Analysis
- max time kernel
149s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
23/10/2026, 06:38
General
- Target 2026-10-23_e20910d6d2364dfeb25ba1e239208126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261023-heflvsas5x
- SHA256 d6d073ccd1e56ba5915a077162736d656fe525f5cccd486b7c3443056d79536e
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-23_e20910d6d2364dfeb25ba1e239208126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-23_e20910d6d2364dfeb25ba1e239208126_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\ljdbwtolgeywqojg.exeC:\Temp\ljdbwtolgeywqojg.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omjdbwtrmg.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\omjdbwtrmg.exeC:\Temp\omjdbwtrmg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omjdbwtrmg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_omjdbwtrmg.exeC:\Temp\i_omjdbwtrmg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dyvqoljdbv.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dyvqoljdbv.exeC:\Temp\dyvqoljdbv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dyvqoljdbv.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dyvqoljdbv.exeC:\Temp\i_dyvqoljdbv.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nlfdbysqol.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nlfdbysqol.exeC:\Temp\nlfdbysqol.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nlfdbysqol.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nlfdbysqol.exeC:\Temp\i_nlfdbysqol.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\faysqkicav.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\faysqkicav.exeC:\Temp\faysqkicav.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_faysqkicav.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_faysqkicav.exeC:\Temp\i_faysqkicav.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqkicaxspn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\sqkicaxspn.exeC:\Temp\sqkicaxspn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqkicaxspn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_sqkicaxspn.exeC:\Temp\i_sqkicaxspn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mkecxupnhf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mkecxupnhf.exeC:\Temp\mkecxupnhf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mkecxupnhf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mkecxupnhf.exeC:\Temp\i_mkecxupnhf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pjhczurmke.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pjhczurmke.exeC:\Temp\pjhczurmke.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pjhczurmke.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pjhczurmke.exeC:\Temp\i_pjhczurmke.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecwuomhezw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ecwuomhezw.exeC:\Temp\ecwuomhezw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecwuomhezw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ecwuomhezw.exeC:\Temp\i_ecwuomhezw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trljdbwtom.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\trljdbwtom.exeC:\Temp\trljdbwtom.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trljdbwtom.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_trljdbwtom.exeC:\Temp\i_trljdbwtom.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dbvtnlgdyv.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dbvtnlgdyv.exeC:\Temp\dbvtnlgdyv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dbvtnlgdyv.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dbvtnlgdyv.exeC:\Temp\i_dbvtnlgdyv.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywqoigdbqk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ywqoigdbqk.exeC:\Temp\ywqoigdbqk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywqoigdbqk.exe ups_ins3⤵
-
C:\Temp\i_ywqoigdbqk.exeC:\Temp\i_ywqoigdbqk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qligaysqki.exe ups_run3⤵
-
C:\Temp\qligaysqki.exeC:\Temp\qligaysqki.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qligaysqki.exe ups_ins3⤵
-
C:\Temp\i_qligaysqki.exeC:\Temp\i_qligaysqki.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kfdxvpnkfd.exe ups_run3⤵
-
C:\Temp\kfdxvpnkfd.exeC:\Temp\kfdxvpnkfd.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kfdxvpnkfd.exe ups_ins3⤵
-
C:\Temp\i_kfdxvpnkfd.exeC:\Temp\i_kfdxvpnkfd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cxrpkhcaus.exe ups_run3⤵
-
C:\Temp\cxrpkhcaus.exeC:\Temp\cxrpkhcaus.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cxrpkhcaus.exe ups_ins3⤵
-
C:\Temp\i_cxrpkhcaus.exeC:\Temp\i_cxrpkhcaus.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pkhcauspjh.exe ups_run3⤵
-
C:\Temp\pkhcauspjh.exeC:\Temp\pkhcauspjh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pkhcauspjh.exe ups_ins3⤵
-
