Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
07/08/2026, 00:17
General
- Target 2026-08-06_c0a1191794272729c588a312c1772135_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample260807-ak4xmsxtcx
- SHA256 6d0084dbaa4b5eb15e96a0a15fd882ea7ab330644d2c7005c0f174c5a2c991f9
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 19 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_c0a1191794272729c588a312c1772135_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-06_c0a1191794272729c588a312c1772135_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\bwlgbytqljdbvtnl.exeC:\Temp\bwlgbytqljdbvtnl.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qljgaywqoi.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\qljgaywqoi.exeC:\Temp\qljgaywqoi.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qljgaywqoi.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qljgaywqoi.exeC:\Temp\i_qljgaywqoi.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdyvtnliga.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fdyvtnliga.exeC:\Temp\fdyvtnliga.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdyvtnliga.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fdyvtnliga.exeC:\Temp\i_fdyvtnliga.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dyvqnigays.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dyvqnigays.exeC:\Temp\dyvqnigays.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dyvqnigays.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dyvqnigays.exeC:\Temp\i_dyvqnigays.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vpnhfcaxsp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vpnhfcaxsp.exeC:\Temp\vpnhfcaxsp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vpnhfcaxsp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vpnhfcaxsp.exeC:\Temp\i_vpnhfcaxsp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\spnhfzxrpj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\spnhfzxrpj.exeC:\Temp\spnhfzxrpj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_spnhfzxrpj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_spnhfzxrpj.exeC:\Temp\i_spnhfzxrpj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zwuomhezwr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zwuomhezwr.exeC:\Temp\zwuomhezwr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zwuomhezwr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zwuomhezwr.exeC:\Temp\i_zwuomhezwr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mjhbzuojge.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mjhbzuojge.exeC:\Temp\mjhbzuojge.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mjhbzuojge.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mjhbzuojge.exeC:\Temp\i_mjhbzuojge.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bztrljgebw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bztrljgebw.exeC:\Temp\bztrljgebw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bztrljgebw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bztrljgebw.exeC:\Temp\i_bztrljgebw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wqljdbvtnl.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wqljdbvtnl.exeC:\Temp\wqljdbvtnl.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wqljdbvtnl.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wqljdbvtnl.exeC:\Temp\i_wqljdbvtnl.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ayvqoigays.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ayvqoigays.exeC:\Temp\ayvqoigays.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ayvqoigays.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ayvqoigays.exeC:\Temp\i_ayvqoigays.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fcayvpnkif.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fcayvpnkif.exeC:\Temp\fcayvpnkif.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fcayvpnkif.exe ups_ins3⤵
-
C:\Temp\i_fcayvpnkif.exeC:\Temp\i_fcayvpnkif.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\khfdxvpnhf.exe ups_run3⤵
-
C:\Temp\khfdxvpnhf.exeC:\Temp\khfdxvpnhf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_khfdxvpnhf.exe ups_ins3⤵
-
C:\Temp\i_khfdxvpnhf.exeC:\Temp\i_khfdxvpnhf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvpmhfzxsp.exe ups_run3⤵
-
C:\Temp\xvpmhfzxsp.exeC:\Temp\xvpmhfzxsp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xvpmhfzxsp.exe ups_ins3⤵
-
C:\Temp\i_xvpmhfzxsp.exeC:\Temp\i_xvpmhfzxsp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pmhezxrpjh.exe ups_run3⤵
