Analysis
- max time kernel
150s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
19/08/2026, 22:38
General
- Target 2026-08-19_777f547ff4f93b891b7b4e6e27866dc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample260819-2kkbsaaa46
- SHA256 4632d9ea89006ed1fc23e4c5a0b878e945238069e48c03088c0b1afca2ed52a2
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 9 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_777f547ff4f93b891b7b4e6e27866dc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_777f547ff4f93b891b7b4e6e27866dc8_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\jdbwtolgeywigbyt.exeC:\Temp\jdbwtolgeywigbyt.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bytrlgdbvt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\bytrlgdbvt.exeC:\Temp\bytrlgdbvt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bytrlgdbvt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bytrlgdbvt.exeC:\Temp\i_bytrlgdbvt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\idaysqlays.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\idaysqlays.exeC:\Temp\idaysqlays.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_idaysqlays.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_idaysqlays.exeC:\Temp\i_idaysqlays.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqkfcavsqk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\sqkfcavsqk.exeC:\Temp\sqkfcavsqk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqkfcavsqk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_sqkfcavsqk.exeC:\Temp\i_sqkfcavsqk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hfdxvpnhfa.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hfdxvpnhfa.exeC:\Temp\hfdxvpnhfa.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hfdxvpnhfa.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hfdxvpnhfa.exeC:\Temp\i_hfdxvpnhfa.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zurpkhcaus.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zurpkhcaus.exeC:\Temp\zurpkhcaus.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zurpkhcaus.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zurpkhcaus.exeC:\Temp\i_zurpkhcaus.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cxupmhfrpj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\cxupmhfrpj.exeC:\Temp\cxupmhfrpj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cxupmhfrpj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_cxupmhfrpj.exeC:\Temp\i_cxupmhfrpj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hecwurmjhe.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hecwurmjhe.exeC:\Temp\hecwurmjhe.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hecwurmjhe.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hecwurmjhe.exeC:\Temp\i_hecwurmjhe.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jgbztrojhb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jgbztrojhb.exeC:\Temp\jgbztrojhb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jgbztrojhb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jgbztrojhb.exeC:\Temp\i_jgbztrojhb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tolgbytqlj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\tolgbytqlj.exeC:\Temp\tolgbytqlj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tolgbytqlj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_tolgbytqlj.exeC:\Temp\i_tolgbytqlj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tqljdaytql.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\tqljdaytql.exeC:\Temp\tqljdaytql.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tqljdaytql.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_tqljdaytql.exeC:\Temp\i_tqljdaytql.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqnlfdyvqn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\sqnlfdyvqn.exeC:\Temp\sqnlfdyvqn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqnlfdyvqn.exe ups_ins3⤵
-
C:\Temp\i_sqnlfdyvqn.exeC:\Temp\i_sqnlfdyvqn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hfaxspnkfc.exe ups_run3⤵
-
C:\Temp\hfaxspnkfc.exeC:\Temp\hfaxspnkfc.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hfaxspnkfc.exe ups_ins3⤵
-
C:\Temp\i_hfaxspnkfc.exeC:\Temp\i_hfaxspnkfc.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ausmkecxus.exe ups_run3⤵
-
C:\Temp\ausmkecxus.exeC:\Temp\ausmkecxus.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ausmkecxus.exe ups_ins3⤵
-
C:\Temp\i_ausmkecxus.exeC:\Temp\i_ausmkecxus.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xuspkhfcwu.exe ups_run3⤵
-
