Analysis
- max time kernel
148s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
27/10/2026, 13:36
General
- Target 2026-10-26_7e5a04ff082f0e161dd519d22603ec3c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261027-qwm19set3n
- SHA256 cd9b8ea53e4bd82547dd0da096bbc507a307ab8c012663b072f0028497bf63df
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_7e5a04ff082f0e161dd519d22603ec3c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-26_7e5a04ff082f0e161dd519d22603ec3c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\yvqoigaytqoigayt.exeC:\Temp\yvqoigaytqoigayt.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdyvtnljdy.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\fdyvtnljdy.exeC:\Temp\fdyvtnljdy.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdyvtnljdy.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fdyvtnljdy.exeC:\Temp\i_fdyvtnljdy.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ysqkidxvqn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ysqkidxvqn.exeC:\Temp\ysqkidxvqn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ysqkidxvqn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ysqkidxvqn.exeC:\Temp\i_ysqkidxvqn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\spnhfaxspk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\spnhfaxspk.exeC:\Temp\spnhfaxspk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_spnhfaxspk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_spnhfaxspk.exeC:\Temp\i_spnhfaxspk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpmkhczxup.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rpmkhczxup.exeC:\Temp\rpmkhczxup.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpmkhczxup.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rpmkhczxup.exeC:\Temp\i_rpmkhczxup.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\czusmkczur.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\czusmkczur.exeC:\Temp\czusmkczur.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_czusmkczur.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_czusmkczur.exeC:\Temp\i_czusmkczur.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecwuomgecz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ecwuomgecz.exeC:\Temp\ecwuomgecz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecwuomgecz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ecwuomgecz.exeC:\Temp\i_ecwuomgecz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mjhbzwtolj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mjhbzwtolj.exeC:\Temp\mjhbzwtolj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mjhbzwtolj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mjhbzwtolj.exeC:\Temp\i_mjhbzwtolj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jebwtomgey.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jebwtomgey.exeC:\Temp\jebwtomgey.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jebwtomgey.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jebwtomgey.exeC:\Temp\i_jebwtomgey.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ligavtqljd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ligavtqljd.exeC:\Temp\ligavtqljd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ligavtqljd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ligavtqljd.exeC:\Temp\i_ligavtqljd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\davtnlidav.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\davtnlidav.exeC:\Temp\davtnlidav.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_davtnlidav.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_davtnlidav.exeC:\Temp\i_davtnlidav.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\caxspnifay.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\caxspnifay.exeC:\Temp\caxspnifay.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_caxspnifay.exe ups_ins3⤵
-
C:\Temp\i_caxspnifay.exeC:\Temp\i_caxspnifay.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kicsmkecxu.exe ups_run3⤵
-
C:\Temp\kicsmkecxu.exeC:\Temp\kicsmkecxu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kicsmkecxu.exe ups_ins3⤵
-
C:\Temp\i_kicsmkecxu.exeC:\Temp\i_kicsmkecxu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fzxupnkfcx.exe ups_run3⤵
-
C:\Temp\fzxupnkfcx.exeC:\Temp\fzxupnkfcx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fzxupnkfcx.exe ups_ins3⤵
-
C:\Temp\i_fzxupnkfcx.exeC:\Temp\i_fzxupnkfcx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecwupmkezw.exe ups_run3⤵
-
C:\Temp\ecwupmkezw.exeC:\Temp\ecwupmkezw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecwupmkezw.exe ups_ins3⤵
-
C:\Temp\i_ecwupmkezw.exeC:\Temp\i_ecwupmkezw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpjecwuomg.exe ups_run3⤵
-
C:\Temp\rpjecwuomg.exeC:\Temp\rpjecwuomg.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpjecwuomg.exe ups_ins3⤵
-