-
C:\Temp\pmhezxrpjh.exeC:\Temp\pmhezxrpjh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pmhezxrpjh.exe ups_ins3⤵
-
C:\Temp\i_pmhezxrpjh.exeC:\Temp\i_pmhezxrpjh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mjebwromge.exe ups_run3⤵
-
C:\Temp\mjebwromge.exeC:\Temp\mjebwromge.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mjebwromge.exe ups_ins3⤵
-
C:\Temp\i_mjebwromge.exeC:\Temp\i_mjebwromge.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mjhbzwrojg.exe ups_run3⤵
-
C:\Temp\mjhbzwrojg.exeC:\Temp\mjhbzwrojg.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mjhbzwrojg.exe ups_ins3⤵
-
C:\Temp\i_mjhbzwrojg.exeC:\Temp\i_mjhbzwrojg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywqojdbztr.exe ups_run3⤵
-
C:\Temp\ywqojdbztr.exeC:\Temp\ywqojdbztr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywqojdbztr.exe ups_ins3⤵
-
C:\Temp\i_ywqojdbztr.exeC:\Temp\i_ywqojdbztr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\igaysqlidb.exe ups_run3⤵
-
C:\Temp\igaysqlidb.exeC:\Temp\igaysqlidb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_igaysqlidb.exe ups_ins3⤵
-
C:\Temp\i_igaysqlidb.exeC:\Temp\i_igaysqlidb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdxvpnicav.exe ups_run3⤵
-
C:\Temp\fdxvpnicav.exeC:\Temp\fdxvpnicav.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdxvpnicav.exe ups_ins3⤵
-
C:\Temp\i_fdxvpnicav.exeC:\Temp\i_fdxvpnicav.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x304,0x7ffb1129c188,0x7ffb1129c194,0x7ffb1129c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1556,i,5899263806169988876,13570798205951367661,262144 --field-trial-handle=2356,i,13315717025174133748,9872194418103832255,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1688,i,7457409932056236655,16195929546278481410,524288 --field-trial-handle=2356,i,13315717025174133748,9872194418103832255,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,7887000779569325112,4152853818019347490,524288 --field-trial-handle=2356,i,13315717025174133748,9872194418103832255,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,10612826911827700364,448392362438128963,2097152 --field-trial-handle=2356,i,13315717025174133748,9872194418103832255,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,11586950968331915038,10018790712666547824,2097152 --field-trial-handle=2356,i,13315717025174133748,9872194418103832255,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,12067274493848694218,15784938905380280278,2097152 --field-trial-handle=2356,i,13315717025174133748,9872194418103832255,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,16609421899769856107,3459204846635235351,2097152 --field-trial-handle=2356,i,13315717025174133748,9872194418103832255,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,1644509513441799877,9304945585692691123,524288 --field-trial-handle=2356,i,13315717025174133748,9872194418103832255,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,11784048914290688700,12636241528062632118,524288 --field-trial-handle=2356,i,13315717025174133748,9872194418103832255,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,875301573236125962,4166964136223889926,524288 --field-trial-handle=2356,i,13315717025174133748,9872194418103832255,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,11893397777964720757,14194416402027797493,524288 --field-trial-handle=2356,i,13315717025174133748,9872194418103832255,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,11893397777964720757,14194416402027797493,524288 --field-trial-handle=2356,i,13315717025174133748,9872194418103832255,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,17823227198331914476,14294330733838606165,524288 --field-trial-handle=2356,i,13315717025174133748,9872194418103832255,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,3485768469001754864,5053175847300859302,524288 --field-trial-handle=2356,i,13315717025174133748,9872194418103832255,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,2851023954491787258,806940267859450006,524288 --field-trial-handle=2356,i,13315717025174133748,9872194418103832255,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,3659189704287671049,13824272624126564299,524288 --field-trial-handle=2356,i,13315717025174133748,9872194418103832255,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,10478818677890633575,11382336837700783879,524288 --field-trial-handle=2356,i,13315717025174133748,9872194418103832255,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,8299558617900352091,7033642639656857214,524288 --field-trial-handle=2356,i,13315717025174133748,9872194418103832255,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3716,i,1828012854075378721,12654515806989572251,524288 --field-trial-handle=2356,i,13315717025174133748,9872194418103832255,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3124,i,11658177780252294320,14728169684881360932,524288 --field-trial-handle=2356,i,13315717025174133748,9872194418103832255,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,17079970058402855892,6115002918869036027,524288 --field-trial-handle=2356,i,13315717025174133748,9872194418103832255,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3476,i,16364777897426188121,10910301492781180762,262144 --field-trial-handle=2356,i,13315717025174133748,9872194418103832255,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:104⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\bwlgbytqljdbvtnl.sysC:\Temp\bwlgbytqljdbvtnl.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Temp\vtolgdywqo.sysC:\Temp\vtolgdywqo.sys1⤵
- Executes dropped EXE
-
C:\Temp\licavsnlfd.sysC:\Temp\licavsnlfd.sys1⤵
- Executes dropped EXE
-
C:\Temp\vsnkfcxvsn.sysC:\Temp\vsnkfcxvsn.sys1⤵
- Executes dropped EXE
-
C:\Temp\xupmkecxup.sysC:\Temp\xupmkecxup.sys1⤵
- Executes dropped EXE
-
C:\Temp\mkhczurpkh.sysC:\Temp\mkhczurpkh.sys1⤵
- Executes dropped EXE
-
C:\Temp\pjhbztrpjh.sysC:\Temp\pjhbztrpjh.sys1⤵
- Executes dropped EXE
-
C:\Temp\ebwuomgebw.sysC:\Temp\ebwuomgebw.sys1⤵
- Executes dropped EXE
-
C:\Temp\dyvtolgeyw.sysC:\Temp\dyvtolgeyw.sys1⤵
- Executes dropped EXE
-
C:\Temp\idaysqliga.sysC:\Temp\idaysqliga.sys1⤵
- Executes dropped EXE
-
C:\Temp\snlfdxvtqk.sysC:\Temp\snlfdxvtqk.sys1⤵
- Executes dropped EXE
-
C:\Temp\nifaxspnif.sysC:\Temp\nifaxspnif.sys1⤵
-
C:\Temp\ausmkecaxs.sysC:\Temp\ausmkecaxs.sys1⤵
-
C:\Temp\rpjhezxrpj.sysC:\Temp\rpjhezxrpj.sys1⤵
-
C:\Temp\rpmgezwrom.sysC:\Temp\rpmgezwrom.sys1⤵
-
C:\Temp\ljebzwromg.sysC:\Temp\ljebzwromg.sys1⤵
-
C:\Temp\bywqojgbyt.sysC:\Temp\bywqojgbyt.sys1⤵
-
C:\Temp\gdbvtqliga.sysC:\Temp\gdbvtqliga.sys1⤵
-
C:\Temp\nlgdyvqnif.sysC:\Temp\nlgdyvqnif.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
bwlgbytqljdbvtnl.exe
bwlgbytqljdbvtnl.sys
dyvqnigays.exe
fdyvtnliga.exe
i_dyvqnigays.exe
i_fdyvtnliga.exe
i_qljgaywqoi.exe
i_spnhfzxrpj.exe
i_vpnhfcaxsp.exe
licavsnlfd.sys
mkhczurpkh.sys
qljgaywqoi.exe
spnhfzxrpj.exe
vpnhfcaxsp.exe
vsnkfcxvsn.sys
vtolgdywqo.sys
xupmkecxup.sys
zwuomhezwr.exe
settings.dat
settings.dat
96b7c44e-5ef9-4a92-9653-25d78de005a9.tmp
the-real-index
the-real-index~RFe59d289.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Secure Preferences
OperationConfig
OperationConfig~RFe5a709d.TMP
Local State
Local State
Local State
Local State
Local State
metadata.json
299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
e0203120-948a-4aee-9a91-5b3b79861512.tmp
metadata.json~RFe59a908.TMP
69b53250-5951-4e9d-b37e-8437da933c73.tmp
content_new.js
CreateProcess.exe
memory/932-620-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/932-570-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1208-555-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1456-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2356-470-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2720-641-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2924-654-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2932-633-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3196-656-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3196-649-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3560-550-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4476-637-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4600-541-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4600-511-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4864-498-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5008-435-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5032-645-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5040-596-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5260-600-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5512-659-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6012-524-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6012-551-0x0000000000010000-0x00000000000AB000-memory.dmp