Analysis
- max time kernel
150s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
11/11/2026, 15:24
General
- Target 2026-11-10_f527f887e27fd8b78293359891ffa2c4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261111-stg4caac54
- SHA256 0c474eb24d28b29af8e09dcd5cdcde683bb8c1c163c8c0a051972019a81f858c
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-10_f527f887e27fd8b78293359891ffa2c4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-10_f527f887e27fd8b78293359891ffa2c4_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\gdbwtolgdbvtgdyv.exeC:\Temp\gdbwtolgdbvtgdyv.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gaytqoigay.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\gaytqoigay.exeC:\Temp\gaytqoigay.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gaytqoigay.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gaytqoigay.exeC:\Temp\i_gaytqoigay.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdyvtnlyvq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jdyvtnlyvq.exeC:\Temp\jdyvtnlyvq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdyvtnlyvq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jdyvtnlyvq.exeC:\Temp\i_jdyvtnlyvq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qnifaysqki.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qnifaysqki.exeC:\Temp\qnifaysqki.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qnifaysqki.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qnifaysqki.exeC:\Temp\i_qnifaysqki.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kfdxvpnhfa.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kfdxvpnhfa.exeC:\Temp\kfdxvpnhfa.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kfdxvpnhfa.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kfdxvpnhfa.exeC:\Temp\i_kfdxvpnhfa.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hfcxrpnhfz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hfcxrpnhfz.exeC:\Temp\hfcxrpnhfz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hfcxrpnhfz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hfcxrpnhfz.exeC:\Temp\i_hfcxrpnhfz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mjecwupmhe.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mjecwupmhe.exeC:\Temp\mjecwupmhe.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mjecwupmhe.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mjecwupmhe.exeC:\Temp\i_mjecwupmhe.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omhezwrpjh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\omhezwrpjh.exeC:\Temp\omhezwrpjh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omhezwrpjh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_omhezwrpjh.exeC:\Temp\i_omhezwrpjh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljgbzwuomg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ljgbzwuomg.exeC:\Temp\ljgbzwuomg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljgbzwuomg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ljgbzwuomg.exeC:\Temp\i_ljgbzwuomg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gdywqoigby.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gdywqoigby.exeC:\Temp\gdywqoigby.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gdywqoigby.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gdywqoigby.exeC:\Temp\i_gdywqoigby.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gaykidaysq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gaykidaysq.exeC:\Temp\gaykidaysq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gaykidaysq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gaykidaysq.exeC:\Temp\i_gaykidaysq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vqnigaysqk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vqnigaysqk.exeC:\Temp\vqnigaysqk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vqnigaysqk.exe ups_ins3⤵
-
C:\Temp\i_vqnigaysqk.exeC:\Temp\i_vqnigaysqk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nhfcavsnki.exe ups_run3⤵
-
C:\Temp\nhfcavsnki.exeC:\Temp\nhfcavsnki.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nhfcavsnki.exe ups_ins3⤵
-
C:\Temp\i_nhfcavsnki.exeC:\Temp\i_nhfcavsnki.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\khczuspkfc.exe ups_run3⤵
-
C:\Temp\khczuspkfc.exeC:\Temp\khczuspkfc.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_khczuspkfc.exe ups_ins3⤵
-
C:\Temp\i_khczuspkfc.exeC:\Temp\i_khczuspkfc.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pkhcaukecx.exe ups_run3⤵
-
C:\Temp\pkhcaukecx.exeC:\Temp\pkhcaukecx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pkhcaukecx.exe ups_ins3⤵
-
C:\Temp\i_pkhcaukecx.exeC:\Temp\i_pkhcaukecx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhbzurpjec.exe ups_run3⤵
-
C:\Temp\jhbzurpjec.exeC:\Temp\jhbzurpjec.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhbzurpjec.exe ups_ins3⤵
-
C:\Temp\i_jhbzurpjec.exeC:\Temp\i_jhbzurpjec.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gebwuojgbz.exe ups_run3⤵
-
