Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
04/11/2026, 18:16
General
- Target 2026-11-03_67c7e535ad19df3dc2d373d3e57b17e8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261104-wwrmcaev9q
- SHA256 ebe05c666a33c11db157ad82095f7863f825f6b8a5338f1d07c339bcbae9600d
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-03_67c7e535ad19df3dc2d373d3e57b17e8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-03_67c7e535ad19df3dc2d373d3e57b17e8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\hfaxsqkicausnkfd.exeC:\Temp\hfaxsqkicausnkfd.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hfzxspkhca.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\hfzxspkhca.exeC:\Temp\hfzxspkhca.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hfzxspkhca.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hfzxspkhca.exeC:\Temp\i_hfzxspkhca.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nhcwusmhec.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nhcwusmhec.exeC:\Temp\nhcwusmhec.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nhcwusmhec.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nhcwusmhec.exeC:\Temp\i_nhcwusmhec.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hfzxrpmhec.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hfzxrpmhec.exeC:\Temp\hfzxrpmhec.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hfzxrpmhec.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hfzxrpmhec.exeC:\Temp\i_hfzxrpmhec.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bzwrpjhbzt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bzwrpjhbzt.exeC:\Temp\bzwrpjhbzt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bzwrpjhbzt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bzwrpjhbzt.exeC:\Temp\i_bzwrpjhbzt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bztolgeywq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bztolgeywq.exeC:\Temp\bztolgeywq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bztolgeywq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bztolgeywq.exeC:\Temp\i_bztolgeywq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tnljgaywql.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\tnljgaywql.exeC:\Temp\tnljgaywql.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tnljgaywql.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_tnljgaywql.exeC:\Temp\i_tnljgaywql.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ytqoigaytq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ytqoigaytq.exeC:\Temp\ytqoigaytq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ytqoigaytq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ytqoigaytq.exeC:\Temp\i_ytqoigaytq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nlidaysqki.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nlidaysqki.exeC:\Temp\nlidaysqki.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nlidaysqki.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nlidaysqki.exeC:\Temp\i_nlidaysqki.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fcxsnkfdau.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fcxsnkfdau.exeC:\Temp\fcxsnkfdau.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fcxsnkfdau.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fcxsnkfdau.exeC:\Temp\i_fcxsnkfdau.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\upmkhczxup.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\upmkhczxup.exeC:\Temp\upmkhczxup.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_upmkhczxup.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_upmkhczxup.exeC:\Temp\i_upmkhczxup.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\smkfzxrpjh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\smkfzxrpjh.exeC:\Temp\smkfzxrpjh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_smkfzxrpjh.exe ups_ins3⤵
-
C:\Temp\i_smkfzxrpjh.exeC:\Temp\i_smkfzxrpjh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpjheztrmj.exe ups_run3⤵
-
C:\Temp\rpjheztrmj.exeC:\Temp\rpjheztrmj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpjheztrmj.exe ups_ins3⤵
-
C:\Temp\i_rpjheztrmj.exeC:\Temp\i_rpjheztrmj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rljhbywurl.exe ups_run3⤵
-
C:\Temp\rljhbywurl.exeC:\Temp\rljhbywurl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rljhbywurl.exe ups_ins3⤵
-
C:\Temp\i_rljhbywurl.exeC:\Temp\i_rljhbywurl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gdywqoigby.exe ups_run3⤵
-
C:\Temp\gdywqoigby.exeC:\Temp\gdywqoigby.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gdywqoigby.exe ups_ins3⤵
-
C:\Temp\i_gdywqoigby.exeC:\Temp\i_gdywqoigby.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qnljdbvtnl.exe ups_run3⤵
-
C:\Temp\qnljdbvtnl.exeC:\Temp\qnljdbvtnl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qnljdbvtnl.exe ups_ins3⤵
-
C:\Temp\i_qnljdbvtnl.exeC:\Temp\i_qnljdbvtnl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\idavsqlfdx.exe ups_run3⤵
