Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
13/11/2026, 01:58
General
- Target 2026-11-12_5fdcf428583e3815ddd315be7f2d10c8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261113-cd72tsyy2n
- SHA256 55bded0c2f160e6071dc63485d73cb8a72110b6db9c501b6d32b14c13b30732b
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-12_5fdcf428583e3815ddd315be7f2d10c8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-12_5fdcf428583e3815ddd315be7f2d10c8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\zxrpkhcausmkeczu.exeC:\Temp\zxrpkhcausmkeczu.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hczxrpkhcw.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\hczxrpkhcw.exeC:\Temp\hczxrpkhcw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hczxrpkhcw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hczxrpkhcw.exeC:\Temp\i_hczxrpkhcw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecwurmjecw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ecwurmjecw.exeC:\Temp\ecwurmjecw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecwurmjecw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ecwurmjecw.exeC:\Temp\i_ecwurmjecw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywrojhtrlj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ywrojhtrlj.exeC:\Temp\ywrojhtrlj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywrojhtrlj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ywrojhtrlj.exeC:\Temp\i_ywrojhtrlj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wqoigbytrl.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wqoigbytrl.exeC:\Temp\wqoigbytrl.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wqoigbytrl.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wqoigbytrl.exeC:\Temp\i_wqoigbytrl.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lgdbvtolgd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lgdbvtolgd.exeC:\Temp\lgdbvtolgd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lgdbvtolgd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lgdbvtolgd.exeC:\Temp\i_lgdbvtolgd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtnlfdxvpn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vtnlfdxvpn.exeC:\Temp\vtnlfdxvpn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vtnlfdxvpn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vtnlfdxvpn.exeC:\Temp\i_vtnlfdxvpn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dxvtnkican.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dxvtnkican.exeC:\Temp\dxvtnkican.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dxvtnkican.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dxvtnkican.exeC:\Temp\i_dxvtnkican.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usmkfcxvsm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\usmkfcxvsm.exeC:\Temp\usmkfcxvsm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usmkfcxvsm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_usmkfcxvsm.exeC:\Temp\i_usmkfcxvsm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fcxusmkecx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fcxusmkecx.exeC:\Temp\fcxusmkecx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fcxusmkecx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fcxusmkecx.exeC:\Temp\i_fcxusmkecx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wromkebzur.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wromkebzur.exeC:\Temp\wromkebzur.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wromkebzur.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wromkebzur.exeC:\Temp\i_wromkebzur.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecwuomjecw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ecwuomjecw.exeC:\Temp\ecwuomjecw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecwuomjecw.exe ups_ins3⤵
-
C:\Temp\i_ecwuomjecw.exeC:\Temp\i_ecwuomjecw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljebztromg.exe ups_run3⤵
-
C:\Temp\ljebztromg.exeC:\Temp\ljebztromg.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljebztromg.exe ups_ins3⤵
-
C:\Temp\i_ljebztromg.exeC:\Temp\i_ljebztromg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dbytqljdby.exe ups_run3⤵
-
C:\Temp\dbytqljdby.exeC:\Temp\dbytqljdby.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dbytqljdby.exe ups_ins3⤵
-
C:\Temp\i_dbytqljdby.exeC:\Temp\i_dbytqljdby.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\yvqnigaysq.exe ups_run3⤵
-
C:\Temp\yvqnigaysq.exeC:\Temp\yvqnigaysq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_yvqnigaysq.exe ups_ins3⤵
-
C:\Temp\i_yvqnigaysq.exeC:\Temp\i_yvqnigaysq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdxvpnifay.exe ups_run3⤵
-
C:\Temp\fdxvpnifay.exeC:\Temp\fdxvpnifay.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdxvpnifay.exe ups_ins3⤵
-
C:\Temp\i_fdxvpnifay.exeC:\Temp\i_fdxvpnifay.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdxvsqkifd.exe ups_run3⤵
-
C:\Temp\fdxvsqkifd.exeC:\Temp\fdxvsqkifd.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdxvsqkifd.exe ups_ins3⤵
