Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
10/11/2026, 08:23
General
- Target 2026-11-10_404bc8b6ce708dca3bad0a2a3d4e304e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261110-j944daea73
- SHA256 58477df5412a098f553f42aa194dd37deb9a11f36fcb68c815e25c8d246668bc
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-10_404bc8b6ce708dca3bad0a2a3d4e304e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-10_404bc8b6ce708dca3bad0a2a3d4e304e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\xrpjhfcxupmhfzxr.exeC:\Temp\xrpjhfcxupmhfzxr.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xupmhcwphc.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\xupmhcwphc.exeC:\Temp\xupmhcwphc.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xupmhcwphc.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xupmhcwphc.exeC:\Temp\i_xupmhcwphc.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wuomgezwro.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wuomgezwro.exeC:\Temp\wuomgezwro.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wuomgezwro.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wuomgezwro.exeC:\Temp\i_wuomgezwro.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljhbzwromj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ljhbzwromj.exeC:\Temp\ljhbzwromj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljhbzwromj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ljhbzwromj.exeC:\Temp\i_ljhbzwromj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jgbztrljgb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jgbztrljgb.exeC:\Temp\jgbztrljgb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jgbztrljgb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jgbztrljgb.exeC:\Temp\i_jgbztrljgb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qoigayvtql.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qoigayvtql.exeC:\Temp\qoigayvtql.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qoigayvtql.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qoigayvtql.exeC:\Temp\i_qoigayvtql.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\idavtnlfdx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\idavtnlfdx.exeC:\Temp\idavtnlfdx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_idavtnlfdx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_idavtnlfdx.exeC:\Temp\i_idavtnlfdx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kigaxvsnki.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kigaxvsnki.exeC:\Temp\kigaxvsnki.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kigaxvsnki.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kigaxvsnki.exeC:\Temp\i_kigaxvsnki.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nhfaxsqkic.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nhfaxsqkic.exeC:\Temp\nhfaxsqkic.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nhfaxsqkic.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nhfaxsqkic.exeC:\Temp\i_nhfaxsqkic.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\axrpkhcaus.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\axrpkhcaus.exeC:\Temp\axrpkhcaus.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_axrpkhcaus.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_axrpkhcaus.exeC:\Temp\i_axrpkhcaus.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\khczurmjec.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\khczurmjec.exeC:\Temp\khczurmjec.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_khczurmjec.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_khczurmjec.exeC:\Temp\i_khczurmjec.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jecwuomgez.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jecwuomgez.exeC:\Temp\jecwuomgez.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jecwuomgez.exe ups_ins3⤵
-
C:\Temp\i_jecwuomgez.exeC:\Temp\i_jecwuomgez.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ebztrojgbz.exe ups_run3⤵
-
C:\Temp\ebztrojgbz.exeC:\Temp\ebztrojgbz.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ebztrojgbz.exe ups_ins3⤵
-
C:\Temp\i_ebztrojgbz.exeC:\Temp\i_ebztrojgbz.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ytqljdbvtn.exe ups_run3⤵
-
C:\Temp\ytqljdbvtn.exeC:\Temp\ytqljdbvtn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ytqljdbvtn.exe ups_ins3⤵
-
C:\Temp\i_ytqljdbvtn.exeC:\Temp\i_ytqljdbvtn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nlidaysqnl.exe ups_run3⤵
-
C:\Temp\nlidaysqnl.exeC:\Temp\nlidaysqnl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nlidaysqnl.exe ups_ins3⤵
-
C:\Temp\i_nlidaysqnl.exeC:\Temp\i_nlidaysqnl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\igaysqkida.exe ups_run3⤵
-
C:\Temp\igaysqkida.exeC:\Temp\igaysqkida.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_igaysqkida.exe ups_ins3⤵
-
C:\Temp\i_igaysqkida.exeC:\Temp\i_igaysqkida.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvsnkfcaxv.exe ups_run3⤵
-
C:\Temp\xvsnkfcaxv.exeC:\Temp\xvsnkfcaxv.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xvsnkfcaxv.exe ups_ins3⤵
