Analysis
- max time kernel
149s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
09/08/2026, 02:42
General
- Target 2026-08-09_c5c5a6fda30fb632f6c1b816e228078e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 376KB
- Sample260809-c7grqsgm6y
- SHA256 06f7bba1c490b9068166653674a93fe7f4e8954e2f2e00a4da813101ab9a6452
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_c5c5a6fda30fb632f6c1b816e228078e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_c5c5a6fda30fb632f6c1b816e228078e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\geywqojgbytrljdb.exeC:\Temp\geywqojgbytrljdb.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gbywigbytq.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\gbywigbytq.exeC:\Temp\gbywigbytq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gbywigbytq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gbywigbytq.exeC:\Temp\i_gbywigbytq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lidaywqnig.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lidaywqnig.exeC:\Temp\lidaywqnig.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lidaywqnig.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lidaywqnig.exeC:\Temp\i_lidaywqnig.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\caxvpnlfdx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\caxvpnlfdx.exeC:\Temp\caxvpnlfdx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_caxvpnlfdx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_caxvpnlfdx.exeC:\Temp\i_caxvpnlfdx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nhfaxspkic.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nhfaxspkic.exeC:\Temp\nhfaxspkic.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nhfaxspkic.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nhfaxspkic.exeC:\Temp\i_nhfaxspkic.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\caxspnhfzx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\caxspnhfzx.exeC:\Temp\caxspnhfzx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_caxspnhfzx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_caxspnhfzx.exeC:\Temp\i_caxspnhfzx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kezxrpjhfz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kezxrpjhfz.exeC:\Temp\kezxrpjhfz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kezxrpjhfz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kezxrpjhfz.exeC:\Temp\i_kezxrpjhfz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mhezwurpjh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mhezwurpjh.exeC:\Temp\mhezwurpjh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mhezwurpjh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mhezwurpjh.exeC:\Temp\i_mhezwurpjh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mgeywqojhb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mgeywqojhb.exeC:\Temp\mgeywqojhb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mgeywqojhb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mgeywqojhb.exeC:\Temp\i_mgeywqojhb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdyvtolgdy.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jdyvtolgdy.exeC:\Temp\jdyvtolgdy.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdyvtolgdy.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jdyvtolgdy.exeC:\Temp\i_jdyvtolgdy.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\olgdyvtqoi.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\olgdyvtqoi.exeC:\Temp\olgdyvtqoi.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_olgdyvtqoi.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_olgdyvtqoi.exeC:\Temp\i_olgdyvtqoi.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lidavtnlfd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lidavtnlfd.exeC:\Temp\lidavtnlfd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lidavtnlfd.exe ups_ins3⤵
-
C:\Temp\i_lidavtnlfd.exeC:\Temp\i_lidavtnlfd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvpnkfcays.exe ups_run3⤵
-
C:\Temp\xvpnkfcays.exeC:\Temp\xvpnkfcays.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xvpnkfcays.exe ups_ins3⤵
-
C:\Temp\i_xvpnkfcays.exeC:\Temp\i_xvpnkfcays.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvpnhfzxrp.exe ups_run3⤵
-
C:\Temp\xvpnhfzxrp.exeC:\Temp\xvpnhfzxrp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xvpnhfzxrp.exe ups_ins3⤵
-
C:\Temp\i_xvpnhfzxrp.exeC:\Temp\i_xvpnhfzxrp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cxupmhfzxr.exe ups_run3⤵
-
C:\Temp\cxupmhfzxr.exeC:\Temp\cxupmhfzxr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cxupmhfzxr.exe ups_ins3⤵
-
C:\Temp\i_cxupmhfzxr.exeC:\Temp\i_cxupmhfzxr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ezxrpmhfzx.exe ups_run3⤵
-
