Analysis
- max time kernel
149s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
14/10/2026, 04:29
General
- Target 2026-10-13_d91e46d7e684a410280a35ae15ba9e3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261014-e4gzfayvbt
- SHA256 54bc071560f221420028869e5502cee62b1d411cbfa10089758bf756ae20580c
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 9 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-13_d91e46d7e684a410280a35ae15ba9e3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-13_d91e46d7e684a410280a35ae15ba9e3a_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\wrpjhbztrmjebwuo.exeC:\Temp\wrpjhbztrmjebwuo.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wrojhbwumg.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\wrojhbwumg.exeC:\Temp\wrojhbwumg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wrojhbwumg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wrojhbwumg.exeC:\Temp\i_wrojhbwumg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdbywqomge.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jdbywqomge.exeC:\Temp\jdbywqomge.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdbywqomge.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jdbywqomge.exeC:\Temp\i_jdbywqomge.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wqoigdywqo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wqoigdywqo.exeC:\Temp\wqoigdywqo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wqoigdywqo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wqoigdywqo.exeC:\Temp\i_wqoigdywqo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dyvqoigayt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dyvqoigayt.exeC:\Temp\dyvqoigayt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dyvqoigayt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dyvqoigayt.exeC:\Temp\i_dyvqoigayt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\avtnkicavs.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\avtnkicavs.exeC:\Temp\avtnkicavs.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_avtnkicavs.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_avtnkicavs.exeC:\Temp\i_avtnkicavs.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\spnkfdxsqk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\spnkfdxsqk.exeC:\Temp\spnkfdxsqk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_spnkfdxsqk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_spnkfdxsqk.exeC:\Temp\i_spnkfdxsqk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnhfzxupmk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pnhfzxupmk.exeC:\Temp\pnhfzxupmk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnhfzxupmk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pnhfzxupmk.exeC:\Temp\i_pnhfzxupmk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxusmjhfcw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zxusmjhfcw.exeC:\Temp\zxusmjhfcw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxusmjhfcw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zxusmjhfcw.exeC:\Temp\i_zxusmjhfcw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cwuomhecwu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\cwuomhecwu.exeC:\Temp\cwuomhecwu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cwuomhecwu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_cwuomhecwu.exeC:\Temp\i_cwuomhecwu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljdbywuomj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ljdbywuomj.exeC:\Temp\ljdbywuomj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljdbywuomj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ljdbywuomj.exeC:\Temp\i_ljdbywuomj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lgdbvtnlgd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lgdbvtnlgd.exeC:\Temp\lgdbvtnlgd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lgdbvtnlgd.exe ups_ins3⤵
-
C:\Temp\i_lgdbvtnlgd.exeC:\Temp\i_lgdbvtnlgd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gaytqoigey.exe ups_run3⤵
-
C:\Temp\gaytqoigey.exeC:\Temp\gaytqoigey.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gaytqoigey.exe ups_ins3⤵
-
C:\Temp\i_gaytqoigey.exeC:\Temp\i_gaytqoigey.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dyvqnlfdyv.exe ups_run3⤵
-
C:\Temp\dyvqnlfdyv.exeC:\Temp\dyvqnlfdyv.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dyvqnlfdyv.exe ups_ins3⤵
-
C:\Temp\i_dyvqnlfdyv.exeC:\Temp\i_dyvqnlfdyv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvqnifaysq.exe ups_run3⤵
-
C:\Temp\xvqnifaysq.exeC:\Temp\xvqnifaysq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xvqnifaysq.exe ups_ins3⤵
-
C:\Temp\i_xvqnifaysq.exeC:\Temp\i_xvqnifaysq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cspnkfcxvp.exe ups_run3⤵
-