-
C:\Temp\idavsqlfdx.exeC:\Temp\idavsqlfdx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_idavsqlfdx.exe ups_ins3⤵
-
C:\Temp\i_idavsqlfdx.exeC:\Temp\i_idavsqlfdx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xsqnifaxsq.exe ups_run3⤵
-
C:\Temp\xsqnifaxsq.exeC:\Temp\xsqnifaxsq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xsqnifaxsq.exe ups_ins3⤵
-
C:\Temp\i_xsqnifaxsq.exeC:\Temp\i_xsqnifaxsq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\spnhczxspk.exe ups_run3⤵
-
C:\Temp\spnhczxspk.exeC:\Temp\spnhczxspk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_spnhczxspk.exe ups_ins3⤵
-
C:\Temp\i_spnhczxspk.exeC:\Temp\i_spnhczxspk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pkhfzxrpkh.exe ups_run3⤵
-
C:\Temp\pkhfzxrpkh.exeC:\Temp\pkhfzxrpkh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pkhfzxrpkh.exe ups_ins3⤵
-
C:\Temp\i_pkhfzxrpkh.exeC:\Temp\i_pkhfzxrpkh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhbzurpjhb.exe ups_run3⤵
-
C:\Temp\jhbzurpjhb.exeC:\Temp\jhbzurpjhb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7fff489ec188,0x7fff489ec194,0x7fff489ec1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,2628751855109163375,14235842371082323189,262144 --field-trial-handle=2328,i,6829101920512585536,13265008204935244980,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,16409323483024709019,9633891242874867081,524288 --field-trial-handle=2328,i,6829101920512585536,13265008204935244980,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,11830545093363078390,2795565731096365991,524288 --field-trial-handle=2328,i,6829101920512585536,13265008204935244980,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,14028986775009054954,6200380462494033000,2097152 --field-trial-handle=2328,i,6829101920512585536,13265008204935244980,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,6276999688058614725,9478811608608665463,2097152 --field-trial-handle=2328,i,6829101920512585536,13265008204935244980,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,15098121694353848989,5608402454011228346,2097152 --field-trial-handle=2328,i,6829101920512585536,13265008204935244980,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,6057618421380141280,2382847404896071896,2097152 --field-trial-handle=2328,i,6829101920512585536,13265008204935244980,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,6272321850615831968,11831357354269384122,524288 --field-trial-handle=2328,i,6829101920512585536,13265008204935244980,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,16448158945297066140,8973830572814836719,524288 --field-trial-handle=2328,i,6829101920512585536,13265008204935244980,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,7778342543312276244,12493235263737531830,524288 --field-trial-handle=2328,i,6829101920512585536,13265008204935244980,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,2009440513726198720,10043317617262517986,524288 --field-trial-handle=2328,i,6829101920512585536,13265008204935244980,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,2009440513726198720,10043317617262517986,524288 --field-trial-handle=2328,i,6829101920512585536,13265008204935244980,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,14605557113889068763,8561634043496995198,524288 --field-trial-handle=2328,i,6829101920512585536,13265008204935244980,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,16178224057712699038,11162305857842252171,524288 --field-trial-handle=2328,i,6829101920512585536,13265008204935244980,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,1640815056851288029,8620111886666596178,524288 --field-trial-handle=2328,i,6829101920512585536,13265008204935244980,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6912,i,9222851163319238923,5037621684736738994,524288 --field-trial-handle=2328,i,6829101920512585536,13265008204935244980,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,15665427903060798958,2447857575534333996,524288 --field-trial-handle=2328,i,6829101920512585536,13265008204935244980,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,5276377162443224493,5944845278153398327,524288 --field-trial-handle=2328,i,6829101920512585536,13265008204935244980,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,9956889130134776501,14339605056212937457,524288 --field-trial-handle=2328,i,6829101920512585536,13265008204935244980,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,17806875343677726186,17000658331052564839,524288 --field-trial-handle=2328,i,6829101920512585536,13265008204935244980,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,6192514662907324476,2369867169461028589,524288 --field-trial-handle=2328,i,6829101920512585536,13265008204935244980,262144 --variations-seed-version --mojo-platform-channel-handle=7048 