Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
22/08/2026, 10:38
General
- Target 2026-08-21_8f8ed7a554cc44235621b54623a24171_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample260822-mpqa9stbqb
- SHA256 dc3bb702587f8d73ea07202c959025820923cc6e71efcdf73c18a9ecf39d7da6
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-21_8f8ed7a554cc44235621b54623a24171_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-21_8f8ed7a554cc44235621b54623a24171_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\nkecxupmhfzxrpmk.exeC:\Temp\nkecxupmhfzxrpmk.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpmkecwupk.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\rpmkecwupk.exeC:\Temp\rpmkecwupk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpmkecwupk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rpmkecwupk.exeC:\Temp\i_rpmkecwupk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\czujhbzxrp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\czujhbzxrp.exeC:\Temp\czujhbzxrp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_czujhbzxrp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_czujhbzxrp.exeC:\Temp\i_czujhbzxrp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gebwtrojge.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gebwtrojge.exeC:\Temp\gebwtrojge.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gebwtrojge.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gebwtrojge.exeC:\Temp\i_gebwtrojge.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wtqomgeywq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wtqomgeywq.exeC:\Temp\wtqomgeywq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wtqomgeywq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wtqomgeywq.exeC:\Temp\i_wtqomgeywq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bvtnlgdyvq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bvtnlgdyvq.exeC:\Temp\bvtnlgdyvq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bvtnlgdyvq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bvtnlgdyvq.exeC:\Temp\i_bvtnlgdyvq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qnlfdxvsqo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qnlfdxvsqo.exeC:\Temp\qnlfdxvsqo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qnlfdxvsqo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qnlfdxvsqo.exeC:\Temp\i_qnlfdxvsqo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nifaxvpnhf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nifaxvpnhf.exeC:\Temp\nifaxvpnhf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nifaxvpnhf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nifaxvpnhf.exeC:\Temp\i_nifaxvpnhf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mkicaxvpnk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mkicaxvpnk.exeC:\Temp\mkicaxvpnk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mkicaxvpnk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mkicaxvpnk.exeC:\Temp\i_mkicaxvpnk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pkecausmke.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pkecausmke.exeC:\Temp\pkecausmke.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pkecausmke.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pkecausmke.exeC:\Temp\i_pkecausmke.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cwuomkeczx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\cwuomkeczx.exeC:\Temp\cwuomkeczx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cwuomkeczx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_cwuomkeczx.exeC:\Temp\i_cwuomkeczx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wuomjebwro.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wuomjebwro.exeC:\Temp\wuomjebwro.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wuomjebwro.exe ups_ins3⤵
-
C:\Temp\i_wuomjebwro.exeC:\Temp\i_wuomjebwro.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mgeywrojhb.exe ups_run3⤵
-
C:\Temp\mgeywrojhb.exeC:\Temp\mgeywrojhb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mgeywrojhb.exe ups_ins3⤵
-
C:\Temp\i_mgeywrojhb.exeC:\Temp\i_mgeywrojhb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gebvtrolge.exe ups_run3⤵
-
C:\Temp\gebvtrolge.exeC:\Temp\gebvtrolge.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gebvtrolge.exe ups_ins3⤵
-
C:\Temp\i_gebvtrolge.exeC:\Temp\i_gebvtrolge.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\oigdbvqoig.exe ups_run3⤵
-
C:\Temp\oigdbvqoig.exeC:\Temp\oigdbvqoig.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_oigdbvqoig.exe ups_ins3⤵
-
C:\Temp\i_oigdbvqoig.exeC:\Temp\i_oigdbvqoig.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\idavsnlfdx.exe ups_run3⤵
