Analysis
- max time kernel
148s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
22/10/2026, 14:50
General
- Target 2026-10-21_a347047f8a003242645317570b372533_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261022-r7nydaae94
- SHA256 ecb018b2215dc5fa0c77fd5710c8b81cc5ed5da151c9b424995550d7931081db
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-21_a347047f8a003242645317570b372533_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-21_a347047f8a003242645317570b372533_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\trljdbwtomgbytrl.exeC:\Temp\trljdbwtomgbytrl.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wqolgdbvld.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\wqolgdbvld.exeC:\Temp\wqolgdbvld.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wqolgdbvld.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wqolgdbvld.exeC:\Temp\i_wqolgdbvld.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qolgdbtnlf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qolgdbtnlf.exeC:\Temp\qolgdbtnlf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qolgdbtnlf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qolgdbtnlf.exeC:\Temp\i_qolgdbtnlf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\avsnlfcays.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\avsnlfcays.exeC:\Temp\avsnlfcays.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_avsnlfcays.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_avsnlfcays.exeC:\Temp\i_avsnlfcays.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\axvsmkfcxv.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\axvsmkfcxv.exeC:\Temp\axvsmkfcxv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_axvsmkfcxv.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_axvsmkfcxv.exeC:\Temp\i_axvsmkfcxv.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usmkfcwupm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\usmkfcwupm.exeC:\Temp\usmkfcwupm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usmkfcwupm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_usmkfcwupm.exeC:\Temp\i_usmkfcwupm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xusmkhczxu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xusmkhczxu.exeC:\Temp\xusmkhczxu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xusmkhczxu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xusmkhczxu.exeC:\Temp\i_xusmkhczxu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trmjhbztrm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\trmjhbztrm.exeC:\Temp\trmjhbztrm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trmjhbztrm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_trmjhbztrm.exeC:\Temp\i_trmjhbztrm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hbztrojgby.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hbztrojgby.exeC:\Temp\hbztrojgby.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hbztrojgby.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hbztrojgby.exeC:\Temp\i_hbztrojgby.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\iytqljdbvt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\iytqljdbvt.exeC:\Temp\iytqljdbvt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_iytqljdbvt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_iytqljdbvt.exeC:\Temp\i_iytqljdbvt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dywqolgdyw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dywqolgdyw.exeC:\Temp\dywqolgdyw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dywqolgdyw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dywqolgdyw.exeC:\Temp\i_dywqolgdyw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvtnlfdbvs.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xvtnlfdbvs.exeC:\Temp\xvtnlfdbvs.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xvtnlfdbvs.exe ups_ins3⤵
-
C:\Temp\i_xvtnlfdbvs.exeC:\Temp\i_xvtnlfdbvs.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\axspnicaxs.exe ups_run3⤵
-
C:\Temp\axspnicaxs.exeC:\Temp\axspnicaxs.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_axspnicaxs.exe ups_ins3⤵
-
C:\Temp\i_axspnicaxs.exeC:\Temp\i_axspnicaxs.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cxvpnhfspk.exe ups_run3⤵
-
C:\Temp\cxvpnhfspk.exeC:\Temp\cxvpnhfspk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cxvpnhfspk.exe ups_ins3⤵
-
C:\Temp\i_cxvpnhfspk.exeC:\Temp\i_cxvpnhfspk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xusmkhfzxr.exe ups_run3⤵
-
C:\Temp\xusmkhfzxr.exeC:\Temp\xusmkhfzxr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xusmkhfzxr.exe ups_ins3⤵
-
C:\Temp\i_xusmkhfzxr.exeC:\Temp\i_xusmkhfzxr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\czurmkeczu.exe ups_run3⤵
-
C:\Temp\czurmkeczu.exeC:\Temp\czurmkeczu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_czurmkeczu.exe ups_ins3⤵
-