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6880,i,10521013427994611436,13589379539428124158,524288 --field-trial-handle=2328,i,6829101920512585536,13265008204935244980,262144 --variations-seed-version --mojo-platform-channel-handle=7008 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6880,i,14007556799418278740,431171963143711122,524288 --field-trial-handle=2328,i,6829101920512585536,13265008204935244980,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6880,i,7436318008077021689,3276492414498317346,262144 --field-trial-handle=2328,i,6829101920512585536,13265008204935244980,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,2086797808908852190,3049101716508301461,524288 --field-trial-handle=2328,i,6829101920512585536,13265008204935244980,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\hfaxsqkicausnkfd.sysC:\Temp\hfaxsqkicausnkfd.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\xuspnhfaus.sysC:\Temp\xuspnhfaus.sys1⤵
- Executes dropped EXE
-
C:\Temp\mhezxupmke.sysC:\Temp\mhezxupmke.sys1⤵
- Executes dropped EXE
-
C:\Temp\bzwrpjhecw.sysC:\Temp\bzwrpjhecw.sys1⤵
- Executes dropped EXE
-
C:\Temp\eywqojgbyt.sysC:\Temp\eywqojgbyt.sys1⤵
- Executes dropped EXE
-
C:\Temp\dyvtolgebz.sysC:\Temp\dyvtolgebz.sys1⤵
- Executes dropped EXE
-
C:\Temp\yvtnlfdyvq.sysC:\Temp\yvtnlfdyvq.sys1⤵
- Executes dropped EXE
-
C:\Temp\vpnifaysqk.sysC:\Temp\vpnifaysqk.sys1⤵
- Executes dropped EXE
-
C:\Temp\kifaxspkic.sysC:\Temp\kifaxspkic.sys1⤵
- Executes dropped EXE
-
C:\Temp\caxsnkfcxv.sysC:\Temp\caxsnkfcxv.sys1⤵
- Executes dropped EXE
-
C:\Temp\upmhfzxupm.sysC:\Temp\upmhfzxupm.sys1⤵
- Executes dropped EXE
-
C:\Temp\rpjhbztrmj.sysC:\Temp\rpjhbztrmj.sys1⤵
-
C:\Temp\omjebwurlj.sysC:\Temp\omjebwurlj.sys1⤵
-
C:\Temp\rojhbztrlj.sysC:\Temp\rojhbztrlj.sys1⤵
-
C:\Temp\trlidbytql.sysC:\Temp\trlidbytql.sys1⤵
-
C:\Temp\qlidbvtnlf.sysC:\Temp\qlidbvtnlf.sys1⤵
-
C:\Temp\axsqkifdxv.sysC:\Temp\axsqkifdxv.sys1⤵
-
C:\Temp\dausqkhfax.sysC:\Temp\dausqkhfax.sys1⤵
-
C:\Temp\usmkfcxupm.sysC:\Temp\usmkfcxupm.sys1⤵
-
C:\Temp\mkecwurpmh.sysC:\Temp\mkecwurpmh.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
bztolgeywq.exe
bzwrpjhbzt.exe
bzwrpjhecw.sys
dyvtolgebz.sys
eywqojgbyt.sys
hfaxsqkicausnkfd.exe
hfaxsqkicausnkfd.sys
hfzxrpmhec.exe
hfzxspkhca.exe
i_bztolgeywq.exe
i_bzwrpjhbzt.exe
i_hfzxrpmhec.exe
i_hfzxspkhca.exe
i_nhcwusmhec.exe
mhezxupmke.sys
nhcwusmhec.exe
tnljgaywql.exe
xuspnhfaus.sys
0fa4e32b-5f85-4dbc-bb22-f787cba440fe.tmp
758abda3-6488-41b7-96ae-d82406fe4e66.tmp
77116b7f-af51-49ec-9253-567d154b87b2.tmp
9eb47bb0-a987-4372-9558-b88fa7dc408a.tmp
settings.dat
settings.dat
15a6618e-c18f-455f-a3c1-9c6cda891e16.tmp
44010961-54ab-4881-bc47-0de47329a837.tmp
5e0b8e03-0d91-433e-9418-ec9100e38ba3.tmp
temp-index
the-real-index
ce6ddef6-0713-4b9c-b8ca-7324bd0a25d0.tmp
dasherSettingSchema.json
1694fca9-6858-445b-9d1b-dabd38ff46a3.tmp
ace50e7f-b9bc-4105-b2ac-337bf6bdb102.tmp
f74be429-963e-4211-950f-47332ccff4ff.tmp
sync_diagnostic.log
adb569c3-55b0-4245-908e-c37dbb827a5a.tmp
bba8fe34-8413-48fe-a3dd-864b59e7875a.tmp
ff971133-ec41-428c-bf1d-3a4239d3a6b7.tmp
OperationConfig
e5f59706-499d-4d91-84e2-3087ab4fd3e7.tmp
3896a5d8-688f-422f-800f-688f7040debf.tmp
8b82ceb3-b6a5-418c-aa33-0bcdad597054.tmp
9b095283-2d4a-4680-bcd4-d6c185b1c6f4.tmp
ea26a6dc-b2e2-4c7e-b30b-0fdee0ca30ad.tmp
ee8d003f-e2c7-47a2-8eaf-3cc9e5f38928.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
c0f882c9-4f60-4a3a-b3ba-6708fbadcb3d.tmp
metadata.json
203af77c-aece-45fc-a478-db8fa1ef909a.tmp
94ae1d86-38d2-4ace-b735-39e56e047839.tmp
messages.json
content.js
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/552-521-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/576-736-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1124-718-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1668-656-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1892-509-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1952-714-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1956-580-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2132-576-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2904-556-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3228-610-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3236-560-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3252-630-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3312-644-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3348-688-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4496-481-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4824-533-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4908-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5076-693-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5332-676-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5636-432-0x0000000000010000-0x00000000000AB000-memory.dmp