Analysis
- max time kernel
148s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
26/10/2026, 23:57
General
- Target 2026-10-25_73c1d2dc22c8df3eab3f3eff6cbda448_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261026-3zsgdaxt4l
- SHA256 87954fe95e15b345d41188714bf777718eadfe443486862ab87522cf93c4f766
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-25_73c1d2dc22c8df3eab3f3eff6cbda448_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-25_73c1d2dc22c8df3eab3f3eff6cbda448_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\aysqlidavtnlfdyv.exeC:\Temp\aysqlidavtnlfdyv.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\aysqlidavn.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\aysqlidavn.exeC:\Temp\aysqlidavn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_aysqlidavn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_aysqlidavn.exeC:\Temp\i_aysqlidavn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\causmkfcxu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\causmkfcxu.exeC:\Temp\causmkfcxu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_causmkfcxu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_causmkfcxu.exeC:\Temp\i_causmkfcxu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ausnkfdxvp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ausnkfdxvp.exeC:\Temp\ausnkfdxvp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ausnkfdxvp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ausnkfdxvp.exeC:\Temp\i_ausnkfdxvp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usmkecwupm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\usmkecwupm.exeC:\Temp\usmkecwupm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usmkecwupm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_usmkecwupm.exeC:\Temp\i_usmkecwupm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\urmkecztrm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\urmkecztrm.exeC:\Temp\urmkecztrm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_urmkecztrm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_urmkecztrm.exeC:\Temp\i_urmkecztrm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rojdbwtrlj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rojdbwtrlj.exeC:\Temp\rojdbwtrlj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rojdbwtrlj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rojdbwtrlj.exeC:\Temp\i_rojdbwtrlj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ztrljdbwto.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ztrljdbwto.exeC:\Temp\ztrljdbwto.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ztrljdbwto.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ztrljdbwto.exeC:\Temp\i_ztrljdbwto.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bytqolgdbv.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bytqolgdbv.exeC:\Temp\bytqolgdbv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bytqolgdbv.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bytqolgdbv.exeC:\Temp\i_bytqolgdbv.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tqlgdyvqnl.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\tqlgdyvqnl.exeC:\Temp\tqlgdyvqnl.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tqlgdyvqnl.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_tqlgdyvqnl.exeC:\Temp\i_tqlgdyvqnl.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kicaxsqkic.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kicaxsqkic.exeC:\Temp\kicaxsqkic.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kicaxsqkic.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kicaxsqkic.exeC:\Temp\i_kicaxsqkic.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnkfdxsqki.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pnkfdxsqki.exeC:\Temp\pnkfdxsqki.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnkfdxsqki.exe ups_ins3⤵
-
C:\Temp\i_pnkfdxsqki.exeC:\Temp\i_pnkfdxsqki.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mkicausmke.exe ups_run3⤵
-
C:\Temp\mkicausmke.exeC:\Temp\mkicausmke.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mkicausmke.exe ups_ins3⤵
-
C:\Temp\i_mkicausmke.exeC:\Temp\i_mkicausmke.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pjhbzwupmk.exe ups_run3⤵
-
C:\Temp\pjhbzwupmk.exeC:\Temp\pjhbzwupmk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pjhbzwupmk.exe ups_ins3⤵
-
C:\Temp\i_pjhbzwupmk.exeC:\Temp\i_pjhbzwupmk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pjhbztrlje.exe ups_run3⤵
-
C:\Temp\pjhbztrlje.exeC:\Temp\pjhbztrlje.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pjhbztrlje.exe ups_ins3⤵
-
C:\Temp\i_pjhbztrlje.exeC:\Temp\i_pjhbztrlje.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zwrojgebzt.exe ups_run3⤵
-
C:\Temp\zwrojgebzt.exeC:\Temp\zwrojgebzt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zwrojgebzt.exe ups_ins3⤵