-
C:\Temp\i_xvsnkfcaxv.exeC:\Temp\i_xvsnkfcaxv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usmkecxupn.exe ups_run3⤵
-
C:\Temp\usmkecxupn.exeC:\Temp\usmkecxupn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usmkecxupn.exe ups_ins3⤵
-
C:\Temp\i_usmkecxupn.exeC:\Temp\i_usmkecxupn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mkfzxrpjhc.exe ups_run3⤵
-
C:\Temp\mkfzxrpjhc.exeC:\Temp\mkfzxrpjhc.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mkfzxrpjhc.exe ups_ins3⤵
-
C:\Temp\i_mkfzxrpjhc.exeC:\Temp\i_mkfzxrpjhc.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mkecwupmhe.exe ups_run3⤵
-
C:\Temp\mkecwupmhe.exeC:\Temp\mkecwupmhe.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mkecwupmhe.exe ups_ins3⤵
-
C:\Temp\i_mkecwupmhe.exeC:\Temp\i_mkecwupmhe.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffc0970c188,0x7ffc0970c194,0x7ffc0970c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2148,i,17611163909821478666,3427845984603290692,524288 --field-trial-handle=2872,i,3285334814116043199,16498880777556595817,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1972,i,12422287366725035221,2950568233177039841,262144 --field-trial-handle=2872,i,3285334814116043199,16498880777556595817,262144 --variations-seed-version --mojo-platform-channel-handle=2868 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2388,i,3919412020500679170,12592787921020912925,524288 --field-trial-handle=2872,i,3285334814116043199,16498880777556595817,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,11778407223870032973,6583239908879003445,2097152 --field-trial-handle=2872,i,3285334814116043199,16498880777556595817,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,14273274935356640665,11585704405753892458,2097152 --field-trial-handle=2872,i,3285334814116043199,16498880777556595817,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,17772388015039557557,2214735379071519334,2097152 --field-trial-handle=2872,i,3285334814116043199,16498880777556595817,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,12790029636341667747,11709435124997139241,2097152 --field-trial-handle=2872,i,3285334814116043199,16498880777556595817,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,4116775357832856960,15125271302883838193,524288 --field-trial-handle=2872,i,3285334814116043199,16498880777556595817,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,11768551231848820235,11644721220663081786,524288 --field-trial-handle=2872,i,3285334814116043199,16498880777556595817,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,11393779519800138334,2977215927799673295,524288 --field-trial-handle=2872,i,3285334814116043199,16498880777556595817,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,17241604574550475509,7214090452806505513,524288 --field-trial-handle=2872,i,3285334814116043199,16498880777556595817,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,17241604574550475509,7214090452806505513,524288 --field-trial-handle=2872,i,3285334814116043199,16498880777556595817,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,653849259450918646,6482084140741168797,524288 --field-trial-handle=2872,i,3285334814116043199,16498880777556595817,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,13089980583526026385,5635996245313628593,524288 --field-trial-handle=2872,i,3285334814116043199,16498880777556595817,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,4379801847537699893,18209695748152328209,524288 --field-trial-handle=2872,i,3285334814116043199,16498880777556595817,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6804,i,3163488154201122909,7361067000238677267,524288 --field-trial-handle=2872,i,3285334814116043199,16498880777556595817,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1392,i,2391165530807958798,13212128894974133077,524288 --field-trial-handle=2872,i,3285334814116043199,16498880777556595817,262144 --variations-seed-version --mojo-platform-channel-handle=1276 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1424,i,16216720208061490733,10110568775452518781,524288 --field-trial-handle=2872,i,3285334814116043199,16498880777556595817,262144 --variations-seed-version --mojo-platform-channel-handle=1268 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1432,i,1938095142015185639,6880284567871415943,524288 --field-trial-handle=2872,i,3285334814116043199,16498880777556595817,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,17780665515823122799,8351795821588342781,524288 --field-trial-handle=2872,i,3285334814116043199,16498880777556595817,262144 --variations-seed-version --mojo-platform-channel-handle=1268 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,3838311354861701728,8853644520373040560,524288 --field-trial-handle=2872,i,3285334814116043199,16498880777556595817,262144 --variations-seed-version --mojo-platform-channel-handle=1376 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,8859625983703238191,9256114697257813050,524288 --field-trial-handle=2872,i,3285334814116043199,16498880777556595817,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,2309597578043792234,15109743662104595692,524288 --field-trial-handle=2872,i,3285334814116043199,16498880777556595817,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6728,i,14638519114653546363,10001931543453641273,262144 --field-trial-handle=2872,i,3285334814116043199,16498880777556595817,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,15867713629270400238,11049462183776027040,524288 --field-trial-handle=2872,i,3285334814116043199,16498880777556595817,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\xrpjhfcxupmhfzxr.sysC:\Temp\xrpjhfcxupmhfzxr.