Analysis
- max time kernel
149s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
26/10/2026, 16:20
General
- Target 2026-10-25_acba45613f77a742d8e690c7d83d22a9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261026-ttd75af15n
- SHA256 9366ca0d438f1c07740f0bbe10b68d8bbfeec7f4b661c53af7be8c052ae517f2
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-25_acba45613f77a742d8e690c7d83d22a9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-25_acba45613f77a742d8e690c7d83d22a9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\vtnlfdxvqnigaysq.exeC:\Temp\vtnlfdxvqnigaysq.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvsqkicasq.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\xvsqkicasq.exeC:\Temp\xvsqkicasq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xvsqkicasq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xvsqkicasq.exeC:\Temp\i_xvsqkicasq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xspkhfdxsq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xspkhfdxsq.exeC:\Temp\xspkhfdxsq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xspkhfdxsq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xspkhfdxsq.exeC:\Temp\i_xspkhfdxsq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cxupmhfzxr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\cxupmhfzxr.exeC:\Temp\cxupmhfzxr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cxupmhfzxr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_cxupmhfzxr.exeC:\Temp\i_cxupmhfzxr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hecwupmhez.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hecwupmhez.exeC:\Temp\hecwupmhez.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hecwupmhez.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hecwupmhez.exeC:\Temp\i_hecwupmhez.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\uomgezwrpj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\uomgezwrpj.exeC:\Temp\uomgezwrpj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_uomgezwrpj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_uomgezwrpj.exeC:\Temp\i_uomgezwrpj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jheywrojgb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jheywrojgb.exeC:\Temp\jheywrojgb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jheywrojgb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jheywrojgb.exeC:\Temp\i_jheywrojgb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gdywqoigby.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gdywqoigby.exeC:\Temp\gdywqoigby.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gdywqoigby.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gdywqoigby.exeC:\Temp\i_gdywqoigby.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lgaytqljdb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lgaytqljdb.exeC:\Temp\lgaytqljdb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lgaytqljdb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lgaytqljdb.exeC:\Temp\i_lgaytqljdb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\avtnlidavq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\avtnlidavq.exeC:\Temp\avtnlidavq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_avtnlidavq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_avtnlidavq.exeC:\Temp\i_avtnlidavq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnhfaxsqki.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pnhfaxsqki.exeC:\Temp\pnhfaxsqki.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnhfaxsqki.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pnhfaxsqki.exeC:\Temp\i_pnhfaxsqki.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\icausmkica.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\icausmkica.exeC:\Temp\icausmkica.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_icausmkica.exe ups_ins3⤵
-
C:\Temp\i_icausmkica.exeC:\Temp\i_icausmkica.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kecausmkec.exe ups_run3⤵
-
C:\Temp\kecausmkec.exeC:\Temp\kecausmkec.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kecausmkec.exe ups_ins3⤵
-
C:\Temp\i_kecausmkec.exeC:\Temp\i_kecausmkec.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\khczxrpjhc.exe ups_run3⤵
-
C:\Temp\khczxrpjhc.exeC:\Temp\khczxrpjhc.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_khczxrpjhc.exe ups_ins3⤵
-
C:\Temp\i_khczxrpjhc.exeC:\Temp\i_khczxrpjhc.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\geywrojhbz.exe ups_run3⤵
-
C:\Temp\geywrojhbz.exeC:\Temp\geywrojhbz.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_geywrojhbz.exe ups_ins3⤵
-
C:\Temp\i_geywrojhbz.exeC:\Temp\i_geywrojhbz.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\eywqoigbyt.exe ups_run3⤵
-
C:\Temp\eywqoigbyt.exeC:\Temp\eywqoigbyt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_eywqoigbyt.exe ups_ins3⤵
-
C:\Temp\i_eywqoigbyt.exeC:\Temp\i_eywqoigbyt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\oigbytqojg.exe ups_run3⤵
