Analysis
- max time kernel
150s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
21/10/2026, 22:26
General
- Target 2026-10-20_a982df6cebb7a64ebb565d033b3d7106_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261021-2clvmsys2l
- SHA256 ffafbc7c1c499c77209e367e50aed821e91fd14c31efb2364f094f49137f4f39
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-20_a982df6cebb7a64ebb565d033b3d7106_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-20_a982df6cebb7a64ebb565d033b3d7106_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\rmjhbzurmjecwurm.exeC:\Temp\rmjhbzurmjecwurm.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wupmhztmew.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\wupmhztmew.exeC:\Temp\wupmhztmew.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wupmhztmew.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wupmhztmew.exeC:\Temp\i_wupmhztmew.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omjebwtrlj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\omjebwtrlj.exeC:\Temp\omjebwtrlj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omjebwtrlj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_omjebwtrlj.exeC:\Temp\i_omjebwtrlj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jgbztrljdb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jgbztrljdb.exeC:\Temp\jgbztrljdb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jgbztrljdb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jgbztrljdb.exeC:\Temp\i_jgbztrljdb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\aysqlidbvt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\aysqlidbvt.exeC:\Temp\aysqlidbvt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_aysqlidbvt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_aysqlidbvt.exeC:\Temp\i_aysqlidbvt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\icavsnlfdx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\icavsnlfdx.exeC:\Temp\icavsnlfdx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_icavsnlfdx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_icavsnlfdx.exeC:\Temp\i_icavsnlfdx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kicaxvpnhf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kicaxvpnhf.exeC:\Temp\kicaxvpnhf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kicaxvpnhf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kicaxvpnhf.exeC:\Temp\i_kicaxvpnhf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\faxsqkicau.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\faxsqkicau.exeC:\Temp\faxsqkicau.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_faxsqkicau.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_faxsqkicau.exeC:\Temp\i_faxsqkicau.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hfzxupmhfz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hfzxupmhfz.exeC:\Temp\hfzxupmhfz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hfzxupmhfz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hfzxupmhfz.exeC:\Temp\i_hfzxupmhfz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wuomhezwuo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wuomhezwuo.exeC:\Temp\wuomhezwuo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wuomhezwuo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wuomhezwuo.exeC:\Temp\i_wuomhezwuo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wujebwuomg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wujebwuomg.exeC:\Temp\wujebwuomg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wujebwuomg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wujebwuomg.exeC:\Temp\i_wujebwuomg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trojgebwto.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\trojgebwto.exeC:\Temp\trojgebwto.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trojgebwto.exe ups_ins3⤵
-
C:\Temp\i_trojgebwto.exeC:\Temp\i_trojgebwto.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljdbvtnlgd.exe ups_run3⤵
-
C:\Temp\ljdbvtnlgd.exeC:\Temp\ljdbvtnlgd.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljdbvtnlgd.exe ups_ins3⤵
-
C:\Temp\i_ljdbvtnlgd.exeC:\Temp\i_ljdbvtnlgd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\idavtqlidb.exe ups_run3⤵
-
C:\Temp\idavtqlidb.exeC:\Temp\idavtqlidb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_idavtqlidb.exe ups_ins3⤵
-
C:\Temp\i_idavtqlidb.exeC:\Temp\i_idavtqlidb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\yvpnkfcaxs.exe ups_run3⤵
-
C:\Temp\yvpnkfcaxs.exeC:\Temp\yvpnkfcaxs.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_yvpnkfcaxs.exe ups_ins3⤵
-
C:\Temp\i_yvpnkfcaxs.exeC:\Temp\i_yvpnkfcaxs.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kicaxsqkic.exe ups_run3⤵
-
C:\Temp\kicaxsqkic.exeC:\Temp\kicaxsqkic.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kicaxsqkic.exe ups_ins3⤵
-
C:\Temp\i_kicaxsqkic.exeC:\Temp\i_kicaxsqkic.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\khfzxspkhc.exe ups_run3⤵
-
