Analysis
- max time kernel
149s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
20/10/2026, 22:25
General
- Target 2026-10-19_416fd1550bf1fcc92f2bc2fd982d738f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 376KB
- Sample261020-2cbdxaax6k
- SHA256 256193962d9d1eee3564f433e50a33d404e4e5afaeccbe7ff3d17025637eeee8
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_416fd1550bf1fcc92f2bc2fd982d738f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-19_416fd1550bf1fcc92f2bc2fd982d738f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\mgezwrojhbzwuomh.exeC:\Temp\mgezwrojhbzwuomh.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omgezwrojb.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\omgezwrojb.exeC:\Temp\omgezwrojb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omgezwrojb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_omgezwrojb.exeC:\Temp\i_omgezwrojb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\eytqojgbzt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\eytqojgbzt.exeC:\Temp\eytqojgbzt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_eytqojgbzt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_eytqojgbzt.exeC:\Temp\i_eytqojgbzt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ztrligebvt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ztrligebvt.exeC:\Temp\ztrligebvt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ztrligebvt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ztrligebvt.exeC:\Temp\i_ztrligebvt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bvtnlgdbwt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bvtnlgdbwt.exeC:\Temp\bvtnlgdbwt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bvtnlgdbwt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bvtnlgdbwt.exeC:\Temp\i_bvtnlgdbwt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qlidavtnlf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qlidavtnlf.exeC:\Temp\qlidavtnlf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qlidavtnlf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qlidavtnlf.exeC:\Temp\i_qlidavtnlf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\avsnkfdxvp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\avsnkfdxvp.exeC:\Temp\avsnkfdxvp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_avsnkfdxvp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_avsnkfdxvp.exeC:\Temp\i_avsnkfdxvp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\axsmkfcxup.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\axsmkfcxup.exeC:\Temp\axsmkfcxup.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_axsmkfcxup.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_axsmkfcxup.exeC:\Temp\i_axsmkfcxup.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\czxusmjhfc.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\czxusmjhfc.exeC:\Temp\czxusmjhfc.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_czxusmjhfc.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_czxusmjhfc.exeC:\Temp\i_czxusmjhfc.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hezwrpjhbw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hezwrpjhbw.exeC:\Temp\hezwrpjhbw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hezwrpjhbw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hezwrpjhbw.exeC:\Temp\i_hezwrpjhbw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\uomgeywroj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\uomgeywroj.exeC:\Temp\uomgeywroj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_uomgeywroj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_uomgeywroj.exeC:\Temp\i_uomgeywroj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bywqojgbzt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bywqojgbzt.exeC:\Temp\bywqojgbzt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bywqojgbzt.exe ups_ins3⤵
-
C:\Temp\i_bywqojgbzt.exeC:\Temp\i_bywqojgbzt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gbytqljdbw.exe ups_run3⤵
-
C:\Temp\gbytqljdbw.exeC:\Temp\gbytqljdbw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gbytqljdbw.exe ups_ins3⤵
-
C:\Temp\i_gbytqljdbw.exeC:\Temp\i_gbytqljdbw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tnlfdyvqoi.exe ups_run3⤵
-
C:\Temp\tnlfdyvqoi.exeC:\Temp\tnlfdyvqoi.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tnlfdyvqoi.exe ups_ins3⤵
-
C:\Temp\i_tnlfdyvqoi.exeC:\Temp\i_tnlfdyvqoi.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ysqcausnlf.exe ups_run3⤵
-
C:\Temp\ysqcausnlf.exeC:\Temp\ysqcausnlf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ysqcausnlf.exe ups_ins3⤵
-
C:\Temp\i_ysqcausnlf.exeC:\Temp\i_ysqcausnlf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usqkicavsn.exe ups_run3⤵
-
C:\Temp\usqkicavsn.exeC:\Temp\usqkicavsn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usqkicavsn.exe ups_ins3⤵
-
