Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
31/10/2026, 11:58
General
- Target 2026-10-31_b512e64983365ef6da2d6a1c26626df1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261031-n45vyaa17s
- SHA256 bb5ee5748438f87e0bc7345b1809c63e39759a3eb2398354d1f1e6ef2f7d0cdf
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-31_b512e64983365ef6da2d6a1c26626df1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-31_b512e64983365ef6da2d6a1c26626df1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\smkfcxmhfzxrpkhc.exeC:\Temp\smkfcxmhfzxrpkhc.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mkhcaurmke.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\mkhcaurmke.exeC:\Temp\mkhcaurmke.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mkhcaurmke.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mkhcaurmke.exeC:\Temp\i_mkhcaurmke.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pecwuomhez.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pecwuomhez.exeC:\Temp\pecwuomhez.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pecwuomhez.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pecwuomhez.exeC:\Temp\i_pecwuomhez.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bwurljebwu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bwurljebwu.exeC:\Temp\bwurljebwu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bwurljebwu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bwurljebwu.exeC:\Temp\i_bwurljebwu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywtolgeywq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ywtolgeywq.exeC:\Temp\ywtolgeywq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywtolgeywq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ywtolgeywq.exeC:\Temp\i_ywtolgeywq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lfdyvqoiga.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lfdyvqoiga.exeC:\Temp\lfdyvqoiga.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lfdyvqoiga.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lfdyvqoiga.exeC:\Temp\i_lfdyvqoiga.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lxvqnlfdxv.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lxvqnlfdxv.exeC:\Temp\lxvqnlfdxv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lxvqnlfdxv.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lxvqnlfdxv.exeC:\Temp\i_lxvqnlfdxv.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lfdxvpnifa.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lfdxvpnifa.exeC:\Temp\lfdxvpnifa.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lfdxvpnifa.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lfdxvpnifa.exeC:\Temp\i_lfdxvpnifa.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\smkicausnk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\smkicausnk.exeC:\Temp\smkicausnk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_smkicausnk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_smkicausnk.exeC:\Temp\i_smkicausnk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pkhfzxrpkh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pkhfzxrpkh.exeC:\Temp\pkhfzxrpkh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pkhfzxrpkh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pkhfzxrpkh.exeC:\Temp\i_pkhfzxrpkh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpjhczxupj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rpjhczxupj.exeC:\Temp\rpjhczxupj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpjhczxupj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rpjhczxupj.exeC:\Temp\i_rpjhczxupj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pjhbztrmje.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pjhbztrmje.exeC:\Temp\pjhbztrmje.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pjhbztrmje.exe ups_ins3⤵
-
C:\Temp\i_pjhbztrmje.exeC:\Temp\i_pjhbztrmje.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\uomgeywroj.exe ups_run3⤵
-
C:\Temp\uomgeywroj.exeC:\Temp\uomgeywroj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_uomgeywroj.exe ups_ins3⤵
-
C:\Temp\i_uomgeywroj.exeC:\Temp\i_uomgeywroj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qljgbywtnl.exe ups_run3⤵
-
C:\Temp\qljgbywtnl.exeC:\Temp\qljgbywtnl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qljgbywtnl.exe ups_ins3⤵
-
C:\Temp\i_qljgbywtnl.exeC:\Temp\i_qljgbywtnl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\igaykidavt.exe ups_run3⤵
-
C:\Temp\igaykidavt.exeC:\Temp\igaykidavt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_igaykidavt.exe ups_ins3⤵
-
C:\Temp\i_igaykidavt.exeC:\Temp\i_igaykidavt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lfdxvtqlid.exe ups_run3⤵
-
C:\Temp\lfdxvtqlid.exeC:\Temp\lfdxvtqlid.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lfdxvtqlid.exe ups_ins3⤵
-
C:\Temp\i_lfdxvtqlid.exeC:\Temp\i_lfdxvtqlid.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dxvqnhcaus.exe ups_run3⤵
