Analysis
- max time kernel
149s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
26/10/2026, 04:57
General
- Target 2026-10-25_fca1cf248ede486bbd32dc44f626041e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261026-flmbwaae25
- SHA256 2fca5bc1a33219974770e5665ab45ddd71b14a40031ccff9fc4b88e9adcdf1d1
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-25_fca1cf248ede486bbd32dc44f626041e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-25_fca1cf248ede486bbd32dc44f626041e_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\lgeywqojgeywqojg.exeC:\Temp\lgeywqojgeywqojg.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qojgbywqoj.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\qojgbywqoj.exeC:\Temp\qojgbywqoj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qojgbywqoj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qojgbywqoj.exeC:\Temp\i_qojgbywqoj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\igdywqoigd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\igdywqoigd.exeC:\Temp\igdywqoigd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_igdywqoigd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_igdywqoigd.exeC:\Temp\i_igdywqoigd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qoidavtnlx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qoidavtnlx.exeC:\Temp\qoidavtnlx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qoidavtnlx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qoidavtnlx.exeC:\Temp\i_qoidavtnlx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kidavsnkic.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kidavsnkic.exeC:\Temp\kidavsnkic.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kidavsnkic.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kidavsnkic.exeC:\Temp\i_kidavsnkic.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\axvsnhfaxs.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\axvsnhfaxs.exeC:\Temp\axvsnhfaxs.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_axvsnhfaxs.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_axvsnhfaxs.exeC:\Temp\i_axvsnhfaxs.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hcausmkfcx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hcausmkfcx.exeC:\Temp\hcausmkfcx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hcausmkfcx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hcausmkfcx.exeC:\Temp\i_hcausmkfcx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hfzxusmkec.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hfzxusmkec.exeC:\Temp\hfzxusmkec.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hfzxusmkec.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hfzxusmkec.exeC:\Temp\i_hfzxusmkec.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mgecwuomhe.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mgecwuomhe.exeC:\Temp\mgecwuomhe.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mgecwuomhe.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mgecwuomhe.exeC:\Temp\i_mgecwuomhe.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wtomgeywro.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wtomgeywro.exeC:\Temp\wtomgeywro.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wtomgeywro.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wtomgeywro.exeC:\Temp\i_wtomgeywro.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rojgbytqoi.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rojgbytqoi.exeC:\Temp\rojgbytqoi.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rojgbytqoi.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rojgbytqoi.exeC:\Temp\i_rojgbytqoi.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wqoigbvtql.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wqoigbvtql.exeC:\Temp\wqoigbvtql.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wqoigbvtql.exe ups_ins3⤵
-
C:\Temp\i_wqoigbvtql.exeC:\Temp\i_wqoigbvtql.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vqoigaysqn.exe ups_run3⤵
-
C:\Temp\vqoigaysqn.exeC:\Temp\vqoigaysqn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vqoigaysqn.exe ups_ins3⤵
-
C:\Temp\i_vqoigaysqn.exeC:\Temp\i_vqoigaysqn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nhfaxsqkif.exe ups_run3⤵
-
C:\Temp\nhfaxsqkif.exeC:\Temp\nhfaxsqkif.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nhfaxsqkif.exe ups_ins3⤵
-
C:\Temp\i_nhfaxsqkif.exeC:\Temp\i_nhfaxsqkif.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnhfcxupnh.exe ups_run3⤵
-
C:\Temp\pnhfcxupnh.exeC:\Temp\pnhfcxupnh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnhfcxupnh.exe ups_ins3⤵
-
C:\Temp\i_pnhfcxupnh.exeC:\Temp\i_pnhfcxupnh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xupmkhczxs.exe ups_run3⤵
-
C:\Temp\xupmkhczxs.exeC:\Temp\xupmkhczxs.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xupmkhczxs.exe ups_ins3⤵
-
C:\Temp\i_xupmkhczxs.exeC:\Temp\i_xupmkhczxs.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hbzurpjhcz.exe ups_run3⤵
-
