Analysis
- max time kernel
149s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
29/07/2026, 00:56
General
- Target 2026-07-28_78f744587383e36c11b5a4b85d626aeb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 376KB
- Sample260729-bapkmsdc27
- SHA256 4c12ecc21693390b5bd52dbc08bcfbd3601110d4bada71209a05cbd45cbdd066
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_78f744587383e36c11b5a4b85d626aeb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_78f744587383e36c11b5a4b85d626aeb_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\keczurmjhczxrpjh.exeC:\Temp\keczurmjhczxrpjh.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpjhbzxupj.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\rpjhbzxupj.exeC:\Temp\rpjhbzxupj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpjhbzxupj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rpjhbzxupj.exeC:\Temp\i_rpjhbzxupj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wurmjebwuo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wurmjebwuo.exeC:\Temp\wurmjebwuo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wurmjebwuo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wurmjebwuo.exeC:\Temp\i_wurmjebwuo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdbzwqomgb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jdbzwqomgb.exeC:\Temp\jdbzwqomgb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdbzwqomgb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jdbzwqomgb.exeC:\Temp\i_jdbzwqomgb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rljdbvtgdy.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rljdbvtgdy.exeC:\Temp\rljdbvtgdy.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rljdbvtgdy.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rljdbvtgdy.exeC:\Temp\i_rljdbvtgdy.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dysqlidbvo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dysqlidbvo.exeC:\Temp\dysqlidbvo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dysqlidbvo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dysqlidbvo.exeC:\Temp\i_dysqlidbvo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ayvqkigays.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ayvqkigays.exeC:\Temp\ayvqkigays.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ayvqkigays.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ayvqkigays.exeC:\Temp\i_ayvqkigays.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\snkicavpnh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\snkicavpnh.exeC:\Temp\snkicavpnh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_snkicavpnh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_snkicavpnh.exeC:\Temp\i_snkicavpnh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\caxspfcxup.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\caxspfcxup.exeC:\Temp\caxspfcxup.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_caxspfcxup.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_caxspfcxup.exeC:\Temp\i_caxspfcxup.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxrpnhfzxr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zxrpnhfzxr.exeC:\Temp\zxrpnhfzxr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxrpnhfzxr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zxrpnhfzxr.exeC:\Temp\i_zxrpnhfzxr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pjhbzurmkh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pjhbzurmkh.exeC:\Temp\pjhbzurmkh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pjhbzurmkh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pjhbzurmkh.exeC:\Temp\i_pjhbzurmkh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wrojgeywto.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wrojgeywto.exeC:\Temp\wrojgeywto.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wrojgeywto.exe ups_ins3⤵
-
C:\Temp\i_wrojgeywto.exeC:\Temp\i_wrojgeywto.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bzwtoljgey.exe ups_run3⤵
-
C:\Temp\bzwtoljgey.exeC:\Temp\bzwtoljgey.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bzwtoljgey.exe ups_ins3⤵
-
C:\Temp\i_bzwtoljgey.exeC:\Temp\i_bzwtoljgey.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gdyvtolgdb.exe ups_run3⤵
-
C:\Temp\gdyvtolgdb.exeC:\Temp\gdyvtolgdb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gdyvtolgdb.exe ups_ins3⤵
-
