Analysis
- max time kernel
150s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
26/10/2026, 07:34
General
- Target 2026-10-25_ec2483dd4b3e888ff58ba4e558771f5a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 376KB
- Sample261026-jec2ea1v9q
- SHA256 3dc0fddfa9e405188adc05f488fddb592c6b9aa06f745b9747781302ed816107
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-25_ec2483dd4b3e888ff58ba4e558771f5a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-25_ec2483dd4b3e888ff58ba4e558771f5a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\ecwupecwuomjecwu.exeC:\Temp\ecwupecwuomjecwu.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecwuomebwr.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\ecwuomebwr.exeC:\Temp\ecwuomebwr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecwuomebwr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ecwuomebwr.exeC:\Temp\i_ecwuomebwr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\romjebztrm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\romjebztrm.exeC:\Temp\romjebztrm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_romjebztrm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_romjebztrm.exeC:\Temp\i_romjebztrm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bztrljdbwt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bztrljdbwt.exeC:\Temp\bztrljdbwt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bztrljdbwt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bztrljdbwt.exeC:\Temp\i_bztrljdbwt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qoigdbvtnl.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qoigdbvtnl.exeC:\Temp\qoigdbvtnl.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qoigdbvtnl.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qoigdbvtnl.exeC:\Temp\i_qoigdbvtnl.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\icavsnlfdx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\icavsnlfdx.exeC:\Temp\icavsnlfdx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_icavsnlfdx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_icavsnlfdx.exeC:\Temp\i_icavsnlfdx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\davsnkifdx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\davsnkifdx.exeC:\Temp\davsnkifdx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_davsnkifdx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_davsnkifdx.exeC:\Temp\i_davsnkifdx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kicausmkfc.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kicausmkfc.exeC:\Temp\kicausmkfc.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kicausmkfc.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kicausmkfc.exeC:\Temp\i_kicausmkfc.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pjhczusmkh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pjhczusmkh.exeC:\Temp\pjhczusmkh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pjhczusmkh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pjhczusmkh.exeC:\Temp\i_pjhczusmkh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhcztrmjhb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jhcztrmjhb.exeC:\Temp\jhcztrmjhb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhcztrmjhb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jhcztrmjhb.exeC:\Temp\i_jhcztrmjhb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xrpjhbzurm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xrpjhbzurm.exeC:\Temp\xrpjhbzurm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xrpjhbzurm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xrpjhbzurm.exeC:\Temp\i_xrpjhbzurm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rojgeywqol.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rojgeywqol.exeC:\Temp\rojgeywqol.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rojgeywqol.exe ups_ins3⤵
-
C:\Temp\i_rojgeywqol.exeC:\Temp\i_rojgeywqol.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\troigaytql.exe ups_run3⤵
-
C:\Temp\troigaytql.exeC:\Temp\troigaytql.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_troigaytql.exe ups_ins3⤵
-
C:\Temp\i_troigaytql.exeC:\Temp\i_troigaytql.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qnlidbvqni.exe ups_run3⤵
-
C:\Temp\qnlidbvqni.exeC:\Temp\qnlidbvqni.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qnlidbvqni.exe ups_ins3⤵
-
C:\Temp\i_qnlidbvqni.exeC:\Temp\i_qnlidbvqni.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qnifdaysqn.exe ups_run3⤵
-
C:\Temp\qnifdaysqn.exeC:\Temp\qnifdaysqn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qnifdaysqn.exe ups_ins3⤵
-
C:\Temp\i_qnifdaysqn.exeC:\Temp\i_qnifdaysqn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vpnifayspk.exe ups_run3⤵
-
C:\Temp\vpnifayspk.exeC:\Temp\vpnifayspk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vpnifayspk.exe ups_ins3⤵
-
C:\Temp\i_vpnifayspk.exeC:\Temp\i_vpnifayspk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvpnhfzxrp.exe ups_run3⤵
-
