exe
i_nlfdaqkifa.exe
i_qligdyvtnl.exe
kfdavsnlfd.exe
nlfdaqkifa.exe
qligdyvtnl.exe
vtnlfdxvpn.sys
ytqljdaytq.sys
58b7a730-d091-428c-90b4-5c704849c83b.tmp
settings.dat
settings.dat
16872a97-a18a-4b3f-9eda-5452d2ee7412.tmp
6c76b372-55da-420d-a830-3a6abbadddb5.tmp
94412e78-cd35-4327-ac36-6d511321bb99.tmp
temp-index
the-real-index
b9ce5cbc-ffa0-42a2-a486-07c30adc0fd0.tmp
dasherSettingSchema.json
1f15a158-7ce9-438f-b5e0-75ca23281be7.tmp
817b35b0-3985-44ae-97cb-597676bcbe20.tmp
Sdch Dictionaries
aa21b631-41df-48cd-8763-cce028d7af48.tmp
ff81e852-67aa-4373-b7b7-930a1ab14570.tmp
a25e84a0-c5d9-49b9-b877-983493ccebd2.tmp
b93c5413-af5e-4d51-954e-3cf8c5c6a6f7.tmp
c1a089e9-38d6-4a8f-ae79-a73e24d83b30.tmp
c56902e3-14cf-418d-b026-8dba84ba452f.tmp
496d2f0e-528f-4bc6-8403-0d1c05e31007.tmp
a035b1be-8c8a-49be-bcf2-e8df7c92df42.tmp
b3fa5ddb-0a94-44eb-afac-bc33e9e6ff05.tmp
d1c3f1a4-4217-4ee6-a56f-b75ed4b1379a.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
aeb37710-1ade-4109-958c-669abf172fe4.tmp
metadata.json
f84a5578-b761-4b86-9d91-e85846c2e92d.tmp
b1cd8a86-79f0-440c-bd67-abc1de6ca0e7.tmp
c65478b5-6064-4ccc-bceb-c663003bb753.tmp
messages.json
content.js
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/712-534-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1104-64-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1816-720-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1928-564-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1980-556-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1992-572-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2056-602-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2492-660-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2780-648-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2836-702-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2968-677-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3420-560-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3908-614-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4116-672-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4252-698-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4820-432-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4924-509-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5124-521-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5704-644-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6120-481-0x0000000000010000-0x00000000000AB000-memory.dmp