-
C:\Temp\dxvqnhcaus.exeC:\Temp\dxvqnhcaus.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dxvqnhcaus.exe ups_ins3⤵
-
C:\Temp\i_dxvqnhcaus.exeC:\Temp\i_dxvqnhcaus.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xusmkicaxr.exe ups_run3⤵
-
C:\Temp\xusmkicaxr.exeC:\Temp\xusmkicaxr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xusmkicaxr.exe ups_ins3⤵
-
C:\Temp\i_xusmkicaxr.exeC:\Temp\i_xusmkicaxr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecausmkecx.exe ups_run3⤵
-
C:\Temp\ecausmkecx.exeC:\Temp\ecausmkecx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecausmkecx.exe ups_ins3⤵
-
C:\Temp\i_ecausmkecx.exeC:\Temp\i_ecausmkecx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecwuomhezx.exe ups_run3⤵
-
C:\Temp\ecwuomhezx.exeC:\Temp\ecwuomhezx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecwuomhezx.exe ups_ins3⤵
-
C:\Temp\i_ecwuomhezx.exeC:\Temp\i_ecwuomhezx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\eywuomjhbz.exe ups_run3⤵
-
C:\Temp\eywuomjhbz.exeC:\Temp\eywuomjhbz.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x220,0x300,0x7ff92372c188,0x7ff92372c194,0x7ff92372c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1820,i,7797664014673236374,10414488072787059611,262144 --field-trial-handle=2464,i,8636754950147269266,15057726934299536770,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2072,i,6486933898609961147,2207972721894181306,524288 --field-trial-handle=2464,i,8636754950147269266,15057726934299536770,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2660,i,7136389977573015259,7620990634222525061,524288 --field-trial-handle=2464,i,8636754950147269266,15057726934299536770,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,14468281647294919306,1123055453798928043,2097152 --field-trial-handle=2464,i,8636754950147269266,15057726934299536770,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,4639814218719867224,15135470229600066798,2097152 --field-trial-handle=2464,i,8636754950147269266,15057726934299536770,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,9703885090940476525,7394809750710443297,2097152 --field-trial-handle=2464,i,8636754950147269266,15057726934299536770,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,17530915156462937622,2071728668693900648,2097152 --field-trial-handle=2464,i,8636754950147269266,15057726934299536770,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,7050638929634568086,1400925393005182622,524288 --field-trial-handle=2464,i,8636754950147269266,15057726934299536770,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,12116133597236912930,12520159697031876471,524288 --field-trial-handle=2464,i,8636754950147269266,15057726934299536770,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,11007807630287657420,16924072374512196392,524288 --field-trial-handle=2464,i,8636754950147269266,15057726934299536770,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,3438438930471005996,13894665963328119267,524288 --field-trial-handle=2464,i,8636754950147269266,15057726934299536770,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,3438438930471005996,13894665963328119267,524288 --field-trial-handle=2464,i,8636754950147269266,15057726934299536770,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,14390208469955038012,5871644663356281144,524288 --field-trial-handle=2464,i,8636754950147269266,15057726934299536770,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,1164166126519628279,11272178602165295064,524288 --field-trial-handle=2464,i,8636754950147269266,15057726934299536770,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,6156500177624140499,13491318577269218831,524288 --field-trial-handle=2464,i,8636754950147269266,15057726934299536770,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6916,i,12384960609017325529,10001498687765511157,524288 --field-trial-handle=2464,i,8636754950147269266,15057726934299536770,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,8303109801892179736,11091583192544757277,524288 --field-trial-handle=2464,i,8636754950147269266,15057726934299536770,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4688,i,12668068426441127601,16440121312802805135,524288 --field-trial-handle=2464,i,8636754950147269266,15057726934299536770,262144 --variations-seed-version --mojo-platform-channel-handle=544 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,6162246479432900329,13564436927108759030,524288 --field-trial-handle=2464,i,8636754950147269266,15057726934299536770,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5564,i,14521595552418811658,10992035445867511790,524288 --field-trial-handle=2464,i,8636754950147269266,15057726934299536770,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6920,i,14286203973985451905,1356548640528238210,524288 --field-trial-handle=2464,i,8636754950147269266,15057726934299536770,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,14326476248559579409,5839009184248577872,524288 --field-trial-handle=2464,i,8636754950147269266,15057726934299536770,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6820,i,8915027364566509075,17829299980365582640,524288 --field-trial-handle=2464,i,8636754950147269266,15057726934299536770,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6252,i,9380157978115869308,9966159815427676594,262144 --field-trial-handle=2464,i,8636754950147269266,15057726934299536770,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,13288213609694008168,6746933095478041553,524288 --field-trial-handle=2464,i,8636754950147269266,15057726934299536770,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\smkfcxmhfzxrpkhc.sysC:\Temp\smkfcxmhfzxrpkhc.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\urmkeczurm.sysC:\Temp\urmkeczurm.sys1⤵
- Executes dropped EXE
-
C:\Temp\ebwurmjgey.sysC:\Temp\ebwurmjgey.sys1⤵
- Executes dropped EXE
-
C:\Temp\wtoljgbztr.sysC:\Temp\wtoljgbztr.sys1⤵
- Executes dropped EXE
-
C:\Temp\ywigbytqlj.sysC:\Temp\ywigbytqlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\tnlfdbvtnl.sysC:\Temp\tnlfdbvtnl.sys1⤵
- Executes dropped EXE
-
C:\Temp\nigaysnkid.sysC:\Temp\nigaysnkid.sys1⤵
- Executes dropped EXE
-
C:\Temp\snkfdxvsqk.sysC:\Temp\snkfdxvsqk.sys1⤵
- Executes dropped EXE
-
C:\Temp\zxvsnkifzx.sysC:\Temp\zxvsnkifzx.sys1⤵
- Executes dropped EXE
-
C:\Temp\usmkhczusm.sysC:\Temp\usmkhczusm.sys1⤵
- Executes dropped EXE
-
C:\Temp\pmkecwuomj.sysC:\Temp\pmkecwuomj.sys1⤵
- Executes dropped EXE
-
C:\Temp\rljdbwtomg.sysC:\Temp\rljdbwtomg.sys1⤵
-
C:\Temp\ztrljdbztr.sysC:\Temp\ztrljdbztr.sys1⤵
-
C:\Temp\oigbytqlid.sysC:\Temp\oigbytqlid.sys1⤵
-
C:\Temp\ligayvtnli.sysC:\Temp\ligayvtnli.sys1⤵
-
C:\Temp\faxsqkicau.sysC:\Temp\faxsqkicau.sys1⤵
-
C:\Temp\fcxusqkifv.sysC:\Temp\fcxusqkifv.sys1⤵
-
C:\Temp\hfzxrpkhcz.sysC:\Temp\hfzxrpkhcz.sys1⤵
-
C:\Temp\fzxrpjhczu.sysC:\Temp\fzxrpjhczu.sys1⤵
-
C:\Temp\ebzwromjec.sysC:\Temp\ebzwromjec.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
bwurljebwu.exe
ebwurmjgey.sys
i_bwurljebwu.exe
i_lfdyvqoiga.exe
i_mkhcaurmke.exe
i_pecwuomhez.exe
i_ywtolgeywq.exe
lfdyvqoiga.exe
lxvqnlfdxv.exe
mkhcaurmke.exe
pecwuomhez.exe
smkfcxmhfzxrpkhc.exe
smkfcxmhfzxrpkhc.sys
tnlfdbvtnl.sys
urmkeczurm.sys
wtoljgbztr.sys
ywigbytqlj.sys
ywtolgeywq.exe
07a2947a-096f-459d-910e-7ab19b47e577.tmp
0a10b669-99c3-412f-ae70-e4b01284a86f.tmp
2b3ecc70-f28c-43c4-a021-2ecdecd8e88d.tmp
38b86c71-084e-4c7e-be34-01dac1c286f3.tmp
settings.dat
settings.dat
3e3da07a-e8ce-40d7-9668-cb52753cffce.tmp
7e01a884-5867-4722-8305-2b87b57d376e.tmp
BookmarkMergedSurfaceOrdering
temp-index
260f2447-c42e-46f9-9288-a17b02c1a698.tmp
dasherSettingSchema.json
d6930529-959a-4cf7-bd43-c2a21e8f3ca6.tmp
f5b43f0f-58f1-479f-a528-bf03f4041e62.tmp
f931e366-54e5-4428-961e-bdd23d430704.tmp
Preferences
sync_diagnostic.log
af748ba6-f7d9-4a98-a83f-62810e1fb19c.tmp
e67b6e03-d6bd-4757-bf67-b3aa498f80ed.tmp
OperationConfig
cbf222ba-1d81-417f-814c-8de281b4be63.tmp
25ff0ae8-a873-464a-a13f-f0e16c1daaf4.tmp
3e34c62a-3ab1-4524-aa26-5628261238cb.tmp
6b2df4a9-7a5a-42ca-a25d-813ff794e316.tmp
7ec11672-eb20-4b53-87da-22103bfee6fd.tmp
d3d7ac14-d69e-44bf-94b5-770adacaa219.tmp
e7243459-1b7c-4249-89e4-19f930adb47a.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
73916cd7-5df6-41e0-a38e-5e037ef3aeb2.tmp
metadata.json
16e2ce7c-e7fe-4364-9586-faa325878c4c.tmp
338c9722-257b-4395-b8a5-2738f30e2e31.tmp
content.js
messages.json
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/1056-731-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1120-606-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1528-60-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1744-430-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1760-576-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1848-705-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2552-556-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2812-684-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2836-479-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3128-672-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4104-552-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4284-572-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4344-648-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4520-727-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4616-626-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4800-516-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5024-504-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5600-529-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5724-709-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5884-652-0x0000000000010000-0x00000000000AB000-memory.dmp