Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
30/10/2026, 21:51
General
- Target 2026-10-30_952dcefa67ad013f1149d0d0f23c8992_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261030-1qkn3aff39
- SHA256 da8f2dd7b071ddba738ef54f087ce2a7b4c257b2020f0b05c0233e65670eba90
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-30_952dcefa67ad013f1149d0d0f23c8992_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-30_952dcefa67ad013f1149d0d0f23c8992_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\mgezwrpjhbztrmje.exeC:\Temp\mgezwrpjhbztrmje.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ojhbzwrojh.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\ojhbzwrojh.exeC:\Temp\ojhbzwrojh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ojhbzwrojh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ojhbzwrojh.exeC:\Temp\i_ojhbzwrojh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qoigeywtom.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qoigeywtom.exeC:\Temp\qoigeywtom.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qoigeywtom.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qoigeywtom.exeC:\Temp\i_qoigeywtom.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ayvqlgdywq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ayvqlgdywq.exeC:\Temp\ayvqlgdywq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ayvqlgdywq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ayvqlgdywq.exeC:\Temp\i_ayvqlgdywq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\daysqlidav.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\daysqlidav.exeC:\Temp\daysqlidav.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_daysqlidav.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_daysqlidav.exeC:\Temp\i_daysqlidav.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vsnlidavtn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vsnlidavtn.exeC:\Temp\vsnlidavtn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vsnlidavtn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vsnlidavtn.exeC:\Temp\i_vsnlidavtn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kifzxspkic.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kifzxspkic.exeC:\Temp\kifzxspkic.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kifzxspkic.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kifzxspkic.exeC:\Temp\i_kifzxspkic.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\khcaupnkec.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\khcaupnkec.exeC:\Temp\khcaupnkec.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_khcaupnkec.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_khcaupnkec.exeC:\Temp\i_khcaupnkec.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pjhbztrmje.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pjhbztrmje.exeC:\Temp\pjhbztrmje.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pjhbztrmje.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pjhbztrmje.exeC:\Temp\i_pjhbztrmje.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhbztrmjge.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jhbztrmjge.exeC:\Temp\jhbztrmjge.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhbztrmjge.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jhbztrmjge.exeC:\Temp\i_jhbztrmjge.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ebwtrljebw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ebwtrljebw.exeC:\Temp\ebwtrljebw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ebwtrljebw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ebwtrljebw.exeC:\Temp\i_ebwtrljebw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\yvtolgeywq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\yvtolgeywq.exeC:\Temp\yvtolgeywq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_yvtolgeywq.exe ups_ins3⤵
-
C:\Temp\i_yvtolgeywq.exeC:\Temp\i_yvtolgeywq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gaysqlidyv.exe ups_run3⤵
-
C:\Temp\gaysqlidyv.exeC:\Temp\gaysqlidyv.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gaysqlidyv.exe ups_ins3⤵
-
C:\Temp\i_gaysqlidyv.exeC:\Temp\i_gaysqlidyv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\igaysqdavs.exe ups_run3⤵
-
C:\Temp\igaysqdavs.exeC:\Temp\igaysqdavs.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_igaysqdavs.exe ups_ins3⤵
-
C:\Temp\i_igaysqdavs.exeC:\Temp\i_igaysqdavs.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\causpnhfca.exe ups_run3⤵
-
C:\Temp\causpnhfca.exeC:\Temp\causpnhfca.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_causpnhfca.exe ups_ins3⤵
-
C:\Temp\i_causpnhfca.exeC:\Temp\i_causpnhfca.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hcausmkfcx.exe ups_run3⤵
-
C:\Temp\hcausmkfcx.exeC:\Temp\hcausmkfcx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hcausmkfcx.exe ups_ins3⤵
-
C:\Temp\i_hcausmkfcx.exeC:\Temp\i_hcausmkfcx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hecwupmhez.exe ups_run3⤵