C:\Temp\i_usqkicavsn.exeC:\Temp\i_usqkicavsn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xupnhfzxrp.exe ups_run3⤵
-
C:\Temp\xupnhfzxrp.exeC:\Temp\xupnhfzxrp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xupnhfzxrp.exe ups_ins3⤵
-
C:\Temp\i_xupnhfzxrp.exeC:\Temp\i_xupnhfzxrp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xrpjhbzxrp.exe ups_run3⤵
-
C:\Temp\xrpjhbzxrp.exeC:\Temp\xrpjhbzxrp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xrpjhbzxrp.exe ups_ins3⤵
-
C:\Temp\i_xrpjhbzxrp.exeC:\Temp\i_xrpjhbzxrp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ezxrpjhczt.exe ups_run3⤵
-
C:\Temp\ezxrpjhczt.exeC:\Temp\ezxrpjhczt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ezxrpjhczt.exe ups_ins3⤵
-
C:\Temp\i_ezxrpjhczt.exeC:\Temp\i_ezxrpjhczt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jebwtrljeb.exe ups_run3⤵
-
C:\Temp\jebwtrljeb.exeC:\Temp\jebwtrljeb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jebwtrljeb.exe ups_ins3⤵
-
C:\Temp\i_jebwtrljeb.exeC:\Temp\i_jebwtrljeb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bywqojdbzt.exe ups_run3⤵
-
C:\Temp\bywqojdbzt.exeC:\Temp\bywqojdbzt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffd35f3c188,0x7ffd35f3c194,0x7ffd35f3c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,18177056198549623920,12426382032777487666,262144 --field-trial-handle=2260,i,12904359445986727500,1569030651428502100,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,9725475938510049162,881498588684911984,524288 --field-trial-handle=2260,i,12904359445986727500,1569030651428502100,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,5357892798395586452,14874158497885134853,524288 --field-trial-handle=2260,i,12904359445986727500,1569030651428502100,262144 --variations-seed-version --mojo-platform-channel-handle=3148 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,3684835431333620073,12960872277902446101,2097152 --field-trial-handle=2260,i,12904359445986727500,1569030651428502100,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,16722914064404197226,12492782706902513857,2097152 --field-trial-handle=2260,i,12904359445986727500,1569030651428502100,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4124,i,11310840138414071243,11482830903578797525,2097152 --field-trial-handle=2260,i,12904359445986727500,1569030651428502100,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4088,i,18238484067206670819,14950682812777505079,2097152 --field-trial-handle=2260,i,12904359445986727500,1569030651428502100,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3808,i,17902126335303087551,6389660572002455317,524288 --field-trial-handle=2260,i,12904359445986727500,1569030651428502100,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,517018785350721583,16414128202779374832,524288 --field-trial-handle=2260,i,12904359445986727500,1569030651428502100,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,14911693492352382384,12271719513652397576,524288 --field-trial-handle=2260,i,12904359445986727500,1569030651428502100,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,13185953270677727234,14004881486327712743,524288 --field-trial-handle=2260,i,12904359445986727500,1569030651428502100,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,13185953270677727234,14004881486327712743,524288 --field-trial-handle=2260,i,12904359445986727500,1569030651428502100,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,7559610276168444870,11550513532977169224,524288 --field-trial-handle=2260,i,12904359445986727500,1569030651428502100,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,5366220790059254241,16618110491657755273,524288 --field-trial-handle=2260,i,12904359445986727500,1569030651428502100,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,17384918637295764688,12051664370917371483,524288 --field-trial-handle=2260,i,12904359445986727500,1569030651428502100,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,13002908568131293881,17769976932718617716,524288 --field-trial-handle=2260,i,12904359445986727500,1569030651428502100,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4128,i,7348300052788932876,15827461038182793629,524288 --field-trial-handle=2260,i,12904359445986727500,1569030651428502100,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,13754730329511130499,15052658831345820555,524288 --field-trial-handle=2260,i,12904359445986727500,1569030651428502100,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3788,i,14023903049812394832,5146909015392666550,524288 --field-trial-handle=2260,i,12904359445986727500,1569030651428502100,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2784,i,15723208930215023737,3896360739245326037,524288 --field-trial-handle=2260,i,12904359445986727500,1569030651428502100,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,4531661697526227414,7838184769870991011,524288 --field-trial-handle=2260,i,12904359445986727500,1569030651428502100,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,11058028560638914499,13289490330695310934,524288 --field-trial-handle=2260,i,12904359445986727500,1569030651428502100,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,3645169720876507658,5993775059670170272,524288 --field-trial-handle=2260,i,12904359445986727500,1569030651428502100,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5448,i,16352687868912984169,12609067677357277312,262144 --field-trial-handle=2260,i,12904359445986727500,1569030651428502100,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,11751220254753506954,7347394299686985270,524288 --field-trial-handle=2260,i,12904359445986727500,1569030651428502100,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\mgezwrojhbzwuomh.sysC:\Temp\mgezwrojhbzwuomh.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\rpjhbztrlj.sysC:\Temp\rpjhbztrlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\ywqomgebwt.sysC:\Temp\ywqomgebwt.sys1⤵
- Executes dropped EXE
-
C:\Temp\ysqoigaytq.sysC:\Temp\ysqoigaytq.sys1⤵
- Executes dropped EXE
-
C:\Temp\tqlidbvqnl.sysC:\Temp\tqlidbvqnl.sys1⤵
- Executes dropped EXE
-
C:\Temp\kidavsqkic.sysC:\Temp\kidavsqkic.sys1⤵
- Executes dropped EXE
-
C:\Temp\zxvpnhfaxs.sysC:\Temp\zxvpnhfaxs.sys1⤵
- Executes dropped EXE
-
C:\Temp\zurpnkeczx.sysC:\Temp\zurpnkeczx.sys1⤵
- Executes dropped EXE
-
C:\Temp\omkhczurmk.sysC:\Temp\omkhczurmk.sys1⤵
- Executes dropped EXE
-
C:\Temp\hbztrmjebz.sysC:\Temp\hbztrmjebz.sys1⤵
- Executes dropped EXE
-
C:\Temp\eywtomgeyw.sysC:\Temp\eywtomgeyw.sys1⤵
- Executes dropped EXE
-
C:\Temp\dbytrljdbv.sysC:\Temp\dbytrljdbv.sys1⤵
-
C:\Temp\jdbnlfdyvq.sysC:\Temp\jdbnlfdyvq.sys1⤵
-
C:\Temp\yvqnigaysq.sysC:\Temp\yvqnigaysq.sys1⤵
-
C:\Temp\ysqkifaxvs.sysC:\Temp\ysqkifaxvs.sys1⤵
-
C:\Temp\xrpmkicaus.sysC:\Temp\xrpmkicaus.sys1⤵
-
C:\Temp\fcxupmhfzx.sysC:\Temp\fcxupmhfzx.sys1⤵
-
C:\Temp\ezwromkecz.sysC:\Temp\ezwromkecz.sys1⤵
-
C:\Temp\mgezwrpjhb.sysC:\Temp\mgezwrpjhb.sys1⤵
-
C:\Temp\ebwqoljgbz.sysC:\Temp\ebwqoljgbz.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
avsnkfdxvp.exe
bvtnlgdbwt.exe
eytqojgbzt.exe
i_bvtnlgdbwt.exe
i_eytqojgbzt.exe
i_omgezwrojb.exe
i_qlidavtnlf.exe
i_ztrligebvt.exe
kidavsqkic.sys
mgezwrojhbzwuomh.exe
mgezwrojhbzwuomh.sys
omgezwrojb.exe
qlidavtnlf.exe
rpjhbztrlj.sys
tqlidbvqnl.sys
ysqoigaytq.sys
ywqomgebwt.sys
ztrligebvt.exe
20f50f8e-7b31-48f8-8b74-8c9e356f1f78.tmp
settings.dat
settings.dat
67434c29-083a-430c-9ffb-b3496bf681aa.tmp
957aedf8-6531-4b4e-a73c-b4382fc506f7.tmp
9aedcd3a-5c42-4990-a1a5-37da19e79b24.tmp
temp-index
the-real-index
d18a4222-d5bd-4674-8bd1-39bd2c84b971.tmp
dasherSettingSchema.json
05165f29-158b-4b5e-a922-27ac813493fc.tmp
4a58a870-0097-4134-a932-e413d749bcf6.tmp
62241b54-f1f4-4ac3-8280-5dc302bcc409.tmp
sync_diagnostic.log
b51b69b2-cf6b-4b6e-bf00-045d525611c7.tmp
c98411ef-648d-4aca-9383-3c7f1b04f8f7.tmp
e4ffb2cd-b868-4d8c-bcc7-b69544d36519.tmp
9408b34c-2f86-4489-aa94-71d370dfb1e9.tmp
Local State
a333a250-a15b-49c9-8d6a-c13d4011cfbb.tmp
a97c64b0-232a-45eb-b1eb-ae7837b5ceef.tmp
cab9bbe1-a899-40e2-9eb3-e0e1af1d9472.tmp
0a2b1b1d-2910-4c6f-9c73-e0dbb15a9360.tmp
3dcde2b3-855d-4682-995b-1c3b34d72774.tmp
45d8d4cb-acfa-4d0c-9a84-d6693192b423.tmp
d5735acc-130a-4b25-b730-222e9049986e.tmp
33b50c24-18f2-46b0-92ee-5494d20abedd.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
a2dc8723-aff8-4b5f-b8c1-a42edcec3009.tmp
aec776b0-add6-4291-88e4-55ed41744f90.tmp
d7094d9b-84e4-4038-9b64-46c37f96ebd2.tmp
content.js
messages.json
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/1644-434-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1924-655-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2560-717-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2620-740-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2908-659-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2992-563-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3124-523-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3344-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3708-511-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4248-633-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4256-483-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4296-559-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4676-613-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4868-583-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4908-691-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4932-696-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4932-718-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5428-679-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5876-571-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5932-536-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5960-722-0x0000000000010000-0x00000000000AB000-memory.dmp