Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
28/10/2026, 23:16
General
- Target 2026-10-27_c5d8961bc43ac0f65a502e56b13aece0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261028-285bvshf64
- SHA256 3a214f40b1d8880bbd700e575b8c9047dffefc3fd8135b8d28f048c51e047f07
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-27_c5d8961bc43ac0f65a502e56b13aece0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-27_c5d8961bc43ac0f65a502e56b13aece0_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\zurmjecwuomhezwu.exeC:\Temp\zurmjecwuomhezwu.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bzxrpjhbzu.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\bzxrpjhbzu.exeC:\Temp\bzxrpjhbzu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bzxrpjhbzu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bzxrpjhbzu.exeC:\Temp\i_bzxrpjhbzu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qojgbzwqoj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qojgbzwqoj.exeC:\Temp\qojgbzwqoj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qojgbzwqoj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qojgbzwqoj.exeC:\Temp\i_qojgbzwqoj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdbywqomge.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jdbywqomge.exeC:\Temp\jdbywqomge.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdbywqomge.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jdbywqomge.exeC:\Temp\i_jdbywqomge.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gaytqoigay.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gaytqoigay.exeC:\Temp\gaytqoigay.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gaytqoigay.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gaytqoigay.exeC:\Temp\i_gaytqoigay.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\avsnlfdyvq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\avsnlfdyvq.exeC:\Temp\avsnlfdyvq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_avsnlfdyvq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_avsnlfdyvq.exeC:\Temp\i_avsnlfdyvq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xsqnhfaxsq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xsqnhfaxsq.exeC:\Temp\xsqnhfaxsq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xsqnhfaxsq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xsqnhfaxsq.exeC:\Temp\i_xsqnhfaxsq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvsnkfcaus.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xvsnkfcaus.exeC:\Temp\xvsnkfcaus.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xvsnkfcaus.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xvsnkfcaus.exeC:\Temp\i_xvsnkfcaus.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxrpjhczxr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zxrpjhczxr.exeC:\Temp\zxrpjhczxr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxrpjhczxr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zxrpjhczxr.exeC:\Temp\i_zxrpjhczxr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pjhczurmje.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pjhczurmje.exeC:\Temp\pjhczurmje.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pjhczurmje.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pjhczurmje.exeC:\Temp\i_pjhczurmje.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ebztrmjebw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ebztrmjebw.exeC:\Temp\ebztrmjebw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ebztrmjebw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ebztrmjebw.exeC:\Temp\i_ebztrmjebw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jgbytrljeb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jgbytrljeb.exeC:\Temp\jgbytrljeb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jgbytrljeb.exe ups_ins3⤵
-
C:\Temp\i_jgbytrljeb.exeC:\Temp\i_jgbytrljeb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywtoljdayt.exe ups_run3⤵
-
C:\Temp\ywtoljdayt.exeC:\Temp\ywtoljdayt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywtoljdayt.exe ups_ins3⤵
-
C:\Temp\i_ywtoljdayt.exeC:\Temp\i_ywtoljdayt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gayvqnlfdy.exe ups_run3⤵
-
C:\Temp\gayvqnlfdy.exeC:\Temp\gayvqnlfdy.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gayvqnlfdy.exe ups_ins3⤵
-
C:\Temp\i_gayvqnlfdy.exeC:\Temp\i_gayvqnlfdy.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\axvtqdaxsp.exe ups_run3⤵
-
C:\Temp\axvtqdaxsp.exeC:\Temp\axvtqdaxsp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_axvtqdaxsp.exe ups_ins3⤵
-
C:\Temp\i_axvtqdaxsp.exeC:\Temp\i_axvtqdaxsp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nifaysqkic.exe ups_run3⤵
-
C:\Temp\nifaysqkic.exeC:\Temp\nifaysqkic.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nifaysqkic.exe ups_ins3⤵
-
C:\Temp\i_nifaysqkic.exeC:\Temp\i_nifaysqkic.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hfcxuspkic.exe ups_run3⤵
