Analysis
- max time kernel
149s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
21/10/2026, 22:25
General
- Target 2026-10-20_a999109ebab4455e1ed54d05b4111e1c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261021-2casdays2j
- SHA256 cd0d205504b193b64e1a20965afad93ea3f1ac6c72289f934a87456ea1c9eb1c
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-20_a999109ebab4455e1ed54d05b4111e1c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-20_a999109ebab4455e1ed54d05b4111e1c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\upmhfzxrpjheczur.exeC:\Temp\upmhfzxrpjheczur.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wrpjhezwuo.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\wrpjhezwuo.exeC:\Temp\wrpjhezwuo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wrpjhezwuo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wrpjhezwuo.exeC:\Temp\i_wrpjhezwuo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywrojgeywu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ywrojgeywu.exeC:\Temp\ywrojgeywu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywrojgeywu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ywrojgeywu.exeC:\Temp\i_ywrojgeywu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gbytrljdbv.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gbytrljdbv.exeC:\Temp\gbytrljdbv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gbytrljdbv.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gbytrljdbv.exeC:\Temp\i_gbytrljdbv.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gbytqljdbv.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gbytqljdbv.exeC:\Temp\gbytqljdbv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gbytqljdbv.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gbytqljdbv.exeC:\Temp\i_gbytqljdbv.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtnlfdvsnl.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vtnlfdvsnl.exeC:\Temp\vtnlfdvsnl.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vtnlfdvsnl.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vtnlfdvsnl.exeC:\Temp\i_vtnlfdvsnl.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnlfdxvpni.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pnlfdxvpni.exeC:\Temp\pnlfdxvpni.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnlfdxvpni.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pnlfdxvpni.exeC:\Temp\i_pnlfdxvpni.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fzxspkicau.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fzxspkicau.exeC:\Temp\fzxspkicau.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fzxspkicau.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fzxspkicau.exeC:\Temp\i_fzxspkicau.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\czurpmkecz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\czurpmkecz.exeC:\Temp\czurpmkecz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_czurpmkecz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_czurpmkecz.exeC:\Temp\i_czurpmkecz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zurmjhbzur.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zurmjhbzur.exeC:\Temp\zurmjhbzur.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zurmjhbzur.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zurmjhbzur.exeC:\Temp\i_zurmjhbzur.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zurmjecwuo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zurmjecwuo.exeC:\Temp\zurmjecwuo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zurmjecwuo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zurmjecwuo.exeC:\Temp\i_zurmjecwuo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qojgeywroj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qojgeywroj.exeC:\Temp\qojgeywroj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qojgeywroj.exe ups_ins3⤵
-
C:\Temp\i_qojgeywroj.exeC:\Temp\i_qojgeywroj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tqligeywqo.exe ups_run3⤵
-
C:\Temp\tqligeywqo.exeC:\Temp\tqligeywqo.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tqligeywqo.exe ups_ins3⤵
-
C:\Temp\i_tqligeywqo.exeC:\Temp\i_tqligeywqo.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nlidayvqoi.exe ups_run3⤵
-
C:\Temp\nlidayvqoi.exeC:\Temp\nlidayvqoi.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nlidayvqoi.exe ups_ins3⤵
-
C:\Temp\i_nlidayvqoi.exeC:\Temp\i_nlidayvqoi.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\aysqkicavs.exe ups_run3⤵
-
C:\Temp\aysqkicavs.exeC:\Temp\aysqkicavs.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_aysqkicavs.exe ups_ins3⤵
-
C:\Temp\i_aysqkicavs.exeC:\Temp\i_aysqkicavs.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ayspkicaus.exe ups_run3⤵
-
C:\Temp\ayspkicaus.exeC:\Temp\ayspkicaus.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ayspkicaus.exe ups_ins3⤵
-
C:\Temp\i_ayspkicaus.exeC:\Temp\i_ayspkicaus.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\upnhfzxrpk.exe ups_run3⤵