-
C:\Temp\i_fdxvsqkifd.exeC:\Temp\i_fdxvsqkifd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vpnhfzxrpk.exe ups_run3⤵
-
C:\Temp\vpnhfzxrpk.exeC:\Temp\vpnhfzxrpk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vpnhfzxrpk.exe ups_ins3⤵
-
C:\Temp\i_vpnhfzxrpk.exeC:\Temp\i_vpnhfzxrpk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zurmjhczus.exe ups_run3⤵
-
C:\Temp\zurmjhczus.exeC:\Temp\zurmjhczus.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zurmjhczus.exe ups_ins3⤵
-
C:\Temp\i_zurmjhczus.exeC:\Temp\i_zurmjhczus.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\eczurpmgez.exe ups_run3⤵
-
C:\Temp\eczurpmgez.exeC:\Temp\eczurpmgez.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_eczurpmgez.exe ups_ins3⤵
-
C:\Temp\i_eczurpmgez.exeC:\Temp\i_eczurpmgez.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jecwuomgez.exe ups_run3⤵
-
C:\Temp\jecwuomgez.exeC:\Temp\jecwuomgez.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x394,0x7ffd16f4c188,0x7ffd16f4c194,0x7ffd16f4c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,10643390755457402935,6108132398891144173,524288 --field-trial-handle=2664,i,9801861694651517862,7377565266597707824,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,4215055946137453072,13369928010472129789,262144 --field-trial-handle=2664,i,9801861694651517862,7377565266597707824,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2332,i,10808880864614037011,421454879724506521,524288 --field-trial-handle=2664,i,9801861694651517862,7377565266597707824,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,6995048065192129941,6600058168794212607,2097152 --field-trial-handle=2664,i,9801861694651517862,7377565266597707824,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,17899889709539567415,3034759927792386599,2097152 --field-trial-handle=2664,i,9801861694651517862,7377565266597707824,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,4298904418203593297,14727880805782630305,2097152 --field-trial-handle=2664,i,9801861694651517862,7377565266597707824,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4360,i,3625497104638791454,1879370118798424858,2097152 --field-trial-handle=2664,i,9801861694651517862,7377565266597707824,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,18334370117170506977,11255264485419595372,524288 --field-trial-handle=2664,i,9801861694651517862,7377565266597707824,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,296700333844044714,16830625912507607050,524288 --field-trial-handle=2664,i,9801861694651517862,7377565266597707824,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,1497755872706256827,14876396890679356677,524288 --field-trial-handle=2664,i,9801861694651517862,7377565266597707824,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,131341868716979648,4324305160560435477,524288 --field-trial-handle=2664,i,9801861694651517862,7377565266597707824,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,131341868716979648,4324305160560435477,524288 --field-trial-handle=2664,i,9801861694651517862,7377565266597707824,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,8544198525429208992,6882235789863861935,524288 --field-trial-handle=2664,i,9801861694651517862,7377565266597707824,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,3017066682312327220,17847871053247620382,524288 --field-trial-handle=2664,i,9801861694651517862,7377565266597707824,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6804,i,17333289433029494726,14190369937829879836,524288 --field-trial-handle=2664,i,9801861694651517862,7377565266597707824,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,4943449761705345385,15368586741326985959,524288 --field-trial-handle=2664,i,9801861694651517862,7377565266597707824,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,2590303764847308494,9175028173363147238,524288 --field-trial-handle=2664,i,9801861694651517862,7377565266597707824,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,14386471809543137643,17308026107414267383,524288 --field-trial-handle=2664,i,9801861694651517862,7377565266597707824,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,15313953171637817270,12813356367144562465,524288 --field-trial-handle=2664,i,9801861694651517862,7377565266597707824,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,15490710553978969465,2196943079198829054,524288 --field-trial-handle=2664,i,9801861694651517862,7377565266597707824,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2240,i,9243171861884692359,4189231333961347532,524288 --field-trial-handle=2664,i,9801861694651517862,7377565266597707824,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7044,i,11693129754543428804,5775731865992909332,524288 --field-trial-handle=2664,i,9801861694651517862,7377565266597707824,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=912,i,10625747812054195599,16410548053051898395,524288 --field-trial-handle=2664,i,9801861694651517862,7377565266597707824,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2968,i,16151312266623967388,14289480856070439866,262144 --field-trial-handle=2664,i,9801861694651517862,7377565266597707824,262144 --variations-seed-version --mojo-platform-channel-handle=1428 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,17503579692790782047,3492948816484401141,524288 --field-trial-handle=2664,i,9801861694651517862,7377565266597707824,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1208,i,6909644604741877204,3744161806672044331,524288 --field-trial-handle=2664,i,9801861694651517862,7377565266597707824,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\zxrpkhcausmkeczu.sysC:\Temp\zxrpkhcausmkeczu.