-
C:\Temp\hfcxuspkic.exeC:\Temp\hfcxuspkic.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hfcxuspkic.exe ups_ins3⤵
-
C:\Temp\i_hfcxuspkic.exeC:\Temp\i_hfcxuspkic.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cwusmkeczu.exe ups_run3⤵
-
C:\Temp\cwusmkeczu.exeC:\Temp\cwusmkeczu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cwusmkeczu.exe ups_ins3⤵
-
C:\Temp\i_cwusmkeczu.exeC:\Temp\i_cwusmkeczu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pjhbzxrpjh.exe ups_run3⤵
-
C:\Temp\pjhbzxrpjh.exeC:\Temp\pjhbzxrpjh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pjhbzxrpjh.exe ups_ins3⤵
-
C:\Temp\i_pjhbzxrpjh.exeC:\Temp\i_pjhbzxrpjh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hbzwuoljeb.exe ups_run3⤵
-
C:\Temp\hbzwuoljeb.exeC:\Temp\hbzwuoljeb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hbzwuoljeb.exe ups_ins3⤵
-
C:\Temp\i_hbzwuoljeb.exeC:\Temp\i_hbzwuoljeb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljdbvtqljg.exe ups_run3⤵
-
C:\Temp\ljdbvtqljg.exeC:\Temp\ljdbvtqljg.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff879d6c188,0x7ff879d6c194,0x7ff879d6c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,12425312070939449871,2541950858391504543,262144 --field-trial-handle=2296,i,7292438078275612011,11189422406107522706,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,8826243455731396422,17331473344104590339,524288 --field-trial-handle=2296,i,7292438078275612011,11189422406107522706,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,5063913127298739255,3064202339967807053,524288 --field-trial-handle=2296,i,7292438078275612011,11189422406107522706,262144 --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3528,i,4394027227473883980,5412574157871274933,2097152 --field-trial-handle=2296,i,7292438078275612011,11189422406107522706,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3532,i,16359155353682004311,8598460401260537051,2097152 --field-trial-handle=2296,i,7292438078275612011,11189422406107522706,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,15985338859375325850,6877163651929855679,2097152 --field-trial-handle=2296,i,7292438078275612011,11189422406107522706,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,377828709150530804,12920081811172345414,2097152 --field-trial-handle=2296,i,7292438078275612011,11189422406107522706,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,1743329651631112633,9387628818655470071,524288 --field-trial-handle=2296,i,7292438078275612011,11189422406107522706,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,3165006136676723694,17970046859070852794,524288 --field-trial-handle=2296,i,7292438078275612011,11189422406107522706,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,17040241870686704744,18149904888002218819,524288 --field-trial-handle=2296,i,7292438078275612011,11189422406107522706,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,13881933947416838148,10787373284232650464,524288 --field-trial-handle=2296,i,7292438078275612011,11189422406107522706,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,13881933947416838148,10787373284232650464,524288 --field-trial-handle=2296,i,7292438078275612011,11189422406107522706,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,11598945298105959421,9864760538730970770,524288 --field-trial-handle=2296,i,7292438078275612011,11189422406107522706,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,14135709419362646260,8608159978177794196,524288 --field-trial-handle=2296,i,7292438078275612011,11189422406107522706,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,638019920323128901,14019739701439779382,524288 --field-trial-handle=2296,i,7292438078275612011,11189422406107522706,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,18392452872754277323,4239549897003018008,524288 --field-trial-handle=2296,i,7292438078275612011,11189422406107522706,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4932,i,17286823090620030611,11861161180678662998,524288 --field-trial-handle=2296,i,7292438078275612011,11189422406107522706,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,7292689831032575542,18200974202279625369,524288 --field-trial-handle=2296,i,7292438078275612011,11189422406107522706,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,14263142040754529984,9957310795391209872,524288 --field-trial-handle=2296,i,7292438078275612011,11189422406107522706,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,1627168703957913723,1042161072126040223,524288 --field-trial-handle=2296,i,7292438078275612011,11189422406107522706,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7044,i,13966080669916233311,11594342460798825847,524288 --field-trial-handle=2296,i,7292438078275612011,11189422406107522706,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=944,i,18382079909043692943,9486945119581719159,524288 --field-trial-handle=2296,i,7292438078275612011,11189422406107522706,262144 --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7036,i,398614211320131003,15338127975763274782,524288 --field-trial-handle=2296,i,7292438078275612011,11189422406107522706,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5820,i,9204356656992748087,16794125367775409176,262144 --field-trial-handle=2296,i,7292438078275612011,11189422406107522706,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,11072587625386589261,8654864494452649731,524288 --field-trial-handle=2296,i,7292438078275612011,11189422406107522706,262144 --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\zurmjecwuomhezwu.sysC:\Temp\zurmjecwuomhezwu.