Analysis
- max time kernel
150s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
09/08/2026, 15:00
General
- Target 2026-08-09_04a00d6b508b7a571d35307d171809c6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample260809-sdenaagq8w
- SHA256 371f4c30eacacb3e8d7b5eb690eb83562720621e0abc3ba3a76071f9e7c7dc7e
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_04a00d6b508b7a571d35307d171809c6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_04a00d6b508b7a571d35307d171809c6_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\vtnlfdxvqnigaysq.exeC:\Temp\vtnlfdxvqnigaysq.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qlidaysqli.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\qlidaysqli.exeC:\Temp\qlidaysqli.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qlidaysqli.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qlidaysqli.exeC:\Temp\i_qlidaysqli.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pkicausnkf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pkicausnkf.exeC:\Temp\pkicausnkf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pkicausnkf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pkicausnkf.exeC:\Temp\i_pkicausnkf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hfzxspcaxs.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hfzxspcaxs.exeC:\Temp\hfzxspcaxs.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hfzxspcaxs.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hfzxspcaxs.exeC:\Temp\i_hfzxspcaxs.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxrmkecwup.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zxrmkecwup.exeC:\Temp\zxrmkecwup.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxrmkecwup.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zxrmkecwup.exeC:\Temp\i_zxrmkecwup.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ezwrpjhbzt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ezwrpjhbzt.exeC:\Temp\ezwrpjhbzt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ezwrpjhbzt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ezwrpjhbzt.exeC:\Temp\i_ezwrpjhbzt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywurljgebw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ywurljgebw.exeC:\Temp\ywurljgebw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywurljgebw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ywurljgebw.exeC:\Temp\i_ywurljgebw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bvtolgeytq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bvtolgeytq.exeC:\Temp\bvtolgeytq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bvtolgeytq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bvtolgeytq.exeC:\Temp\i_bvtolgeytq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gaywqoljdb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gaywqoljdb.exeC:\Temp\gaywqoljdb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gaywqoljdb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gaywqoljdb.exeC:\Temp\i_gaywqoljdb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lidaysqkid.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lidaysqkid.exeC:\Temp\lidaysqkid.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lidaysqkid.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lidaysqkid.exeC:\Temp\i_lidaysqkid.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\aysnkfdxvp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\aysnkfdxvp.exeC:\Temp\aysnkfdxvp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_aysnkfdxvp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_aysnkfdxvp.exeC:\Temp\i_aysnkfdxvp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mkfcauspnh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mkfcauspnh.exeC:\Temp\mkfcauspnh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mkfcauspnh.exe ups_ins3⤵
-
C:\Temp\i_mkfcauspnh.exeC:\Temp\i_mkfcauspnh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpnhczusmk.exe ups_run3⤵
-
C:\Temp\rpnhczusmk.exeC:\Temp\rpnhczusmk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpnhczusmk.exe ups_ins3⤵
-
C:\Temp\i_rpnhczusmk.exeC:\Temp\i_rpnhczusmk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhbzxrpmhe.exe ups_run3⤵
-
C:\Temp\jhbzxrpmhe.exeC:\Temp\jhbzxrpmhe.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhbzxrpmhe.exe ups_ins3⤵
-
C:\Temp\i_jhbzxrpmhe.exeC:\Temp\i_jhbzxrpmhe.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ebwurljecw.exe ups_run3⤵
-
C:\Temp\ebwurljecw.exeC:\Temp\ebwurljecw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ebwurljecw.exe ups_ins3⤵
-
C:\Temp\i_ebwurljecw.exeC:\Temp\i_ebwurljecw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bytrojgbyt.exe ups_run3⤵
-
C:\Temp\bytrojgbyt.exeC:\Temp\bytrojgbyt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bytrojgbyt.exe ups_ins3⤵
-