C:\Temp\xuspkhfcwu.exeC:\Temp\xuspkhfcwu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xuspkhfcwu.exe ups_ins3⤵
-
C:\Temp\i_xuspkhfcwu.exeC:\Temp\i_xuspkhfcwu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zurmkecwur.exe ups_run3⤵
-
C:\Temp\zurmkecwur.exeC:\Temp\zurmkecwur.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zurmkecwur.exe ups_ins3⤵
-
C:\Temp\i_zurmkecwur.exeC:\Temp\i_zurmkecwur.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ojhbztrlje.exe ups_run3⤵
-
C:\Temp\ojhbztrlje.exeC:\Temp\ojhbztrlje.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ojhbztrlje.exe ups_ins3⤵
-
C:\Temp\i_ojhbztrlje.exeC:\Temp\i_ojhbztrlje.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\geywqojgbz.exe ups_run3⤵
-
C:\Temp\geywqojgbz.exeC:\Temp\geywqojgbz.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_geywqojgbz.exe ups_ins3⤵
-
C:\Temp\i_geywqojgbz.exeC:\Temp\i_geywqojgbz.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gbywqoigby.exe ups_run3⤵
-
C:\Temp\gbywqoigby.exeC:\Temp\gbywqoigby.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gbywqoigby.exe ups_ins3⤵
-
C:\Temp\i_gbywqoigby.exeC:\Temp\i_gbywqoigby.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ayvqoigays.exe ups_run3⤵
-
C:\Temp\ayvqoigays.exeC:\Temp\ayvqoigays.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ayvqoigays.exe ups_ins3⤵
-
C:\Temp\i_ayvqoigays.exeC:\Temp\i_ayvqoigays.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qnlfdavsnl.exe ups_run3⤵
-
C:\Temp\qnlfdavsnl.exeC:\Temp\qnlfdavsnl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x300,0x7ffdcc21c188,0x7ffdcc21c194,0x7ffdcc21c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2100,i,1136523244176983273,11351527219434209676,524288 --field-trial-handle=2756,i,2571223398373248955,364718045888181969,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1976,i,1179106918336270313,15367133577866712164,262144 --field-trial-handle=2756,i,2571223398373248955,364718045888181969,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,12204054155269779191,14927829326354104031,524288 --field-trial-handle=2756,i,2571223398373248955,364718045888181969,262144 --variations-seed-version --mojo-platform-channel-handle=2808 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,15453099532886748328,8767349302734999209,2097152 --field-trial-handle=2756,i,2571223398373248955,364718045888181969,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3580,i,13261203561961317795,18441530768284505051,2097152 --field-trial-handle=2756,i,2571223398373248955,364718045888181969,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4360,i,9479433028665886584,12920906537558359949,2097152 --field-trial-handle=2756,i,2571223398373248955,364718045888181969,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4372,i,2286436276101592479,7176193895525442360,2097152 --field-trial-handle=2756,i,2571223398373248955,364718045888181969,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,4473567735664765964,13216286237276155014,524288 --field-trial-handle=2756,i,2571223398373248955,364718045888181969,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,7926309491698568253,4190790332388449542,524288 --field-trial-handle=2756,i,2571223398373248955,364718045888181969,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,2596726913918422119,8242036569493627790,524288 --field-trial-handle=2756,i,2571223398373248955,364718045888181969,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,6281552445594283248,5764645767437527117,524288 --field-trial-handle=2756,i,2571223398373248955,364718045888181969,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,6281552445594283248,5764645767437527117,524288 --field-trial-handle=2756,i,2571223398373248955,364718045888181969,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,16588514128226613988,1852464624651948141,524288 --field-trial-handle=2756,i,2571223398373248955,364718045888181969,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,3891721125406055509,1217666387333002317,524288 --field-trial-handle=2756,i,2571223398373248955,364718045888181969,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1428,i,6279830706476563976,6313451985501209923,524288 --field-trial-handle=2756,i,2571223398373248955,364718045888181969,262144 --variations-seed-version --mojo-platform-channel-handle=1436 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1268,i,13541472203181046639,18315986424728959252,524288 --field-trial-handle=2756,i,2571223398373248955,364718045888181969,262144 --variations-seed-version --mojo-platform-channel-handle=1264 