-
C:\Temp\oigbytqojg.exeC:\Temp\oigbytqojg.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_oigbytqojg.exe ups_ins3⤵
-
C:\Temp\i_oigbytqojg.exeC:\Temp\i_oigbytqojg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\igaywqniga.exe ups_run3⤵
-
C:\Temp\igaywqniga.exeC:\Temp\igaywqniga.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_igaywqniga.exe ups_ins3⤵
-
C:\Temp\i_igaywqniga.exeC:\Temp\i_igaywqniga.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ifavsnlida.exe ups_run3⤵
-
C:\Temp\ifavsnlida.exeC:\Temp\ifavsnlida.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ifavsnlida.exe ups_ins3⤵
-
C:\Temp\i_ifavsnlida.exeC:\Temp\i_ifavsnlida.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kidxvhfzxv.exe ups_run3⤵
-
C:\Temp\kidxvhfzxv.exeC:\Temp\kidxvhfzxv.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kidxvhfzxv.exe ups_ins3⤵
-
C:\Temp\i_kidxvhfzxv.exeC:\Temp\i_kidxvhfzxv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\caxvpnhfax.exe ups_run3⤵
-
C:\Temp\caxvpnhfax.exeC:\Temp\caxvpnhfax.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffb04d5c188,0x7ffb04d5c194,0x7ffb04d5c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2148,i,6625248911765037781,7092303082092982013,524288 --field-trial-handle=2828,i,110156712191008645,3917579452102243273,262144 --variations-seed-version --mojo-platform-channel-handle=2856 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,5567590551947985834,2888877665075052844,524288 --field-trial-handle=2828,i,110156712191008645,3917579452102243273,262144 --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1972,i,9967595876994890463,17585319230207619546,262144 --field-trial-handle=2828,i,110156712191008645,3917579452102243273,262144 --variations-seed-version --mojo-platform-channel-handle=2820 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,6203164996237428125,13886894859762115478,2097152 --field-trial-handle=2828,i,110156712191008645,3917579452102243273,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,1508307653037445638,18190998975369141125,2097152 --field-trial-handle=2828,i,110156712191008645,3917579452102243273,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,17126449407685115295,11921758965075986746,2097152 --field-trial-handle=2828,i,110156712191008645,3917579452102243273,262144 --variations-seed-version --mojo-platform-channel-handle=1976 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,9322058660961613087,17266352666280913542,2097152 --field-trial-handle=2828,i,110156712191008645,3917579452102243273,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,4040794998079679738,11090955294472031909,524288 --field-trial-handle=2828,i,110156712191008645,3917579452102243273,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3604,i,17006090801940663891,11215506016041025833,524288 --field-trial-handle=2828,i,110156712191008645,3917579452102243273,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,2124885196173602381,13740683727908271766,524288 --field-trial-handle=2828,i,110156712191008645,3917579452102243273,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,3950510202738612065,12106727514548888679,524288 --field-trial-handle=2828,i,110156712191008645,3917579452102243273,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,3950510202738612065,12106727514548888679,524288 --field-trial-handle=2828,i,110156712191008645,3917579452102243273,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,11449529544647438706,14457473326762373529,524288 --field-trial-handle=2828,i,110156712191008645,3917579452102243273,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,1372133846899045792,13314357479763682772,524288 --field-trial-handle=2828,i,110156712191008645,3917579452102243273,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,6931373117814413220,3080610270475182993,524288 --field-trial-handle=2828,i,110156712191008645,3917579452102243273,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,15641866152178840117,7339549821010091556,524288 --field-trial-handle=2828,i,110156712191008645,3917579452102243273,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,112331270625551412,4124201987686777189,524288 --field-trial-handle=2828,i,110156712191008645,3917579452102243273,262144 --variations-seed-version --mojo-platform-channel-handle=1496 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,15240695813999129712,3697772037937094506,524288 --field-trial-handle=2828,i,110156712191008645,3917579452102243273,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,5121316579494524556,8359411144606863185,524288 --field-trial-handle=2828,i,110156712191008645,3917579452102243273,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3704,i,5027274032618803586,12558367169972058018,524288 --field-trial-handle=2828,i,110156712191008645,3917579452102243273,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,17860649758470714768,8044472883619840187,524288 --field-trial-handle=2828,i,110156712191008645,3917579452102243273,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,13568487416952454326,18054822457419338261,524288 --field-trial-handle=2828,i,110156712191008645,3917579452102243273,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,15081679583880775451,8650949330819587395,524288 --field-trial-handle=2828,i,110156712191008645,3917579452102243273,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5448,i,5704601211606336792,3056654240407404369,262144 --field-trial-handle=2828,i,110156712191008645,3917579452102243273,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,3320260283973744459,5945429232608437882,524288 --field-trial-handle=2828,i,110156712191008645,3917579452102243273,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\vtnlfdxvqnigaysq.sysC:\Temp\vtnlfdxvqnigaysq.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\faxsqnhfax.sysC:\Temp\faxsqnhfax.sys1⤵
- Executes dropped EXE
-
C:\Temp\mkfcxupnhf.sysC:\Temp\mkfcxupnhf.sys1⤵
- Executes dropped EXE
-
C:\Temp\hczxrpkhcz.sysC:\Temp\hczxrpkhcz.sys1⤵
- Executes dropped EXE
-
C:\Temp\cwuomhezwr.sysC:\Temp\cwuomhezwr.sys1⤵
- Executes dropped EXE
-
C:\Temp\mgezwqomjh.sysC:\Temp\mgezwqomjh.sys1⤵
- Executes dropped EXE
-
C:\Temp\rljdbwtomg.sysC:\Temp\rljdbwtomg.sys1⤵
- Executes dropped EXE
-
C:\Temp\tnlgdywqoi.sysC:\Temp\tnlgdywqoi.sys1⤵
- Executes dropped EXE
-
C:\Temp\lidaysnlid.sysC:\Temp\lidaysnlid.sys1⤵
- Executes dropped EXE
-
C:\Temp\xvpnhfaxsq.sysC:\Temp\xvpnhfaxsq.sys1⤵
- Executes dropped EXE
-
C:\Temp\vpnhfdausn.sysC:\Temp\vpnhfdausn.sys1⤵
- Executes dropped EXE
-
C:\Temp\khfzxspkhc.sysC:\Temp\khfzxspkhc.sys1⤵
-
C:\Temp\heczxrpmkh.sysC:\Temp\heczxrpmkh.sys1⤵
-
C:\Temp\jebwuomgez.sysC:\Temp\jebwuomgez.sys1⤵
-
C:\Temp\omgeywqojg.sysC:\Temp\omgeywqojg.sys1⤵
-
C:\Temp\ljgeywqoig.sysC:\Temp\ljgeywqoig.sys1⤵
-
C:\Temp\lgdywqoifd.sysC:\Temp\lgdywqoifd.sys1⤵
-
C:\Temp\tnlfdsqkif.sysC:\Temp\tnlfdsqkif.sys1⤵
-
C:\Temp\pnifaysqki.sysC:\Temp\pnifaysqki.sys1⤵
-
C:\Temp\fcaxvpnkfc.sysC:\Temp\fcaxvpnkfc.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
cwuomhezwr.sys
cxupmhfzxr.exe
faxsqnhfax.sys
hczxrpkhcz.sys
hecwupmhez.exe
i_cxupmhfzxr.exe
i_hecwupmhez.exe
i_uomgezwrpj.exe
i_xspkhfdxsq.exe
i_xvsqkicasq.exe
jheywrojgb.exe
mgezwqomjh.sys
mkfcxupnhf.sys
uomgezwrpj.exe
vtnlfdxvqnigaysq.exe
vtnlfdxvqnigaysq.sys
xspkhfdxsq.exe
xvsqkicasq.exe
0e38c3e9-c607-40e1-b2fc-b55e698a0b78.tmp
16c81912-8f09-40a4-958a-9cdf0bd31947.tmp
5e89ada4-29e5-4071-b5b6-8a499bd70891.tmp
7bdbd350-e15a-4170-b6d5-5ffeb8ca1b3d.tmp
824456f9-d7c1-4bd5-85a5-ca7ddfa919cc.tmp
settings.dat
settings.dat
130eebe6-5500-4732-baff-56d20589305f.tmp
492870fe-4158-480a-b84e-3457efe3e79d.tmp
59fe7445-fc8e-418c-85b6-4c61b38a181c.tmp
9a607e79-7d4a-478e-a310-9590e5e82593.tmp
temp-index
the-real-index
092b31bf-730e-4949-a29b-4b15029f0990.tmp
dasherSettingSchema.json
1fd68817-ace6-40b0-9798-a900ed43673a.tmp
6034d8d5-c6ac-439b-b2cc-50096ae5bf8d.tmp
732c8285-c5f1-4fe8-af9f-3d6af6d51875.tmp
d1d1165f-ee30-4924-983c-ce39bef6e17f.tmp
b783c096-9735-4582-8301-bfa87dffafaa.tmp
2738f8a0-259d-4af5-bbfe-fb2c18085a9d.tmp
5b7f3c35-817e-441a-b4a5-6d06b16cf33d.tmp
c4547977-c93d-47b8-87e2-b90c80db487e.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
457955bc-a36a-48e2-a1f7-a93c757d2c14.tmp
f381c658-6392-4e45-9ee3-1451e287c9dd.tmp
15dd27fe-6a97-497f-95ba-5b25f45e24ef.tmp
ba83d5ba-3d28-4c5d-a273-c9ad9c7c461e.tmp
content.js
messages.json
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/780-580-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1180-724-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2724-719-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3212-564-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3308-484-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3680-560-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3764-584-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4084-721-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4084-699-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4276-537-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4432-634-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4504-694-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5020-682-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5032-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5032-469-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5084-614-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5368-512-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5396-679-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5396-656-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5456-661-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5756-524-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6052-742-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6140-434-0x0000000000010000-0x00000000000AB000-memory.dmp