C:\Temp\cspnkfcxvp.exeC:\Temp\cspnkfcxvp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cspnkfcxvp.exe ups_ins3⤵
-
C:\Temp\i_cspnkfcxvp.exeC:\Temp\i_cspnkfcxvp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hczxupnhfz.exe ups_run3⤵
-
C:\Temp\hczxupnhfz.exeC:\Temp\hczxupnhfz.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hczxupnhfz.exe ups_ins3⤵
-
C:\Temp\i_hczxupnhfz.exeC:\Temp\i_hczxupnhfz.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zupmhezxrp.exe ups_run3⤵
-
C:\Temp\zupmhezxrp.exeC:\Temp\zupmhezxrp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zupmhezxrp.exe ups_ins3⤵
-
C:\Temp\i_zupmhezxrp.exeC:\Temp\i_zupmhezxrp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ztrljebwuo.exe ups_run3⤵
-
C:\Temp\ztrljebwuo.exeC:\Temp\ztrljebwuo.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ztrljebwuo.exe ups_ins3⤵
-
C:\Temp\i_ztrljebwuo.exeC:\Temp\i_ztrljebwuo.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gbywtrljdb.exe ups_run3⤵
-
C:\Temp\gbywtrljdb.exeC:\Temp\gbywtrljdb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gbywtrljdb.exe ups_ins3⤵
-
C:\Temp\i_gbywtrljdb.exeC:\Temp\i_gbywtrljdb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tqoigbytrl.exe ups_run3⤵
-
C:\Temp\tqoigbytrl.exeC:\Temp\tqoigbytrl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffe6881c188,0x7ffe6881c194,0x7ffe6881c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,9655887675668346166,3468531349505872945,262144 --field-trial-handle=2224,i,9278244361779184292,7809384501888815556,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,13456783530411671379,14849320791480180008,524288 --field-trial-handle=2224,i,9278244361779184292,7809384501888815556,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,15203488530221130449,15052440011151693107,524288 --field-trial-handle=2224,i,9278244361779184292,7809384501888815556,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3620,i,9267143189771644753,459463303445239662,2097152 --field-trial-handle=2224,i,9278244361779184292,7809384501888815556,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3624,i,18037647930847460928,6632604053187654365,2097152 --field-trial-handle=2224,i,9278244361779184292,7809384501888815556,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,13099814756206975843,2391403869701346430,2097152 --field-trial-handle=2224,i,9278244361779184292,7809384501888815556,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,1535345379461936363,11294480151283031908,2097152 --field-trial-handle=2224,i,9278244361779184292,7809384501888815556,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,14862622085309851059,14875805681802628496,524288 --field-trial-handle=2224,i,9278244361779184292,7809384501888815556,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3852,i,3491457034351845595,6278953820358344131,524288 --field-trial-handle=2224,i,9278244361779184292,7809384501888815556,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,9955126076267021122,17515693818417726444,524288 --field-trial-handle=2224,i,9278244361779184292,7809384501888815556,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,4025215650215684057,2132560615206441439,524288 --field-trial-handle=2224,i,9278244361779184292,7809384501888815556,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,4025215650215684057,2132560615206441439,524288 --field-trial-handle=2224,i,9278244361779184292,7809384501888815556,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,13649202971320461472,11339473133796408600,524288 --field-trial-handle=2224,i,9278244361779184292,7809384501888815556,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,12863656278226246777,17513253594162263037,524288 --field-trial-handle=2224,i,9278244361779184292,7809384501888815556,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,10457856833082281273,17831273601361969210,524288 --field-trial-handle=2224,i,9278244361779184292,7809384501888815556,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,4504854077483591024,14795385042334719017,524288 --field-trial-handle=2224,i,9278244361779184292,7809384501888815556,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,4801335452959120659,1389216889307483102,524288 --field-trial-handle=2224,i,9278244361779184292,7809384501888815556,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,14839600036081478857,4388969653592582368,524288 --field-trial-handle=2224,i,9278244361779184292,7809384501888815556,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,1416595652556815686,11610286727295544111,524288 --field-trial-handle=2224,i,9278244361779184292,7809384501888815556,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,8620458851585808665,10229636786857978108,524288 --field-trial-handle=2224,i,9278244361779184292,7809384501888815556,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,16788180274508143324,6302736871250537756,524288 --field-trial-handle=2224,i,9278244361779184292,7809384501888815556,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6716,i,11403433002933801960,11797210244919770034,262144 --field-trial-handle=2224,i,9278244361779184292,7809384501888815556,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,1170662012922873266,5980129718919589407,524288 --field-trial-handle=2224,i,9278244361779184292,7809384501888815556,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\wrpjhbztrmjebwuo.sysC:\Temp\wrpjhbztrmjebwuo.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\ljebwtoljd.sysC:\Temp\ljebwtoljd.sys1⤵
