Analysis
- max time kernel
149s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
09/08/2026, 16:50
General
- Target 2026-08-09_511d7d33071575a43719547eb72630b6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 376KB
- Sample260809-vcrmkaam21
- SHA256 c374ec63508b1a6015335e4f92c26139ad8ae842fe572ca2bfb559846955db60
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_511d7d33071575a43719547eb72630b6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_511d7d33071575a43719547eb72630b6_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\zxrpjhczusmkecwr.exeC:\Temp\zxrpjhczusmkecwr.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecwupmhezx.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\ecwupmhezx.exeC:\Temp\ecwupmhezx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecwupmhezx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ecwupmhezx.exeC:\Temp\i_ecwupmhezx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ztrmjhczur.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ztrmjhczur.exeC:\Temp\ztrmjhczur.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ztrmjhczur.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ztrmjhczur.exeC:\Temp\i_ztrmjhczur.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rmjebwrojh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rmjebwrojh.exeC:\Temp\rmjebwrojh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rmjebwrojh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rmjebwrojh.exeC:\Temp\i_rmjebwrojh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gbytqoigby.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gbytqoigby.exeC:\Temp\gbytqoigby.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gbytqoigby.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gbytqoigby.exeC:\Temp\i_gbytqoigby.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qligdbvtnl.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qligdbvtnl.exeC:\Temp\qligdbvtnl.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qligdbvtnl.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qligdbvtnl.exeC:\Temp\i_qligdbvtnl.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lfdavtnlfd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lfdavtnlfd.exeC:\Temp\lfdavtnlfd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lfdavtnlfd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lfdavtnlfd.exeC:\Temp\i_lfdavtnlfd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nkidavtnlf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nkidavtnlf.exeC:\Temp\nkidavtnlf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nkidavtnlf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nkidavtnlf.exeC:\Temp\i_nkidavtnlf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\icauspnkfc.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\icauspnkfc.exeC:\Temp\icauspnkfc.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_icauspnkfc.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_icauspnkfc.exeC:\Temp\i_icauspnkfc.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zurpkhczus.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zurpkhczus.exeC:\Temp\zurpkhczus.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zurpkhczus.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zurpkhczus.exeC:\Temp\i_zurpkhczus.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mjebzxupmg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mjebzxupmg.exeC:\Temp\mjebzxupmg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mjebzxupmg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mjebzxupmg.exeC:\Temp\i_mjebzxupmg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trmjebztom.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\trmjebztom.exeC:\Temp\trmjebztom.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trmjebztom.exe ups_ins3⤵
-
C:\Temp\i_trmjebztom.exeC:\Temp\i_trmjebztom.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rljebwuomg.exe ups_run3⤵
-
C:\Temp\rljebwuomg.exeC:\Temp\rljebwuomg.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rljebwuomg.exe ups_ins3⤵
-
C:\Temp\i_rljebwuomg.exeC:\Temp\i_rljebwuomg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\igaytqljdb.exe ups_run3⤵
-
C:\Temp\igaytqljdb.exeC:\Temp\igaytqljdb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_igaytqljdb.exe ups_ins3⤵
-
C:\Temp\i_igaytqljdb.exeC:\Temp\i_igaytqljdb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lidayvqoig.exe ups_run3⤵
-
C:\Temp\lidayvqoig.exeC:\Temp\lidayvqoig.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lidayvqoig.exe ups_ins3⤵
-
C:\Temp\i_lidayvqoig.exeC:\Temp\i_lidayvqoig.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ysqlidavsq.exe ups_run3⤵