-
C:\Temp\hecwupmhez.exeC:\Temp\hecwupmhez.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hecwupmhez.exe ups_ins3⤵
-
C:\Temp\i_hecwupmhez.exeC:\Temp\i_hecwupmhez.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hezxrpjhbz.exe ups_run3⤵
-
C:\Temp\hezxrpjhbz.exeC:\Temp\hezxrpjhbz.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hezxrpjhbz.exe ups_ins3⤵
-
C:\Temp\i_hezxrpjhbz.exeC:\Temp\i_hezxrpjhbz.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\eywuojgbzt.exe ups_run3⤵
-
C:\Temp\eywuojgbzt.exeC:\Temp\eywuojgbzt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_eywuojgbzt.exe ups_ins3⤵
-
C:\Temp\i_eywuojgbzt.exeC:\Temp\i_eywuojgbzt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\geywqojgbz.exe ups_run3⤵
-
C:\Temp\geywqojgbz.exeC:\Temp\geywqojgbz.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_geywqojgbz.exe ups_ins3⤵
-
C:\Temp\i_geywqojgbz.exeC:\Temp\i_geywqojgbz.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lgdywqoiga.exe ups_run3⤵
-
C:\Temp\lgdywqoiga.exeC:\Temp\lgdywqoiga.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff845ffc188,0x7ff845ffc194,0x7ff845ffc1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,5505505562304198174,9386565420140113070,524288 --field-trial-handle=2712,i,3113720853719235979,13327777982370820214,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,1156160240490017453,2262917245686651614,262144 --field-trial-handle=2712,i,3113720853719235979,13327777982370820214,262144 --variations-seed-version --mojo-platform-channel-handle=2708 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,9498124202092106644,4726254618551048005,524288 --field-trial-handle=2712,i,3113720853719235979,13327777982370820214,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,14537520152731567926,2662879346475315807,2097152 --field-trial-handle=2712,i,3113720853719235979,13327777982370820214,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,16347714611742851325,18236280357996347599,2097152 --field-trial-handle=2712,i,3113720853719235979,13327777982370820214,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4308,i,340778067079342100,6518159829549900166,2097152 --field-trial-handle=2712,i,3113720853719235979,13327777982370820214,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4328,i,12129238397480235224,15418315488750635527,2097152 --field-trial-handle=2712,i,3113720853719235979,13327777982370820214,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,10969334391873549578,2056482391308627764,524288 --field-trial-handle=2712,i,3113720853719235979,13327777982370820214,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,16332509514279851315,13987913458359867721,524288 --field-trial-handle=2712,i,3113720853719235979,13327777982370820214,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,6087677920242072290,14813139729123011963,524288 --field-trial-handle=2712,i,3113720853719235979,13327777982370820214,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,18334579629199210257,14525156925078166801,524288 --field-trial-handle=2712,i,3113720853719235979,13327777982370820214,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,18334579629199210257,14525156925078166801,524288 --field-trial-handle=2712,i,3113720853719235979,13327777982370820214,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,10114352215480827702,3650941954442973239,524288 --field-trial-handle=2712,i,3113720853719235979,13327777982370820214,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,11268235237471333478,2856011591373731839,524288 --field-trial-handle=2712,i,3113720853719235979,13327777982370820214,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,16729473930170467948,11540561135789373273,524288 --field-trial-handle=2712,i,3113720853719235979,13327777982370820214,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6728,i,5250518287840577035,3742116191246117465,524288 --field-trial-handle=2712,i,3113720853719235979,13327777982370820214,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3424,i,17665864355236964765,11234712599364751073,524288 --field-trial-handle=2712,i,3113720853719235979,13327777982370820214,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,15625778475041741665,3227034999190147126,524288 --field-trial-handle=2712,i,3113720853719235979,13327777982370820214,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,5947991603011251944,1922740413334665828,524288 --field-trial-handle=2712,i,3113720853719235979,13327777982370820214,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,9994628594611711041,15847829619128032702,524288 --field-trial-handle=2712,i,3113720853719235979,13327777982370820214,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,5296703717038220478,4311789701061843987,524288 --field-trial-handle=2712,i,3113720853719235979,13327777982370820214,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,3160856305097401253,4209603985020894843,524288 --field-trial-handle=2712,i,3113720853719235979,13327777982370820214,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,7654343984257428593,4612930094365097847,524288 --field-trial-handle=2712,i,3113720853719235979,13327777982370820214,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6212,i,1431344604587275681,4465562116118733062,262144 --field-trial-handle=2712,i,3113720853719235979,13327777982370820214,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3880,i,8394384512973744786,8794500472701144002,524288 --field-trial-handle=2712,i,3113720853719235979,13327777982370820214,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\mgezwrpjhbztrmje.sysC:\Temp\mgezwrpjhbztrmje.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\wtoljdbztr.sysC:\Temp\wtoljdbztr.sys1⤵
- Executes dropped EXE
-
C:\Temp\gbytqligay.sysC:\Temp\gbytqligay.sys1⤵
- Executes dropped EXE
-
C:\Temp\fdyvtqliga.sysC:\Temp\fdyvtqliga.sys1⤵
- Executes dropped EXE
-
C:\Temp\xvsqkidavt.sysC:\Temp\xvsqkidavt.sys1⤵
- Executes dropped EXE
-
C:\Temp\qkicauspkh.sysC:\Temp\qkicauspkh.sys1⤵
- Executes dropped EXE
-
C:\Temp\khczusmkec.sysC:\Temp\khczusmkec.sys1⤵
- Executes dropped EXE
-
C:\Temp\xrpjhczurp.sysC:\Temp\xrpjhczurp.sys1⤵
- Executes dropped EXE
-
C:\Temp\uomgezwupj.sysC:\Temp\uomgezwupj.sys1⤵
- Executes dropped EXE
-
C:\Temp\hbztrojgeb.sysC:\Temp\hbztrojgeb.sys1⤵
- Executes dropped EXE
-
C:\Temp\ytqoljdbwt.sysC:\Temp\ytqoljdbwt.sys1⤵
- Executes dropped EXE
-
C:\Temp\tqoigayoig.sysC:\Temp\tqoigayoig.sys1⤵
-
C:\Temp\nlfdxvqnif.sysC:\Temp\nlfdxvqnif.sys1⤵
-
C:\Temp\faysqkifda.sysC:\Temp\faysqkifda.sys1⤵
-
C:\Temp\ifzxsmkicx.sysC:\Temp\ifzxsmkicx.sys1⤵
-
C:\Temp\rpnhcaxrpm.sysC:\Temp\rpnhcaxrpm.sys1⤵
-
C:\Temp\mkeczurpjh.sysC:\Temp\mkeczurpjh.sys1⤵
-
C:\Temp\heztrmjhbw.sysC:\Temp\heztrmjhbw.sys1⤵
-
C:\Temp\geyvtrojgb.sysC:\Temp\geyvtrojgb.sys1⤵
-
C:\Temp\wtolgdywqo.sysC:\Temp\wtolgdywqo.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ayvqlgdywq.exe
daysqlidav.exe
fdyvtqliga.sys
gbytqligay.sys
i_ayvqlgdywq.exe
i_daysqlidav.exe
i_ojhbzwrojh.exe
i_qoigeywtom.exe
i_vsnlidavtn.exe
kifzxspkic.exe
mgezwrpjhbztrmje.exe
mgezwrpjhbztrmje.sys
ojhbzwrojh.exe
qkicauspkh.sys
qoigeywtom.exe
vsnlidavtn.exe
wtoljdbztr.sys
xvsqkidavt.sys
0d944f49-c9b9-4f2a-8c35-2cacbaa0d832.tmp
12d0153f-382c-4c13-a62c-105d6a68b3a4.tmp
27a67cdc-c38f-47d6-a212-6801857397e5.tmp
settings.dat
settings.dat
29d9328c-d2c6-4fa6-8dd4-4a90aef177d5.tmp
6e117c52-4cc6-4aa2-a939-36fb386da5de.tmp
temp-index
the-real-index
39ca5023-90ba-435d-85b7-3d29dfe014a6.tmp
dasherSettingSchema.json
22acb8b9-7582-4429-b6fd-93eaea0fbd3e.tmp
58a22628-16ee-4089-8161-86a3ba62b14c.tmp
a6955df5-27a0-4319-8427-e6eac2a60501.tmp
Secure Preferences
e4ae76d2-ab07-419e-9525-bdb63d8a3fe7.tmp
f23905f1-c1dc-4f96-817f-f960e82046d4.tmp
896acf93-0630-4254-9a57-ad1d70311f9d.tmp
OperationConfig
a31e215c-95d1-4ed5-abae-42d4e7fc7993.tmp
a6fac388-d7d4-40c6-9ab7-5fcd4f7c10d0.tmp
336cb4e4-7cc4-4245-b6e6-a8883bac7b0f.tmp
73ad59da-ac37-4429-9fc1-a8608599c400.tmp
9a8dd12c-d491-406d-862f-76ef96e4cd42.tmp
b7a98265-dd1d-4284-9a94-3b79c09fca43.tmp
d04ed740-7be2-4e80-b3b9-89b2e35c7c12.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
b3b8f104-2401-4522-a901-53c46dfebf11.tmp
metadata.json
5be8a6a1-938e-41ca-8c40-11b5e0d3dabe.tmp
5f50db22-7481-44f6-8efe-e177695f8f94.tmp
messages.json
content.js
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/124-537-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1152-733-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1320-584-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1352-669-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1480-511-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1480-673-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1948-580-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1948-607-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2216-706-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2896-729-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3524-615-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3752-524-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4368-635-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4504-434-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4696-657-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4796-711-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4980-685-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5048-564-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5868-560-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5888-517-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5888-483-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5968-66-0x0000000000010000-0x00000000000AB000-memory.dmp