C:\Temp\xvpnhfzxrp.exeC:\Temp\xvpnhfzxrp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xvpnhfzxrp.exe ups_ins3⤵
-
C:\Temp\i_xvpnhfzxrp.exeC:\Temp\i_xvpnhfzxrp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xrpjhczusm.exe ups_run3⤵
-
C:\Temp\xrpjhczusm.exeC:\Temp\xrpjhczusm.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xrpjhczusm.exe ups_ins3⤵
-
C:\Temp\i_xrpjhczusm.exeC:\Temp\i_xrpjhczusm.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\urmkeczurp.exe ups_run3⤵
-
C:\Temp\urmkeczurp.exeC:\Temp\urmkeczurp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_urmkeczurp.exe ups_ins3⤵
-
C:\Temp\i_urmkeczurp.exeC:\Temp\i_urmkeczurp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\romgezwrpj.exe ups_run3⤵
-
C:\Temp\romgezwrpj.exeC:\Temp\romgezwrpj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_romgezwrpj.exe ups_ins3⤵
-
C:\Temp\i_romgezwrpj.exeC:\Temp\i_romgezwrpj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qojgbytqoj.exe ups_run3⤵
-
C:\Temp\qojgbytqoj.exeC:\Temp\qojgbytqoj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qojgbytqoj.exe ups_ins3⤵
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffe8f65c188,0x7ffe8f65c194,0x7ffe8f65c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,3029344998723110247,1836007323220587273,524288 --field-trial-handle=2988,i,2771515928224042714,1345430640434623169,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,11296740309678233414,528252313871076297,262144 --field-trial-handle=2988,i,2771515928224042714,1345430640434623169,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2284,i,2064820725989078290,7627212529958174441,524288 --field-trial-handle=2988,i,2771515928224042714,1345430640434623169,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3608,i,6557914887083144165,16958777320922333480,2097152 --field-trial-handle=2988,i,2771515928224042714,1345430640434623169,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,15109138460453624304,15745747944476342431,2097152 --field-trial-handle=2988,i,2771515928224042714,1345430640434623169,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4328,i,15204608448675197909,8765126813138090177,2097152 --field-trial-handle=2988,i,2771515928224042714,1345430640434623169,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,4210939048309591993,2102559017908675734,2097152 --field-trial-handle=2988,i,2771515928224042714,1345430640434623169,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,17672269475738839214,13296839156769471624,524288 --field-trial-handle=2988,i,2771515928224042714,1345430640434623169,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,1672197275639012394,4993925606489265595,524288 --field-trial-handle=2988,i,2771515928224042714,1345430640434623169,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,14317284032864089784,9675445362796811498,524288 --field-trial-handle=2988,i,2771515928224042714,1345430640434623169,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,22526420589026583,17057458399833439980,524288 --field-trial-handle=2988,i,2771515928224042714,1345430640434623169,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,22526420589026583,17057458399833439980,524288 --field-trial-handle=2988,i,2771515928224042714,1345430640434623169,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,6974367603617859769,9701229770987225887,524288 --field-trial-handle=2988,i,2771515928224042714,1345430640434623169,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,6380750079733961337,11345732992921599314,524288 --field-trial-handle=2988,i,2771515928224042714,1345430640434623169,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,6016149219738044152,15652560242433640351,524288 --field-trial-handle=2988,i,2771515928224042714,1345430640434623169,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,15205699138513557020,5600369572443701202,524288 --field-trial-handle=2988,i,2771515928224042714,1345430640434623169,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4728,i,1852654228297591396,8368099741767497467,524288 --field-trial-handle=2988,i,2771515928224042714,1345430640434623169,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,15160557939589309050,7656356702423942413,524288 --field-trial-handle=2988,i,2771515928224042714,1345430640434623169,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,2889757155882552451,1072715062366913402,524288 --field-trial-handle=2988,i,2771515928224042714,1345430640434623169,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,17367351472444016036,2922811623877943854,524288 --field-trial-handle=2988,i,2771515928224042714,1345430640434623169,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,16156442341597943461,10999623949582913723,524288 --field-trial-handle=2988,i,2771515928224042714,1345430640434623169,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,10366233246341950842,17405157708346720738,524288 --field-trial-handle=2988,i,2771515928224042714,1345430640434623169,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,2460801593152281723,13667739956401555631,524288 --field-trial-handle=2988,i,2771515928224042714,1345430640434623169,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5152,i,14392026517304967177,6887444459486594958,262144 --field-trial-handle=2988,i,2771515928224042714,1345430640434623169,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3236,i,11328601713801338762,17707395986569183716,524288 --field-trial-handle=2988,i,2771515928224042714,1345430640434623169,262144 --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\ecwupecwuomjecwu.sysC:\Temp\ecwupecwuomjecwu.