C:\Temp\ezxrpmhfzx.exeC:\Temp\ezxrpmhfzx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ezxrpmhfzx.exe ups_ins3⤵
-
C:\Temp\i_ezxrpmhfzx.exeC:\Temp\i_ezxrpmhfzx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gezwromgeb.exe ups_run3⤵
-
C:\Temp\gezwromgeb.exeC:\Temp\gezwromgeb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gezwromgeb.exe ups_ins3⤵
-
C:\Temp\i_gezwromgeb.exeC:\Temp\i_gezwromgeb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jgbzlgeywt.exe ups_run3⤵
-
C:\Temp\jgbzlgeywt.exeC:\Temp\jgbzlgeywt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jgbzlgeywt.exe ups_ins3⤵
-
C:\Temp\i_jgbzlgeywt.exeC:\Temp\i_jgbzlgeywt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dbvtnlgdbv.exe ups_run3⤵
-
C:\Temp\dbvtnlgdbv.exeC:\Temp\dbvtnlgdbv.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dbvtnlgdbv.exe ups_ins3⤵
-
C:\Temp\i_dbvtnlgdbv.exeC:\Temp\i_dbvtnlgdbv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ayvtnlidbv.exe ups_run3⤵
-
C:\Temp\ayvtnlidbv.exeC:\Temp\ayvtnlidbv.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ayvtnlidbv.exe ups_ins3⤵
-
C:\Temp\i_ayvtnlidbv.exeC:\Temp\i_ayvtnlidbv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ysqnlfayvq.exe ups_run3⤵
-
C:\Temp\ysqnlfayvq.exeC:\Temp\ysqnlfayvq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x300,0x7ffdcc21c188,0x7ffdcc21c194,0x7ffdcc21c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,5094959347320869584,7995129997649115974,524288 --field-trial-handle=2396,i,7683885162045731654,564357164014738133,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,3076167808731676113,11727236806555461427,262144 --field-trial-handle=2396,i,7683885162045731654,564357164014738133,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2404,i,7877554718962406271,9064820745741699987,524288 --field-trial-handle=2396,i,7683885162045731654,564357164014738133,262144 --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3616,i,2720928018314573159,7292686394879870526,2097152 --field-trial-handle=2396,i,7683885162045731654,564357164014738133,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3620,i,14014677468252497174,9279608330865953984,2097152 --field-trial-handle=2396,i,7683885162045731654,564357164014738133,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4316,i,12997830792245666422,13879895870472387893,2097152 --field-trial-handle=2396,i,7683885162045731654,564357164014738133,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,12163522725858368196,18237139320649308345,2097152 --field-trial-handle=2396,i,7683885162045731654,564357164014738133,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3824,i,5629296747583081131,10638159520533546234,2097152 --field-trial-handle=2396,i,7683885162045731654,564357164014738133,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,7203309938798846993,41329090997785518,524288 --field-trial-handle=2396,i,7683885162045731654,564357164014738133,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5512,i,7297200095092361125,7716004682988401074,2097152 --field-trial-handle=2396,i,7683885162045731654,564357164014738133,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4760,i,83919580340559903,11773434283885333216,524288 --field-trial-handle=2396,i,7683885162045731654,564357164014738133,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4744,i,18151699717471534262,2407721311006663989,524288 --field-trial-handle=2396,i,7683885162045731654,564357164014738133,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,3078440230350339965,4543872149131674773,524288 --field-trial-handle=2396,i,7683885162045731654,564357164014738133,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,3078440230350339965,4543872149131674773,524288 --field-trial-handle=2396,i,7683885162045731654,564357164014738133,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,11550957218535366593,15786240395089958239,524288 --field-trial-handle=2396,i,7683885162045731654,564357164014738133,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,5600682319944228916,12135310574227556819,524288 --field-trial-handle=2396,i,7683885162045731654,564357164014738133,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,16108510724574438402,3546881050127496698,524288 --field-trial-handle=2396,i,7683885162045731654,564357164014738133,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6796,i,3812206231174139741,16268923759187567863,524288 --field-trial-handle=2396,i,7683885162045731654,564357164014738133,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4628,i,13652387053143958026,15449381687303654646,524288 --field-trial-handle=2396,i,7683885162045731654,564357164014738133,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,10271628759444031840,4019131279672779789,524288 --field-trial-handle=2396,i,7683885162045731654,564357164014738133,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4632,i,12423156733649305615,7519714693575084383,524288 --field-trial-handle=2396,i,7683885162045731654,564357164014738133,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2912,i,10613995282383188724,15934836986409226215,524288 --field-trial-handle=2396,i,7683885162045731654,564357164014738133,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,11458951924522087786,6112809712010996379,524288 --field-trial-handle=2396,i,7683885162045731654,564357164014738133,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,3981468613904020362,16435487879729683612,524288 --field-trial-handle=2396,i,7683885162045731654,564357164014738133,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,8618601294593487069,5592026259950109706,524288 --field-trial-handle=2396,i,7683885162045731654,564357164014738133,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6384,i,13833206535231079880,16795473457941087198,262144 --field-trial-handle=2396,i,7683885162045731654,564357164014738133,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,16889867384910863939,15855829952783561709,524288 --field-trial-handle=2396,i,7683885162045731654,564357164014738133,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\geywqojgbytrljdb.sysC:\Temp\geywqojgbytrljdb.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\lidbvtqlig.sysC:\Temp\lidbvtqlig.sys1⤵
- Executes dropped EXE
-
C:\Temp\gaysqnifay.sysC:\Temp\gaysqnifay.sys1⤵
- Executes dropped EXE
-
C:\Temp\qkifaxspki.sysC:\Temp\qkifaxspki.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfcausqkhf.sysC:\Temp\hfcausqkhf.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfzxrpmhfz.sysC:\Temp\hfzxrpmhfz.sys1⤵
- Executes dropped EXE
-
C:\Temp\gezwrpmkeb.sysC:\Temp\gezwrpmkeb.sys1⤵
- Executes dropped EXE
-
C:\Temp\mgebwtrljh.sysC:\Temp\mgebwtrljh.sys1⤵
- Executes dropped EXE
-
C:\Temp\qojgbztroj.sysC:\Temp\qojgbztroj.sys1⤵
- Executes dropped EXE
-
C:\Temp\oigbywqoig.sysC:\Temp\oigbywqoig.sys1⤵
- Executes dropped EXE
-
C:\Temp\nlidaysqlf.sysC:\Temp\nlidaysqlf.sys1⤵
- Executes dropped EXE
-
C:\Temp\vsqnifdxvs.sysC:\Temp\vsqnifdxvs.sys1⤵
-
C:\Temp\kicausqkic.sysC:\Temp\kicausqkic.sys1⤵
-
C:\Temp\fcxvpnhecx.sysC:\Temp\fcxvpnhecx.sys1⤵
-
C:\Temp\zxrpmhezxr.sysC:\Temp\zxrpmhezxr.sys1⤵
-
C:\Temp\omcwuomgey.sysC:\Temp\omcwuomgey.sys1⤵
-
C:\Temp\jdbzwromge.sysC:\Temp\jdbzwromge.sys1⤵
-
C:\Temp\igbytrljdb.sysC:\Temp\igbytrljdb.sys1⤵
-
C:\Temp\bysqolgdyv.sysC:\Temp\bysqolgdyv.sys1⤵
-
C:\Temp\igayvqlids.sysC:\Temp\igayvqlids.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
caxspnhfzx.exe
caxvpnlfdx.exe
gaysqnifay.sys
gbywigbytq.exe
geywqojgbytrljdb.exe
geywqojgbytrljdb.sys
hfcausqkhf.sys
hfzxrpmhfz.sys
i_caxspnhfzx.exe
i_caxvpnlfdx.exe
i_gbywigbytq.exe
i_lidaywqnig.exe
i_nhfaxspkic.exe
kezxrpjhfz.exe
lidaywqnig.exe
lidbvtqlig.sys
nhfaxspkic.exe
qkifaxspki.sys
settings.dat
settings.dat
03a2f8a4-a779-450e-a59a-de4cdedb1a17.tmp
the-real-index
the-real-index~RFe59ca99.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
1f9720f3-95e4-4277-9491-1fb1cdc6196a.tmp
Local State
Local State
Local State
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
d23a0d64-a037-46f2-8ed4-0cdf8fad2593.tmp
content_new.js
CreateProcess.exe
memory/924-505-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/924-527-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1076-408-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1088-470-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1476-310-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1620-554-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2324-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2504-263-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2852-482-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3160-389-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3684-458-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4492-509-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4492-534-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4528-426-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4528-404-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4900-349-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4964-438-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5436-355-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5444-385-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5520-532-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5784-537-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5892-362-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5976-494-0x0000000000010000-0x00000000000AB000-memory.dmp