Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 18:46
General
- Target 2026-08-04_aee80635cad6007e72c7498b1613eafe_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 376KB
- Sample260804-xey6jack6w
- SHA256 57d90de0fe65adc4ba841c1e4b6a222f35f32499c18fb2cf976b04d86bad4d2f
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_aee80635cad6007e72c7498b1613eafe_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_aee80635cad6007e72c7498b1613eafe_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\rmjhbzwuomgecwur.exeC:\Temp\rmjhbzwuomgecwur.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ztrmjgecwu.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\ztrmjgecwu.exeC:\Temp\ztrmjgecwu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ztrmjgecwu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ztrmjgecwu.exeC:\Temp\i_ztrmjgecwu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trojgbztrl.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\trojgbztrl.exeC:\Temp\trojgbztrl.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trojgbztrl.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_trojgbztrl.exeC:\Temp\i_trojgbztrl.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tqoigdbvtg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\tqoigdbvtg.exeC:\Temp\tqoigdbvtg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tqoigdbvtg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_tqoigdbvtg.exeC:\Temp\i_tqoigdbvtg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lgdysqoiga.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lgdysqoiga.exeC:\Temp\lgdysqoiga.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lgdysqoiga.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lgdysqoiga.exeC:\Temp\i_lgdysqoiga.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vqnlfdxvsn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vqnlfdxvsn.exeC:\Temp\vqnlfdxvsn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vqnlfdxvsn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vqnlfdxvsn.exeC:\Temp\i_vqnlfdxvsn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mkfcxvpnhf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mkfcxvpnhf.exeC:\Temp\mkfcxvpnhf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mkfcxvpnhf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mkfcxvpnhf.exeC:\Temp\i_mkfcxvpnhf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\spnkfczxvp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\spnkfczxvp.exeC:\Temp\spnkfczxvp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_spnkfczxvp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_spnkfczxvp.exeC:\Temp\i_spnkfczxvp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpjhczusmk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rpjhczusmk.exeC:\Temp\rpjhczusmk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpjhczusmk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rpjhczusmk.exeC:\Temp\i_rpjhczusmk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jecztrmjec.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jecztrmjec.exeC:\Temp\jecztrmjec.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jecztrmjec.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jecztrmjec.exeC:\Temp\i_jecztrmjec.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bwtrljhbzt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bwtrljhbzt.exeC:\Temp\bwtrljhbzt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bwtrljhbzt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bwtrljhbzt.exeC:\Temp\i_bwtrljhbzt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mgeywqojgb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mgeywqojgb.exeC:\Temp\mgeywqojgb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mgeywqojgb.exe ups_ins3⤵
-
C:\Temp\i_mgeywqojgb.exeC:\Temp\i_mgeywqojgb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywqolgdyvq.exe ups_run3⤵
-
C:\Temp\ywqolgdyvq.exeC:\Temp\ywqolgdyvq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywqolgdyvq.exe ups_ins3⤵
-
C:\Temp\i_ywqolgdyvq.exeC:\Temp\i_ywqolgdyvq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nifdyvqoig.exe ups_run3⤵
-
C:\Temp\nifdyvqoig.exeC:\Temp\nifdyvqoig.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nifdyvqoig.exe ups_ins3⤵
-
C:\Temp\i_nifdyvqoig.exeC:\Temp\i_nifdyvqoig.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\axvpnkfdxv.exe ups_run3⤵
-
C:\Temp\axvpnkfdxv.exeC:\Temp\axvpnkfdxv.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_axvpnkfdxv.exe ups_ins3⤵
-
C:\Temp\i_axvpnkfdxv.exeC:\Temp\i_axvpnkfdxv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\faxvpnicau.exe ups_run3⤵
