Analysis
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
02/08/2026, 03:34
General
- Target 2026-08-02_153ad271ffc7e43c47f0071dd634aedf_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample260802-d449asce95
- SHA256 94908dd2c6fff13ce302aa5f41c152938c209613cbae877357262743c3cc9ba0
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_153ad271ffc7e43c47f0071dd634aedf_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_153ad271ffc7e43c47f0071dd634aedf_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\bzurmkebztrpmhez.exeC:\Temp\bzurmkebztrpmhez.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mjhbzwrpje.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\mjhbzwrpje.exeC:\Temp\mjhbzwrpje.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mjhbzwrpje.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mjhbzwrpje.exeC:\Temp\i_mjhbzwrpje.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jgbywqlgeb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jgbywqlgeb.exeC:\Temp\jgbywqlgeb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jgbywqlgeb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jgbywqlgeb.exeC:\Temp\i_jgbywqlgeb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rljgbytqoj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rljgbytqoj.exeC:\Temp\rljgbytqoj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rljgbytqoj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rljgbytqoj.exeC:\Temp\i_rljgbytqoj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\yvtnlfdyvq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\yvtnlfdyvq.exeC:\Temp\yvtnlfdyvq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_yvtnlfdyvq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_yvtnlfdyvq.exeC:\Temp\i_yvtnlfdyvq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lidavtnlfa.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lidavtnlfa.exeC:\Temp\lidavtnlfa.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lidavtnlfa.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lidavtnlfa.exeC:\Temp\i_lidavtnlfa.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xusnkfdavs.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xusnkfdavs.exeC:\Temp\xusnkfdavs.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xusnkfdavs.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xusnkfdavs.exeC:\Temp\i_xusnkfdavs.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nhfzxsqkhc.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nhfzxsqkhc.exeC:\Temp\nhfzxsqkhc.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nhfzxsqkhc.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nhfzxsqkhc.exeC:\Temp\i_nhfzxsqkhc.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hfcwupmkhc.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hfcwupmkhc.exeC:\Temp\hfcwupmkhc.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hfcwupmkhc.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hfcwupmkhc.exeC:\Temp\i_hfcwupmkhc.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\urmkhbwupm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\urmkhbwupm.exeC:\Temp\urmkhbwupm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_urmkhbwupm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_urmkhbwupm.exeC:\Temp\i_urmkhbwupm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bztromjdbw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bztromjdbw.exeC:\Temp\bztromjdbw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bztromjdbw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bztromjdbw.exeC:\Temp\i_bztromjdbw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mgdbwtomge.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mgdbwtomge.exeC:\Temp\mgdbwtomge.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mgdbwtomge.exe ups_ins3⤵
-
C:\Temp\i_mgdbwtomge.exeC:\Temp\i_mgdbwtomge.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qoljdaywtn.exe ups_run3⤵
-
C:\Temp\qoljdaywtn.exeC:\Temp\qoljdaywtn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qoljdaywtn.exe ups_ins3⤵
-
C:\Temp\i_qoljdaywtn.exeC:\Temp\i_qoljdaywtn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qnigdyvqni.exe ups_run3⤵
-
C:\Temp\qnigdyvqni.exeC:\Temp\qnigdyvqni.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qnigdyvqni.exe ups_ins3⤵
-
C:\Temp\i_qnigdyvqni.exeC:\Temp\i_qnigdyvqni.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kifdxvpnif.exe ups_run3⤵
-