C:\Temp\khfzxspkhc.exeC:\Temp\khfzxspkhc.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_khfzxspkhc.exe ups_ins3⤵
-
C:\Temp\i_khfzxspkhc.exeC:\Temp\i_khfzxspkhc.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ebzurpjhfz.exe ups_run3⤵
-
C:\Temp\ebzurpjhfz.exeC:\Temp\ebzurpjhfz.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ebzurpjhfz.exe ups_ins3⤵
-
C:\Temp\i_ebzurpjhfz.exeC:\Temp\i_ebzurpjhfz.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cwtrmjhbzw.exe ups_run3⤵
-
C:\Temp\cwtrmjhbzw.exeC:\Temp\cwtrmjhbzw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cwtrmjhbzw.exe ups_ins3⤵
-
C:\Temp\i_cwtrmjhbzw.exeC:\Temp\i_cwtrmjhbzw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omgebwtrlj.exe ups_run3⤵
-
C:\Temp\omgebwtrlj.exeC:\Temp\omgebwtrlj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omgebwtrlj.exe ups_ins3⤵
-
C:\Temp\i_omgebwtrlj.exeC:\Temp\i_omgebwtrlj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jgbytrljdb.exe ups_run3⤵
-
C:\Temp\jgbytrljdb.exeC:\Temp\jgbytrljdb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffd442fc188,0x7ffd442fc194,0x7ffd442fc1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1984,i,17965647052490273523,9514530599278592299,262144 --field-trial-handle=2540,i,6002561576909892748,13943867789704262680,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2100,i,11577344051571871864,16354971306451290914,524288 --field-trial-handle=2540,i,6002561576909892748,13943867789704262680,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2664,i,7911024622077064122,16628478544625098884,524288 --field-trial-handle=2540,i,6002561576909892748,13943867789704262680,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,16614924278900361723,18413863378053246766,2097152 --field-trial-handle=2540,i,6002561576909892748,13943867789704262680,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,11574822312266961296,15217269219010323025,2097152 --field-trial-handle=2540,i,6002561576909892748,13943867789704262680,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,9426837447835608045,410115995916133603,2097152 --field-trial-handle=2540,i,6002561576909892748,13943867789704262680,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,13045108117830790482,1958124840205615093,2097152 --field-trial-handle=2540,i,6002561576909892748,13943867789704262680,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,3663304179948789355,410209921211090996,524288 --field-trial-handle=2540,i,6002561576909892748,13943867789704262680,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,17989727539371196619,1518603397319987291,524288 --field-trial-handle=2540,i,6002561576909892748,13943867789704262680,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,12202808767899837696,7622840234166805382,524288 --field-trial-handle=2540,i,6002561576909892748,13943867789704262680,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,5998739461003205222,2433558989511911107,524288 --field-trial-handle=2540,i,6002561576909892748,13943867789704262680,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,5998739461003205222,2433558989511911107,524288 --field-trial-handle=2540,i,6002561576909892748,13943867789704262680,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,6115683014689618188,14727481174679803706,524288 --field-trial-handle=2540,i,6002561576909892748,13943867789704262680,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3780,i,8360730377473420484,6231249854588852007,524288 --field-trial-handle=2540,i,6002561576909892748,13943867789704262680,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6828,i,8609805316696915138,1351838165417684506,524288 --field-trial-handle=2540,i,6002561576909892748,13943867789704262680,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6840,i,3286612074500643111,16378613725894425421,524288 --field-trial-handle=2540,i,6002561576909892748,13943867789704262680,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,18165302489301419308,15696227982926726137,524288 --field-trial-handle=2540,i,6002561576909892748,13943867789704262680,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1284,i,11482159707355117540,6060172562074213662,524288 --field-trial-handle=2540,i,6002561576909892748,13943867789704262680,262144 --variations-seed-version --mojo-platform-channel-handle=1416 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1276,i,7505255437628009400,14819127161460850145,524288 --field-trial-handle=2540,i,6002561576909892748,13943867789704262680,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,6106858429042096764,4908337435671904577,524288 --field-trial-handle=2540,i,6002561576909892748,13943867789704262680,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3476,i,846764560109137189,17717129083726486785,524288 --field-trial-handle=2540,i,6002561576909892748,13943867789704262680,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,11549030182095983512,14558502128528729295,524288 --field-trial-handle=2540,i,6002561576909892748,13943867789704262680,262144 --variations-seed-version --mojo-platform-channel-handle=932 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3476,i,9909598558044201014,14795783528415644685,524288 --field-trial-handle=2540,i,6002561576909892748,13943867789704262680,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6196,i,10037486062564773641,9451133259974648945,262144 --field-trial-handle=2540,i,6002561576909892748,13943867789704262680,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,609829709601597622,17077784702404024364,524288 --field-trial-handle=2540,i,6002561576909892748,13943867789704262680,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\rmjhbzurmjecwurm.sysC:\Temp\rmjhbzurmjecwurm.