C:\Temp\hbzurpjhcz.exeC:\Temp\hbzurpjhcz.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hbzurpjhcz.exe ups_ins3⤵
-
C:\Temp\i_hbzurpjhcz.exeC:\Temp\i_hbzurpjhcz.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhbztromge.exe ups_run3⤵
-
C:\Temp\jhbztromge.exeC:\Temp\jhbztromge.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhbztromge.exe ups_ins3⤵
-
C:\Temp\i_jhbztromge.exeC:\Temp\i_jhbztromge.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\urljdbomge.exe ups_run3⤵
-
C:\Temp\urljdbomge.exeC:\Temp\urljdbomge.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_urljdbomge.exe ups_ins3⤵
-
C:\Temp\i_urljdbomge.exeC:\Temp\i_urljdbomge.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wqoigbytrl.exe ups_run3⤵
-
C:\Temp\wqoigbytrl.exeC:\Temp\wqoigbytrl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wqoigbytrl.exe ups_ins3⤵
-
C:\Temp\i_wqoigbytrl.exeC:\Temp\i_wqoigbytrl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqoljdaysq.exe ups_run3⤵
-
C:\Temp\sqoljdaysq.exeC:\Temp\sqoljdaysq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x300,0x7ffc527cc188,0x7ffc527cc194,0x7ffc527cc1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1892,i,15657166773964982520,2455541221857423882,262144 --field-trial-handle=2800,i,10699935188204401831,12675749215206251685,262144 --variations-seed-version --mojo-platform-channel-handle=2796 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2024,i,8165336364514264611,4757271761046040178,524288 --field-trial-handle=2800,i,10699935188204401831,12675749215206251685,262144 --variations-seed-version --mojo-platform-channel-handle=2828 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2420,i,342464241797523977,11714916796670546067,524288 --field-trial-handle=2800,i,10699935188204401831,12675749215206251685,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,12254093307129831794,5389058870491699082,2097152 --field-trial-handle=2800,i,10699935188204401831,12675749215206251685,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,8498810534960923632,5212078498862939380,2097152 --field-trial-handle=2800,i,10699935188204401831,12675749215206251685,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,14372929625585835170,11731489514971140902,2097152 --field-trial-handle=2800,i,10699935188204401831,12675749215206251685,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,8266232815927847090,14110620721550190358,2097152 --field-trial-handle=2800,i,10699935188204401831,12675749215206251685,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,4702255202011548196,14962857706375447127,524288 --field-trial-handle=2800,i,10699935188204401831,12675749215206251685,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,6042723329215991294,9959112471082228301,524288 --field-trial-handle=2800,i,10699935188204401831,12675749215206251685,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,13895505208181177887,204770186579047925,524288 --field-trial-handle=2800,i,10699935188204401831,12675749215206251685,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,11499961501787003615,9208505208413080011,524288 --field-trial-handle=2800,i,10699935188204401831,12675749215206251685,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,11499961501787003615,9208505208413080011,524288 --field-trial-handle=2800,i,10699935188204401831,12675749215206251685,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,366448482281350915,13807656954360943618,524288 --field-trial-handle=2800,i,10699935188204401831,12675749215206251685,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,6319460344282064629,1250843864919654273,524288 --field-trial-handle=2800,i,10699935188204401831,12675749215206251685,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,4779274328610680645,15444629915591482316,524288 --field-trial-handle=2800,i,10699935188204401831,12675749215206251685,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,8110836041241621548,5374433002608413423,524288 --field-trial-handle=2800,i,10699935188204401831,12675749215206251685,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1276,i,1885125264518272272,7952797044538997176,524288 --field-trial-handle=2800,i,10699935188204401831,12675749215206251685,262144 --variations-seed-version --mojo-platform-channel-handle=1260 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,12115316835360180288,16872753071814063019,524288 --field-trial-handle=2800,i,10699935188204401831,12675749215206251685,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1284,i,14224809774408286678,6909232727434776377,524288 --field-trial-handle=2800,i,10699935188204401831,12675749215206251685,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,7770086017348546844,12741707666001148555,524288 --field-trial-handle=2800,i,10699935188204401831,12675749215206251685,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,18010285620258247461,7910611798480325801,524288 --field-trial-handle=2800,i,10699935188204401831,12675749215206251685,262144 --variations-seed-version --mojo-platform-channel-handle=1424 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,8438599596045068810,16357756477834649743,524288 --field-trial-handle=2800,i,10699935188204401831,12675749215206251685,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,13915694412325656321,14551978448759424632,524288 --field-trial-handle=2800,i,10699935188204401831,12675749215206251685,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5152,i,13589404180396473541,15517007036098535912,262144 --field-trial-handle=2800,i,10699935188204401831,12675749215206251685,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,14082205711373053255,7151541044760523795,524288 --field-trial-handle=2800,i,10699935188204401831,12675749215206251685,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\lgeywqojgeywqojg.sysC:\Temp\lgeywqojgeywqojg.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\olgdbztolj.sysC:\Temp\olgdbztolj.sys1⤵
- Executes dropped EXE
-
C:\Temp\ysqligayvt.sysC:\Temp\ysqligayvt.sys1⤵
- Executes dropped EXE
-
C:\Temp\qkifayvqni.sysC:\Temp\qkifayvqni.sys1⤵
- Executes dropped EXE
-
C:\Temp\caxspnkfcx.sysC:\Temp\caxspnkfcx.sys1⤵
- Executes dropped EXE
-
C:\Temp\kicausmkfc.sysC:\Temp\kicausmkfc.sys1⤵
- Executes dropped EXE
-
C:\Temp\mhfzxrpmhf.sysC:\Temp\mhfzxrpmhf.sys1⤵
- Executes dropped EXE
-
C:\Temp\kebztrpmhe.sysC:\Temp\kebztrpmhe.sys1⤵
- Executes dropped EXE
-
C:\Temp\wtomgeywro.sysC:\Temp\wtomgeywro.sys1⤵
- Executes dropped EXE
-
C:\Temp\ztrljdbywq.sysC:\Temp\ztrljdbywq.sys1⤵
- Executes dropped EXE
-
C:\Temp\ywqoigbytq.sysC:\Temp\ywqoigbytq.sys1⤵
- Executes dropped EXE
-
C:\Temp\xvqnigaxvq.sysC:\Temp\xvqnigaxvq.sys1⤵
-
C:\Temp\sqnifdavsn.sysC:\Temp\sqnifdavsn.sys1⤵
-
C:\Temp\xvpnhfdxvp.sysC:\Temp\xvpnhfdxvp.sys1⤵
-
C:\Temp\xvpnhfzxsp.sysC:\Temp\xvpnhfzxsp.sys1⤵
-
C:\Temp\hbzxrpjhcz.sysC:\Temp\hbzxrpjhcz.sys1⤵
-
C:\Temp\rmjwurmjhb.sysC:\Temp\rmjwurmjhb.sys1⤵
-
C:\Temp\mjdbztromg.sysC:\Temp\mjdbztromg.sys1⤵
-
C:\Temp\ztqolgeywq.sysC:\Temp\ztqolgeywq.sys1⤵
-
C:\Temp\tnljdayvqo.sysC:\Temp\tnljdayvqo.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
axvsnhfaxs.exe
caxspnkfcx.sys
hcausmkfcx.exe
i_axvsnhfaxs.exe
i_igdywqoigd.exe
i_kidavsnkic.exe
i_qoidavtnlx.exe
i_qojgbywqoj.exe
igdywqoigd.exe
kicausmkfc.sys
kidavsnkic.exe
lgeywqojgeywqojg.exe
lgeywqojgeywqojg.sys
olgdbztolj.sys
qkifayvqni.sys
qoidavtnlx.exe
qojgbywqoj.exe
ysqligayvt.sys
0e169802-76a8-4bda-9f77-aa116f126b64.tmp
5c5f3776-e489-4fd5-b9e1-a1c228bf3014.tmp
99789bab-af88-48d4-814b-2f8e6597db8d.tmp
9cdeea6a-9a5f-4c84-a1ed-d0b7e39ce966.tmp
settings.dat
settings.dat
16cdf4cb-96fa-4711-8847-ee4babd48f01.tmp
37bef7fc-b472-441e-bcf4-c4c608acd9ba.tmp
5e883e54-e6e4-4917-b669-80124148eacd.tmp
7550d1cc-336b-40d8-90e7-7820bd35a8d1.tmp
94820a73-cb7a-4f7c-9ea8-e2fafd916aeb.tmp
temp-index
the-real-index
d3fbc8a1-36ee-47da-838d-f7375e6f2505.tmp
dasherSettingSchema.json
753f7490-2dee-43f0-99bf-69b8a37b14a3.tmp
acb4af19-1515-4ea7-b5c0-5e3dc4f8e9ac.tmp
f1d110c9-e38e-4155-9a31-19f835d1c84d.tmp
OperationConfig
db35eedb-c381-4029-a6d4-0f4586213562.tmp
b88b46f0-a07f-4a5c-bb73-bf63b3eac7cb.tmp
27a96a5d-e39d-4e0d-973a-a955e6e0a2ca.tmp
99d566ab-ea65-41f0-b001-a10be9d72dae.tmp
dbd48fb7-6ccc-4576-97d8-506e6d4a6c04.tmp
2e1d4db4-8d49-4276-a548-0ded6e3c4973.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
metadata.json
f3074d8c-8bae-43dd-80c0-4034a2dc2c6c.tmp
3b30f1a4-990b-42d6-9d2e-a6796be1d2be.tmp
93532d96-4771-432e-82be-8f92be64b5ad.tmp
content.js
messages.json
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/800-680-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1248-634-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2288-741-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3176-584-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3380-483-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3440-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3604-738-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3604-718-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4108-434-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4212-560-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4300-656-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4372-692-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4512-511-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4908-523-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5160-743-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5160-722-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5180-696-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5476-660-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5736-580-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5792-564-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5896-536-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5948-614-0x0000000000010000-0x00000000000AB000-memory.dmp