Analysis
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
28/10/2026, 23:14
General
- Target 2026-10-27_c6030ccf8b05e72e1e5eb60d8cd0ecf3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261028-28c8dagx4k
- SHA256 3d22ec39365ed9d3f6b888d2a8d5aec97c2174de2251caccf082db0d3d7d31c9
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-27_c6030ccf8b05e72e1e5eb60d8cd0ecf3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-27_c6030ccf8b05e72e1e5eb60d8cd0ecf3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\mkecxupmhezwupmk.exeC:\Temp\mkecxupmhezwupmk.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\upmhfzupmf.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\upmhfzupmf.exeC:\Temp\upmhfzupmf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_upmhfzupmf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_upmhfzupmf.exeC:\Temp\i_upmhfzupmf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\urmjhcwurm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\urmjhcwurm.exeC:\Temp\urmjhcwurm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_urmjhcwurm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_urmjhcwurm.exeC:\Temp\i_urmjhcwurm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mgebwtrojh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mgebwtrojh.exeC:\Temp\mgebwtrojh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mgebwtrojh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mgebwtrojh.exeC:\Temp\i_mgebwtrojh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lgebwtomgb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lgebwtomgb.exeC:\Temp\lgebwtomgb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lgebwtomgb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lgebwtomgb.exeC:\Temp\i_lgebwtomgb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qoidayvtnl.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qoidayvtnl.exeC:\Temp\qoidayvtnl.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qoidayvtnl.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qoidayvtnl.exeC:\Temp\i_qoidayvtnl.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lfdxvtniga.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lfdxvtniga.exeC:\Temp\lfdxvtniga.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lfdxvtniga.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lfdxvtniga.exeC:\Temp\i_lfdxvtniga.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\licavsqnlf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\licavsqnlf.exeC:\Temp\licavsqnlf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_licavsqnlf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_licavsqnlf.exeC:\Temp\i_licavsqnlf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fzxspnifax.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fzxspnifax.exeC:\Temp\fzxspnifax.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fzxspnifax.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fzxspnifax.exeC:\Temp\i_fzxspnifax.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\smhczusmke.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\smhczusmke.exeC:\Temp\smhczusmke.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_smhczusmke.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_smhczusmke.exeC:\Temp\i_smhczusmke.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wupmgezxrp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wupmgezxrp.exeC:\Temp\wupmgezxrp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wupmgezxrp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wupmgezxrp.exeC:\Temp\i_wupmgezxrp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bztrmjecwu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bztrmjecwu.exeC:\Temp\bztrmjecwu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bztrmjecwu.exe ups_ins3⤵
-
C:\Temp\i_bztrmjecwu.exeC:\Temp\i_bztrmjecwu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wtomjdbztr.exe ups_run3⤵
-
C:\Temp\wtomjdbztr.exeC:\Temp\wtomjdbztr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wtomjdbztr.exe ups_ins3⤵
-
C:\Temp\i_wtomjdbztr.exeC:\Temp\i_wtomjdbztr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gebvtnlgdb.exe ups_run3⤵
-
C:\Temp\gebvtnlgdb.exeC:\Temp\gebvtnlgdb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gebvtnlgdb.exe ups_ins3⤵
-
C:\Temp\i_gebvtnlgdb.exeC:\Temp\i_gebvtnlgdb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lidavtnlfd.exe ups_run3⤵
-
C:\Temp\lidavtnlfd.exeC:\Temp\lidavtnlfd.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lidavtnlfd.exe ups_ins3⤵
-
C:\Temp\i_lidavtnlfd.exeC:\Temp\i_lidavtnlfd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdavsqkida.exe ups_run3⤵
-
C:\Temp\fdavsqkida.exeC:\Temp\fdavsqkida.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdavsqkida.exe ups_ins3⤵
-
C:\Temp\i_fdavsqkida.exeC:\Temp\i_fdavsqkida.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hfaxsnkfcx.exe ups_run3⤵