C:\Temp\gebwuojgbz.exeC:\Temp\gebwuojgbz.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gebwuojgbz.exe ups_ins3⤵
-
C:\Temp\i_gebwuojgbz.exeC:\Temp\i_gebwuojgbz.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jgbztroigb.exe ups_run3⤵
-
C:\Temp\jgbztroigb.exeC:\Temp\jgbztroigb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jgbztroigb.exe ups_ins3⤵
-
C:\Temp\i_jgbztroigb.exeC:\Temp\i_jgbztroigb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdywqoigby.exe ups_run3⤵
-
C:\Temp\jdywqoigby.exeC:\Temp\jdywqoigby.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdywqoigby.exe ups_ins3⤵
-
C:\Temp\i_jdywqoigby.exeC:\Temp\i_jdywqoigby.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ysqkidavtn.exe ups_run3⤵
-
C:\Temp\ysqkidavtn.exeC:\Temp\ysqkidavtn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ysqkidavtn.exe ups_ins3⤵
-
C:\Temp\i_ysqkidavtn.exeC:\Temp\i_ysqkidavtn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\snkidxvpni.exe ups_run3⤵
-
C:\Temp\snkidxvpni.exeC:\Temp\snkidxvpni.exe ups_run4⤵
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffbf26ac188,0x7ffbf26ac194,0x7ffbf26ac1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,822253804387832365,14348433294706947633,524288 --field-trial-handle=2440,i,15092483082035479747,16992500879946294693,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,8013479966712019582,13503574950881058818,262144 --field-trial-handle=2440,i,15092483082035479747,16992500879946294693,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2392,i,13957684411451932269,9570820091935417706,524288 --field-trial-handle=2440,i,15092483082035479747,16992500879946294693,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,15841201663257976289,15783937788134598118,2097152 --field-trial-handle=2440,i,15092483082035479747,16992500879946294693,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,13262014346113186492,15095720607206705006,2097152 --field-trial-handle=2440,i,15092483082035479747,16992500879946294693,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4364,i,10072287020823450313,18380533732952644874,2097152 --field-trial-handle=2440,i,15092483082035479747,16992500879946294693,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4336,i,7153077925565146959,5912523587183563597,2097152 --field-trial-handle=2440,i,15092483082035479747,16992500879946294693,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3780,i,8919337157576300119,7359310509652070465,524288 --field-trial-handle=2440,i,15092483082035479747,16992500879946294693,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,14663702448413920062,1631832716422595806,524288 --field-trial-handle=2440,i,15092483082035479747,16992500879946294693,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,14965939354831078494,1823616040202030223,524288 --field-trial-handle=2440,i,15092483082035479747,16992500879946294693,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,11175752921407376153,10214503901942979473,524288 --field-trial-handle=2440,i,15092483082035479747,16992500879946294693,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,11175752921407376153,10214503901942979473,524288 --field-trial-handle=2440,i,15092483082035479747,16992500879946294693,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,5452657474218940331,2966019084134889333,524288 --field-trial-handle=2440,i,15092483082035479747,16992500879946294693,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,6797469778419248148,793116022197239370,524288 --field-trial-handle=2440,i,15092483082035479747,16992500879946294693,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,11677959972946622580,10194853830909414270,524288 --field-trial-handle=2440,i,15092483082035479747,16992500879946294693,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,3287679600479401009,12862142355626117491,524288 --field-trial-handle=2440,i,15092483082035479747,16992500879946294693,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,6424924108267056923,13695263369019316928,524288 --field-trial-handle=2440,i,15092483082035479747,16992500879946294693,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3796,i,5697087109336228800,10513759779396985659,524288 --field-trial-handle=2440,i,15092483082035479747,16992500879946294693,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,17077093863415545672,986736217454375489,524288 --field-trial-handle=2440,i,15092483082035479747,16992500879946294693,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,10460246913019411842,12093843562714423727,524288 --field-trial-handle=2440,i,15092483082035479747,16992500879946294693,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,7083639716221158241,17803554597503636066,524288 --field-trial-handle=2440,i,15092483082035479747,16992500879946294693,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,10556479346166810621,16554694420288335172,524288 --field-trial-handle=2440,i,15092483082035479747,16992500879946294693,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,16401467615868526877,2935234487404774744,524288 --field-trial-handle=2440,i,15092483082035479747,16992500879946294693,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,11051831028279808088,3992589474501074233,524288 --field-trial-handle=2440,i,15092483082035479747,16992500879946294693,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6204,i,6009321203958134899,8097478607927496454,262144 --field-trial-handle=2440,i,15092483082035479747,16992500879946294693,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,6208658773469364854,15916301523848669634,524288 --field-trial-handle=2440,i,15092483082035479747,16992500879946294693,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\gdbwtolgdbvtgdyv.sysC:\Temp\gdbwtolgdbvtgdyv.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\ljdbvtnlgd.sysC:\Temp\ljdbvtnlgd.sys1⤵
- Executes dropped EXE
-
C:\Temp\tnlfdxvpni.sysC:\Temp\tnlfdxvpni.sys1⤵
- Executes dropped EXE
-
C:\Temp\fdxvpnifax.sysC:\Temp\fdxvpnifax.sys1⤵
- Executes dropped EXE
-
C:\Temp\xspkhcausp.sysC:\Temp\xspkhcausp.sys1⤵
- Executes dropped EXE
-
C:\Temp\smkeczurpn.sysC:\Temp\smkeczurpn.sys1⤵
- Executes dropped EXE
-
C:\Temp\ojhezxrpjh.sysC:\Temp\ojhezxrpjh.sys1⤵
- Executes dropped EXE
-
C:\Temp\omgeywuomg.sysC:\Temp\omgeywuomg.sys1⤵
- Executes dropped EXE
-
C:\Temp\ywtrljgebw.sysC:\Temp\ywtrljgebw.sys1⤵
- Executes dropped EXE
-
C:\Temp\jdbytrliga.sysC:\Temp\jdbytrliga.sys1⤵
- Executes dropped EXE
-
C:\Temp\ayvqnigdyv.sysC:\Temp\ayvqnigdyv.sys1⤵
- Executes dropped EXE
-
C:\Temp\qnlicausnk.sysC:\Temp\qnlicausnk.sys1⤵
-
C:\Temp\axspkicsmk.sysC:\Temp\axspkicsmk.sys1⤵
-
C:\Temp\spkecxupnk.sysC:\Temp\spkecxupnk.sys1⤵
-
C:\Temp\pjhbzwupmh.sysC:\Temp\pjhbzwupmh.sys1⤵
-
C:\Temp\jhbztrojeb.sysC:\Temp\jhbztrojeb.sys1⤵
-
C:\Temp\rljhbywurl.sysC:\Temp\rljhbywurl.sys1⤵
-
C:\Temp\olgdbwtolg.sysC:\Temp\olgdbwtolg.sys1⤵
-
C:\Temp\dbvqoigdyv.sysC:\Temp\dbvqoigdyv.sys1⤵
-
C:\Temp\xvpnifdysq.sysC:\Temp\xvpnifdysq.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
fdxvpnifax.sys
gaytqoigay.exe
gdbwtolgdbvtgdyv.exe
gdbwtolgdbvtgdyv.sys
hfcxrpnhfz.exe
i_gaytqoigay.exe
i_hfcxrpnhfz.exe
i_jdyvtnlyvq.exe
i_kfdxvpnhfa.exe
i_qnifaysqki.exe
jdyvtnlyvq.exe
kfdxvpnhfa.exe
ljdbvtnlgd.sys
mjecwupmhe.exe
qnifaysqki.exe
smkeczurpn.sys
tnlfdxvpni.sys
xspkhcausp.sys
0f103602-888f-4b21-82d9-d49bf1da1578.tmp
48434af4-52d7-4de2-9fcd-82bea1ffd8b2.tmp
49f4b426-3e9c-49c1-a596-97ee8a95a2f8.tmp
manifest.json
settings.dat
settings.dat
1cba932f-1255-4c6e-a96b-e6b6d83890df.tmp
29f48a50-9bc5-4c8e-8dd6-a5783bba121f.tmp
90f0513d-7049-4626-9bb9-a4673205c332.tmp
LOG.old
temp-index
3fa5f7c9-154d-4c8d-b9b2-c1dd3852aff0.tmp
dasherSettingSchema.json
0ac0b88d-9078-4de1-8baa-78662ac2aa3f.tmp
3d6ff60f-0522-45b7-a1f0-eb8b9ae3ec49.tmp
b630cc6c-5598-4e5a-a3b9-5b3af6e6d2c0.tmp
sync_diagnostic.log
a4e2ce4c-a081-4a37-af38-af72ea9b0a1e.tmp
f20c3049-8372-46aa-9781-87e5ed7b5c6f.tmp
fbe29ecf-ecf0-4b6a-befa-921e67f9ac6e.tmp
4af684b3-c5e2-482c-bc7c-73fb91db41fe.tmp
OperationConfig
manifest.json
manifest.json
manifest.json
a6162f34-7f4a-4713-9ba0-48fb707bd36a.tmp
aca7e256-9fde-4ce5-8879-001ba4e3560e.tmp
270e04d7-ef5d-4e9b-8ef5-e8f17658e79a.tmp
56430844-6a93-4613-b3ef-8523424033e7.tmp
699677f0-4fdc-4d45-8dcb-f352cf93edb0.tmp
ef7e8366-4fe6-44a0-b078-c892e80166b2.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
cc963a98-c931-4eb2-bd5b-81668f5f2c94.tmp
metadata.json
e3b90d62-2212-4d24-85ba-00804bd7d8fd.tmp
814543da-9b3d-4efd-a411-a6ce52c82645.tmp
content.js
messages.json
protocols.json
llm_user_input_extractor_config.json
office_endpoints_list.json
smart_switch_list.json
nav_config.json
CreateProcess.exe
memory/604-576-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1472-725-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1816-684-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2236-704-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2604-556-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2616-434-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2980-560-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3024-656-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3288-508-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3364-483-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4256-699-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4496-664-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4652-631-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5384-729-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5392-533-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5440-752-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5492-520-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5624-62-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5808-611-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5948-580-0x0000000000010000-0x00000000000AB000-memory.dmp