-
C:\Temp\faxvpnicau.exeC:\Temp\faxvpnicau.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_faxvpnicau.exe ups_ins3⤵
-
C:\Temp\i_faxvpnicau.exeC:\Temp\i_faxvpnicau.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usmkecxupn.exe ups_run3⤵
-
C:\Temp\usmkecxupn.exeC:\Temp\usmkecxupn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usmkecxupn.exe ups_ins3⤵
-
C:\Temp\i_usmkecxupn.exeC:\Temp\i_usmkecxupn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\eczurmkecw.exe ups_run3⤵
-
C:\Temp\eczurmkecw.exeC:\Temp\eczurmkecw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_eczurmkecw.exe ups_ins3⤵
-
C:\Temp\i_eczurmkecw.exeC:\Temp\i_eczurmkecw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bzwrojhbzt.exe ups_run3⤵
-
C:\Temp\bzwrojhbzt.exeC:\Temp\bzwrojhbzt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bzwrojhbzt.exe ups_ins3⤵
-
C:\Temp\i_bzwrojhbzt.exeC:\Temp\i_bzwrojhbzt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gezwrojhbz.exe ups_run3⤵
-
C:\Temp\gezwrojhbz.exeC:\Temp\gezwrojhbz.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gezwrojhbz.exe ups_ins3⤵
-
C:\Temp\i_gezwrojhbz.exeC:\Temp\i_gezwrojhbz.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x300,0x7ffec25dc188,0x7ffec25dc194,0x7ffec25dc1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,16075876186333049194,12648729809238850286,262144 --field-trial-handle=2312,i,6962562952436681283,2822025188924436468,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,13129746846779188198,12262780791885801153,524288 --field-trial-handle=2312,i,6962562952436681283,2822025188924436468,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1440,i,14859885785950134517,15269406000740017967,524288 --field-trial-handle=2312,i,6962562952436681283,2822025188924436468,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,8086042626629516006,1223608382988590887,2097152 --field-trial-handle=2312,i,6962562952436681283,2822025188924436468,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3536,i,5410888937147448219,2650480878766830131,2097152 --field-trial-handle=2312,i,6962562952436681283,2822025188924436468,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,14890517127651794191,11895935792897885847,2097152 --field-trial-handle=2312,i,6962562952436681283,2822025188924436468,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,6745040730264822963,9655130727644455767,2097152 --field-trial-handle=2312,i,6962562952436681283,2822025188924436468,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,15486781629305082720,6510854477088713136,524288 --field-trial-handle=2312,i,6962562952436681283,2822025188924436468,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,4850070312058328715,1518090452577211186,524288 --field-trial-handle=2312,i,6962562952436681283,2822025188924436468,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,3889916845005757258,17846680843386875592,524288 --field-trial-handle=2312,i,6962562952436681283,2822025188924436468,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,9716633584200304782,8240113863675195111,524288 --field-trial-handle=2312,i,6962562952436681283,2822025188924436468,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,9716633584200304782,8240113863675195111,524288 --field-trial-handle=2312,i,6962562952436681283,2822025188924436468,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,4507277969337115700,15730970103613919910,524288 --field-trial-handle=2312,i,6962562952436681283,2822025188924436468,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,6158585020886281501,15704089701591740646,524288 --field-trial-handle=2312,i,6962562952436681283,2822025188924436468,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,17612406443405992894,1185032806690359297,524288 --field-trial-handle=2312,i,6962562952436681283,2822025188924436468,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6920,i,2462307723433029307,11176099616660338253,524288 --field-trial-handle=2312,i,6962562952436681283,2822025188924436468,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,12316508941070426393,13667202580996510486,524288 --field-trial-handle=2312,i,6962562952436681283,2822025188924436468,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,17898675179172826322,5015628551494248871,524288 --field-trial-handle=2312,i,6962562952436681283,2822025188924436468,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,5824779657514546028,1848811409294922610,524288 --field-trial-handle=2312,i,6962562952436681283,2822025188924436468,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,11253535117980520700,5768464043409504344,524288 --field-trial-handle=2312,i,6962562952436681283,2822025188924436468,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,1336526652142731680,17386113187868301641,524288 --field-trial-handle=2312,i,6962562952436681283,2822025188924436468,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6996,i,11033245203839180940,13227669017846823568,524288 --field-trial-handle=2312,i,6962562952436681283,2822025188924436468,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6972,i,684660532428253707,1628315692658301651,524288 --field-trial-handle=2312,i,6962562952436681283,2822025188924436468,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3584,i,2251470597695606694,8163930730368038938,262144 --field-trial-handle=2312,i,6962562952436681283,2822025188924436468,262144 --variations-seed-version --mojo-platform-channel-handle=7028 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,10361101655635868957,11508989676017151871,524288 --field-trial-handle=2312,i,6962562952436681283,2822025188924436468,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,16527286122385633631,642392723540016383,524288 --field-trial-handle=2312,i,6962562952436681283,2822025188924436468,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\rmjhbzwuomgecwur.sysC:\Temp\rmjhbzwuomgecwur.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\mgezwrpjhb.sysC:\Temp\mgezwrpjhb.sys1⤵
- Executes dropped EXE
-
C:\Temp\wqoljdbvtr.sysC:\Temp\wqoljdbvtr.sys1⤵
- Executes dropped EXE
-
C:\Temp\qljdbvtnlg.sysC:\Temp\qljdbvtnlg.sys1⤵
- Executes dropped EXE
-
C:\Temp\davsnlfdxv.sysC:\Temp\davsnlfdxv.sys1⤵
- Executes dropped EXE
-
C:\Temp\ayvpnifaqk.sysC:\Temp\ayvpnifaqk.sys1⤵
- Executes dropped EXE
-
C:\Temp\vpnhfdxvsm.sysC:\Temp\vpnhfdxvsm.sys1⤵
- Executes dropped EXE
-
C:\Temp\usmkhczusm.sysC:\Temp\usmkhczusm.sys1⤵
- Executes dropped EXE
-
C:\Temp\rmjecwuomj.sysC:\Temp\rmjecwuomj.sys1⤵
- Executes dropped EXE
-
C:\Temp\pmgezwuomj.sysC:\Temp\pmgezwuomj.sys1⤵
- Executes dropped EXE
-
C:\Temp\ljdbwtolge.sysC:\Temp\ljdbwtolge.sys1⤵
- Executes dropped EXE
-
C:\Temp\aywqoigbyt.sysC:\Temp\aywqoigbyt.sys1⤵
-
C:\Temp\tqlidavtnl.sysC:\Temp\tqlidavtnl.sys1⤵
-
C:\Temp\lfdyvtnlid.sysC:\Temp\lfdyvtnlid.sys1⤵
-
C:\Temp\faxsqkifay.sysC:\Temp\faxsqkifay.sys1⤵
-
C:\Temp\spnhecausp.sysC:\Temp\spnhecausp.sys1⤵
-
C:\Temp\pmhfzxrpjh.sysC:\Temp\pmhfzxrpjh.sys1⤵
-
C:\Temp\mjecwuomkh.sysC:\Temp\mjecwuomkh.sys1⤵
-
C:\Temp\gezwroljeb.sysC:\Temp\gezwroljeb.sys1⤵
-
C:\Temp\bvtolgeywq.sysC:\Temp\bvtolgeywq.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ayvpnifaqk.sys
davsnlfdxv.sys
i_lgdysqoiga.exe
i_tqoigdbvtg.exe
i_trojgbztrl.exe
i_vqnlfdxvsn.exe
i_ztrmjgecwu.exe
lgdysqoiga.exe
mgezwrpjhb.sys
mkfcxvpnhf.exe
qljdbvtnlg.sys
rmjhbzwuomgecwur.exe
rmjhbzwuomgecwur.sys
tqoigdbvtg.exe
trojgbztrl.exe
vqnlfdxvsn.exe
wqoljdbvtr.sys
ztrmjgecwu.exe
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
temp-index
the-real-index~RFe5985ef.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
ae9a5ec5-7014-41ff-81c1-3f421d6c34a2.tmp
Local State
Local State
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
metadata.json
0314e394-4818-4566-8bd2-3584a0411765.tmp
299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
metadata.json
4792a9af-4816-4350-b943-7be01483110a.tmp
content_new.js
CreateProcess.exe
memory/1904-703-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2348-735-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2620-601-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2904-739-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3020-533-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3400-499-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3540-664-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3880-553-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3880-641-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4148-471-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4252-707-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4364-685-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4764-576-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5164-628-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5196-456-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5396-513-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5416-666-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5416-660-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5616-422-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5844-568-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6012-549-0x0000000000010000-0x00000000000AB000-memory.dmp