C:\Temp\i_pkhcauspjh.exeC:\Temp\i_pkhcauspjh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\khbzurpjhe.exe ups_run3⤵
-
C:\Temp\khbzurpjhe.exeC:\Temp\khbzurpjhe.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_khbzurpjhe.exe ups_ins3⤵
-
C:\Temp\i_khbzurpjhe.exeC:\Temp\i_khbzurpjhe.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ebwuomjebw.exe ups_run3⤵
-
C:\Temp\ebwuomjebw.exeC:\Temp\ebwuomjebw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ebwuomjebw.exe ups_ins3⤵
-
C:\Temp\i_ebwuomjebw.exeC:\Temp\i_ebwuomjebw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\eywqojgebw.exe ups_run3⤵
-
C:\Temp\eywqojgebw.exeC:\Temp\eywqojgebw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_eywqojgebw.exe ups_ins3⤵
-
C:\Temp\i_eywqojgebw.exeC:\Temp\i_eywqojgebw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gdywqoigay.exe ups_run3⤵
-
C:\Temp\gdywqoigay.exeC:\Temp\gdywqoigay.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gdywqoigay.exe ups_ins3⤵
-
C:\Temp\i_gdywqoigay.exeC:\Temp\i_gdywqoigay.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffd0c41c188,0x7ffd0c41c194,0x7ffd0c41c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1608,i,17050884970656752122,8155093922047898190,262144 --field-trial-handle=2324,i,8828704060151632969,15502527144780285786,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,5057266218569528966,1577547323030032921,524288 --field-trial-handle=2324,i,8828704060151632969,15502527144780285786,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2536,i,12693013023549213000,18258364126928540489,524288 --field-trial-handle=2324,i,8828704060151632969,15502527144780285786,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,2202168979570874375,17620064665084325644,2097152 --field-trial-handle=2324,i,8828704060151632969,15502527144780285786,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,18098843206632786992,10422810037235571896,2097152 --field-trial-handle=2324,i,8828704060151632969,15502527144780285786,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,1582029088405936096,11235263558217586264,2097152 --field-trial-handle=2324,i,8828704060151632969,15502527144780285786,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,16359922034682935489,361353997377175176,2097152 --field-trial-handle=2324,i,8828704060151632969,15502527144780285786,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,2722863811064615185,16991667667592871537,524288 --field-trial-handle=2324,i,8828704060151632969,15502527144780285786,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,17070909166831023459,526391959378777061,524288 --field-trial-handle=2324,i,8828704060151632969,15502527144780285786,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,9690692153390229469,3786717145548596567,524288 --field-trial-handle=2324,i,8828704060151632969,15502527144780285786,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,15735509181884757217,14750064839669161254,524288 --field-trial-handle=2324,i,8828704060151632969,15502527144780285786,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,15735509181884757217,14750064839669161254,524288 --field-trial-handle=2324,i,8828704060151632969,15502527144780285786,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,17377316581623196884,11281187126817411793,524288 --field-trial-handle=2324,i,8828704060151632969,15502527144780285786,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,5413049271430553875,7715708190611631974,524288 --field-trial-handle=2324,i,8828704060151632969,15502527144780285786,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,17888919097888159477,3595699524623547188,524288 --field-trial-handle=2324,i,8828704060151632969,15502527144780285786,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,1714835024026331925,9006686472596525871,524288 --field-trial-handle=2324,i,8828704060151632969,15502527144780285786,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,7437652389274921337,652488212197405995,524288 --field-trial-handle=2324,i,8828704060151632969,15502527144780285786,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,4292519417725830979,6559408246524240106,524288 --field-trial-handle=2324,i,8828704060151632969,15502527144780285786,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,16396219223635678438,3027523981545319457,524288 --field-trial-handle=2324,i,8828704060151632969,15502527144780285786,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,165723755259292717,12047376987935479066,524288 --field-trial-handle=2324,i,8828704060151632969,15502527144780285786,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,9686422355378454862,17650826465192976294,524288 --field-trial-handle=2324,i,8828704060151632969,15502527144780285786,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,14760446603340547328,13512700310347560525,524288 --field-trial-handle=2324,i,8828704060151632969,15502527144780285786,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,16372494812658313647,16480544261744305242,524288 --field-trial-handle=2324,i,8828704060151632969,15502527144780285786,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6824,i,4864908900641221284,17198986532694015639,524288 --field-trial-handle=2324,i,8828704060151632969,15502527144780285786,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6496,i,9079444078179516625,18312498809760960630,262144 --field-trial-handle=2324,i,8828704060151632969,15502527144780285786,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,10157165213915942257,766527207415315035,524288 --field-trial-handle=2324,i,8828704060151632969,15502527144780285786,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\ljdbwtolgeywqojg.sysC:\Temp\ljdbwtolgeywqojg.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\qomgeywqoj.sysC:\Temp\qomgeywqoj.sys1⤵
- Executes dropped EXE
-
C:\Temp\oigayvqnlg.sysC:\Temp\oigayvqnlg.sys1⤵
- Executes dropped EXE
-
C:\Temp\ifaysqkica.sysC:\Temp\ifaysqkica.sys1⤵
- Executes dropped EXE
-
C:\Temp\xsqkicavsm.sysC:\Temp\xsqkicavsm.sys1⤵
- Executes dropped EXE
-
C:\Temp\vpnhfzxspk.sysC:\Temp\vpnhfzxspk.sys1⤵
- Executes dropped EXE
-
C:\Temp\smkecxupmh.sysC:\Temp\smkecxupmh.sys1⤵
- Executes dropped EXE
-
C:\Temp\mkecwurmke.sysC:\Temp\mkecwurmke.sys1⤵
- Executes dropped EXE
-
C:\Temp\eywrojgbzt.sysC:\Temp\eywrojgbzt.sys1⤵
- Executes dropped EXE
-
C:\Temp\oljebwtrlj.sysC:\Temp\oljebwtrlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\bytqligayv.sysC:\Temp\bytqligayv.sys1⤵
- Executes dropped EXE
-
C:\Temp\sqoigaysql.sysC:\Temp\sqoigaysql.sys1⤵
-
C:\Temp\sqkicavsnl.sysC:\Temp\sqkicavsnl.sys1⤵
-
C:\Temp\icaxvpnhfs.sysC:\Temp\icaxvpnhfs.sys1⤵
-
C:\Temp\pkhcausmke.sysC:\Temp\pkhcausmke.sys1⤵
-
C:\Temp\mkecwuomkh.sysC:\Temp\mkecwuomkh.sys1⤵
-
C:\Temp\mjebzuomge.sysC:\Temp\mjebzuomge.sys1⤵
-
C:\Temp\ljebwtrljh.sysC:\Temp\ljebwtrljh.sys1⤵
-
C:\Temp\gbywqojgby.sysC:\Temp\gbywqojgby.sys1⤵
-
C:\Temp\ytqlidbvtn.sysC:\Temp\ytqlidbvtn.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
dyvqoljdbv.exe
faysqkicav.exe
i_dyvqoljdbv.exe
i_faysqkicav.exe
i_nlfdbysqol.exe
i_omjdbwtrmg.exe
i_sqkicaxspn.exe
ifaysqkica.sys
ljdbwtolgeywqojg.exe
ljdbwtolgeywqojg.sys
mkecxupnhf.exe
nlfdbysqol.exe
oigayvqnlg.sys
omjdbwtrmg.exe
qomgeywqoj.sys
sqkicaxspn.exe
vpnhfzxspk.sys
xsqkicavsm.sys
05257427-1479-4f4c-872b-e6882bd5e834.tmp
1366af81-c3c0-4677-af1d-8f0e253bdbff.tmp
3ed57397-613d-40ef-a4ef-c71afd0487b7.tmp
5a5f88a1-91c2-40c3-bc57-7b1d1d51c813.tmp
settings.dat
settings.dat
08dc04a8-ff30-495d-8d54-5168ac209712.tmp
5ac02d05-5862-434f-b2c6-d18468c700d0.tmp
LOG.old
the-real-index
the-real-index
9e65189f-fdcb-4232-8a4a-4dbc534a6910.tmp
dasherSettingSchema.json
7fde3e0c-448e-4b31-81c8-a971aded9fd4.tmp
a1bb0fe4-a018-4530-8808-91a1ffd42caf.tmp
e371ff3a-0dc4-4534-a167-92b4fa0250f7.tmp
sync_diagnostic.log
bab4f03d-b76a-4df0-a178-091b3cc3923e.tmp
c49234ad-f327-4438-a014-309d125399f8.tmp
fe0de3a7-f3ac-4948-8529-2f2e8ab79d57.tmp
66e425d7-d40f-404a-acbf-8802378998cd.tmp
OperationConfig
b51083c7-c5c3-4af0-8c2a-6eeafaf73b78.tmp
27626796-4c49-46d6-a5c5-9171a04f05f1.tmp
2d5cfe5e-d404-4a59-8cd2-0c2b2cb432ee.tmp
492d6b0a-329a-4d51-9d36-6a7c348287a4.tmp
c27b0971-31ea-4bd6-94a4-a94451509277.tmp
ec94fc71-7c53-4cd0-b1b3-d3b1b81bcc56.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
eff9876e-ed3f-41bb-84ec-606e3f977027.tmp
metadata.json
090877b2-28d3-48ff-8c6b-cc2a0e4c1921.tmp
e08c6746-31a2-4cf1-9793-1432b6f9e9ac.tmp
content.js
messages.json
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/560-699-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1336-743-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1544-588-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1684-667-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2080-508-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2156-723-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2536-613-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2592-641-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2596-533-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2604-722-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2668-575-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2688-747-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2764-663-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3224-558-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4240-480-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4456-559-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4552-520-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5332-431-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5608-679-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6136-64-0x0000000000010000-0x00000000000AB000-memory.dmp