C:\Temp\kifdxvpnif.exeC:\Temp\kifdxvpnif.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kifdxvpnif.exe ups_ins3⤵
-
C:\Temp\i_kifdxvpnif.exeC:\Temp\i_kifdxvpnif.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pkicausmkf.exe ups_run3⤵
-
C:\Temp\pkicausmkf.exeC:\Temp\pkicausmkf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pkicausmkf.exe ups_ins3⤵
-
C:\Temp\i_pkicausmkf.exeC:\Temp\i_pkicausmkf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxupnhczxr.exe ups_run3⤵
-
C:\Temp\zxupnhczxr.exeC:\Temp\zxupnhczxr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxupnhczxr.exe ups_ins3⤵
-
C:\Temp\i_zxupnhczxr.exeC:\Temp\i_zxupnhczxr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpmhezxrpm.exe ups_run3⤵
-
C:\Temp\rpmhezxrpm.exeC:\Temp\rpmhezxrpm.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpmhezxrpm.exe ups_ins3⤵
-
C:\Temp\i_rpmhezxrpm.exeC:\Temp\i_rpmhezxrpm.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljhbzwuomh.exe ups_run3⤵
-
C:\Temp\ljhbzwuomh.exeC:\Temp\ljhbzwuomh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljhbzwuomh.exe ups_ins3⤵
-
C:\Temp\i_ljhbzwuomh.exeC:\Temp\i_ljhbzwuomh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ztrojgbztr.exe ups_run3⤵
-
C:\Temp\ztrojgbztr.exeC:\Temp\ztrojgbztr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ztrojgbztr.exe ups_ins3⤵
-
C:\Temp\i_ztrojgbztr.exeC:\Temp\i_ztrojgbztr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywqoigbytr.exe ups_run3⤵
-
C:\Temp\ywqoigbytr.exeC:\Temp\ywqoigbytr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffab109c188,0x7ffab109c194,0x7ffab109c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,1960909202135433989,5642139884322876845,524288 --field-trial-handle=2636,i,8178694709632621045,12430215194889737797,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,15584054510913064624,17231040723682192523,524288 --field-trial-handle=2636,i,8178694709632621045,12430215194889737797,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,9940618928807232276,4428362917371890272,262144 --field-trial-handle=2636,i,8178694709632621045,12430215194889737797,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,4461336019019521211,3482471839319817780,2097152 --field-trial-handle=2636,i,8178694709632621045,12430215194889737797,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,15558967120082236543,12980016105114459446,2097152 --field-trial-handle=2636,i,8178694709632621045,12430215194889737797,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4332,i,15151277300582398099,11318112592025822827,2097152 --field-trial-handle=2636,i,8178694709632621045,12430215194889737797,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4376,i,4002841691949412331,20471141638029801,2097152 --field-trial-handle=2636,i,8178694709632621045,12430215194889737797,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5376,i,5995224201376239010,17435860330014015074,2097152 --field-trial-handle=2636,i,8178694709632621045,12430215194889737797,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,13660892045695696326,716515573553639700,524288 --field-trial-handle=2636,i,8178694709632621045,12430215194889737797,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3784,i,2277160582877847414,3391223784113058228,2097152 --field-trial-handle=2636,i,8178694709632621045,12430215194889737797,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,7288240658688591570,9045964723958376952,524288 --field-trial-handle=2636,i,8178694709632621045,12430215194889737797,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4776,i,3055164881781483733,9982844424191498603,524288 --field-trial-handle=2636,i,8178694709632621045,12430215194889737797,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,14416606064676014797,10132610683251921641,524288 --field-trial-handle=2636,i,8178694709632621045,12430215194889737797,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,14416606064676014797,10132610683251921641,524288 --field-trial-handle=2636,i,8178694709632621045,12430215194889737797,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,12636746153866475157,16416541444863341884,524288 --field-trial-handle=2636,i,8178694709632621045,12430215194889737797,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,2762336043919744360,16762144459365291936,524288 --field-trial-handle=2636,i,8178694709632621045,12430215194889737797,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,13759555217552798355,2526731137855704807,524288 --field-trial-handle=2636,i,8178694709632621045,12430215194889737797,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6896,i,7231396399391814682,5068103163099672659,524288 --field-trial-handle=2636,i,8178694709632621045,12430215194889737797,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,4900588910802450146,8567866702255521073,524288 --field-trial-handle=2636,i,8178694709632621045,12430215194889737797,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4672,i,6947944745254985226,12814243783693741088,524288 --field-trial-handle=2636,i,8178694709632621045,12430215194889737797,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,14313724612819700766,13251015520228900676,524288 --field-trial-handle=2636,i,8178694709632621045,12430215194889737797,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1292,i,11310454566278395921,5645154209831814351,524288 --field-trial-handle=2636,i,8178694709632621045,12430215194889737797,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6696,i,11780703287024042561,10078343996178478942,262144 --field-trial-handle=2636,i,8178694709632621045,12430215194889737797,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:104⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\bzurmkebztrpmhez.sysC:\Temp\bzurmkebztrpmhez.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\uomgecwuom.sysC:\Temp\uomgecwuom.sys1⤵
- Executes dropped EXE
-
C:\Temp\tolgeywqol.sysC:\Temp\tolgeywqol.sys1⤵
- Executes dropped EXE
-
C:\Temp\bytqoigays.sysC:\Temp\bytqoigays.sys1⤵
- Executes dropped EXE
-
C:\Temp\qnifaysqni.sysC:\Temp\qnifaysqni.sys1⤵
- Executes dropped EXE
-
C:\Temp\igaxsqnifa.sysC:\Temp\igaxsqnifa.sys1⤵
- Executes dropped EXE
-
C:\Temp\nkfcxvpnhf.sysC:\Temp\nkfcxvpnhf.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfzxrpjhfc.sysC:\Temp\hfzxrpjhfc.sys1⤵
- Executes dropped EXE
-
C:\Temp\ecwurmkecw.sysC:\Temp\ecwurmkecw.sys1⤵
- Executes dropped EXE
-
C:\Temp\hezwurmjhb.sysC:\Temp\hezwurmjhb.sys1⤵
- Executes dropped EXE
-
C:\Temp\ojgbztrljd.sysC:\Temp\ojgbztrljd.sys1⤵
- Executes dropped EXE
-
C:\Temp\toljdbvtol.sysC:\Temp\toljdbvtol.sys1⤵
-
C:\Temp\ytqlidavtn.sysC:\Temp\ytqlidavtn.sys1⤵
-
C:\Temp\tqlicaysqk.sysC:\Temp\tqlicaysqk.sys1⤵
-
C:\Temp\qkicaxsqki.sysC:\Temp\qkicaxsqki.sys1⤵
-
C:\Temp\kfcxupnhfz.sysC:\Temp\kfcxupnhfz.sys1⤵
-
C:\Temp\wupmkecwuo.sysC:\Temp\wupmkecwuo.sys1⤵
-
C:\Temp\urmjebzurp.sysC:\Temp\urmjebzurp.sys1⤵
-
C:\Temp\urljheywuo.sysC:\Temp\urljheywuo.sys1⤵
-
C:\Temp\geywqoigby.sysC:\Temp\geywqoigby.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
bytqoigays.sys
bzurmkebztrpmhez.exe
bzurmkebztrpmhez.sys
i_jgbywqlgeb.exe
i_lidavtnlfa.exe
i_mjhbzwrpje.exe
i_rljgbytqoj.exe
i_yvtnlfdyvq.exe
igaxsqnifa.sys
jgbywqlgeb.exe
lidavtnlfa.exe
mjhbzwrpje.exe
qnifaysqni.sys
rljgbytqoj.exe
tolgeywqol.sys
uomgecwuom.sys
yvtnlfdyvq.exe
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
the-real-index
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
OperationConfig
OperationConfig~RFe5a203b.TMP
Local State
Local State
Local State
Local State
299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
a102892f-fbc2-420e-b127-578a3e9358af.tmp
metadata.json~RFe595c8d.TMP
e5f7969f-e18c-4180-bc51-79b69fb2577f.tmp
content_new.js
CreateProcess.exe
memory/936-557-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1104-586-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1896-62-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2072-617-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2072-603-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2588-629-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2824-505-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3156-615-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3160-421-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3364-638-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3960-493-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4392-561-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4448-634-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4796-642-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4832-542-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5224-620-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5744-624-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5840-468-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6012-518-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6076-598-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6096-538-0x0000000000010000-0x00000000000AB000-memory.dmp