Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
20/10/2026, 15:25
General
- Target 2026-10-19_7cfbd600aaf7cde89ac6810074435b17_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261020-stxtssbv2v
- SHA256 c9e7ffde53e14ad99e248ab32eef9a4556221f48090491586ddda9ce052b0eab
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_7cfbd600aaf7cde89ac6810074435b17_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-19_7cfbd600aaf7cde89ac6810074435b17_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\trljebwtomgeywro.exeC:\Temp\trljebwtomgeywro.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywqomgebwt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\ywqomgebwt.exeC:\Temp\ywqomgebwt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywqomgebwt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ywqomgebwt.exeC:\Temp\i_ywqomgebwt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qolgdyvtoi.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qolgdyvtoi.exeC:\Temp\qolgdyvtoi.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qolgdyvtoi.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qolgdyvtoi.exeC:\Temp\i_qolgdyvtoi.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqkidavtnl.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\sqkidavtnl.exeC:\Temp\sqkidavtnl.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqkidavtnl.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_sqkidavtnl.exeC:\Temp\i_sqkidavtnl.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vsnlfdxvpn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vsnlfdxvpn.exeC:\Temp\vsnlfdxvpn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vsnlfdxvpn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vsnlfdxvpn.exeC:\Temp\i_vsnlfdxvpn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nkicxvsnkf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nkicxvsnkf.exeC:\Temp\nkicxvsnkf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nkicxvsnkf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nkicxvsnkf.exeC:\Temp\i_nkicxvsnkf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fcxusmkecx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fcxusmkecx.exeC:\Temp\fcxusmkecx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fcxusmkecx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fcxusmkecx.exeC:\Temp\i_fcxusmkecx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pmheromhez.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pmheromhez.exeC:\Temp\pmheromhez.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pmheromhez.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pmheromhez.exeC:\Temp\i_pmheromhez.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhezurmjec.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jhezurmjec.exeC:\Temp\jhezurmjec.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhezurmjec.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jhezurmjec.exeC:\Temp\i_jhezurmjec.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywtomgeywq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ywtomgeywq.exeC:\Temp\ywtomgeywq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywtomgeywq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ywtomgeywq.exeC:\Temp\i_ywtomgeywq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gbytrljdbv.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gbytrljdbv.exeC:\Temp\gbytrljdbv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gbytrljdbv.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gbytrljdbv.exeC:\Temp\i_gbytrljdbv.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\daysqoifdb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\daysqoifdb.exeC:\Temp\daysqoifdb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_daysqoifdb.exe ups_ins3⤵
-
C:\Temp\i_daysqoifdb.exeC:\Temp\i_daysqoifdb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kifdyvqnlf.exe ups_run3⤵
-
C:\Temp\kifdyvqnlf.exeC:\Temp\kifdyvqnlf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kifdyvqnlf.exe ups_ins3⤵
-
C:\Temp\i_kifdyvqnlf.exeC:\Temp\i_kifdyvqnlf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lfdxvpnhfd.exe ups_run3⤵
-
C:\Temp\lfdxvpnhfd.exeC:\Temp\lfdxvpnhfd.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lfdxvpnhfd.exe ups_ins3⤵
-
C:\Temp\i_lfdxvpnhfd.exeC:\Temp\i_lfdxvpnhfd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hfcxuspnhf.exe ups_run3⤵
-
C:\Temp\hfcxuspnhf.exeC:\Temp\hfcxuspnhf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hfcxuspnhf.exe ups_ins3⤵
-
C:\Temp\i_hfcxuspnhf.exeC:\Temp\i_hfcxuspnhf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhczurmkec.exe ups_run3⤵
-
C:\Temp\jhczurmkec.exeC:\Temp\jhczurmkec.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhczurmkec.exe ups_ins3⤵
-
C:\Temp\i_jhczurmkec.exeC:\Temp\i_jhczurmkec.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omhecwupmh.exe ups_run3⤵
-
C:\Temp\omhecwupmh.exeC:\Temp\omhecwupmh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omhecwupmh.exe ups_ins3⤵
