Analysis
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
16/09/2026, 18:19
General
- Target 2026-09-16_a99bafb2b185ba325dd091ca1376609c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample260916-wyncpsek2w
- SHA256 389238c01ff8a36e025c5a12668da2177b3b6820782e8a9cd7bde1b21a35dea3
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 9 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-16_a99bafb2b185ba325dd091ca1376609c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-16_a99bafb2b185ba325dd091ca1376609c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\wuomheczurpjhecz.exeC:\Temp\wuomheczurpjhecz.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cwuomgezup.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\cwuomgezup.exeC:\Temp\cwuomgezup.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cwuomgezup.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_cwuomgezup.exeC:\Temp\i_cwuomgezup.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mjecwuomge.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mjecwuomge.exeC:\Temp\mjecwuomge.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mjecwuomge.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mjecwuomge.exeC:\Temp\i_mjecwuomge.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gbytrljdbv.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gbytrljdbv.exeC:\Temp\gbytrljdbv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gbytrljdbv.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gbytrljdbv.exeC:\Temp\i_gbytrljdbv.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bvtqligdyw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bvtqligdyw.exeC:\Temp\bvtqligdyw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bvtqligdyw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bvtqligdyw.exeC:\Temp\i_bvtqligdyw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vqnigaysqn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vqnigaysqn.exeC:\Temp\vqnigaysqn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vqnigaysqn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vqnigaysqn.exeC:\Temp\i_vqnigaysqn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvqnifaysq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xvqnifaysq.exeC:\Temp\xvqnifaysq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xvqnifaysq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xvqnifaysq.exeC:\Temp\i_xvqnifaysq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnkfdxvpnh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pnkfdxvpnh.exeC:\Temp\pnkfdxvpnh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnkfdxvpnh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pnkfdxvpnh.exeC:\Temp\i_pnkfdxvpnh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usmkecwupm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\usmkecwupm.exeC:\Temp\usmkecwupm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usmkecwupm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_usmkecwupm.exeC:\Temp\i_usmkecwupm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\urpjhbzurm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\urpjhbzurm.exeC:\Temp\urpjhbzurm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_urpjhbzurm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_urpjhbzurm.exeC:\Temp\i_urpjhbzurm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\romhezwrpj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\romhezwrpj.exeC:\Temp\romhezwrpj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_romhezwrpj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_romhezwrpj.exeC:\Temp\i_romhezwrpj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\oljdbwtrom.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\oljdbwtrom.exeC:\Temp\oljdbwtrom.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_oljdbwtrom.exe ups_ins3⤵
-
C:\Temp\i_oljdbwtrom.exeC:\Temp\i_oljdbwtrom.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywqoljgbyt.exe ups_run3⤵
-
C:\Temp\ywqoljgbyt.exeC:\Temp\ywqoljgbyt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywqoljgbyt.exe ups_ins3⤵
-
C:\Temp\i_ywqoljgbyt.exeC:\Temp\i_ywqoljgbyt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\oigbqlidbv.exe ups_run3⤵
-
C:\Temp\oigbqlidbv.exeC:\Temp\oigbqlidbv.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_oigbqlidbv.exe ups_ins3⤵
-
C:\Temp\i_oigbqlidbv.exeC:\Temp\i_oigbqlidbv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nifaysqkid.exe ups_run3⤵
-
C:\Temp\nifaysqkid.exeC:\Temp\nifaysqkid.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nifaysqkid.exe ups_ins3⤵
-