-
C:\Temp\i_zwrojgebzt.exeC:\Temp\i_zwrojgebzt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdbywqoigb.exe ups_run3⤵
-
C:\Temp\jdbywqoigb.exeC:\Temp\jdbywqoigb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdbywqoigb.exe ups_ins3⤵
-
C:\Temp\i_jdbywqoigb.exeC:\Temp\i_jdbywqoigb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gaywqoiday.exe ups_run3⤵
-
C:\Temp\gaywqoiday.exeC:\Temp\gaywqoiday.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gaywqoiday.exe ups_ins3⤵
-
C:\Temp\i_gaywqoiday.exeC:\Temp\i_gaywqoiday.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nlfvpnifay.exe ups_run3⤵
-
C:\Temp\nlfvpnifay.exeC:\Temp\nlfvpnifay.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nlfvpnifay.exe ups_ins3⤵
-
C:\Temp\i_nlfvpnifay.exeC:\Temp\i_nlfvpnifay.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qnifdxvqni.exe ups_run3⤵
-
C:\Temp\qnifdxvqni.exeC:\Temp\qnifdxvqni.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qnifdxvqni.exe ups_ins3⤵
-
C:\Temp\i_qnifdxvqni.exeC:\Temp\i_qnifdxvqni.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\spkicausmk.exe ups_run3⤵
-
C:\Temp\spkicausmk.exeC:\Temp\spkicausmk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffa1c79c188,0x7ffa1c79c194,0x7ffa1c79c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1928,i,3544748501049638350,9069100781401098404,262144 --field-trial-handle=2528,i,10076104448273912382,16030328593080281121,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2096,i,832495457232712627,15976117113830508183,524288 --field-trial-handle=2528,i,10076104448273912382,16030328593080281121,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2644,i,204882186185855016,11769640257720367020,524288 --field-trial-handle=2528,i,10076104448273912382,16030328593080281121,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,15634834690089956221,4092527958152497940,2097152 --field-trial-handle=2528,i,10076104448273912382,16030328593080281121,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3624,i,2659647831131255405,13508432079638464559,2097152 --field-trial-handle=2528,i,10076104448273912382,16030328593080281121,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,610027508993010493,18047074969429167428,2097152 --field-trial-handle=2528,i,10076104448273912382,16030328593080281121,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,10128773901310203947,12240060642764988079,2097152 --field-trial-handle=2528,i,10076104448273912382,16030328593080281121,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3764,i,16677559142522678780,14156646306840826028,2097152 --field-trial-handle=2528,i,10076104448273912382,16030328593080281121,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,4752805802796183272,8612037778892613963,524288 --field-trial-handle=2528,i,10076104448273912382,16030328593080281121,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5296,i,5540901894125500371,14883991178952459658,2097152 --field-trial-handle=2528,i,10076104448273912382,16030328593080281121,262144 --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4228,i,2137403048127762916,11317853829159692092,524288 --field-trial-handle=2528,i,10076104448273912382,16030328593080281121,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4912,i,17752203178518607830,626467394649873553,524288 --field-trial-handle=2528,i,10076104448273912382,16030328593080281121,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,1622254934290850650,5831767308649579698,524288 --field-trial-handle=2528,i,10076104448273912382,16030328593080281121,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,1622254934290850650,5831767308649579698,524288 --field-trial-handle=2528,i,10076104448273912382,16030328593080281121,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,7878144044008710595,12453500024522257468,524288 --field-trial-handle=2528,i,10076104448273912382,16030328593080281121,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,5704573098306885791,16050425926508340777,524288 --field-trial-handle=2528,i,10076104448273912382,16030328593080281121,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,14186304961905106181,13895313588023174712,524288 --field-trial-handle=2528,i,10076104448273912382,16030328593080281121,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6772,i,666952098257992612,11795805012717894134,524288 --field-trial-handle=2528,i,10076104448273912382,16030328593080281121,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,1143405587682456445,12796044297256070973,524288 --field-trial-handle=2528,i,10076104448273912382,16030328593080281121,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1276,i,11837943532628010198,18262839373970284870,524288 --field-trial-handle=2528,i,10076104448273912382,16030328593080281121,262144 --variations-seed-version --mojo-platform-channel-handle=1264 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,16843531721951716626,9473629673678711734,524288 --field-trial-handle=2528,i,10076104448273912382,16030328593080281121,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,8512629683656089123,10760890638567548755,524288 --field-trial-handle=2528,i,10076104448273912382,16030328593080281121,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,13853265226716043345,11210629934194656013,524288 --field-trial-handle=2528,i,10076104448273912382,16030328593080281121,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6720,i,6504053570018372512,3105025006018385745,262144 --field-trial-handle=2528,i,10076104448273912382,16030328593080281121,262144 --variations-seed-version --mojo-platform-channel-handle=920 /prefetch:104⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\aysqlidavtnlfdyv.sysC:\Temp\aysqlidavtnlfdyv.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\qkicayvpni.sysC:\Temp\qkicayvpni.sys1⤵
- Executes dropped EXE
-
C:\Temp\cxvsnkfcxv.sysC:\Temp\cxvsnkfcxv.sys1⤵
- Executes dropped EXE
-
C:\Temp\rpnhecxupn.sysC:\Temp\rpnhecxupn.sys1⤵
- Executes dropped EXE
-
C:\Temp\uomjecwuom.sysC:\Temp\uomjecwuom.sys1⤵
- Executes dropped EXE
-
C:\Temp\bzwrpjgezw.sysC:\Temp\bzwrpjgezw.sys1⤵
- Executes dropped EXE
-
C:\Temp\bztrljdbwt.sysC:\Temp\bztrljdbwt.sys1⤵
- Executes dropped EXE
-
C:\Temp\bytrljdbvt.sysC:\Temp\bytrljdbvt.sys1⤵
- Executes dropped EXE
-
C:\Temp\yvqnigaysq.sysC:\Temp\yvqnigaysq.sys1⤵
- Executes dropped EXE
-
C:\Temp\ysqnigaysq.sysC:\Temp\ysqnigaysq.sys1⤵
- Executes dropped EXE
-
C:\Temp\pnkfcausnk.sysC:\Temp\pnkfcausnk.sys1⤵
- Executes dropped EXE
-
C:\Temp\pnhfcausmk.sysC:\Temp\pnhfcausmk.sys1⤵
-
C:\Temp\pjhbzxupmk.sysC:\Temp\pjhbzxupmk.sys1⤵
-
C:\Temp\xrpjhczurm.sysC:\Temp\xrpjhczurm.sys1⤵
-
C:\Temp\bwuomgeywr.sysC:\Temp\bwuomgeywr.sys1⤵
-
C:\Temp\ebvtroigeb.sysC:\Temp\ebvtroigeb.sys1⤵
-
C:\Temp\qgaytqljdb.sysC:\Temp\qgaytqljdb.sys1⤵
-
C:\Temp\lidayvqnli.sysC:\Temp\lidayvqnli.sys1⤵
-
C:\Temp\qkifaysqni.sysC:\Temp\qkifaysqni.sys1⤵
-
C:\Temp\vpnkfdxvpn.sysC:\Temp\vpnkfdxvpn.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ausnkfdxvp.exe
aysqlidavn.exe
aysqlidavtnlfdyv.exe
aysqlidavtnlfdyv.sys
bzwrpjgezw.sys
causmkfcxu.exe
cxvsnkfcxv.sys
i_ausnkfdxvp.exe
i_aysqlidavn.exe
i_causmkfcxu.exe
i_urmkecztrm.exe
i_usmkecwupm.exe
qkicayvpni.sys
rojdbwtrlj.exe
rpnhecxupn.sys
uomjecwuom.sys
urmkecztrm.exe
usmkecwupm.exe
0a7df9d5-fba2-443f-85c4-392bce0c0132.tmp
834276d7-a63c-46f5-8b6d-9cffa539b483.tmp
8b47ecf8-a622-42a7-af36-3eb9fa810fe4.tmp
8d1f9451-fee8-42ee-ab28-bfa8257f4bee.tmp
settings.dat
settings.dat
8bf49b30-a7c4-42f7-a205-e1290a8051d5.tmp
94116cca-33c8-45dd-aea3-c4cd73860574.tmp
9618f0d6-e222-4e4f-8c66-3aa3bef8550e.tmp
9f504cd9-8ea1-4398-84c6-e71e436c4a88.tmp
temp-index
4619319d-9856-42d3-b37a-5b39cd210294.tmp
dasherSettingSchema.json
1a32dbf2-f6af-44a5-a787-bf54d8bd24ef.tmp
647a1f24-4156-4332-bf31-a450c1053459.tmp
6dbbbbd1-6c3b-4ee0-ba10-ebe4665f12d3.tmp
sync_diagnostic.log
dbf46281-76d7-47e3-be8d-487ca9d62745.tmp
e3df2033-aff2-41d1-937a-2b5276b6b418.tmp
2d993a3e-654b-4ba2-9294-2aa99cfcf140.tmp
ce76e754-1fc8-4cc5-abc8-2ca9b7cf9fe6.tmp
d16e2e4c-d2ad-44bc-9907-4b7e19347414.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
6b58dc64-4c46-4ce4-823d-cf0216568d00.tmp
metadata.json
9aaab72a-0cb0-4be7-af34-3569527de11a.tmp
e4347372-2ac7-4790-98af-f90e535cf041.tmp
messages.json
content.js
CreateProcess.exe
memory/472-668-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/616-507-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1060-626-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1740-556-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2240-656-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2272-519-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2592-580-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2680-664-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2816-482-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2840-532-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3160-652-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3644-648-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4240-640-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4432-606-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4688-433-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4816-660-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5340-62-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5568-576-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5572-644-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6052-560-0x0000000000010000-0x00000000000AB000-memory.dmp