Analysis
- max time kernel
149s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
30/08/2026, 22:43
General
- Target 2026-08-29_ff280577e4712dce230c3f1417daecfc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample260830-2np2faar6s
- SHA256 aae6de4948ce7f0f6b271e57514d28c32808349327490d8c2172d0959f754525
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-29_ff280577e4712dce230c3f1417daecfc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-29_ff280577e4712dce230c3f1417daecfc_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\tqljdbvtnlgdyvqo.exeC:\Temp\tqljdbvtnlgdyvqo.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywqoidysql.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\ywqoidysql.exeC:\Temp\ywqoidysql.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywqoidysql.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ywqoidysql.exeC:\Temp\i_ywqoidysql.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvpnlfdavs.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xvpnlfdavs.exeC:\Temp\xvpnlfdavs.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xvpnlfdavs.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xvpnlfdavs.exeC:\Temp\i_xvpnlfdavs.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\snkicausmk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\snkicausmk.exeC:\Temp\snkicausmk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_snkicausmk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_snkicausmk.exeC:\Temp\i_snkicausmk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecxupnhfcx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ecxupnhfcx.exeC:\Temp\ecxupnhfcx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecxupnhfcx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ecxupnhfcx.exeC:\Temp\i_ecxupnhfcx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zurpmkecwu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zurpmkecwu.exeC:\Temp\zurpmkecwu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zurpmkecwu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zurpmkecwu.exeC:\Temp\i_zurpmkecwu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wuomhezwrp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wuomhezwrp.exeC:\Temp\wuomhezwrp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wuomhezwrp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wuomhezwrp.exeC:\Temp\i_wuomhezwrp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wtrljgebwt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wtrljgebwt.exeC:\Temp\wtrljgebwt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wtrljgebwt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wtrljgebwt.exeC:\Temp\i_wtrljgebwt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\olgdywqoig.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\olgdywqoig.exeC:\Temp\olgdywqoig.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_olgdywqoig.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_olgdywqoig.exeC:\Temp\i_olgdywqoig.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tqljdbnlfd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\tqljdbnlfd.exeC:\Temp\tqljdbnlfd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tqljdbnlfd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_tqljdbnlfd.exeC:\Temp\i_tqljdbnlfd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qoigaysqki.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qoigaysqki.exeC:\Temp\qoigaysqki.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qoigaysqki.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qoigaysqki.exeC:\Temp\i_qoigaysqki.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nkifaxvqnh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nkifaxvqnh.exeC:\Temp\nkifaxvqnh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nkifaxvqnh.exe ups_ins3⤵
-
C:\Temp\i_nkifaxvqnh.exeC:\Temp\i_nkifaxvqnh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xusmkfcxus.exe ups_run3⤵
-
C:\Temp\xusmkfcxus.exeC:\Temp\xusmkfcxus.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xusmkfcxus.exe ups_ins3⤵
-
C:\Temp\i_xusmkfcxus.exeC:\Temp\i_xusmkfcxus.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\khfzxrpkhf.exe ups_run3⤵
-
C:\Temp\khfzxrpkhf.exeC:\Temp\khfzxrpkhf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_khfzxrpkhf.exe ups_ins3⤵
-
C:\Temp\i_khfzxrpkhf.exeC:\Temp\i_khfzxrpkhf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pmhecwurpj.exe ups_run3⤵
-
C:\Temp\pmhecwurpj.exeC:\Temp\pmhecwurpj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pmhecwurpj.exe ups_ins3⤵
-
C:\Temp\i_pmhecwurpj.exeC:\Temp\i_pmhecwurpj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rljebwuomg.exe ups_run3⤵
