Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 18:40
General
- Target 2026-08-04_b42a58179ac54c1cb7a8b2f656fac49a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 376KB
- Sample260804-xa9fpsvxfx
- SHA256 8bb1edfd41f7422c91e0246b39d0ac9be729cbe75a0ff93a3412533214d85641
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_b42a58179ac54c1cb7a8b2f656fac49a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_b42a58179ac54c1cb7a8b2f656fac49a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\cwuomhbztrpjhezw.exeC:\Temp\cwuomhbztrpjhezw.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bzwrmjhbwu.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\bzwrmjhbwu.exeC:\Temp\bzwrmjhbwu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bzwrmjhbwu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bzwrmjhbwu.exeC:\Temp\i_bzwrmjhbwu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wtoljdywqo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wtoljdywqo.exeC:\Temp\wtoljdywqo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wtoljdywqo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wtoljdywqo.exeC:\Temp\i_wtoljdywqo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtoigaytql.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vtoigaytql.exeC:\Temp\vtoigaytql.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vtoigaytql.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vtoigaytql.exeC:\Temp\i_vtoigaytql.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtnlgdyvto.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vtnlgdyvto.exeC:\Temp\vtnlgdyvto.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vtnlgdyvto.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vtnlgdyvto.exeC:\Temp\i_vtnlgdyvto.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\avsqkifdxv.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\avsqkifdxv.exeC:\Temp\avsqkifdxv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_avsqkifdxv.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_avsqkifdxv.exeC:\Temp\i_avsqkifdxv.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\causpkifax.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\causpkifax.exeC:\Temp\causpkifax.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_causpkifax.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_causpkifax.exeC:\Temp\i_causpkifax.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\uspkecwupm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\uspkecwupm.exeC:\Temp\uspkecwupm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_uspkecwupm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_uspkecwupm.exeC:\Temp\i_uspkecwupm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxupjhczxr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zxupjhczxr.exeC:\Temp\zxupjhczxr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxupjhczxr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zxupjhczxr.exeC:\Temp\i_zxupjhczxr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhbztrmjec.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jhbztrmjec.exeC:\Temp\jhbztrmjec.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhbztrmjec.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jhbztrmjec.exeC:\Temp\i_jhbztrmjec.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gbywrojgby.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gbywrojgby.exeC:\Temp\gbywrojgby.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gbywrojgby.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gbywrojgby.exeC:\Temp\i_gbywrojgby.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bvtqljdbvt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bvtqljdbvt.exeC:\Temp\bvtqljdbvt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bvtqljdbvt.exe ups_ins3⤵
-
C:\Temp\i_bvtqljdbvt.exeC:\Temp\i_bvtqljdbvt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gaytqljdbv.exe ups_run3⤵
-
C:\Temp\gaytqljdbv.exeC:\Temp\gaytqljdbv.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gaytqljdbv.exe ups_ins3⤵
-
C:\Temp\i_gaytqljdbv.exeC:\Temp\i_gaytqljdbv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gaysqkiday.exe ups_run3⤵
-
C:\Temp\gaysqkiday.exeC:\Temp\gaysqkiday.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gaysqkiday.exe ups_ins3⤵
-
C:\Temp\i_gaysqkiday.exeC:\Temp\i_gaysqkiday.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\auspnifdxv.exe ups_run3⤵
-
C:\Temp\auspnifdxv.exeC:\Temp\auspnifdxv.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_auspnifdxv.exe ups_ins3⤵
-
C:\Temp\i_auspnifdxv.exeC:\Temp\i_auspnifdxv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xspnhfzxsp.exe ups_run3⤵