-
C:\Temp\i_omhecwupmh.exeC:\Temp\i_omhecwupmh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\romgebzwrl.exe ups_run3⤵
-
C:\Temp\romgebzwrl.exeC:\Temp\romgebzwrl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_romgebzwrl.exe ups_ins3⤵
-
C:\Temp\i_romgebzwrl.exeC:\Temp\i_romgebzwrl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wtrljdbwto.exe ups_run3⤵
-
C:\Temp\wtrljdbwto.exeC:\Temp\wtrljdbwto.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wtrljdbwto.exe ups_ins3⤵
-
C:\Temp\i_wtrljdbwto.exeC:\Temp\i_wtrljdbwto.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywqljdbvtn.exe ups_run3⤵
-
C:\Temp\ywqljdbvtn.exeC:\Temp\ywqljdbvtn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywqljdbvtn.exe ups_ins3⤵
-
C:\Temp\i_ywqljdbvtn.exeC:\Temp\i_ywqljdbvtn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\yvtnlfdyvq.exe ups_run3⤵
-
C:\Temp\yvtnlfdyvq.exeC:\Temp\yvtnlfdyvq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffb5f71c188,0x7ffb5f71c194,0x7ffb5f71c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1572,i,9982999073582757726,12676440354371519724,262144 --field-trial-handle=2356,i,14358604625791213885,13644454486624102460,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,12226189214346008381,12494787472479270155,524288 --field-trial-handle=2356,i,14358604625791213885,13644454486624102460,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,4801688550441471220,18422669024994731005,524288 --field-trial-handle=2356,i,14358604625791213885,13644454486624102460,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3616,i,15775817775408961451,1018027066533930609,2097152 --field-trial-handle=2356,i,14358604625791213885,13644454486624102460,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,7552666947005403076,3427553023918681246,2097152 --field-trial-handle=2356,i,14358604625791213885,13644454486624102460,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,1676732386638656730,8363863029049255986,2097152 --field-trial-handle=2356,i,14358604625791213885,13644454486624102460,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,15608111014498056461,5947131348958216499,2097152 --field-trial-handle=2356,i,14358604625791213885,13644454486624102460,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,10419978650817731276,4355195676083720134,524288 --field-trial-handle=2356,i,14358604625791213885,13644454486624102460,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,7975277732289583930,4551103067521335158,524288 --field-trial-handle=2356,i,14358604625791213885,13644454486624102460,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3840,i,4304280854201224094,5328545556498945240,524288 --field-trial-handle=2356,i,14358604625791213885,13644454486624102460,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,14044356414640253763,7679239906196717024,524288 --field-trial-handle=2356,i,14358604625791213885,13644454486624102460,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,14044356414640253763,7679239906196717024,524288 --field-trial-handle=2356,i,14358604625791213885,13644454486624102460,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,12968757221001524074,3294215318959742697,524288 --field-trial-handle=2356,i,14358604625791213885,13644454486624102460,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,7570594189678742881,2979304388359162526,524288 --field-trial-handle=2356,i,14358604625791213885,13644454486624102460,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6744,i,7122455864579128244,712433545679705105,524288 --field-trial-handle=2356,i,14358604625791213885,13644454486624102460,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6776,i,15503793682790729462,14052443223296246050,524288 --field-trial-handle=2356,i,14358604625791213885,13644454486624102460,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,8601439544929572292,13737059343465822488,524288 --field-trial-handle=2356,i,14358604625791213885,13644454486624102460,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,9454920746887749718,1528828751792532006,524288 --field-trial-handle=2356,i,14358604625791213885,13644454486624102460,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,11299555847929899653,15625615699233981933,524288 --field-trial-handle=2356,i,14358604625791213885,13644454486624102460,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2796,i,3788276017570806441,12096597993449096519,524288 --field-trial-handle=2356,i,14358604625791213885,13644454486624102460,262144 --variations-seed-version --mojo-platform-channel-handle=3880 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,2243901430707440733,11633604657344025961,524288 --field-trial-handle=2356,i,14358604625791213885,13644454486624102460,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6840,i,13681323381813813498,12883037317055988472,524288 --field-trial-handle=2356,i,14358604625791213885,13644454486624102460,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,12432419676998024101,12256589453714965403,524288 --field-trial-handle=2356,i,14358604625791213885,13644454486624102460,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6816,i,13980370640157094733,5978615790590198271,524288 --field-trial-handle=2356,i,14358604625791213885,13644454486624102460,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6232,i,4398789206337537114,10521958393920424904,262144 --field-trial-handle=2356,i,14358604625791213885,13644454486624102460,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,12784003120314740422,3009527841070796006,524288 --field-trial-handle=2356,i,14358604625791213885,13644454486624102460,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\trljebwtomgeywro.sysC:\Temp\trljebwtomgeywro.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\jdbvtgdyvt.sysC:\Temp\jdbvtgdyvt.sys1⤵
- Executes dropped EXE
-
C:\Temp\idbvtnlfdb.sysC:\Temp\idbvtnlfdb.sys1⤵
- Executes dropped EXE
-
C:\Temp\snlidavtnl.sysC:\Temp\snlidavtnl.sys1⤵
- Executes dropped EXE
-
C:\Temp\xsqkicausn.sysC:\Temp\xsqkicausn.sys1⤵
- Executes dropped EXE
-
C:\Temp\mcxuspkhec.sysC:\Temp\mcxuspkhec.sys1⤵
- Executes dropped EXE
-
C:\Temp\upmkecwupj.sysC:\Temp\upmkecwupj.sys1⤵
- Executes dropped EXE
-
C:\Temp\omjecwuomg.sysC:\Temp\omjecwuomg.sys1⤵
- Executes dropped EXE
-
C:\Temp\gebwtomgey.sysC:\Temp\gebwtomgey.sys1⤵
- Executes dropped EXE
-
C:\Temp\bztrljytql.sysC:\Temp\bztrljytql.sys1⤵
- Executes dropped EXE
-
C:\Temp\qligaytqlj.sysC:\Temp\qligaytqlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\tnlfdavtnl.sysC:\Temp\tnlfdavtnl.sys1⤵
-
C:\Temp\snlfdxvpni.sysC:\Temp\snlfdxvpni.sys1⤵
-
C:\Temp\nkecxusmkf.sysC:\Temp\nkecxusmkf.sys1⤵
-
C:\Temp\smkhfcxupm.sysC:\Temp\smkhfcxupm.sys1⤵
-
C:\Temp\smjhbzurpj.sysC:\Temp\smjhbzurpj.sys1⤵
-
C:\Temp\romgecwtro.sysC:\Temp\romgecwtro.sys1⤵
-
C:\Temp\eywuojgbzl.sysC:\Temp\eywuojgbzl.sys1⤵
-
C:\Temp\dbytolgdbw.sysC:\Temp\dbytolgdbw.sys1⤵
-
C:\Temp\aytqoigdbv.sysC:\Temp\aytqoigdbv.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
fcxusmkecx.exe
i_nkicxvsnkf.exe
i_qolgdyvtoi.exe
i_sqkidavtnl.exe
i_vsnlfdxvpn.exe
i_ywqomgebwt.exe
idbvtnlfdb.sys
jdbvtgdyvt.sys
mcxuspkhec.sys
nkicxvsnkf.exe
qolgdyvtoi.exe
snlidavtnl.sys
sqkidavtnl.exe
trljebwtomgeywro.exe
trljebwtomgeywro.sys
vsnlfdxvpn.exe
xsqkicausn.sys
ywqomgebwt.exe
03b8e189-5214-47ea-9424-e9f513fba56f.tmp
06323291-c2f2-45a0-bb7b-b1dc605472c0.tmp
309c3fe7-abe1-492c-898e-99ba36cb4405.tmp
8c0638b5-8218-4c67-9c8f-5170b47a4398.tmp
9398dec3-2417-48a5-b3e7-ca8a7f10c9b4.tmp
settings.dat
settings.dat
5e9c388a-f4c7-4d6c-b182-b1279d6132c3.tmp
653faa94-9458-4428-a095-03a583f0cb45.tmp
LOG.old
temp-index
the-real-index
e0ed3df4-5a97-4b06-a316-5bb7c60407aa.tmp
dasherSettingSchema.json
01c02542-0ab3-473f-b7d1-2eda7cad9813.tmp
52f490b4-dc18-4a07-bc04-f6c223da4035.tmp
66bccf9c-2900-4fe0-9324-cdb233377f81.tmp
Preferences
cf31056a-fa0d-45f7-a187-0cb0d9045feb.tmp
ef24af2e-946f-45f3-8330-0d49aad898ca.tmp
692801b3-487e-4225-9b47-52cb81b9d167.tmp
c959ccd0-06d8-43bc-ad72-0caa1a06962b.tmp
3caecb22-7658-43a2-b830-219f6de822d2.tmp
4a3019a7-6482-42a7-bb25-9d592e0cce98.tmp
c5cb4294-31fb-402b-bbb8-9fdaaee4c2e1.tmp
f8c0f22d-e762-4bf3-98d0-413c5e58238e.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
6ca1d1bb-dcf2-4b71-89be-e7299c51044b.tmp
824083e7-d91e-4501-a0e8-cfe41e29f201.tmp
1cc01ad9-95f8-4f4d-b870-3fb75b998434.tmp
2cd2d572-0c58-4449-865e-89dc911c53a9.tmp
content.js
messages.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/428-568-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/428-585-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1092-684-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1640-523-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1640-468-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1640-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1640-561-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1792-584-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1900-672-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2900-618-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2992-589-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3108-564-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3252-534-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3252-511-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3264-728-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3828-704-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4108-752-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4820-646-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5020-709-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5456-541-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5464-483-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5652-433-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5744-748-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6020-660-0x0000000000010000-0x00000000000AB000-memory.dmp