-
C:\Temp\rljebwuomg.exeC:\Temp\rljebwuomg.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rljebwuomg.exe ups_ins3⤵
-
C:\Temp\i_rljebwuomg.exeC:\Temp\i_rljebwuomg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jgeywtrljg.exe ups_run3⤵
-
C:\Temp\jgeywtrljg.exeC:\Temp\jgeywtrljg.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jgeywtrljg.exe ups_ins3⤵
-
C:\Temp\i_jgeywtrljg.exeC:\Temp\i_jgeywtrljg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljdbvtnlge.exe ups_run3⤵
-
C:\Temp\ljdbvtnlge.exeC:\Temp\ljdbvtnlge.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljdbvtnlge.exe ups_ins3⤵
-
C:\Temp\i_ljdbvtnlge.exeC:\Temp\i_ljdbvtnlge.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\idbvqnlgdy.exe ups_run3⤵
-
C:\Temp\idbvqnlgdy.exeC:\Temp\idbvqnlgdy.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_idbvqnlgdy.exe ups_ins3⤵
-
C:\Temp\i_idbvqnlgdy.exeC:\Temp\i_idbvqnlgdy.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdxvqnifay.exe ups_run3⤵
-
C:\Temp\fdxvqnifay.exeC:\Temp\fdxvqnifay.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdxvqnifay.exe ups_ins3⤵
-
C:\Temp\i_fdxvqnifay.exeC:\Temp\i_fdxvqnifay.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dxvpnkfdxv.exe ups_run3⤵
-
C:\Temp\dxvpnkfdxv.exeC:\Temp\dxvpnkfdxv.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x31c,0x7ffbd0dec188,0x7ffbd0dec194,0x7ffbd0dec1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2116,i,3351218005727814148,4099979759002904972,524288 --field-trial-handle=2456,i,617490358730462035,5897552197372753271,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1908,i,2204664829188552417,4664108425413763564,262144 --field-trial-handle=2456,i,617490358730462035,5897552197372753271,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2668,i,3758340995014831119,17985194721011183606,524288 --field-trial-handle=2456,i,617490358730462035,5897552197372753271,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,8267160877956974079,16046512057296453563,2097152 --field-trial-handle=2456,i,617490358730462035,5897552197372753271,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,16864734855403403050,6349135584632987374,2097152 --field-trial-handle=2456,i,617490358730462035,5897552197372753271,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,1206635708076910838,7345167714591616215,2097152 --field-trial-handle=2456,i,617490358730462035,5897552197372753271,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,4716272927075098000,15519083022439692627,2097152 --field-trial-handle=2456,i,617490358730462035,5897552197372753271,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3824,i,7003451117277649154,6068661465424144675,524288 --field-trial-handle=2456,i,617490358730462035,5897552197372753271,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,688391434281386482,18066875284573202588,524288 --field-trial-handle=2456,i,617490358730462035,5897552197372753271,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3812,i,13453712542293481323,3223639128770123962,524288 --field-trial-handle=2456,i,617490358730462035,5897552197372753271,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,857128859913739390,9446338360110719251,524288 --field-trial-handle=2456,i,617490358730462035,5897552197372753271,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,857128859913739390,9446338360110719251,524288 --field-trial-handle=2456,i,617490358730462035,5897552197372753271,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,16484177754575150825,11774650042393596184,524288 --field-trial-handle=2456,i,617490358730462035,5897552197372753271,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,10936850881319633403,7881066354469317605,524288 --field-trial-handle=2456,i,617490358730462035,5897552197372753271,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,12968380117208796323,15751168883071500075,524288 --field-trial-handle=2456,i,617490358730462035,5897552197372753271,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,11106796163398894428,8722614002038433646,524288 --field-trial-handle=2456,i,617490358730462035,5897552197372753271,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1436,i,12607211740067857629,10216471529878256033,524288 --field-trial-handle=2456,i,617490358730462035,5897552197372753271,262144 --variations-seed-version --mojo-platform-channel-handle=1288 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1440,i,7637641856285492806,1138462035959216081,524288 --field-trial-handle=2456,i,617490358730462035,5897552197372753271,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1448,i,8949070804992811169,5028526752360446483,524288 --field-trial-handle=2456,i,617490358730462035,5897552197372753271,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1472,i,15378951850504632647,3729552717897931384,524288 --field-trial-handle=2456,i,617490358730462035,5897552197372753271,262144 --variations-seed-version --mojo-platform-channel-handle=1440 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,5634020953726805979,3700856970485473397,524288 --field-trial-handle=2456,i,617490358730462035,5897552197372753271,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=948,i,6286379349775332774,4230965516620386609,524288 --field-trial-handle=2456,i,617490358730462035,5897552197372753271,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6712,i,17766241159407579440,14082096284109785960,524288 --field-trial-handle=2456,i,617490358730462035,5897552197372753271,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6204,i,4249169214114585156,447183259623840265,262144 --field-trial-handle=2456,i,617490358730462035,5897552197372753271,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1596,i,6588072624459754818,10882194418697782480,524288 --field-trial-handle=2456,i,617490358730462035,5897552197372753271,262144 --variations-seed-version --mojo-platform-channel-handle=1336 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\tqljdbvtnlgdyvqo.sysC:\Temp\tqljdbvtnlgdyvqo.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Temp\xvtqkicavs.sysC:\Temp\xvtqkicavs.sys1⤵
- Executes dropped EXE
-
C:\Temp\qkicauspnk.sysC:\Temp\qkicauspnk.sys1⤵
- Executes dropped EXE
-
C:\Temp\xvsnkfcxvp.sysC:\Temp\xvsnkfcxvp.sys1⤵
- Executes dropped EXE
-
C:\Temp\zxrpjhczxr.sysC:\Temp\zxrpjhczxr.sys1⤵
- Executes dropped EXE
-
C:\Temp\zurmjecwuo.sysC:\Temp\zurmjecwuo.sys1⤵
- Executes dropped EXE
-
C:\Temp\bztrljdbwt.sysC:\Temp\bztrljdbwt.sys1⤵
- Executes dropped EXE
-
C:\Temp\jdbywqoljd.sysC:\Temp\jdbywqoljd.sys1⤵
- Executes dropped EXE
-
C:\Temp\tqoigaywqo.sysC:\Temp\tqoigaywqo.sys1⤵
- Executes dropped EXE
-
C:\Temp\vsqlidavtn.sysC:\Temp\vsqlidavtn.sys1⤵
- Executes dropped EXE
-
C:\Temp\nhfdaysqnl.sysC:\Temp\nhfdaysqnl.sys1⤵
- Executes dropped EXE
-
C:\Temp\fdxvpnifax.sysC:\Temp\fdxvpnifax.sys1⤵
-
C:\Temp\mkecxusmke.sysC:\Temp\mkecxusmke.sys1⤵
-
C:\Temp\mkecwurpmh.sysC:\Temp\mkecwurpmh.sys1⤵
-
C:\Temp\rojhbwtrmj.sysC:\Temp\rojhbwtrmj.sys1⤵
-
C:\Temp\trljdbzwuo.sysC:\Temp\trljdbzwuo.sys1⤵
-
C:\Temp\qoigbywqoi.sysC:\Temp\qoigbywqoi.sys1⤵
-
C:\Temp\jdbvtnlfdy.sysC:\Temp\jdbvtnlfdy.sys1⤵
-
C:\Temp\lfdavsnkic.sysC:\Temp\lfdavsnkic.sys1⤵
-
C:\Temp\qkidavsnlf.sysC:\Temp\qkidavsnlf.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ecxupnhfcx.exe
i_ecxupnhfcx.exe
i_snkicausmk.exe
i_xvpnlfdavs.exe
i_ywqoidysql.exe
i_zurpmkecwu.exe
qkicauspnk.sys
snkicausmk.exe
tqljdbvtnlgdyvqo.exe
tqljdbvtnlgdyvqo.sys
wuomhezwrp.exe
xvpnlfdavs.exe
xvsnkfcxvp.sys
xvtqkicavs.sys
ywqoidysql.exe
zurmjecwuo.sys
zurpmkecwu.exe
zxrpjhczxr.sys
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
the-real-index
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
3ba00fdc-826e-482f-a91e-2d1bfefb9296.tmp
Local State
Local State
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
42aa3b8a-331e-4327-b94b-5856c961d13f.tmp
e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
metadata.json
6c620276-7916-4348-9757-5da32d1f3f03.tmp
content_new.js
CreateProcess.exe
memory/1140-654-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1264-581-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1356-505-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1648-230-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1900-576-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2192-650-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2988-685-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3192-610-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3276-557-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3368-690-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3836-561-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3960-711-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4108-489-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4512-732-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4804-62-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5260-550-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5912-183-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5932-630-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5992-715-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6028-674-0x0000000000010000-0x00000000000AB000-memory.dmp