-
C:\Temp\xspnhfzxsp.exeC:\Temp\xspnhfzxsp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xspnhfzxsp.exe ups_ins3⤵
-
C:\Temp\i_xspnhfzxsp.exeC:\Temp\i_xspnhfzxsp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zurpkhczxu.exe ups_run3⤵
-
C:\Temp\zurpkhczxu.exeC:\Temp\zurpkhczxu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zurpkhczxu.exe ups_ins3⤵
-
C:\Temp\i_zurpkhczxu.exeC:\Temp\i_zurpkhczxu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hbzurmjhbz.exe ups_run3⤵
-
C:\Temp\hbzurmjhbz.exeC:\Temp\hbzurmjhbz.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hbzurmjhbz.exe ups_ins3⤵
-
C:\Temp\i_hbzurmjhbz.exeC:\Temp\i_hbzurmjhbz.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zwromgebzw.exe ups_run3⤵
-
C:\Temp\zwromgebzw.exeC:\Temp\zwromgebzw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zwromgebzw.exe ups_ins3⤵
-
C:\Temp\i_zwromgebzw.exeC:\Temp\i_zwromgebzw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ytqojdbztr.exe ups_run3⤵
-
C:\Temp\ytqojdbztr.exeC:\Temp\ytqojdbztr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ytqojdbztr.exe ups_ins3⤵
-
C:\Temp\i_ytqojdbztr.exeC:\Temp\i_ytqojdbztr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dbvtnlgdyv.exe ups_run3⤵
-
C:\Temp\dbvtnlgdyv.exeC:\Temp\dbvtnlgdyv.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x318,0x7ffc66e2c188,0x7ffc66e2c194,0x7ffc66e2c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1904,i,3014914183264173413,14921727223222560323,262144 --field-trial-handle=2616,i,14829175114466406365,11689563504179620100,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,11272509891300504444,7966775811767343841,524288 --field-trial-handle=2616,i,14829175114466406365,11689563504179620100,262144 --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,7953796034295674521,1091757019582721650,524288 --field-trial-handle=2616,i,14829175114466406365,11689563504179620100,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3392,i,12498967704171747545,6236751052967668038,2097152 --field-trial-handle=2616,i,14829175114466406365,11689563504179620100,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,16482702820119908124,5620707297178953237,2097152 --field-trial-handle=2616,i,14829175114466406365,11689563504179620100,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4308,i,12663466898861539749,18156151314981552616,2097152 --field-trial-handle=2616,i,14829175114466406365,11689563504179620100,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4328,i,12757456751326701331,3028592527474223942,2097152 --field-trial-handle=2616,i,14829175114466406365,11689563504179620100,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,3640975394235870595,6842103642672936736,524288 --field-trial-handle=2616,i,14829175114466406365,11689563504179620100,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,7162423653951182753,4870094709376240576,524288 --field-trial-handle=2616,i,14829175114466406365,11689563504179620100,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,2772671670919443811,10902581908786146081,524288 --field-trial-handle=2616,i,14829175114466406365,11689563504179620100,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,6675469992335033734,9694532657531381737,524288 --field-trial-handle=2616,i,14829175114466406365,11689563504179620100,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,6675469992335033734,9694532657531381737,524288 --field-trial-handle=2616,i,14829175114466406365,11689563504179620100,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,16578059896503236588,4881437276762258172,524288 --field-trial-handle=2616,i,14829175114466406365,11689563504179620100,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,14668193878686200369,8048746368018345895,524288 --field-trial-handle=2616,i,14829175114466406365,11689563504179620100,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6552,i,5651522994738171024,18046062154602452618,524288 --field-trial-handle=2616,i,14829175114466406365,11689563504179620100,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,17125162059322347712,17047772854571545622,524288 --field-trial-handle=2616,i,14829175114466406365,11689563504179620100,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1272,i,5463513985905738626,10991034294537872613,524288 --field-trial-handle=2616,i,14829175114466406365,11689563504179620100,262144 --variations-seed-version --mojo-platform-channel-handle=1276 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,10830142233102825919,5123867325433469119,524288 --field-trial-handle=2616,i,14829175114466406365,11689563504179620100,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4844,i,16093817820287158533,9954913070460044550,524288 --field-trial-handle=2616,i,14829175114466406365,11689563504179620100,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1468,i,10317719801043127708,5841392465220314105,524288 --field-trial-handle=2616,i,14829175114466406365,11689563504179620100,262144 --variations-seed-version --mojo-platform-channel-handle=1272 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,6648982606309817813,7098710911823741434,524288 --field-trial-handle=2616,i,14829175114466406365,11689563504179620100,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,13678918667905141587,15632313167749874918,524288 --field-trial-handle=2616,i,14829175114466406365,11689563504179620100,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,5169684459416560756,14990882449228713208,524288 --field-trial-handle=2616,i,14829175114466406365,11689563504179620100,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6472,i,6104996585601650583,4222268833483594035,262144 --field-trial-handle=2616,i,14829175114466406365,11689563504179620100,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2084,i,3379423982314266441,5358035718752499637,524288 --field-trial-handle=2616,i,14829175114466406365,11689563504179620100,262144 --variations-seed-version --mojo-platform-channel-handle=1264 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\cwuomhbztrpjhezw.sysC:\Temp\cwuomhbztrpjhezw.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\dbwtrljgbz.sysC:\Temp\dbwtrljgbz.sys1⤵
- Executes dropped EXE
-
C:\Temp\geywtrljdb.sysC:\Temp\geywtrljdb.sys1⤵
- Executes dropped EXE
-
C:\Temp\aytqlidbvt.sysC:\Temp\aytqlidbvt.sys1⤵
- Executes dropped EXE
-
C:\Temp\fdxvtnlfdx.sysC:\Temp\fdxvtnlfdx.sys1⤵
- Executes dropped EXE
-
C:\Temp\axspkicaxs.sysC:\Temp\axspkicaxs.sys1⤵
- Executes dropped EXE
-
C:\Temp\icausnkfzx.sysC:\Temp\icausnkfzx.sys1⤵
- Executes dropped EXE
-
C:\Temp\zxupmhfzxr.sysC:\Temp\zxupmhfzxr.sys1⤵
- Executes dropped EXE
-
C:\Temp\rpjhbzxrpm.sysC:\Temp\rpjhbzxrpm.sys1⤵
- Executes dropped EXE
-
C:\Temp\ebwtomjebz.sysC:\Temp\ebwtomjebz.sys1⤵
- Executes dropped EXE
-
C:\Temp\mgebwtomge.sysC:\Temp\mgebwtomge.sys1⤵
- Executes dropped EXE
-
C:\Temp\igdytqoigb.sysC:\Temp\igdytqoigb.sys1⤵
-
C:\Temp\kidbvtnlfd.sysC:\Temp\kidbvtnlfd.sys1⤵
-
C:\Temp\avsnkfcays.sysC:\Temp\avsnkfcays.sys1⤵
-
C:\Temp\axspnkfdxv.sysC:\Temp\axspnkfdxv.sys1⤵
-
C:\Temp\fcaupmkfzx.sysC:\Temp\fcaupmkfzx.sys1⤵
-
C:\Temp\kebzxrpmhf.sysC:\Temp\kebzxrpmhf.sys1⤵
-
C:\Temp\cwuomgeywu.sysC:\Temp\cwuomgeywu.sys1⤵
-
C:\Temp\jdbwtrojge.sysC:\Temp\jdbwtrojge.sys1⤵
-
C:\Temp\jdbvtolgey.sysC:\Temp\jdbvtolgey.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
avsqkifdxv.exe
axspkicaxs.sys
aytqlidbvt.sys
bzwrmjhbwu.exe
causpkifax.exe
cwuomhbztrpjhezw.exe
cwuomhbztrpjhezw.sys
dbwtrljgbz.sys
fdxvtnlfdx.sys
geywtrljdb.sys
i_avsqkifdxv.exe
i_bzwrmjhbwu.exe
i_vtnlgdyvto.exe
i_vtoigaytql.exe
i_wtoljdywqo.exe
vtnlgdyvto.exe
vtoigaytql.exe
wtoljdywqo.exe
settings.dat
settings.dat
the-real-index
the-real-index~RFe5991e6.TMP
SiteList-Enterprise.json
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Secure Preferences
aad30e22-33aa-419b-aab0-04bc10c70351.tmp
55942272-e707-45de-b629-6d0a8ff222fb.tmp
Local State
Local State
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
5bb27d1d-c939-4987-8e3d-df9d4024b422.tmp
metadata.json~RFe5968c2.TMP
9946eeae-2a95-4901-84ce-c6c554722f7c.tmp
content_new.js
CreateProcess.exe
memory/612-700-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1280-659-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1504-65-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1664-496-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1760-595-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1892-717-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1908-421-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2576-547-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2592-691-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2760-520-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3864-566-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4436-543-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4496-639-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4720-670-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4772-696-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5088-635-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5500-508-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5664-615-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5728-468-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5924-562-0x0000000000010000-0x00000000000AB000-memory.dmp