-
C:\Temp\ysqlidavsq.exeC:\Temp\ysqlidavsq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ysqlidavsq.exe ups_ins3⤵
-
C:\Temp\i_ysqlidavsq.exeC:\Temp\i_ysqlidavsq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\caysnkfdav.exe ups_run3⤵
-
C:\Temp\caysnkfdav.exeC:\Temp\caysnkfdav.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_caysnkfdav.exe ups_ins3⤵
-
C:\Temp\i_caysnkfdav.exeC:\Temp\i_caysnkfdav.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\uspkhczxrp.exe ups_run3⤵
-
C:\Temp\uspkhczxrp.exeC:\Temp\uspkhczxrp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_uspkhczxrp.exe ups_ins3⤵
-
C:\Temp\i_uspkhczxrp.exeC:\Temp\i_uspkhczxrp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usmkhczurm.exe ups_run3⤵
-
C:\Temp\usmkhczurm.exeC:\Temp\usmkhczurm.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usmkhczurm.exe ups_ins3⤵
-
C:\Temp\i_usmkhczurm.exeC:\Temp\i_usmkhczurm.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hezxrpmkec.exe ups_run3⤵
-
C:\Temp\hezxrpmkec.exeC:\Temp\hezxrpmkec.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hezxrpmkec.exe ups_ins3⤵
-
C:\Temp\i_hezxrpmkec.exeC:\Temp\i_hezxrpmkec.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gebwtrojgb.exe ups_run3⤵
-
C:\Temp\gebwtrojgb.exeC:\Temp\gebwtrojgb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffc467ac188,0x7ffc467ac194,0x7ffc467ac1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1944,i,14115759062200215655,5140215581034771303,262144 --field-trial-handle=2512,i,6719565392920172648,5245535138683759980,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2000,i,9195094891739793864,9205059077578644258,524288 --field-trial-handle=2512,i,6719565392920172648,5245535138683759980,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,3047895293288183343,2072387241114116892,524288 --field-trial-handle=2512,i,6719565392920172648,5245535138683759980,262144 --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,11387974367499045991,9681878884792832173,2097152 --field-trial-handle=2512,i,6719565392920172648,5245535138683759980,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,1823734431092643407,15711944926757748089,2097152 --field-trial-handle=2512,i,6719565392920172648,5245535138683759980,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,2191920779383258663,12377138847895456992,2097152 --field-trial-handle=2512,i,6719565392920172648,5245535138683759980,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,3810095562581728360,6733426071242454894,2097152 --field-trial-handle=2512,i,6719565392920172648,5245535138683759980,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,11428387027416050729,3918403843797588592,524288 --field-trial-handle=2512,i,6719565392920172648,5245535138683759980,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,8077840517876300367,14260595199571458156,524288 --field-trial-handle=2512,i,6719565392920172648,5245535138683759980,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,4214027849602472175,6406892423088668447,524288 --field-trial-handle=2512,i,6719565392920172648,5245535138683759980,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,7811223661960665409,961177699369447604,524288 --field-trial-handle=2512,i,6719565392920172648,5245535138683759980,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,7811223661960665409,961177699369447604,524288 --field-trial-handle=2512,i,6719565392920172648,5245535138683759980,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,7740587837287512006,7252238140507834155,524288 --field-trial-handle=2512,i,6719565392920172648,5245535138683759980,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,16862795334609928804,17215513776823711335,524288 --field-trial-handle=2512,i,6719565392920172648,5245535138683759980,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6816,i,1421868141387258456,4589783450719943337,524288 --field-trial-handle=2512,i,6719565392920172648,5245535138683759980,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6924,i,1968699906600690717,12429129123857087328,524288 --field-trial-handle=2512,i,6719565392920172648,5245535138683759980,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1412,i,14385972739227601385,15537426432827682488,524288 --field-trial-handle=2512,i,6719565392920172648,5245535138683759980,262144 --variations-seed-version --mojo-platform-channel-handle=1276 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1396,i,3370326571714280606,2649108734371277129,524288 --field-trial-handle=2512,i,6719565392920172648,5245535138683759980,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1428,i,13180791483629936577,4704891751628736540,524288 --field-trial-handle=2512,i,6719565392920172648,5245535138683759980,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=316,i,7599111562412230801,14487483239714537531,524288 --field-trial-handle=2512,i,6719565392920172648,5245535138683759980,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,10205483927241596978,16928371387304961123,524288 --field-trial-handle=2512,i,6719565392920172648,5245535138683759980,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,11461167468416426210,3738297949148165785,524288 --field-trial-handle=2512,i,6719565392920172648,5245535138683759980,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,16256406916710356674,218906272283389203,524288 --field-trial-handle=2512,i,6719565392920172648,5245535138683759980,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5680,i,12031152503183847290,169329276088595755,262144 --field-trial-handle=2512,i,6719565392920172648,5245535138683759980,262144 --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,4200429465031440143,1420244466468810071,524288 --field-trial-handle=2512,i,6719565392920172648,5245535138683759980,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\zxrpjhczusmkecwr.sysC:\Temp\zxrpjhczusmkecwr.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\mkecwurmkh.sysC:\Temp\mkecwurmkh.sys1⤵
- Executes dropped EXE
-
C:\Temp\wrojhbywro.sysC:\Temp\wrojhbywro.sys1⤵
- Executes dropped EXE
-
C:\Temp\gbytrljdby.sysC:\Temp\gbytrljdby.sys1⤵
- Executes dropped EXE
-
C:\Temp\qlidbvtqoi.sysC:\Temp\qlidbvtqoi.sys1⤵
- Executes dropped EXE
-
C:\Temp\qlidavtnlx.sysC:\Temp\qlidavtnlx.sys1⤵
- Executes dropped EXE
-
C:\Temp\nlfdxvtnlf.sysC:\Temp\nlfdxvtnlf.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfaxspnhfa.sysC:\Temp\hfaxspnhfa.sys1⤵
- Executes dropped EXE
-
C:\Temp\hczusmkhcw.sysC:\Temp\hczusmkhcw.sys1⤵
- Executes dropped EXE
-
C:\Temp\rpjhczxupm.sysC:\Temp\rpjhczxupm.sys1⤵
- Executes dropped EXE
-
C:\Temp\zurmkecwuo.sysC:\Temp\zurmkecwuo.sys1⤵
- Executes dropped EXE
-
C:\Temp\rljgbywtrl.sysC:\Temp\rljgbywtrl.sys1⤵
-
C:\Temp\rljdbvtqlj.sysC:\Temp\rljdbvtqlj.sys1⤵
-
C:\Temp\qlidbvtqlj.sysC:\Temp\qlidbvtqlj.sys1⤵
-
C:\Temp\sqkigdbvsn.sysC:\Temp\sqkigdbvsn.sys1⤵
-
C:\Temp\faxsqkicax.sysC:\Temp\faxsqkicax.sys1⤵
-
C:\Temp\ausmkfcaus.sysC:\Temp\ausmkfcaus.sys1⤵
-
C:\Temp\axspjhczus.sysC:\Temp\axspjhczus.sys1⤵
-
C:\Temp\khcwurmkec.sysC:\Temp\khcwurmkec.sys1⤵
-
C:\Temp\gebztrpjhb.sysC:\Temp\gebztrpjhb.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ecwupmhezx.exe
gbytqoigby.exe
gbytrljdby.sys
i_ecwupmhezx.exe
i_gbytqoigby.exe
i_qligdbvtnl.exe
i_rmjebwrojh.exe
i_ztrmjhczur.exe
lfdavtnlfd.exe
mkecwurmkh.sys
qlidavtnlx.sys
qlidbvtqoi.sys
qligdbvtnl.exe
rmjebwrojh.exe
wrojhbywro.sys
ztrmjhczur.exe
zxrpjhczusmkecwr.exe
zxrpjhczusmkecwr.sys
blocklist
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
the-real-index
the-real-index~RFe5960c4.TMP
SiteList-Enterprise.json
Edge Profile.ico
4be27867-d8ed-4f1a-b0d5-2d754f681408.tmp
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
OperationConfig
OperationConfig~RFe59fbbb.TMP
Local State
Local State
Local State
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
ecb8587c-5b59-485d-8170-ea5a78397f7c.tmp
metadata.json~RFe59380e.TMP
4e347c7e-dac4-47e8-9ef3-4060b6153666.tmp
content_new.js
CreateProcess.exe
memory/120-604-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/768-735-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1068-428-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1148-705-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2116-515-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2344-644-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2544-624-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3060-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3272-679-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3388-648-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3464-537-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3564-475-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3840-668-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4332-522-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4332-503-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4528-718-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5160-575-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6012-556-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6072-684-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6072-706-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6096-571-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6104-552-0x0000000000010000-0x00000000000AB000-memory.dmp