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\rmjhbztrlj.sysC:\Temp\rmjhbztrlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\ebwtomgeyw.sysC:\Temp\ebwtomgeyw.sys1⤵
- Executes dropped EXE
-
C:\Temp\tnljdbywqo.sysC:\Temp\tnljdbywqo.sys1⤵
- Executes dropped EXE
-
C:\Temp\vtqljdbvtn.sysC:\Temp\vtqljdbvtn.sys1⤵
- Executes dropped EXE
-
C:\Temp\idavtnlfda.sysC:\Temp\idavtnlfda.sys1⤵
- Executes dropped EXE
-
C:\Temp\icaxspnkfd.sysC:\Temp\icaxspnkfd.sys1⤵
- Executes dropped EXE
-
C:\Temp\pjhczusmke.sysC:\Temp\pjhczusmke.sys1⤵
- Executes dropped EXE
-
C:\Temp\zxrpjhfzxu.sysC:\Temp\zxrpjhfzxu.sys1⤵
- Executes dropped EXE
-
C:\Temp\xrpjhbzurm.sysC:\Temp\xrpjhbzurm.sys1⤵
- Executes dropped EXE
-
C:\Temp\wqojgeywro.sysC:\Temp\wqojgeywro.sys1⤵
- Executes dropped EXE
-
C:\Temp\toljgbytqo.sysC:\Temp\toljgbytqo.sys1⤵
-
C:\Temp\yvtnlgdytq.sysC:\Temp\yvtnlgdytq.sys1⤵
-
C:\Temp\xvqnifaysq.sysC:\Temp\xvqnifaysq.sys1⤵
-
C:\Temp\vpnifaysqk.sysC:\Temp\vpnifaysqk.sys1⤵
-
C:\Temp\xspkicaxsp.sysC:\Temp\xspkicaxsp.sys1⤵
-
C:\Temp\zxupmkhcau.sysC:\Temp\zxupmkhcau.sys1⤵
-
C:\Temp\wupmhfzxrp.sysC:\Temp\wupmhfzxrp.sys1⤵
-
C:\Temp\rljgeywurp.sysC:\Temp\rljgeywurp.sys1⤵
-
C:\Temp\boljdbwtol.sysC:\Temp\boljdbwtol.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
bztrljdbwt.exe
davsnkifdx.exe
ebwtomgeyw.sys
ecwuomebwr.exe
ecwupecwuomjecwu.exe
ecwupecwuomjecwu.sys
i_bztrljdbwt.exe
i_ecwuomebwr.exe
i_icavsnlfdx.exe
i_qoigdbvtnl.exe
i_romjebztrm.exe
icavsnlfdx.exe
idavtnlfda.sys
qoigdbvtnl.exe
rmjhbztrlj.sys
romjebztrm.exe
tnljdbywqo.sys
vtqljdbvtn.sys
1f1e4e4b-4948-4b26-bbbd-fe1cfd9e34f3.tmp
293c9d05-0010-482e-97b2-a78d87229e7c.tmp
336be260-55a4-4669-9c2a-9dc3300712e9.tmp
3b005037-0e3d-4fb8-a7eb-ab20b1e111a5.tmp
4319ee9c-9978-46bf-8af4-321f82627a1f.tmp
settings.dat
settings.dat
2844c68c-80e2-4cba-9957-82d512473b10.tmp
47726535-6cb4-4e30-8a7b-e9e4b38b6b44.tmp
temp-index
f22811eb-0da0-4f22-a786-5494cae62a2d.tmp
dasherSettingSchema.json
21faf1e5-7b98-4aad-9859-7b36d63c9102.tmp
22b92705-ed3e-49d5-a5d2-8086fcbe6513.tmp
652edca4-e5e1-41ca-b5a6-795241a80254.tmp
sync_diagnostic.log
a067610f-7746-4ab7-a1f2-b4978d3a02b3.tmp
d9976912-82d6-4f43-b455-9cfdc6f117dd.tmp
f2a35103-b171-45e1-a267-2170493df9e3.tmp
f62b4b3c-b9af-4de9-9270-62689e5ffc97.tmp
OperationConfig
c5cb8c11-d0d8-48b0-8059-168309e60cfa.tmp
c8813b16-bffe-4f42-838a-4a18b7cc26db.tmp
42a608d5-483a-4bbf-92c1-84a9b4f1147c.tmp
dd737778-2baf-4faf-b961-63c87df1d966.tmp
f44ec5e4-e7cf-4417-b5e2-e41076f4556d.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
fc83420c-14b8-4247-b54c-7055688f215a.tmp
metadata.json
18a0681e-2efa-43ac-900c-3b34977de358.tmp
350bc704-4466-436f-ac0c-ac67eafb9f51.tmp
messages.json
content.js
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/468-65-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1112-722-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1184-582-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1332-679-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2052-624-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2108-557-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2448-432-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2844-696-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2844-719-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2928-740-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2944-578-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3196-717-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4256-647-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4628-520-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4648-562-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4704-659-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4936-534-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4936-559-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5056-508-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5056-522-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5724-483-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5868-471-0x0000022864300000-0x0000022864541000-memory.dmp
memory/5884-691-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5988-634-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5988-612-0x0000000000010000-0x00000000000AB000-memory.dmp