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\jhbzurmjhf.sysC:\Temp\jhbzurmjhf.sys1⤵
- Executes dropped EXE
-
C:\Temp\mjhbzwromj.sysC:\Temp\mjhbzwromj.sys1⤵
- Executes dropped EXE
-
C:\Temp\lgeywqoigb.sysC:\Temp\lgeywqoigb.sys1⤵
- Executes dropped EXE
-
C:\Temp\dytqligbyt.sysC:\Temp\dytqligbyt.sys1⤵
- Executes dropped EXE
-
C:\Temp\vqnigaysql.sysC:\Temp\vqnigaysql.sys1⤵
- Executes dropped EXE
-
C:\Temp\nigaysqkif.sysC:\Temp\nigaysqkif.sys1⤵
- Executes dropped EXE
-
C:\Temp\nkfcausnkf.sysC:\Temp\nkfcausnkf.sys1⤵
- Executes dropped EXE
-
C:\Temp\hcausmkeca.sysC:\Temp\hcausmkeca.sys1⤵
- Executes dropped EXE
-
C:\Temp\usmkeczurm.sysC:\Temp\usmkeczurm.sys1⤵
- Executes dropped EXE
-
C:\Temp\mgezwrpjhe.sysC:\Temp\mgezwrpjhe.sys1⤵
- Executes dropped EXE
-
C:\Temp\eywtrljgbz.sysC:\Temp\eywtrljgbz.sys1⤵
-
C:\Temp\gaytqoigby.sysC:\Temp\gaytqoigby.sys1⤵
-
C:\Temp\vtnlgdbvtq.sysC:\Temp\vtnlgdbvtq.sys1⤵
-
C:\Temp\sqkidavsnl.sysC:\Temp\sqkidavsnl.sys1⤵
-
C:\Temp\axspnifdxv.sysC:\Temp\axspnifdxv.sys1⤵
-
C:\Temp\auspkhcaus.sysC:\Temp\auspkhcaus.sys1⤵
-
C:\Temp\ausmkfczus.sysC:\Temp\ausmkfczus.sys1⤵
-
C:\Temp\mjebzxupmh.sysC:\Temp\mjebzxupmh.sys1⤵
-
C:\Temp\ljebwuomge.sysC:\Temp\ljebwuomge.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
dytqligbyt.sys
i_jgbztrljgb.exe
i_ljhbzwromj.exe
i_qoigayvtql.exe
i_wuomgezwro.exe
i_xupmhcwphc.exe
idavtnlfdx.exe
jgbztrljgb.exe
jhbzurmjhf.sys
lgeywqoigb.sys
ljhbzwromj.exe
mjhbzwromj.sys
qoigayvtql.exe
vqnigaysql.sys
wuomgezwro.exe
xrpjhfcxupmhfzxr.exe
xrpjhfcxupmhfzxr.sys
xupmhcwphc.exe
2f1d302e-b7c0-461e-b1e5-b87d1720370a.tmp
2f6d6ad1-af87-4af4-8fc4-a182ac8313f7.tmp
981fc7e2-8498-48f5-bee8-f1468d8d716a.tmp
manifest.json
settings.dat
settings.dat
053076be-727b-413e-9a25-03ed0acaaf23.tmp
0cc45820-404e-49ac-b03b-b6465d7e7068.tmp
60577fa9-15d0-4c0c-a1cc-cfc400f114b5.tmp
temp-index
the-real-index
3ff34f22-73c6-46ec-a62b-db95f017f958.tmp
dasherSettingSchema.json
43ae9cd1-3daf-4585-89d1-f4553abde006.tmp
4e02dc36-eba8-465e-97e8-8d18d50725aa.tmp
928f4bc5-6f29-436f-a30c-9abb0c473277.tmp
sync_diagnostic.log
cd1990a2-9db5-41a3-967e-a3e8ee5332c5.tmp
d877589b-973c-43b7-bace-c7f92efaafd2.tmp
652fdd96-d71e-44de-b16d-de94de62e3ae.tmp
manifest.json
smart_switch_list.json
manifest.json
manifest.json
7d1e82e2-f718-4cf5-8d5f-e20c05ada7fb.tmp
af1dc307-300f-49ce-9089-7a4764645cc8.tmp
c28db55a-aef5-4113-9d67-6a36f7c07a7f.tmp
ed24e34e-5e59-4af8-8cd8-73a7cd7ceb24.tmp
d22b5cd1-dec8-4d0c-91b3-47cd8506772c.tmp
daa6003a-1272-4a36-8fee-44ef39f79a38.tmp
19aeb6b5-dc58-4e6f-aa12-7b960178ff3e.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
f19f7872-b20a-4615-96e4-402fb47b683f.tmp
f4a35656-f01b-4e85-8ba7-85683c64d96b.tmp
eb553dbb-5e59-4b9f-8c50-796f265e6159.tmp
messages.json
content.js
d1a91745-bc94-4d5e-8cbc-f1eaedc0eea2.tmp
nav_config.json
protocols.json
llm_user_input_extractor_config.json
office_endpoints_list.json
CreateProcess.exe
memory/200-567-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1060-734-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1188-618-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1260-663-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1780-539-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2800-435-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2952-759-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3224-593-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3380-563-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4072-763-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4176-649-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4380-686-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4704-739-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4780-470-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4780-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5136-513-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5336-556-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5336-526-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5356-690-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5864-710-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5876-519-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5876-485-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5952-583-0x0000000000010000-0x00000000000AB000-memory.dmp