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\mhecwusecw.sysC:\Temp\mhecwusecw.sys1⤵
- Executes dropped EXE
-
C:\Temp\ywurljebwt.sysC:\Temp\ywurljebwt.sys1⤵
- Executes dropped EXE
-
C:\Temp\trljdbvtom.sysC:\Temp\trljdbvtom.sys1⤵
- Executes dropped EXE
-
C:\Temp\ljdbvtnlfd.sysC:\Temp\ljdbvtnlfd.sys1⤵
- Executes dropped EXE
-
C:\Temp\davsqoiysq.sysC:\Temp\davsqoiysq.sys1⤵
- Executes dropped EXE
-
C:\Temp\davsnlfdxv.sysC:\Temp\davsnlfdxv.sys1⤵
- Executes dropped EXE
-
C:\Temp\spkhfdxusn.sysC:\Temp\spkhfdxusn.sys1⤵
- Executes dropped EXE
-
C:\Temp\hczusmkecw.sysC:\Temp\hczusmkecw.sys1⤵
- Executes dropped EXE
-
C:\Temp\hecaurpmhf.sysC:\Temp\hecaurpmhf.sys1⤵
- Executes dropped EXE
-
C:\Temp\ecwuomhezw.sysC:\Temp\ecwuomhezw.sys1⤵
- Executes dropped EXE
-
C:\Temp\jgeywrojge.sysC:\Temp\jgeywrojge.sys1⤵
-
C:\Temp\igbytrljdb.sysC:\Temp\igbytrljdb.sys1⤵
-
C:\Temp\igaytqligb.sysC:\Temp\igaytqligb.sys1⤵
-
C:\Temp\idaysqliga.sysC:\Temp\idaysqliga.sys1⤵
-
C:\Temp\faxsqkifax.sysC:\Temp\faxsqkifax.sys1⤵
-
C:\Temp\cxuspkiczx.sysC:\Temp\cxuspkiczx.sys1⤵
-
C:\Temp\hfzxrpkhca.sysC:\Temp\hfzxrpkhca.sys1⤵
-
C:\Temp\ecwurpjhec.sysC:\Temp\ecwurpjhec.sys1⤵
-
C:\Temp\mjebwuomge.sysC:\Temp\mjebwuomge.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
davsqoiysq.sys
ecwurmjecw.exe
hczxrpkhcw.exe
i_ecwurmjecw.exe
i_hczxrpkhcw.exe
i_lgdbvtolgd.exe
i_wqoigbytrl.exe
i_ywrojhtrlj.exe
lgdbvtolgd.exe
ljdbvtnlfd.sys
mhecwusecw.sys
trljdbvtom.sys
vtnlfdxvpn.exe
wqoigbytrl.exe
ywrojhtrlj.exe
ywurljebwt.sys
zxrpkhcausmkeczu.exe
zxrpkhcausmkeczu.sys
29f43d90-b823-4135-9a67-405af10b6062.tmp
3c9cffc0-8588-4c42-8abc-3878f29c78da.tmp
40fe48be-cf51-4a78-bb32-ea6f1bd2870c.tmp
manifest.json
settings.dat
settings.dat
24c5f5bb-bcff-427f-959e-7a23ced1cf9d.tmp
43061a56-6073-4ee1-ac30-e6fdf094fda7.tmp
432c2bdd-9957-4242-b016-a39d39ac8cb9.tmp
5672c908-6c04-49c7-95e3-efe09c5ab411.tmp
81f7ea75-ea19-4659-9a00-d9a571cbb671.tmp
temp-index
the-real-index
f3dc372b-c2c2-454b-b09e-17d9793e36f2.tmp
dasherSettingSchema.json
5d144954-ce28-4309-a452-eedd697c87f5.tmp
621c1216-6031-40eb-95d7-94b5b7a30e70.tmp
931184dd-c2ac-449c-b5b2-2ded15e1514a.tmp
sync_diagnostic.log
OperationConfig
b43c5060-52c7-4af8-925f-d1dd19fdf2f4.tmp
manifest.json
manifest.json
manifest.json
manifest.json
caa86405-1083-4803-a8b0-f76dc939b9d7.tmp
175ee5bd-10c9-4b80-aebd-df878c11d1d5.tmp
3fb4fda9-d5ff-4cd2-a069-e8d47910a1ef.tmp
f3b4d96b-1047-482a-b437-d505bb2183ad.tmp
metadata.json
ee958b59-abad-4669-a98a-4fbe2a23e000.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
76a8bd83-0f31-4d9e-90ec-269564e43262.tmp
metadata.json
fb9b4d11-b667-463e-94b2-dc45a83265a7.tmp
5d499472-b47b-4f61-add2-bc1d1c05b7c6.tmp
3b4c5335-404e-4f59-a31c-c2c0db8f1de6.tmp
content.js
messages.json
llm_user_input_extractor_config.json
office_endpoints_list.json
smart_switch_list.json
protocols.json
LICENSE
verified_contents.json
keys.json
nav_config.json
CreateProcess.exe
memory/552-584-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/552-672-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/788-64-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1080-523-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1132-559-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1396-760-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1840-564-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2080-756-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2128-511-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2272-580-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2584-483-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2732-736-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3192-434-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3508-731-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3544-561-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3544-536-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5272-660-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5356-646-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5720-687-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5932-615-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6048-707-0x0000000000010000-0x00000000000AB000-memory.dmp