C:\Temp\i_gdyvtolgdb.exeC:\Temp\i_gdyvtolgdb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\yvqnlfdayv.exe ups_run3⤵
-
C:\Temp\yvqnlfdayv.exeC:\Temp\yvqnlfdayv.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_yvqnlfdayv.exe ups_ins3⤵
-
C:\Temp\i_yvqnlfdayv.exeC:\Temp\i_yvqnlfdayv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqkifayvpn.exe ups_run3⤵
-
C:\Temp\sqkifayvpn.exeC:\Temp\sqkifayvpn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqkifayvpn.exe ups_ins3⤵
-
C:\Temp\i_sqkifayvpn.exeC:\Temp\i_sqkifayvpn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdxvsnkfcx.exe ups_run3⤵
-
C:\Temp\fdxvsnkfcx.exeC:\Temp\fdxvsnkfcx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdxvsnkfcx.exe ups_ins3⤵
-
C:\Temp\i_fdxvsnkfcx.exeC:\Temp\i_fdxvsnkfcx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\czurpkhcax.exe ups_run3⤵
-
C:\Temp\czurpkhcax.exeC:\Temp\czurpkhcax.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_czurpkhcax.exe ups_ins3⤵
-
C:\Temp\i_czurpkhcax.exeC:\Temp\i_czurpkhcax.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zusmkhbzuo.exe ups_run3⤵
-
C:\Temp\zusmkhbzuo.exeC:\Temp\zusmkhbzuo.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zusmkhbzuo.exe ups_ins3⤵
-
C:\Temp\i_zusmkhbzuo.exeC:\Temp\i_zusmkhbzuo.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ezwrljebwu.exe ups_run3⤵
-
C:\Temp\ezwrljebwu.exeC:\Temp\ezwrljebwu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ezwrljebwu.exe ups_ins3⤵
-
C:\Temp\i_ezwrljebwu.exeC:\Temp\i_ezwrljebwu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ojgebwtrlj.exe ups_run3⤵
-
C:\Temp\ojgebwtrlj.exeC:\Temp\ojgebwtrlj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ff8b120c188,0x7ff8b120c194,0x7ff8b120c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1572,i,1436816435279827473,15770565326857890715,262144 --field-trial-handle=2244,i,6076927668240252648,9326499485757465173,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,9646470322796265906,2181558762330707573,524288 --field-trial-handle=2244,i,6076927668240252648,9326499485757465173,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,13865871894463060162,2885037710396013161,524288 --field-trial-handle=2244,i,6076927668240252648,9326499485757465173,262144 --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,3372062416217199948,9041781927367607505,2097152 --field-trial-handle=2244,i,6076927668240252648,9326499485757465173,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,14473067142309983459,11612857667116449958,2097152 --field-trial-handle=2244,i,6076927668240252648,9326499485757465173,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5088,i,2880258997959770485,7595031037200106812,2097152 --field-trial-handle=2244,i,6076927668240252648,9326499485757465173,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3748,i,4569418796039377295,3064244592930308988,2097152 --field-trial-handle=2244,i,6076927668240252648,9326499485757465173,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3504,i,4629975932219849391,15086073129910449288,524288 --field-trial-handle=2244,i,6076927668240252648,9326499485757465173,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3776,i,5354842045654137749,13534609517315816054,524288 --field-trial-handle=2244,i,6076927668240252648,9326499485757465173,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,8359165712798716957,11048516638348649080,524288 --field-trial-handle=2244,i,6076927668240252648,9326499485757465173,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,8359165712798716957,11048516638348649080,524288 --field-trial-handle=2244,i,6076927668240252648,9326499485757465173,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,8213434342583863084,6665177003934771995,524288 --field-trial-handle=2244,i,6076927668240252648,9326499485757465173,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,10242588420728924508,11499950319415411889,524288 --field-trial-handle=2244,i,6076927668240252648,9326499485757465173,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,7866537081526861454,17734072802817388689,524288 --field-trial-handle=2244,i,6076927668240252648,9326499485757465173,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,11399644730632705874,9513447786519719269,524288 --field-trial-handle=2244,i,6076927668240252648,9326499485757465173,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,4365846184815888732,3808152756470909184,524288 --field-trial-handle=2244,i,6076927668240252648,9326499485757465173,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,4787501370232858033,13539018129003487363,524288 --field-trial-handle=2244,i,6076927668240252648,9326499485757465173,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,7319687816901290265,9333555164373496477,524288 --field-trial-handle=2244,i,6076927668240252648,9326499485757465173,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=916,i,17593429489693433371,1526708851966988224,524288 --field-trial-handle=2244,i,6076927668240252648,9326499485757465173,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,16382266206901467266,7708193083824206606,524288 --field-trial-handle=2244,i,6076927668240252648,9326499485757465173,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6044,i,13607217368007825539,2792109604447488838,262144 --field-trial-handle=2244,i,6076927668240252648,9326499485757465173,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:104⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\keczurmjhczxrpjh.sysC:\Temp\keczurmjhczxrpjh.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\hbzurmjecw.sysC:\Temp\hbzurmjecw.sys1⤵
- Executes dropped EXE
-
C:\Temp\rljetoljdb.sysC:\Temp\rljetoljdb.sys1⤵
- Executes dropped EXE
-
C:\Temp\ljgeywtrlj.sysC:\Temp\ljgeywtrlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\gaytqlidby.sysC:\Temp\gaytqlidby.sys1⤵
- Executes dropped EXE
-
C:\Temp\fdyvpnlfda.sysC:\Temp\fdyvpnlfda.sys1⤵
- Executes dropped EXE
-
C:\Temp\faqnifaysq.sysC:\Temp\faqnifaysq.sys1⤵
- Executes dropped EXE
-
C:\Temp\axspkifaxv.sysC:\Temp\axspkifaxv.sys1⤵
- Executes dropped EXE
-
C:\Temp\ecxupmhfcw.sysC:\Temp\ecxupmhfcw.sys1⤵
- Executes dropped EXE
-
C:\Temp\pjheczuomk.sysC:\Temp\pjheczuomk.sys1⤵
- Executes dropped EXE
-
C:\Temp\zurmjhbzwj.sysC:\Temp\zurmjhbzwj.sys1⤵
- Executes dropped EXE
-
C:\Temp\bwuoljgeyw.sysC:\Temp\bwuoljgeyw.sys1⤵
-
C:\Temp\geyvtqligb.sysC:\Temp\geyvtqligb.sys1⤵
-
C:\Temp\aysqoigays.sysC:\Temp\aysqoigays.sys1⤵
-
C:\Temp\idavtnlfdx.sysC:\Temp\idavtnlfdx.sys1⤵
-
C:\Temp\fdxvsnifax.sysC:\Temp\fdxvsnifax.sys1⤵
-
C:\Temp\causmkhczx.sysC:\Temp\causmkhczx.sys1⤵
-
C:\Temp\wusmkhczxr.sysC:\Temp\wusmkhczxr.sys1⤵
-
C:\Temp\mhecwuomke.sysC:\Temp\mhecwuomke.sys1⤵
-
C:\Temp\jgeywtrljg.sysC:\Temp\jgeywtrljg.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ayvqkigays.exe
dysqlidbvo.exe
fdyvpnlfda.sys
gaytqlidby.sys
hbzurmjecw.sys
i_ayvqkigays.exe
i_dysqlidbvo.exe
i_jdbzwqomgb.exe
i_rljdbvtgdy.exe
i_rpjhbzxupj.exe
i_wurmjebwuo.exe
jdbzwqomgb.exe
keczurmjhczxrpjh.exe
keczurmjhczxrpjh.sys
ljgeywtrlj.sys
rljdbvtgdy.exe
rljetoljdb.sys
rpjhbzxupj.exe
wurmjebwuo.exe
settings.dat
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
SiteList-Enterprise.json
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
Local State
Local State
Local State
Local State
ac325c0b-6c8a-4dfb-b979-32cfd0ad4d4f.tmp
cb33b64c-2ca0-4835-a0f7-593292b34253.tmp
metadata.json
metadata.json
metadata.json
299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
metadata.json
CreateProcess.exe
memory/1212-605-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1828-507-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2456-170-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2660-553-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2860-143-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3596-468-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3676-637-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3716-593-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3888-558-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4116-641-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4152-536-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4152-511-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5160-198-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5260-535-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5336-499-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5780-503-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5800-370-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5912-52-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5984-589-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6180-577-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/7004-609-0x0000000000010000-0x00000000000AB000-memory.dmp