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1272,i,13123864348955699415,5916115170477803872,524288 --field-trial-handle=2756,i,2571223398373248955,364718045888181969,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4588,i,14673473425836248554,15025691980193682222,524288 --field-trial-handle=2756,i,2571223398373248955,364718045888181969,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,17110008432037022940,17409596837241872409,524288 --field-trial-handle=2756,i,2571223398373248955,364718045888181969,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,3278694038179400439,2356238989371728731,524288 --field-trial-handle=2756,i,2571223398373248955,364718045888181969,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,6339241871356568901,821923283594174252,524288 --field-trial-handle=2756,i,2571223398373248955,364718045888181969,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6640,i,1944930746158389912,10560521888205420918,262144 --field-trial-handle=2756,i,2571223398373248955,364718045888181969,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,9557489670194669061,9290595100785733856,524288 --field-trial-handle=2756,i,2571223398373248955,364718045888181969,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\jdbwtolgeywigbyt.sysC:\Temp\jdbwtolgeywigbyt.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\qlidbysqoi.sysC:\Temp\qlidbysqoi.sys1⤵
- Executes dropped EXE
-
C:\Temp\vtnlfdxvpn.sysC:\Temp\vtnlfdxvpn.sys1⤵
- Executes dropped EXE
-
C:\Temp\kfcxvpnhfz.sysC:\Temp\kfcxvpnhfz.sys1⤵
- Executes dropped EXE
-
C:\Temp\fcxuspfzxu.sysC:\Temp\fcxuspfzxu.sys1⤵
- Executes dropped EXE
-
C:\Temp\czusmkecwu.sysC:\Temp\czusmkecwu.sys1⤵
- Executes dropped EXE
-
C:\Temp\bztrpjhbzw.sysC:\Temp\bztrpjhbzw.sys1⤵
- Executes dropped EXE
-
C:\Temp\gebwtrljeb.sysC:\Temp\gebwtrljeb.sys1⤵
- Executes dropped EXE
-
C:\Temp\bwtrljebwt.sysC:\Temp\bwtrljebwt.sys1⤵
- Executes dropped EXE
-
C:\Temp\qolgdbvtnl.sysC:\Temp\qolgdbvtnl.sys1⤵
- Executes dropped EXE
-
C:\Temp\sqkidavtnl.sysC:\Temp\sqkidavtnl.sys1⤵
- Executes dropped EXE
-
C:\Temp\nifdxvpnlf.sysC:\Temp\nifdxvpnlf.sys1⤵
-
C:\Temp\pnhfaxsqkf.sysC:\Temp\pnhfaxsqkf.sys1⤵
-
C:\Temp\ausmkhczxv.sysC:\Temp\ausmkhczxv.sys1⤵
-
C:\Temp\urpmhecwur.sysC:\Temp\urpmhecwur.sys1⤵
-
C:\Temp\ojhbzwuomg.sysC:\Temp\ojhbzwuomg.sys1⤵
-
C:\Temp\uomjebwuom.sysC:\Temp\uomjebwuom.sys1⤵
-
C:\Temp\igbytroige.sysC:\Temp\igbytroige.sys1⤵
-
C:\Temp\dyvtnlfdyv.sysC:\Temp\dyvtnlfdyv.sys1⤵
-
C:\Temp\sqkicavsnl.sysC:\Temp\sqkicavsnl.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
bytrlgdbvt.exe
cxupmhfrpj.exe
czusmkecwu.sys
fcxuspfzxu.sys
hfdxvpnhfa.exe
i_bytrlgdbvt.exe
i_hfdxvpnhfa.exe
i_idaysqlays.exe
i_sqkfcavsqk.exe
i_zurpkhcaus.exe
idaysqlays.exe
jdbwtolgeywigbyt.exe
jdbwtolgeywigbyt.sys
kfcxvpnhfz.sys
qlidbysqoi.sys
sqkfcavsqk.exe
vtnlfdxvpn.sys
zurpkhcaus.exe
settings.dat
settings.dat
the-real-index
the-real-index~RFe59cdd5.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
a7c5dadb-4634-4f09-b0f0-bc6ea1849d6a.tmp
Local State
Local State
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
a79a52c3-ea38-4d71-81e0-68d0d89c8758.tmp
content_new.js
CreateProcess.exe
memory/472-236-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1236-289-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1556-318-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2024-189-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2068-322-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2236-378-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2360-430-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2636-366-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2784-461-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3140-399-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3184-459-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3628-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4244-434-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4432-264-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4520-410-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5096-466-0x0000000000F30000-0x0000000000F8F000-memory.dmp
memory/5604-337-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5692-314-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5692-464-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5692-484-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5840-276-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5960-482-0x0000000000010000-0x00000000000AB000-memory.dmp