C:\Temp\i_rpjecwuomg.exeC:\Temp\i_rpjecwuomg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zwqoljebzt.exe ups_run3⤵
-
C:\Temp\zwqoljebzt.exeC:\Temp\zwqoljebzt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zwqoljebzt.exe ups_ins3⤵
-
C:\Temp\i_zwqoljebzt.exeC:\Temp\i_zwqoljebzt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tqojgbytrl.exe ups_run3⤵
-
C:\Temp\tqojgbytrl.exeC:\Temp\tqojgbytrl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tqojgbytrl.exe ups_ins3⤵
-
C:\Temp\i_tqojgbytrl.exeC:\Temp\i_tqojgbytrl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vqnigaysql.exe ups_run3⤵
-
C:\Temp\vqnigaysql.exeC:\Temp\vqnigaysql.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vqnigaysql.exe ups_ins3⤵
-
C:\Temp\i_vqnigaysql.exeC:\Temp\i_vqnigaysql.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqnigaysqk.exe ups_run3⤵
-
C:\Temp\sqnigaysqk.exeC:\Temp\sqnigaysqk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqnigaysqk.exe ups_ins3⤵
-
C:\Temp\i_sqnigaysqk.exeC:\Temp\i_sqnigaysqk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\aysqkicavs.exe ups_run3⤵
-
C:\Temp\aysqkicavs.exeC:\Temp\aysqkicavs.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7fff8f57c188,0x7fff8f57c194,0x7fff8f57c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,11973287397329371496,7036754192195600843,262144 --field-trial-handle=2304,i,4291040695908617218,15584669354606659767,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,9551615007553630540,8048157480887610063,524288 --field-trial-handle=2304,i,4291040695908617218,15584669354606659767,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,12513445966997207937,2223909042589239221,524288 --field-trial-handle=2304,i,4291040695908617218,15584669354606659767,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,12306257756955896018,9728709288862445489,2097152 --field-trial-handle=2304,i,4291040695908617218,15584669354606659767,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,14370342205831309487,14110835293492854767,2097152 --field-trial-handle=2304,i,4291040695908617218,15584669354606659767,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4300,i,6332953457808598507,17621005958673043451,2097152 --field-trial-handle=2304,i,4291040695908617218,15584669354606659767,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,12717238892807148276,6121314231816359781,2097152 --field-trial-handle=2304,i,4291040695908617218,15584669354606659767,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,4030013371971638152,6843773499353884881,524288 --field-trial-handle=2304,i,4291040695908617218,15584669354606659767,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,8827079236219550904,10604933518898328642,524288 --field-trial-handle=2304,i,4291040695908617218,15584669354606659767,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,855403508937003212,5434595008347790083,524288 --field-trial-handle=2304,i,4291040695908617218,15584669354606659767,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,1348521000897805011,2075065611175199755,524288 --field-trial-handle=2304,i,4291040695908617218,15584669354606659767,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,1348521000897805011,2075065611175199755,524288 --field-trial-handle=2304,i,4291040695908617218,15584669354606659767,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,15508197367739844781,4448530963915531364,524288 --field-trial-handle=2304,i,4291040695908617218,15584669354606659767,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,18216969279274953816,14234355317063899197,524288 --field-trial-handle=2304,i,4291040695908617218,15584669354606659767,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,1236312466201855209,8448986995789683987,524288 --field-trial-handle=2304,i,4291040695908617218,15584669354606659767,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,5591908778186968927,97910860747288565,524288 --field-trial-handle=2304,i,4291040695908617218,15584669354606659767,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,15614468922645555616,14518710701904521832,524288 --field-trial-handle=2304,i,4291040695908617218,15584669354606659767,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4840,i,5240846816479398736,14596939004498544364,524288 --field-trial-handle=2304,i,4291040695908617218,15584669354606659767,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4828,i,5487471932216798137,2084852432905671852,524288 --field-trial-handle=2304,i,4291040695908617218,15584669354606659767,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,794739755763770792,4693129892676305400,524288 --field-trial-handle=2304,i,4291040695908617218,15584669354606659767,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,9691801877481336311,10179459742363990429,524288 --field-trial-handle=2304,i,4291040695908617218,15584669354606659767,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,13887228217976697363,4371033082005946169,524288 --field-trial-handle=2304,i,4291040695908617218,15584669354606659767,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,12257075393996848112,18001688569060175938,524288 --field-trial-handle=2304,i,4291040695908617218,15584669354606659767,262144 --variations-seed-version --mojo-platform-channel-handle=920 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6792,i,12524274900343528692,15062265073242025510,262144 --field-trial-handle=2304,i,4291040695908617218,15584669354606659767,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,5608203216964576688,15456000920305957344,524288 --field-trial-handle=2304,i,4291040695908617218,15584669354606659767,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\yvqoigaytqoigayt.sysC:\Temp\yvqoigaytqoigayt.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Temp\dxvqnifays.sysC:\Temp\dxvqnifays.sys1⤵
- Executes dropped EXE
-
C:\Temp\spkicaxvpn.sysC:\Temp\spkicaxvpn.sys1⤵
- Executes dropped EXE
-
C:\Temp\ausqkhfcxu.sysC:\Temp\ausqkhfcxu.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfcwurpjhc.sysC:\Temp\hfcwurpjhc.sys1⤵
- Executes dropped EXE
-
C:\Temp\ezwuomhezw.sysC:\Temp\ezwuomhezw.sys1⤵
- Executes dropped EXE
-
C:\Temp\omjeczwjge.sysC:\Temp\omjeczwjge.sys1⤵
- Executes dropped EXE
-
C:\Temp\gbywtoljdb.sysC:\Temp\gbywtoljdb.sys1⤵
- Executes dropped EXE
-
C:\Temp\trljdbvtql.sysC:\Temp\trljdbvtql.sys1⤵
- Executes dropped EXE
-
C:\Temp\ligaysqlid.sysC:\Temp\ligaysqlid.sys1⤵
- Executes dropped EXE
-
C:\Temp\qdausqkifa.sysC:\Temp\qdausqkifa.sys1⤵
- Executes dropped EXE
-
C:\Temp\nhfaxsqkic.sysC:\Temp\nhfaxsqkic.sys1⤵
-
C:\Temp\hfzxupnhfc.sysC:\Temp\hfzxupnhfc.sys1⤵
-
C:\Temp\czusmkecwu.sysC:\Temp\czusmkecwu.sys1⤵
-
C:\Temp\zxrpjhczur.sysC:\Temp\zxrpjhczur.sys1⤵
-
C:\Temp\eywrojgbzt.sysC:\Temp\eywrojgbzt.sys1⤵
-
C:\Temp\ywqojgbytq.sysC:\Temp\ywqojgbytq.sys1⤵
-
C:\Temp\tnlfdbvtql.sysC:\Temp\tnlfdbvtql.sys1⤵
-
C:\Temp\gaysqlidby.sysC:\Temp\gaysqlidby.sys1⤵
-
C:\Temp\dxvpnhfaxs.sysC:\Temp\dxvpnhfaxs.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ausqkhfcxu.sys
czusmkczur.exe
dxvqnifays.sys
ecwuomgecz.exe
ezwuomhezw.sys
fdyvtnljdy.exe
hfcwurpjhc.sys
i_czusmkczur.exe
i_fdyvtnljdy.exe
i_rpmkhczxup.exe
i_spnhfaxspk.exe
i_ysqkidxvqn.exe
rpmkhczxup.exe
spkicaxvpn.sys
spnhfaxspk.exe
ysqkidxvqn.exe
yvqoigaytqoigayt.exe
yvqoigaytqoigayt.sys
2a75f58c-89ea-4118-a10e-170d45bd7586.tmp
39c1f483-9c4c-4d70-9f04-5c801f65075c.tmp
7bfc8738-e1cc-4da0-b1df-d8155c5b1c81.tmp
settings.dat
settings.dat
1e5e2648-f549-40e4-a152-f7f61db795ad.tmp
59727129-5771-4daa-a925-358f6d3e9965.tmp
temp-index
the-real-index
76714f74-b544-46b6-80e6-a5a723465bca.tmp
Edge Profile.ico
dasherSettingSchema.json
b8cadc33-b485-478c-a4a6-80a47021fad4.tmp
e430809c-5ef2-44e0-872a-21a8a0fab72f.tmp
f43a1b46-29e2-4464-8237-2603a48abd76.tmp
sync_diagnostic.log
ed3664a0-ec1c-4d56-8d63-297674e4db01.tmp
f70e879f-10c1-41b4-bd4b-624bba7b04c8.tmp
7676bf58-3aa8-46f9-9082-f950e8fc6f90.tmp
a1946917-a5b1-434d-8b15-19df67435cd1.tmp
c29d9194-7463-4159-a937-2b27cd9d6a7b.tmp
a24a1a0b-b935-467a-9908-2391bff48379.tmp
c7773251-7466-4748-88ca-caa0f9dfb654.tmp
da0631a4-617e-4be8-a1b4-2ecfd67f09fd.tmp
d5cf1de1-4e25-4afd-96f8-e39048636e4f.tmp
07a9499e-4644-4ffd-84cb-91f9346afef2.tmp
1eb466c7-472b-4d58-ab24-057788f8f2d3.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
697757a2-c42e-42f2-bc28-6ac350406ef2.tmp
d6ff00d5-8396-4e3f-8a15-ea57a6352ef4.tmp
messages.json
content.js
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/52-718-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/588-511-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1324-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3000-696-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3452-563-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3716-536-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4120-656-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4252-634-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4280-584-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4328-722-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4360-579-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4364-692-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4568-523-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4704-614-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4888-482-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4980-680-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5288-433-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5288-488-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5716-740-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5796-660-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6036-559-0x0000000000010000-0x00000000000AB000-memory.dmp