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\ebwurmjebw.sysC:\Temp\ebwurmjebw.sys1⤵
- Executes dropped EXE
-
C:\Temp\jdbytqomge.sysC:\Temp\jdbytqomge.sys1⤵
- Executes dropped EXE
-
C:\Temp\daytqlidbv.sysC:\Temp\daytqlidbv.sys1⤵
- Executes dropped EXE
-
C:\Temp\xvtnlfdays.sysC:\Temp\xvtnlfdays.sys1⤵
- Executes dropped EXE
-
C:\Temp\icaysqkica.sysC:\Temp\icaysqkica.sys1⤵
- Executes dropped EXE
-
C:\Temp\uspnhfdxus.sysC:\Temp\uspnhfdxus.sys1⤵
- Executes dropped EXE
-
C:\Temp\zxupmkecxu.sysC:\Temp\zxupmkecxu.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhczurmjhe.sysC:\Temp\jhczurmjhe.sys1⤵
- Executes dropped EXE
-
C:\Temp\rpjhbzurmj.sysC:\Temp\rpjhbzurmj.sys1⤵
- Executes dropped EXE
-
C:\Temp\ljebwtomje.sysC:\Temp\ljebwtomje.sys1⤵
- Executes dropped EXE
-
C:\Temp\aywtoljdby.sysC:\Temp\aywtoljdby.sys1⤵
-
C:\Temp\olgdbnlfdy.sysC:\Temp\olgdbnlfdy.sys1⤵
-
C:\Temp\dxvqnlfdxv.sysC:\Temp\dxvqnlfdxv.sys1⤵
-
C:\Temp\ifaxspnhfa.sysC:\Temp\ifaxspnhfa.sys1⤵
-
C:\Temp\hfcxusmkic.sysC:\Temp\hfcxusmkic.sys1⤵
-
C:\Temp\khfzxuspkh.sysC:\Temp\khfzxuspkh.sys1⤵
-
C:\Temp\rmjhbzurmk.sysC:\Temp\rmjhbzurmk.sys1⤵
-
C:\Temp\jgeywurmje.sysC:\Temp\jgeywurmje.sys1⤵
-
C:\Temp\mgebvtolge.sysC:\Temp\mgebvtolge.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
avsnlfdyvq.exe
bzxrpjhbzu.exe
daytqlidbv.sys
ebwurmjebw.sys
gaytqoigay.exe
i_avsnlfdyvq.exe
i_bzxrpjhbzu.exe
i_gaytqoigay.exe
i_jdbywqomge.exe
i_qojgbzwqoj.exe
icaysqkica.sys
jdbytqomge.sys
jdbywqomge.exe
qojgbzwqoj.exe
xsqnhfaxsq.exe
xvtnlfdays.sys
zurmjecwuomhezwu.exe
zurmjecwuomhezwu.sys
2458d0c3-ae38-46b7-8954-454665fa2b47.tmp
3adc7549-5985-49e0-bc5f-928c27d88cfc.tmp
3c4497f2-4365-4915-b4f8-2d86a178861d.tmp
7760fbd3-2ce0-4d56-b501-e496a5547132.tmp
settings.dat
settings.dat
2615b300-0209-4a50-a9a3-8f72dd99af7d.tmp
33355692-6e3f-4b3b-8c15-7f54baded71f.tmp
4d83a713-efa9-42d1-bbf1-42b79a2e4378.tmp
9410b72c-5004-4097-9b01-6ad6a7078639.tmp
temp-index
4542e79f-43bd-48f6-ba8f-979f60765d3c.tmp
dasherSettingSchema.json
1a3ec721-97e8-498e-baa5-b2e954821951.tmp
91087238-5be8-418a-a04e-1245b44de8f1.tmp
Sdch Dictionaries
sync_diagnostic.log
b4336dde-1ed1-42d3-b645-60555dba47ce.tmp
e0433d4a-e88a-455c-8a56-23a716d44920.tmp
7b7f7e6e-415c-4856-8f7b-21458a4e0a4d.tmp
c83b661f-7f19-4c99-9b27-5405a7fb97ad.tmp
71231e0f-652b-424e-aff7-b4b0e51f3673.tmp
7aa7cec2-c08f-452f-9746-460cd112df85.tmp
9a948578-4952-4d14-bae8-1878031b28b9.tmp
aaecfece-cef7-4392-9072-94e4a9bd1774.tmp
ec8b813f-c2ca-4825-9677-302f1d8f328c.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
a17d7613-b4b1-4b59-be11-a853d2660ff1.tmp
cd6846b7-d797-405e-b77c-8877c78b20bd.tmp
54b9f74b-3960-42d1-aa86-7c4ea2e55004.tmp
74f1d004-a48b-4d39-94f8-4fac9b728d5e.tmp
messages.json
content.js
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/1424-630-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1460-559-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1880-685-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2388-656-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2664-506-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2788-711-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2796-519-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3292-668-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3784-532-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3868-670-0x0000000000FB0000-0x000000000100F000-memory.dmp
memory/4276-575-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4276-597-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4480-59-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4652-481-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4652-508-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4756-432-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5004-729-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5216-610-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5644-707-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5784-555-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5792-652-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5872-681-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6020-579-0x0000000000010000-0x00000000000AB000-memory.dmp