- Executes dropped EXE
-
C:\Temp\dbwtoljgey.sysC:\Temp\dbwtoljgey.sys1⤵
- Executes dropped EXE
-
C:\Temp\gdywtnlfdy.sysC:\Temp\gdywtnlfdy.sys1⤵
- Executes dropped EXE
-
C:\Temp\avsqkidavs.sysC:\Temp\avsqkidavs.sys1⤵
- Executes dropped EXE
-
C:\Temp\sqkhfdxvsn.sysC:\Temp\sqkhfdxvsn.sys1⤵
- Executes dropped EXE
-
C:\Temp\xvpnhfaxsp.sysC:\Temp\xvpnhfaxsp.sys1⤵
- Executes dropped EXE
-
C:\Temp\cxupmhfcxu.sysC:\Temp\cxupmhfcxu.sys1⤵
- Executes dropped EXE
-
C:\Temp\ezwuomhezx.sysC:\Temp\ezwuomhezx.sys1⤵
- Executes dropped EXE
-
C:\Temp\rljdbztrlj.sysC:\Temp\rljdbztrlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\trljdbwtrl.sysC:\Temp\trljdbwtrl.sys1⤵
- Executes dropped EXE
-
C:\Temp\igdywqoigb.sysC:\Temp\igdywqoigb.sys1⤵
-
C:\Temp\idayvqnlfd.sysC:\Temp\idayvqnlfd.sys1⤵
-
C:\Temp\axsqkicavs.sysC:\Temp\axsqkicavs.sys1⤵
-
C:\Temp\axsqkhfdxv.sysC:\Temp\axsqkhfdxv.sys1⤵
-
C:\Temp\hczusmkecx.sysC:\Temp\hczusmkecx.sys1⤵
-
C:\Temp\cwusmkhbzw.sysC:\Temp\cwusmkhbzw.sys1⤵
-
C:\Temp\eczurmcwuo.sysC:\Temp\eczurmcwuo.sys1⤵
-
C:\Temp\geywuomjdb.sysC:\Temp\geywuomjdb.sys1⤵
-
C:\Temp\ztqoigeywq.sysC:\Temp\ztqoigeywq.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
avsqkidavs.sys
avtnkicavs.exe
dbwtoljgey.sys
dyvqoigayt.exe
gdywtnlfdy.sys
i_avtnkicavs.exe
i_dyvqoigayt.exe
i_jdbywqomge.exe
i_wqoigdywqo.exe
i_wrojhbwumg.exe
jdbywqomge.exe
ljebwtoljd.sys
spnkfdxsqk.exe
sqkhfdxvsn.sys
wqoigdywqo.exe
wrojhbwumg.exe
wrpjhbztrmjebwuo.exe
wrpjhbztrmjebwuo.sys
097a9c96-44f2-4f21-a162-52b2aba4d245.tmp
1ca36876-5bfc-431b-bbaa-c34ba0ececf1.tmp
85b79724-d535-4e5d-893c-d7540b0b7607.tmp
8d5825b4-5a69-4f9f-8193-cc39af72e343.tmp
a9802e2e-98fd-4764-9e84-23fd3af8a6af.tmp
settings.dat
settings.dat
119260cc-db30-4b01-b4aa-5544d15f40b9.tmp
1f2451c1-73d7-4813-8337-873c9aa27b04.tmp
67fa4f8a-fe7d-400c-acc3-c3f870a5cfba.tmp
813972ef-4765-4fcd-8ffe-09a6114c7d67.tmp
temp-index
the-real-index
ea45cccb-d8cd-4f75-af42-aead47061d90.tmp
74f89a45-e5e5-4213-9c50-d61da91e0222.tmp
Sdch Dictionaries
bb4f9b2a-6a8a-4eaa-b958-e6d442ece64a.tmp
sync_diagnostic.log
c85f2db3-e9ba-46e4-9fbc-3a2a0b6dcd3b.tmp
e8b572a2-5016-44bb-a393-a307ca3e972c.tmp
OperationConfig
e094840b-1af4-47a9-8023-1181dd01f526.tmp
ab772410-5d46-4eb7-969d-3175be7b550e.tmp
296976c2-19be-4b8a-b9d4-95888dcf156a.tmp
ac944003-e0f2-45f7-9a1d-06fb55245db3.tmp
cbbdea6e-e889-4ea5-a357-e6d6d0bf3df1.tmp
dc95f9e6-4481-4e1e-bb9e-cc336d84529f.tmp
0b3d2003-76da-48aa-b589-a268a6327ba2.tmp
cd945dd0-a4d3-48e5-8382-18e419076455.tmp
ee36f431-ea4a-400a-8d4b-e750c663edb1.tmp
content.js
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/1372-277-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1372-328-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1412-466-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1664-383-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1676-403-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1676-427-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2336-430-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2700-511-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2876-353-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2876-462-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2876-485-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2976-324-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2976-289-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3564-450-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3716-302-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4452-348-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4676-489-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4736-249-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5104-425-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5456-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5772-200-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5776-349-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5776-332-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5804-493-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5804-513-0x0000000000010000-0x00000000000AB000-memory.dmp