C:\Temp\i_nifaysqkid.exeC:\Temp\i_nifaysqkid.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nkfdxvpnhf.exe ups_run3⤵
-
C:\Temp\nkfdxvpnhf.exeC:\Temp\nkfdxvpnhf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nkfdxvpnhf.exe ups_ins3⤵
-
C:\Temp\i_nkfdxvpnhf.exeC:\Temp\i_nkfdxvpnhf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fzxrpkicau.exe ups_run3⤵
-
C:\Temp\fzxrpkicau.exeC:\Temp\fzxrpkicau.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fzxrpkicau.exe ups_ins3⤵
-
C:\Temp\i_fzxrpkicau.exeC:\Temp\i_fzxrpkicau.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\khczxrpmke.exe ups_run3⤵
-
C:\Temp\khczxrpmke.exeC:\Temp\khczxrpmke.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_khczxrpmke.exe ups_ins3⤵
-
C:\Temp\i_khczxrpmke.exeC:\Temp\i_khczxrpmke.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ebzurmkecw.exe ups_run3⤵
-
C:\Temp\ebzurmkecw.exeC:\Temp\ebzurmkecw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ebzurmkecw.exe ups_ins3⤵
-
C:\Temp\i_ebzurmkecw.exeC:\Temp\i_ebzurmkecw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mgeywromge.exe ups_run3⤵
-
C:\Temp\mgeywromge.exeC:\Temp\mgeywromge.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mgeywromge.exe ups_ins3⤵
-
C:\Temp\i_mgeywromge.exeC:\Temp\i_mgeywromge.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jgbywqojgb.exe ups_run3⤵
-
C:\Temp\jgbywqojgb.exeC:\Temp\jgbywqojgb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jgbywqojgb.exe ups_ins3⤵
-
C:\Temp\i_jgbywqojgb.exeC:\Temp\i_jgbywqojgb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff9699ec188,0x7ff9699ec194,0x7ff9699ec1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2052,i,1163774379936421675,4584028361624390566,524288 --field-trial-handle=2416,i,7477862385129286770,5168320682982922116,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1880,i,11274435353729409177,80661241339551026,262144 --field-trial-handle=2416,i,7477862385129286770,5168320682982922116,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2440,i,10889324706289129511,11143474854927996301,524288 --field-trial-handle=2416,i,7477862385129286770,5168320682982922116,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,12620671775519898828,9754338472234308999,2097152 --field-trial-handle=2416,i,7477862385129286770,5168320682982922116,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,12202404395086689204,17561466457484845699,2097152 --field-trial-handle=2416,i,7477862385129286770,5168320682982922116,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,5284602736953298786,4919946576254377666,2097152 --field-trial-handle=2416,i,7477862385129286770,5168320682982922116,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,17542052644388040601,16610994549872119058,2097152 --field-trial-handle=2416,i,7477862385129286770,5168320682982922116,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,8031243432060611398,5047885709122060839,524288 --field-trial-handle=2416,i,7477862385129286770,5168320682982922116,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3688,i,7479530201117282821,6728926543400947903,524288 --field-trial-handle=2416,i,7477862385129286770,5168320682982922116,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,11406290500204838390,1963674229453935493,524288 --field-trial-handle=2416,i,7477862385129286770,5168320682982922116,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,14913885250051476787,7141383310756587193,524288 --field-trial-handle=2416,i,7477862385129286770,5168320682982922116,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,14913885250051476787,7141383310756587193,524288 --field-trial-handle=2416,i,7477862385129286770,5168320682982922116,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,2873405779142907071,6335688772908804585,524288 --field-trial-handle=2416,i,7477862385129286770,5168320682982922116,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,17351044904722959788,15141257240938955377,524288 --field-trial-handle=2416,i,7477862385129286770,5168320682982922116,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4744,i,1563280079526140996,2787736724326807015,524288 --field-trial-handle=2416,i,7477862385129286770,5168320682982922116,262144 --variations-seed-version --mojo-platform-channel-handle=1416 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4780,i,7582488819635746897,10052391730730551840,524288 --field-trial-handle=2416,i,7477862385129286770,5168320682982922116,262144 --variations-seed-version --mojo-platform-channel-handle=1372 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,7335419191698659953,14947022282352137155,524288 --field-trial-handle=2416,i,7477862385129286770,5168320682982922116,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4780,i,7157596441440490425,17136108624995741967,524288 --field-trial-handle=2416,i,7477862385129286770,5168320682982922116,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,9851109985115112834,17506487836799915195,524288 --field-trial-handle=2416,i,7477862385129286770,5168320682982922116,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,6648798584043849877,13592740456589394522,524288 --field-trial-handle=2416,i,7477862385129286770,5168320682982922116,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4852,i,13570969892332755398,12209084924733921876,524288 --field-trial-handle=2416,i,7477862385129286770,5168320682982922116,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=920,i,12377522065884511276,13875202754886448104,262144 --field-trial-handle=2416,i,7477862385129286770,5168320682982922116,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,9313491876724010700,17608774521382915251,524288 --field-trial-handle=2416,i,7477862385129286770,5168320682982922116,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\wuomheczurpjhecz.sysC:\Temp\wuomheczurpjhecz.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\rmjecwuomg.sysC:\Temp\rmjecwuomg.sys1⤵
- Executes dropped EXE
-
C:\Temp\jdbvtolgey.sysC:\Temp\jdbvtolgey.sys1⤵
- Executes dropped EXE
-
C:\Temp\yvtnljgayw.sysC:\Temp\yvtnljgayw.sys1⤵
- Executes dropped EXE
-
C:\Temp\jdbvtnlfdy.sysC:\Temp\jdbvtnlfdy.sys1⤵
- Executes dropped EXE
-
C:\Temp\aysqkicavs.sysC:\Temp\aysqkicavs.sys1⤵
- Executes dropped EXE
-
C:\Temp\smkfcaxvpn.sysC:\Temp\smkfcaxvpn.sys1⤵
- Executes dropped EXE
-
C:\Temp\usmkhcausm.sysC:\Temp\usmkhcausm.sys1⤵
- Executes dropped EXE
-
C:\Temp\czxrpjhecw.sysC:\Temp\czxrpjhecw.sys1⤵
- Executes dropped EXE
-
C:\Temp\wupmhezwuo.sysC:\Temp\wupmhezwuo.sys1⤵
- Executes dropped EXE
-
C:\Temp\rojgbztrlj.sysC:\Temp\rojgbztrlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\tqolgdbvtq.sysC:\Temp\tqolgdbvtq.sys1⤵
-
C:\Temp\olgdywqoig.sysC:\Temp\olgdywqoig.sys1⤵
-
C:\Temp\oigaysqnli.sysC:\Temp\oigaysqnli.sys1⤵
-
C:\Temp\nkicaysqki.sysC:\Temp\nkicaysqki.sys1⤵
-
C:\Temp\snkfcxvpnk.sysC:\Temp\snkfcxvpnk.sys1⤵
-
C:\Temp\hfcxuspkhc.sysC:\Temp\hfcxuspkhc.sys1⤵
-
C:\Temp\hecwuomhez.sysC:\Temp\hecwuomhez.sys1⤵
-
C:\Temp\jhezwurmje.sysC:\Temp\jhezwurmje.sys1⤵
-
C:\Temp\oljebztomg.sysC:\Temp\oljebztomg.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
aysqkicavs.sys
bvtqligdyw.exe
cwuomgezup.exe
gbytrljdbv.exe
i_bvtqligdyw.exe
i_cwuomgezup.exe
i_gbytrljdbv.exe
i_mjecwuomge.exe
i_vqnigaysqn.exe
i_xvqnifaysq.exe
jdbvtnlfdy.sys
jdbvtolgey.sys
mjecwuomge.exe
rmjecwuomg.sys
vqnigaysqn.exe
wuomheczurpjhecz.exe
wuomheczurpjhecz.sys
xvqnifaysq.exe
yvtnljgayw.sys
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
the-real-index
the-real-index~RFe597d06.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
OperationConfig
OperationConfig~RFe5a1762.TMP
Local State
Local State
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
5975d814-d29d-4edc-a3b2-06ffea8c5706.tmp
content_new.js
CreateProcess.exe
memory/600-478-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1240-417-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1336-63-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1336-222-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1932-437-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1944-278-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2360-384-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2452-189-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2468-495-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3416-448-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3456-271-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3456-237-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3612-372-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3612-394-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3828-265-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3828-285-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4112-292-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4184-337-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4184-360-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4664-474-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5000-342-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5272-452-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5600-398-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5780-322-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5780-339-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6000-318-0x0000000000010000-0x00000000000AB000-memory.dmp