-
C:\Temp\upnhfzxrpk.exeC:\Temp\upnhfzxrpk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_upnhfzxrpk.exe ups_ins3⤵
-
C:\Temp\i_upnhfzxrpk.exeC:\Temp\i_upnhfzxrpk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpjhbzurmk.exe ups_run3⤵
-
C:\Temp\rpjhbzurmk.exeC:\Temp\rpjhbzurmk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpjhbzurmk.exe ups_ins3⤵
-
C:\Temp\i_rpjhbzurmk.exeC:\Temp\i_rpjhbzurmk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zwurmheczu.exe ups_run3⤵
-
C:\Temp\zwurmheczu.exeC:\Temp\zwurmheczu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zwurmheczu.exe ups_ins3⤵
-
C:\Temp\i_zwurmheczu.exeC:\Temp\i_zwurmheczu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hbztrmjebw.exe ups_run3⤵
-
C:\Temp\hbztrmjebw.exeC:\Temp\hbztrmjebw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hbztrmjebw.exe ups_ins3⤵
-
C:\Temp\i_hbztrmjebw.exeC:\Temp\i_hbztrmjebw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bywqoigebz.exe ups_run3⤵
-
C:\Temp\bywqoigebz.exeC:\Temp\bywqoigebz.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x30c,0x7ff88f7ac188,0x7ff88f7ac194,0x7ff88f7ac1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,2971818650367926385,8227178763148947296,262144 --field-trial-handle=2344,i,8049596698291828606,16968272973972844547,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,18062294021470607950,16610574580146966006,524288 --field-trial-handle=2344,i,8049596698291828606,16968272973972844547,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2412,i,17434608783407019115,16978831131554687408,524288 --field-trial-handle=2344,i,8049596698291828606,16968272973972844547,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3620,i,15872667510901804650,12290687580417386133,2097152 --field-trial-handle=2344,i,8049596698291828606,16968272973972844547,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3628,i,425638420645961214,13558410681000558429,2097152 --field-trial-handle=2344,i,8049596698291828606,16968272973972844547,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4144,i,11182752075234619630,12851460215659896319,2097152 --field-trial-handle=2344,i,8049596698291828606,16968272973972844547,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,12308545646386006618,16506840836501054517,2097152 --field-trial-handle=2344,i,8049596698291828606,16968272973972844547,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3820,i,10257755403127848497,5340987823318662532,524288 --field-trial-handle=2344,i,8049596698291828606,16968272973972844547,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,782620670141825404,6566323202251890894,524288 --field-trial-handle=2344,i,8049596698291828606,16968272973972844547,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3800,i,1279409690836509342,5855736968527379017,524288 --field-trial-handle=2344,i,8049596698291828606,16968272973972844547,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,1371514518268766640,3622088419053630809,524288 --field-trial-handle=2344,i,8049596698291828606,16968272973972844547,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,1371514518268766640,3622088419053630809,524288 --field-trial-handle=2344,i,8049596698291828606,16968272973972844547,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3816,i,14015149885728224702,8150399101715067404,524288 --field-trial-handle=2344,i,8049596698291828606,16968272973972844547,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,13518370939258792749,10013249794128031750,524288 --field-trial-handle=2344,i,8049596698291828606,16968272973972844547,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,649565623719912318,13053329981833142198,524288 --field-trial-handle=2344,i,8049596698291828606,16968272973972844547,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6832,i,12697549287436516293,14491546826479188273,524288 --field-trial-handle=2344,i,8049596698291828606,16968272973972844547,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,15945145117548383790,10221882769251579143,524288 --field-trial-handle=2344,i,8049596698291828606,16968272973972844547,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,13153175322377077073,13050409429731091951,524288 --field-trial-handle=2344,i,8049596698291828606,16968272973972844547,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,9288632431378522695,3935934697050211451,524288 --field-trial-handle=2344,i,8049596698291828606,16968272973972844547,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,10619061135594972103,6191024727110162230,524288 --field-trial-handle=2344,i,8049596698291828606,16968272973972844547,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,3730920736260642387,12164575909691586506,524288 --field-trial-handle=2344,i,8049596698291828606,16968272973972844547,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,17914952377936066557,9031996621205443110,524288 --field-trial-handle=2344,i,8049596698291828606,16968272973972844547,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,10089225989527262349,13717364423794122791,524288 --field-trial-handle=2344,i,8049596698291828606,16968272973972844547,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,4091466754694796079,8481262714862379371,524288 --field-trial-handle=2344,i,8049596698291828606,16968272973972844547,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5672,i,6000426728551474357,11753766411408985814,262144 --field-trial-handle=2344,i,8049596698291828606,16968272973972844547,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3520,i,7901060027158276417,6148759117364862447,524288 --field-trial-handle=2344,i,8049596698291828606,16968272973972844547,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\upmhfzxrpjheczur.sysC:\Temp\upmhfzxrpjheczur.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\ebwuomgeyw.sysC:\Temp\ebwuomgeyw.sys1⤵
- Executes dropped EXE
-
C:\Temp\geywqomgeb.sysC:\Temp\geywqomgeb.sys1⤵
- Executes dropped EXE
-
C:\Temp\dbvtqlidbv.sysC:\Temp\dbvtqlidbv.sys1⤵
- Executes dropped EXE
-
C:\Temp\dbvtnljdbv.sysC:\Temp\dbvtnljdbv.sys1⤵
- Executes dropped EXE
-
C:\Temp\spnlidavsn.sysC:\Temp\spnlidavsn.sys1⤵
- Executes dropped EXE
-
C:\Temp\kicausmkic.sysC:\Temp\kicausmkic.sys1⤵
- Executes dropped EXE
-
C:\Temp\ecxupmkecz.sysC:\Temp\ecxupmkecz.sys1⤵
- Executes dropped EXE
-
C:\Temp\mkecwupmhf.sysC:\Temp\mkecwupmhf.sys1⤵
- Executes dropped EXE
-
C:\Temp\cwuomhecwu.sysC:\Temp\cwuomhecwu.sys1⤵
- Executes dropped EXE
-
C:\Temp\zwrojgbztr.sysC:\Temp\zwrojgbztr.sys1⤵
- Executes dropped EXE
-
C:\Temp\qoigbytqol.sysC:\Temp\qoigbytqol.sys1⤵
-
C:\Temp\bytqoigdbv.sysC:\Temp\bytqoigdbv.sys1⤵
-
C:\Temp\dxvqnigays.sysC:\Temp\dxvqnigays.sys1⤵
-
C:\Temp\xsqnkfcaus.sysC:\Temp\xsqnkfcaus.sys1⤵
-
C:\Temp\uspkhfzxsp.sysC:\Temp\uspkhfzxsp.sys1⤵
-
C:\Temp\fzxspkhcau.sysC:\Temp\fzxspkhcau.sys1⤵
-
C:\Temp\wurmkhczxu.sysC:\Temp\wurmkhczxu.sys1⤵
-
C:\Temp\gebwuomgey.sysC:\Temp\gebwuomgey.sys1⤵
-
C:\Temp\dbztrljgby.sysC:\Temp\dbztrljgby.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
dbvtnljdbv.sys
dbvtqlidbv.sys
ebwuomgeyw.sys
gbytqljdbv.exe
gbytrljdbv.exe
geywqomgeb.sys
i_gbytqljdbv.exe
i_gbytrljdbv.exe
i_vtnlfdvsnl.exe
i_wrpjhezwuo.exe
i_ywrojgeywu.exe
pnlfdxvpni.exe
spnlidavsn.sys
upmhfzxrpjheczur.exe
upmhfzxrpjheczur.sys
vtnlfdvsnl.exe
wrpjhezwuo.exe
ywrojgeywu.exe
1e10730b-ccfd-4401-9658-16fa0346f53c.tmp
23e4e32e-e4de-48c9-8b9c-f9058a17e871.tmp
36502b39-bab4-4412-93df-897a395e7b48.tmp
settings.dat
settings.dat
196280fd-f6d3-4452-bb9f-af544fe766e8.tmp
278eec3c-fc17-49cd-abbb-9de87c3411eb.tmp
LOG.old
the-real-index
the-real-index
7e05af1a-bf9d-4af4-a195-b7fbfcb3ea2f.tmp
dasherSettingSchema.json
0e4d8804-ea8c-44fb-9e01-fd350f972f48.tmp
80dc23ed-d922-4767-85d2-2d172e8ad8ef.tmp
a1ed2daf-0a88-4547-958b-198bcaabc123.tmp
a4d7d873-5e9d-4a0b-8279-0ebb2fac6e8b.tmp
a5fedb2a-1375-4d0c-a8de-0bf9dd5fc5ca.tmp
ae041b5c-3370-4cc2-bbcc-b7072e969231.tmp
5a07230c-dceb-489f-96fb-4b60114d414f.tmp
OperationConfig
c403a1c9-e557-4572-8b70-b3f7a875bec5.tmp
3b2d7401-cdfb-4d60-a906-283a7947afa3.tmp
3bdfe76d-7db9-4b79-8c18-3b83165635f1.tmp
6c37bfe7-f097-43f3-b18c-668b4473dd8f.tmp
e0e98795-024f-435a-a936-c87b5aac746b.tmp
128f3672-5faa-4b59-94f9-ba649ce0d907.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
a54d914d-8a91-4cee-a124-c21261e04c3a.tmp
8dd1fc5c-60fd-4487-be84-8164b53faf76.tmp
e53394c6-bb24-4c0c-9f17-eaea6085d6da.tmp
content.js
messages.json
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/1588-650-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2064-533-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2404-431-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3452-715-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3588-686-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3596-616-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3768-508-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3964-586-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4008-520-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4008-561-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4008-550-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4008-582-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4020-662-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4020-733-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4252-557-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4292-691-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4496-480-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4640-636-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5064-577-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5532-711-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5756-674-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5852-66-0x0000000000010000-0x00000000000AB000-memory.dmp