-
C:\Temp\hfaxsnkfcx.exeC:\Temp\hfaxsnkfcx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hfaxsnkfcx.exe ups_ins3⤵
-
C:\Temp\i_hfaxsnkfcx.exeC:\Temp\i_hfaxsnkfcx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cxusmkfcxv.exe ups_run3⤵
-
C:\Temp\cxusmkfcxv.exeC:\Temp\cxusmkfcxv.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cxusmkfcxv.exe ups_ins3⤵
-
C:\Temp\i_cxusmkfcxv.exeC:\Temp\i_cxusmkfcxv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cwusmkhczu.exe ups_run3⤵
-
C:\Temp\cwusmkhczu.exeC:\Temp\cwusmkhczu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cwusmkhczu.exe ups_ins3⤵
-
C:\Temp\i_cwusmkhczu.exeC:\Temp\i_cwusmkhczu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhbzurmkec.exe ups_run3⤵
-
C:\Temp\jhbzurmkec.exeC:\Temp\jhbzurmkec.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhbzurmkec.exe ups_ins3⤵
-
C:\Temp\i_jhbzurmkec.exeC:\Temp\i_jhbzurmkec.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7fffc830c188,0x7fffc830c194,0x7fffc830c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1928,i,1637982824838598668,862515034948902412,262144 --field-trial-handle=3208,i,15347181490532424305,13499531209146393745,262144 --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2180,i,4264179133438577339,13738131382348515795,524288 --field-trial-handle=3208,i,15347181490532424305,13499531209146393745,262144 --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2648,i,13659976436203131182,16047710535342072103,524288 --field-trial-handle=3208,i,15347181490532424305,13499531209146393745,262144 --variations-seed-version --mojo-platform-channel-handle=3308 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,12014494372444798714,3778028372934482950,2097152 --field-trial-handle=3208,i,15347181490532424305,13499531209146393745,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,9318153668022501947,8447709928664923709,2097152 --field-trial-handle=3208,i,15347181490532424305,13499531209146393745,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,4326716596974488452,1099484320830463495,2097152 --field-trial-handle=3208,i,15347181490532424305,13499531209146393745,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,8146045948971528601,13168634871762823119,2097152 --field-trial-handle=3208,i,15347181490532424305,13499531209146393745,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,10965392681174667003,18041165805464379543,524288 --field-trial-handle=3208,i,15347181490532424305,13499531209146393745,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,13533708008179064147,15981058152129088836,524288 --field-trial-handle=3208,i,15347181490532424305,13499531209146393745,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,10536474233198588376,2607298758328287174,524288 --field-trial-handle=3208,i,15347181490532424305,13499531209146393745,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,15669807774174349968,798926451314542626,524288 --field-trial-handle=3208,i,15347181490532424305,13499531209146393745,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,15669807774174349968,798926451314542626,524288 --field-trial-handle=3208,i,15347181490532424305,13499531209146393745,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,2383485648357472964,9906762580265996278,524288 --field-trial-handle=3208,i,15347181490532424305,13499531209146393745,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,18411103626819055405,8461863851618136146,524288 --field-trial-handle=3208,i,15347181490532424305,13499531209146393745,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,8008526542345818184,16217538267654359408,524288 --field-trial-handle=3208,i,15347181490532424305,13499531209146393745,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,9402527437749672986,3955909719431516977,524288 --field-trial-handle=3208,i,15347181490532424305,13499531209146393745,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1264,i,439771625305292311,8259548573204099288,524288 --field-trial-handle=3208,i,15347181490532424305,13499531209146393745,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1272,i,12264417880392818176,489563501588163327,524288 --field-trial-handle=3208,i,15347181490532424305,13499531209146393745,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1276,i,6925924561966972016,1187117425027058049,524288 --field-trial-handle=3208,i,15347181490532424305,13499531209146393745,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,11500485138924901850,11790010332248947085,524288 --field-trial-handle=3208,i,15347181490532424305,13499531209146393745,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,15148033381293748100,16020950876395567531,524288 --field-trial-handle=3208,i,15347181490532424305,13499531209146393745,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,14813125440390877440,14766821743887036419,524288 --field-trial-handle=3208,i,15347181490532424305,13499531209146393745,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,3246232374563884149,2681518174291775061,524288 --field-trial-handle=3208,i,15347181490532424305,13499531209146393745,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6816,i,1612101476895128586,2203001734595407423,262144 --field-trial-handle=3208,i,15347181490532424305,13499531209146393745,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6816,i,5185396275913680194,3455174697952616382,524288 --field-trial-handle=3208,i,15347181490532424305,13499531209146393745,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,7754435485109302875,912350138916182520,524288 --field-trial-handle=3208,i,15347181490532424305,13499531209146393745,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\mkecxupmhezwupmk.sysC:\Temp\mkecxupmhezwupmk.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\hfzxrpjhbz.sysC:\Temp\hfzxrpjhbz.sys1⤵
- Executes dropped EXE
-
C:\Temp\mjhbztrojh.sysC:\Temp\mjhbztrojh.sys1⤵
- Executes dropped EXE
-
C:\Temp\mgeywqojgb.sysC:\Temp\mgeywqojgb.sys1⤵
- Executes dropped EXE
-
C:\Temp\bytrljdbvt.sysC:\Temp\bytrljdbvt.sys1⤵
- Executes dropped EXE
-
C:\Temp\yvtqljdbvt.sysC:\Temp\yvtqljdbvt.sys1⤵
- Executes dropped EXE
-
C:\Temp\nlfdavtnif.sysC:\Temp\nlfdavtnif.sys1⤵
- Executes dropped EXE
-
C:\Temp\faxspnkfcx.sysC:\Temp\faxspnkfcx.sys1⤵
- Executes dropped EXE
-
C:\Temp\zxupkhfzxr.sysC:\Temp\zxupkhfzxr.sys1⤵
- Executes dropped EXE
-
C:\Temp\kecwusmkec.sysC:\Temp\kecwusmkec.sys1⤵
- Executes dropped EXE
-
C:\Temp\ecwuomhezw.sysC:\Temp\ecwuomhezw.sys1⤵
- Executes dropped EXE
-
C:\Temp\wtomjheywt.sysC:\Temp\wtomjheywt.sys1⤵
-
C:\Temp\ytqoigbytq.sysC:\Temp\ytqoigbytq.sys1⤵
-
C:\Temp\qnljdbvtol.sysC:\Temp\qnljdbvtol.sys1⤵
-
C:\Temp\nlidbvsnli.sysC:\Temp\nlidbvsnli.sys1⤵
-
C:\Temp\hfaxsqnifd.sysC:\Temp\hfaxsqnifd.sys1⤵
-
C:\Temp\hfcxvpnhcz.sysC:\Temp\hfcxvpnhcz.sys1⤵
-
C:\Temp\hczxrpnhfc.sysC:\Temp\hczxrpnhfc.sys1⤵
-
C:\Temp\mkecwupjhe.sysC:\Temp\mkecwupjhe.sys1⤵
-
C:\Temp\pjhbztrlje.sysC:\Temp\pjhbztrlje.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
bytrljdbvt.sys
hfzxrpjhbz.sys
i_lgebwtomgb.exe
i_mgebwtrojh.exe
i_qoidayvtnl.exe
i_upmhfzupmf.exe
i_urmjhcwurm.exe
lfdxvtniga.exe
lgebwtomgb.exe
mgebwtrojh.exe
mgeywqojgb.sys
mjhbztrojh.sys
mkecxupmhezwupmk.exe
mkecxupmhezwupmk.sys
qoidayvtnl.exe
upmhfzupmf.exe
urmjhcwurm.exe
yvtqljdbvt.sys
084962e3-6bcd-40eb-a807-9b95981ced70.tmp
20e60069-584f-4e3d-b807-38a524c4fff9.tmp
545e2ec5-22c3-4a09-ab58-cf31eab1c968.tmp
5ab65c1d-26a3-474d-a9fe-3c00b66abc05.tmp
settings.dat
settings.dat
13c925b4-06d5-414b-b00e-b1f395aabc78.tmp
5683d25d-acc7-4067-9567-f4acbfc4e904.tmp
77f6491f-a15d-4896-8178-67c487418345.tmp
9eab720a-cff0-4560-bc2e-783feba7a9fa.tmp
temp-index
the-real-index
9a94e77e-9d67-40e1-a64d-d8360c2eba72.tmp
dasherSettingSchema.json
096c3d3c-8612-4c48-bf37-503d67fc5b52.tmp
50a3c81c-1901-4dba-a5ae-d8105e6d8a17.tmp
81b631e1-5041-4ce5-ac2e-6251bc1008d9.tmp
sync_diagnostic.log
d6496689-bafa-42bd-8212-9a24cb493c34.tmp
a38d575a-d490-42dc-8317-c43df05f6509.tmp
b415009d-aeb4-47e3-ac15-5a7cac81987d.tmp
3bb5c8c4-bcea-419e-88ba-a1dce8ee0bc0.tmp
52226973-5667-4b9a-a99a-631fa92e3b0c.tmp
a2fe70aa-4610-4a9e-8392-a8640245bf1c.tmp
be3a8c4c-5f60-450f-bf0c-d8042fcad229.tmp
e72a03bd-1f15-426a-9f9a-adbb641fd70e.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
4275c9aa-02ce-48f0-87b8-cd8cb4607fac.tmp
metadata.json
47c07640-13b8-494e-a4e2-659d0b1f94f4.tmp
e5704ead-2f35-42a3-ac95-e98a21e685f5.tmp
messages.json
content.js
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/888-430-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1132-698-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1132-676-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1672-638-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1732-556-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1836-696-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1904-721-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2080-716-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2080-739-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2312-746-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2812-519-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2876-671-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3248-610-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3820-742-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3908-560-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4816-479-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5132-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5296-532-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5656-576-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5660-585-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5692-507-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6008-672-0x0000000000010000-0x00000000000AB000-memory.dmp