C:\Temp\i_czurmkeczu.exeC:\Temp\i_czurmkeczu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\uomjheywtr.exe ups_run3⤵
-
C:\Temp\uomjheywtr.exeC:\Temp\uomjheywtr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_uomjheywtr.exe ups_ins3⤵
-
C:\Temp\i_uomjheywtr.exeC:\Temp\i_uomjheywtr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ebwtomgeyw.exe ups_run3⤵
-
C:\Temp\ebwtomgeyw.exeC:\Temp\ebwtomgeyw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ebwtomgeyw.exe ups_ins3⤵
-
C:\Temp\i_ebwtomgeyw.exeC:\Temp\i_ebwtomgeyw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\yvtoljdbyt.exe ups_run3⤵
-
C:\Temp\yvtoljdbyt.exeC:\Temp\yvtoljdbyt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_yvtoljdbyt.exe ups_ins3⤵
-
C:\Temp\i_yvtoljdbyt.exeC:\Temp\i_yvtoljdbyt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qoigaytqli.exe ups_run3⤵
-
C:\Temp\qoigaytqli.exeC:\Temp\qoigaytqli.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qoigaytqli.exe ups_ins3⤵
-
C:\Temp\i_qoigaytqli.exeC:\Temp\i_qoigaytqli.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\idaysqlfdx.exe ups_run3⤵
-
C:\Temp\idaysqlfdx.exeC:\Temp\idaysqlfdx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x33c,0x7ffed949c188,0x7ffed949c194,0x7ffed949c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,11197291640869358562,16113338985276014149,262144 --field-trial-handle=2652,i,7535974375869529851,11051907444069370360,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,13855336408113396654,991421892013733158,524288 --field-trial-handle=2652,i,7535974375869529851,11051907444069370360,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,16098048315710710339,14382754615695463,524288 --field-trial-handle=2652,i,7535974375869529851,11051907444069370360,262144 --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,7239945648146433511,9000250512473607799,2097152 --field-trial-handle=2652,i,7535974375869529851,11051907444069370360,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,586354330827759423,703334930505835666,2097152 --field-trial-handle=2652,i,7535974375869529851,11051907444069370360,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4356,i,5719450339636899793,5727978795522415590,2097152 --field-trial-handle=2652,i,7535974375869529851,11051907444069370360,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4404,i,10899207064212434456,537198331708162599,2097152 --field-trial-handle=2652,i,7535974375869529851,11051907444069370360,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,14202170028997810136,17552085556546204216,524288 --field-trial-handle=2652,i,7535974375869529851,11051907444069370360,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,5287670248686269649,5491945688434908897,524288 --field-trial-handle=2652,i,7535974375869529851,11051907444069370360,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,11849064426220037878,16750738949005294685,524288 --field-trial-handle=2652,i,7535974375869529851,11051907444069370360,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,17399836892427903281,16250722182631647052,524288 --field-trial-handle=2652,i,7535974375869529851,11051907444069370360,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,17399836892427903281,16250722182631647052,524288 --field-trial-handle=2652,i,7535974375869529851,11051907444069370360,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,17292321147221729284,12213660385708060796,524288 --field-trial-handle=2652,i,7535974375869529851,11051907444069370360,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,16657688686498407463,2403838065587624006,524288 --field-trial-handle=2652,i,7535974375869529851,11051907444069370360,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,3948571234106249788,942666799159537181,524288 --field-trial-handle=2652,i,7535974375869529851,11051907444069370360,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,991902534588499850,12095270172437870873,524288 --field-trial-handle=2652,i,7535974375869529851,11051907444069370360,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4656,i,17147632922220350300,3874878997262478372,524288 --field-trial-handle=2652,i,7535974375869529851,11051907444069370360,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,11829433230251994192,15389727496325394090,524288 --field-trial-handle=2652,i,7535974375869529851,11051907444069370360,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,2770524371537465667,7835843125075394585,524288 --field-trial-handle=2652,i,7535974375869529851,11051907444069370360,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,4336840982828403652,5675972877183807902,524288 --field-trial-handle=2652,i,7535974375869529851,11051907444069370360,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,7991425847832132161,6893306076060716680,524288 --field-trial-handle=2652,i,7535974375869529851,11051907444069370360,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,898352390281042611,8477549044733712180,524288 --field-trial-handle=2652,i,7535974375869529851,11051907444069370360,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,7051274550215147640,12405711304336277921,524288 --field-trial-handle=2652,i,7535974375869529851,11051907444069370360,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6612,i,12749533838861233823,4352237877770545862,262144 --field-trial-handle=2652,i,7535974375869529851,11051907444069370360,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,16281203700216607824,6112936829149638058,524288 --field-trial-handle=2652,i,7535974375869529851,11051907444069370360,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\trljdbwtomgbytrl.sysC:\Temp\trljdbwtomgbytrl.