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\bztrpjhbzt.sysC:\Temp\bztrpjhbzt.sys1⤵
- Executes dropped EXE
-
C:\Temp\ljdbwtomjd.sysC:\Temp\ljdbwtomjd.sys1⤵
- Executes dropped EXE
-
C:\Temp\ysqnlgdywq.sysC:\Temp\ysqnlgdywq.sys1⤵
- Executes dropped EXE
-
C:\Temp\sqkidavsqk.sysC:\Temp\sqkidavsqk.sys1⤵
- Executes dropped EXE
-
C:\Temp\sqkifdxvtn.sysC:\Temp\sqkifdxvtn.sys1⤵
- Executes dropped EXE
-
C:\Temp\fzxsqkicau.sysC:\Temp\fzxsqkicau.sys1⤵
- Executes dropped EXE
-
C:\Temp\hcausmkhcz.sysC:\Temp\hcausmkhcz.sys1⤵
- Executes dropped EXE
-
C:\Temp\mkeuomhecw.sysC:\Temp\mkeuomhecw.sys1⤵
- Executes dropped EXE
-
C:\Temp\czurmjecwu.sysC:\Temp\czurmjecwu.sys1⤵
- Executes dropped EXE
-
C:\Temp\ztrljhbztq.sysC:\Temp\ztrljhbztq.sys1⤵
- Executes dropped EXE
-
C:\Temp\wtoigaytqo.sysC:\Temp\wtoigaytqo.sys1⤵
-
C:\Temp\lfdxvtnlfd.sysC:\Temp\lfdxvtnlfd.sys1⤵
-
C:\Temp\kigaysqkid.sysC:\Temp\kigaysqkid.sys1⤵
-
C:\Temp\fdxvsqkifa.sysC:\Temp\fdxvsqkifa.sys1⤵
-
C:\Temp\khcaxspkhf.sysC:\Temp\khcaxspkhf.sys1⤵
-
C:\Temp\hecxuomjhf.sysC:\Temp\hecxuomjhf.sys1⤵
-
C:\Temp\mkecwupmhe.sysC:\Temp\mkecwupmhe.sys1⤵
-
C:\Temp\omgezwromg.sysC:\Temp\omgezwromg.sys1⤵
-
C:\Temp\lgeywtomge.sysC:\Temp\lgeywtomge.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
aysqlidbvt.exe
bztrpjhbzt.sys
i_aysqlidbvt.exe
i_icavsnlfdx.exe
i_jgbztrljdb.exe
i_omjebwtrlj.exe
i_wupmhztmew.exe
icavsnlfdx.exe
jgbztrljdb.exe
kicaxvpnhf.exe
ljdbwtomjd.sys
omjebwtrlj.exe
rmjhbzurmjecwurm.exe
rmjhbzurmjecwurm.sys
sqkidavsqk.sys
sqkifdxvtn.sys
wupmhztmew.exe
ysqnlgdywq.sys
186152df-12cc-486e-9f1b-a3ab1161d559.tmp
28803244-eca7-4aa5-a871-3dfa44b18f4b.tmp
60918981-234d-4629-9689-0ac3674a2b93.tmp
6b9a03eb-10c6-4c13-9793-4897d32cfaa8.tmp
7b8a722e-e520-485b-87bc-34cab37289e4.tmp
cad65d6c-a993-4923-8e8b-da84889f9070.tmp
settings.dat
settings.dat
50e31573-89d9-4090-9080-4b161dadbbd1.tmp
temp-index
the-real-index
d4c970f7-a214-4eba-b504-d987f445ed1e.tmp
dasherSettingSchema.json
0db883f6-e315-4df6-9161-508bce0b0c89.tmp
ac77e773-2e4c-4495-9ab6-951f0f071b2e.tmp
c7601dca-749b-4196-a21b-bf103cbeb749.tmp
sync_diagnostic.log
a09be2e9-8608-48d8-8f61-c9282ed9b07c.tmp
bd5f917a-3fb3-4e56-97d0-32db05dd6de8.tmp
c15d3ffb-f74d-48d9-8bb1-1d384787acd8.tmp
e8919de1-4ab3-43ac-8893-de65c78011cd.tmp
ed478e49-5582-4384-8af3-0dc1e3bbd101.tmp
e4fb04df-c367-49ac-b44f-f09728c29583.tmp
ad6e91aa-670d-4d4f-93c6-4d8751cc2cbe.tmp
1f7aaf1d-812d-461d-9ca6-12f7354457ce.tmp
24134ebe-86c3-4ea4-897f-4c5a701066ff.tmp
f668bcb3-996d-4397-8d47-aa5a24bc7624.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
424f7ddf-25c2-47ff-9f03-82bf13f14a47.tmp
51753c85-ad47-4a33-b338-0b13fa017924.tmp
26a40ff9-d13b-4a2d-bd63-eb9844500574.tmp
88623262-65b6-42a0-b219-59a88d4b0fe3.tmp
messages.json
content.js
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/428-697-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1112-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1196-567-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1296-723-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1352-638-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1360-685-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1388-487-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1992-527-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2548-438-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2804-728-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3016-725-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3016-718-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3436-661-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3976-583-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3976-604-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4280-618-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4280-640-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4452-563-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4860-665-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5012-746-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5328-540-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5384-515-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6100-587-0x0000000000010000-0x00000000000AB000-memory.dmp