-
C:\Temp\idavsnlfdx.exeC:\Temp\idavsnlfdx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_idavsnlfdx.exe ups_ins3⤵
-
C:\Temp\i_idavsnlfdx.exeC:\Temp\i_idavsnlfdx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ifaxvpnifa.exe ups_run3⤵
-
C:\Temp\ifaxvpnifa.exeC:\Temp\ifaxvpnifa.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ifaxvpnifa.exe ups_ins3⤵
-
C:\Temp\i_ifaxvpnifa.exeC:\Temp\i_ifaxvpnifa.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvpnhfzxsp.exe ups_run3⤵
-
C:\Temp\xvpnhfzxsp.exeC:\Temp\xvpnhfzxsp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xvpnhfzxsp.exe ups_ins3⤵
-
C:\Temp\i_xvpnhfzxsp.exeC:\Temp\i_xvpnhfzxsp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\smjhczusmk.exe ups_run3⤵
-
C:\Temp\smjhczusmk.exeC:\Temp\smjhczusmk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_smjhczusmk.exe ups_ins3⤵
-
C:\Temp\i_smjhczusmk.exeC:\Temp\i_smjhczusmk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mkecwuomhe.exe ups_run3⤵
-
C:\Temp\mkecwuomhe.exeC:\Temp\mkecwuomhe.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mkecwuomhe.exe ups_ins3⤵
-
C:\Temp\i_mkecwuomhe.exeC:\Temp\i_mkecwuomhe.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\urljebwuom.exe ups_run3⤵
-
C:\Temp\urljebwuom.exeC:\Temp\urljebwuom.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x30c,0x310,0x314,0x308,0x334,0x7ffc7bdcc188,0x7ffc7bdcc194,0x7ffc7bdcc1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,16261508566832446109,17990363645763076289,262144 --field-trial-handle=2348,i,7367031964051377851,15838262000487797447,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,11056662842488127331,6635219878241256476,524288 --field-trial-handle=2348,i,7367031964051377851,15838262000487797447,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2508,i,3789539472721775474,15043834030543291748,524288 --field-trial-handle=2348,i,7367031964051377851,15838262000487797447,262144 --variations-seed-version --mojo-platform-channel-handle=3344 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,4220183528615984141,10991926115848657957,2097152 --field-trial-handle=2348,i,7367031964051377851,15838262000487797447,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,14197142362998197257,13668877362752281896,2097152 --field-trial-handle=2348,i,7367031964051377851,15838262000487797447,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,7751908447383066735,15699896719635416918,2097152 --field-trial-handle=2348,i,7367031964051377851,15838262000487797447,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,4930061297903982587,13471758471488125501,2097152 --field-trial-handle=2348,i,7367031964051377851,15838262000487797447,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3800,i,11582394759485811391,17919632608357774774,524288 --field-trial-handle=2348,i,7367031964051377851,15838262000487797447,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3808,i,967510509512533976,5993668283102690602,524288 --field-trial-handle=2348,i,7367031964051377851,15838262000487797447,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,9806781273746699992,13139632686845730413,524288 --field-trial-handle=2348,i,7367031964051377851,15838262000487797447,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,12981377209771765758,11272480117499386010,524288 --field-trial-handle=2348,i,7367031964051377851,15838262000487797447,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,12981377209771765758,11272480117499386010,524288 --field-trial-handle=2348,i,7367031964051377851,15838262000487797447,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,9980559589146506441,4623883123556599766,524288 --field-trial-handle=2348,i,7367031964051377851,15838262000487797447,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,662914967529512913,16381066792533968565,524288 --field-trial-handle=2348,i,7367031964051377851,15838262000487797447,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,10167414081355645564,469024897267015135,524288 --field-trial-handle=2348,i,7367031964051377851,15838262000487797447,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,5928990439923168472,15658112705694767750,524288 --field-trial-handle=2348,i,7367031964051377851,15838262000487797447,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,15270295021806639274,5405947085265822432,524288 --field-trial-handle=2348,i,7367031964051377851,15838262000487797447,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,16673461275195158088,2165545186625888048,524288 --field-trial-handle=2348,i,7367031964051377851,15838262000487797447,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,14270897377448704026,11070852655251818017,524288 --field-trial-handle=2348,i,7367031964051377851,15838262000487797447,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,16223757840612406012,10034115919239960140,524288 --field-trial-handle=2348,i,7367031964051377851,15838262000487797447,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,12725534817013586301,15900226744098072967,524288 --field-trial-handle=2348,i,7367031964051377851,15838262000487797447,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,11395669668261325556,11331892916650376248,524288 --field-trial-handle=2348,i,7367031964051377851,15838262000487797447,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,12616121474902222136,18104718266292388970,524288 --field-trial-handle=2348,i,7367031964051377851,15838262000487797447,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6304,i,3432376499106324377,6276017271902832602,262144 --field-trial-handle=2348,i,7367031964051377851,15838262000487797447,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,11400695338517124902,2116735183978879700,524288 --field-trial-handle=2348,i,7367031964051377851,15838262000487797447,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\nkecxupmhfzxrpmk.sysC:\Temp\nkecxupmhfzxrpmk.sys1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\jhbzuomgez.sysC:\Temp\jhbzuomgez.sys1⤵
- Executes dropped EXE
-
C:\Temp\wuomgezwug.sysC:\Temp\wuomgezwug.sys1⤵
- Executes dropped EXE
-
C:\Temp\trojgeywtr.sysC:\Temp\trojgeywtr.sys1⤵
- Executes dropped EXE
-
C:\Temp\dbvtqljdbv.sysC:\Temp\dbvtqljdbv.sys1⤵
- Executes dropped EXE
-
C:\Temp\qlidaysqoi.sysC:\Temp\qlidaysqoi.sys1⤵
- Executes dropped EXE
-
C:\Temp\vsnlfdxvpn.sysC:\Temp\vsnlfdxvpn.sys1⤵
- Executes dropped EXE
-
C:\Temp\usqkicausn.sysC:\Temp\usqkicausn.sys1⤵
- Executes dropped EXE
-
C:\Temp\smkhfcxusm.sysC:\Temp\smkhfcxusm.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfzxrpjhcz.sysC:\Temp\hfzxrpjhcz.sys1⤵
- Executes dropped EXE
-
C:\Temp\ecwuomjebz.sysC:\Temp\ecwuomjebz.sys1⤵
- Executes dropped EXE
-
C:\Temp\mjecwuomge.sysC:\Temp\mjecwuomge.sys1⤵
-
C:\Temp\geywtolgdb.sysC:\Temp\geywtolgdb.sys1⤵
-
C:\Temp\oigaysqlid.sysC:\Temp\oigaysqlid.sys1⤵
-
C:\Temp\qkidaysqol.sysC:\Temp\qkidaysqol.sys1⤵
-
C:\Temp\ifdavsnkfd.sysC:\Temp\ifdavsnkfd.sys1⤵
-
C:\Temp\czxspkicau.sysC:\Temp\czxspkicau.sys1⤵
-
C:\Temp\smjhfcxupn.sysC:\Temp\smjhfcxupn.sys1⤵
-
C:\Temp\zurmkecwuo.sysC:\Temp\zurmkecwuo.sys1⤵
-
C:\Temp\rpmgebwtrp.sysC:\Temp\rpmgebwtrp.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
bvtnlgdyvq.exe
czujhbzxrp.exe
dbvtqljdbv.sys
gebwtrojge.exe
i_bvtnlgdyvq.exe
i_czujhbzxrp.exe
i_gebwtrojge.exe
i_rpmkecwupk.exe
i_wtqomgeywq.exe
jhbzuomgez.sys
nkecxupmhfzxrpmk.exe
nkecxupmhfzxrpmk.sys
qlidaysqoi.sys
qnlfdxvsqo.exe
rpmkecwupk.exe
trojgeywtr.sys
wtqomgeywq.exe
wuomgezwug.sys
settings.dat
settings.dat
the-real-index
the-real-index~RFe5a56eb.TMP
SiteList-Enterprise.json
Edge Profile.ico
SCT Auditing Pending Reports
Sdch Dictionaries
b49b1444-b4a8-4070-83d5-e4ce060e02e5.tmp
Preferences
Preferences
Secure Preferences
be4783c6-2b84-4e00-bb49-a30011b4996c.tmp
e986f85d-1735-4983-936f-f45272cc0c6a.tmp
Local State
Local State
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
metadata.json
metadata.json
8d73ed09-3df4-40c5-8df0-dc73194a623e.tmp
content_new.js
CreateProcess.exe
memory/1256-547-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2148-660-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2388-701-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2916-496-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3096-508-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3364-520-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3612-551-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3612-468-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3948-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4024-640-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4176-596-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4244-543-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4556-421-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4828-567-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4924-718-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5544-608-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5548-675-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5600-636-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5600-671-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5808-697-0x0000000000010000-0x00000000000AB000-memory.dmp