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\qoigdywqol.sysC:\Temp\qoigdywqol.sys1⤵
- Executes dropped EXE
-
C:\Temp\idavsnlfdx.sysC:\Temp\idavsnlfdx.sys1⤵
- Executes dropped EXE
-
C:\Temp\xspnkfcaxs.sysC:\Temp\xspnkfcaxs.sys1⤵
- Executes dropped EXE
-
C:\Temp\kicausnkfc.sysC:\Temp\kicausnkfc.sys1⤵
- Executes dropped EXE
-
C:\Temp\xrpmkecxup.sysC:\Temp\xrpmkecxup.sys1⤵
- Executes dropped EXE
-
C:\Temp\urmjhezwuo.sysC:\Temp\urmjhezwuo.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhbztrmjeb.sysC:\Temp\jhbztrmjeb.sys1⤵
- Executes dropped EXE
-
C:\Temp\omgeywqomj.sysC:\Temp\omgeywqomj.sys1⤵
- Executes dropped EXE
-
C:\Temp\gaywqoidbv.sysC:\Temp\gaywqoidbv.sys1⤵
- Executes dropped EXE
-
C:\Temp\gaysqkiday.sysC:\Temp\gaysqkiday.sys1⤵
- Executes dropped EXE
-
C:\Temp\ifaxvtqcax.sysC:\Temp\ifaxvtqcax.sys1⤵
-
C:\Temp\ifaysqkica.sysC:\Temp\ifaysqkica.sys1⤵
-
C:\Temp\xrpkhczxrp.sysC:\Temp\xrpkhczxrp.sys1⤵
-
C:\Temp\hczusmkecw.sysC:\Temp\hczusmkecw.sys1⤵
-
C:\Temp\ezxrpmkecz.sysC:\Temp\ezxrpmkecz.sys1⤵
-
C:\Temp\hbzwrojgbz.sysC:\Temp\hbzwrojgbz.sys1⤵
-
C:\Temp\ywtolgdbwt.sysC:\Temp\ywtolgdbwt.sys1⤵
-
C:\Temp\vtnlfdyvtn.sysC:\Temp\vtnlfdyvtn.sys1⤵
-
C:\Temp\qnigaysqki.sysC:\Temp\qnigaysqki.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
avsnlfcays.exe
axvsmkfcxv.exe
i_avsnlfcays.exe
i_axvsmkfcxv.exe
i_qolgdbtnlf.exe
i_usmkfcwupm.exe
i_wqolgdbvld.exe
idavsnlfdx.sys
kicausnkfc.sys
qoigdywqol.sys
qolgdbtnlf.exe
trljdbwtomgbytrl.exe
trljdbwtomgbytrl.sys
usmkfcwupm.exe
wqolgdbvld.exe
xrpmkecxup.sys
xspnkfcaxs.sys
xusmkhczxu.exe
0ecc8eb8-854e-41f3-b823-8ccd75aa3ce2.tmp
7d4fb3d1-c9b8-4133-b8a3-abe618ba633d.tmp
9030660d-c420-486e-9a3b-c92b08742c84.tmp
settings.dat
settings.dat
030924d0-3d5e-4802-b398-f3f03913bb99.tmp
2f72c8b4-0125-472d-8941-7061dd7e48dd.tmp
5f3511bc-fd77-4960-90b9-9e8f5ff1b206.tmp
7db3d16d-1c66-4e60-b5de-b3ead11eccdb.tmp
temp-index
the-real-index
347b052a-8bdf-47b0-ad21-41ec3d06a7b8.tmp
dasherSettingSchema.json
00640be7-3b00-454b-8e81-e661d648fde5.tmp
0933fa90-40dd-4292-afe1-7cba00a7f620.tmp
75d4544e-412d-4444-b011-8f143dec171d.tmp
d1545f93-73dd-4755-8dee-087372d47cf2.tmp
25bbef92-2d35-4680-a8e2-3fa6fb5c5bdc.tmp
OperationConfig
b3197943-43fe-4838-9c4a-196fd6e2ecca.tmp
728f3805-35f7-4248-a870-5e994c1da8c2.tmp
75de106e-2855-41c4-88fa-9f12c8523505.tmp
bb0946bc-54e1-42a3-ba4a-4be505861163.tmp
05482be8-41a1-4908-9fa4-8196a31ec609.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
564ddd0f-5963-4ea7-973e-7d09ed7fa20c.tmp
f2b2f6de-95b1-4c35-8cbf-eff3e6872689.tmp
fca3ae43-30bc-406e-a2c8-b6f6cbf42b96.tmp
6badf702-4192-424e-9df8-324103bdea3a.tmp
842c0019-0a7d-43f2-9204-8bba68bb19b6.tmp
messages.json
content.js
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/1288-678-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1488-562-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2928-612-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3076-485-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3076-432-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3096-721-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3124-739-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3528-690-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4328-624-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4372-481-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4440-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4720-716-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4824-694-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4824-718-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4848-510-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4848-528-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5052-569-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5052-535-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5452-522-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5588-558-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5860-658-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5940-638-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6052-582-0x0000000000010000-0x00000000000AB000-memory.dmp