C:\Temp\i_bytrojgbyt.exeC:\Temp\i_bytrojgbyt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\yvtoljdbvt.exe ups_run3⤵
-
C:\Temp\yvtoljdbvt.exeC:\Temp\yvtoljdbvt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_yvtoljdbvt.exe ups_ins3⤵
-
C:\Temp\i_yvtoljdbvt.exeC:\Temp\i_yvtoljdbvt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtnlfdyvqn.exe ups_run3⤵
-
C:\Temp\vtnlfdyvqn.exeC:\Temp\vtnlfdyvqn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vtnlfdyvqn.exe ups_ins3⤵
-
C:\Temp\i_vtnlfdyvqn.exeC:\Temp\i_vtnlfdyvqn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qnlfdxvqni.exe ups_run3⤵
-
C:\Temp\qnlfdxvqni.exeC:\Temp\qnlfdxvqni.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qnlfdxvqni.exe ups_ins3⤵
-
C:\Temp\i_qnlfdxvqni.exeC:\Temp\i_qnlfdxvqni.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\causmkfcau.exe ups_run3⤵
-
C:\Temp\causmkfcau.exeC:\Temp\causmkfcau.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_causmkfcau.exe ups_ins3⤵
-
C:\Temp\i_causmkfcau.exeC:\Temp\i_causmkfcau.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x31c,0x7ffa974dc188,0x7ffa974dc194,0x7ffa974dc1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1908,i,14010681252397356885,4297248910006833519,262144 --field-trial-handle=2588,i,4275861097040601199,5676461309578355967,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2112,i,10574663039037618605,7441879245441315220,524288 --field-trial-handle=2588,i,4275861097040601199,5676461309578355967,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2680,i,4719392480311355588,9309758738673782221,524288 --field-trial-handle=2588,i,4275861097040601199,5676461309578355967,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,17160269938745500712,13119224318025991095,2097152 --field-trial-handle=2588,i,4275861097040601199,5676461309578355967,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,12543172850940357373,17786567414686309176,2097152 --field-trial-handle=2588,i,4275861097040601199,5676461309578355967,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,4742358294789774110,9591584076766188791,2097152 --field-trial-handle=2588,i,4275861097040601199,5676461309578355967,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,9998804404757652913,11167278345811086832,2097152 --field-trial-handle=2588,i,4275861097040601199,5676461309578355967,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3776,i,10074063705984900321,1258279518168795120,2097152 --field-trial-handle=2588,i,4275861097040601199,5676461309578355967,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,12551448299090758588,4690779589931722210,524288 --field-trial-handle=2588,i,4275861097040601199,5676461309578355967,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5060,i,12072956605242252366,17693984864184439206,2097152 --field-trial-handle=2588,i,4275861097040601199,5676461309578355967,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,15623403643291515608,8619815291890085168,524288 --field-trial-handle=2588,i,4275861097040601199,5676461309578355967,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3856,i,15677233112157047246,14196144475484043211,524288 --field-trial-handle=2588,i,4275861097040601199,5676461309578355967,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,7874479061594702262,18389751857812813292,524288 --field-trial-handle=2588,i,4275861097040601199,5676461309578355967,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,7874479061594702262,18389751857812813292,524288 --field-trial-handle=2588,i,4275861097040601199,5676461309578355967,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,18070963572956808015,9077747151709706828,524288 --field-trial-handle=2588,i,4275861097040601199,5676461309578355967,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,16240874920503897168,2536701795004492337,524288 --field-trial-handle=2588,i,4275861097040601199,5676461309578355967,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,10971051927534097748,5137201459458850414,524288 --field-trial-handle=2588,i,4275861097040601199,5676461309578355967,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,18418727780180325816,8794292038769400807,524288 --field-trial-handle=2588,i,4275861097040601199,5676461309578355967,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1260,i,4055882606300717440,17302680035711341848,524288 --field-trial-handle=2588,i,4275861097040601199,5676461309578355967,262144 --variations-seed-version --mojo-platform-channel-handle=1392 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1292,i,14787875647087577892,1681479059174499138,524288 --field-trial-handle=2588,i,4275861097040601199,5676461309578355967,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1296,i,15610022270309321257,3538198879086869671,524288 --field-trial-handle=2588,i,4275861097040601199,5676461309578355967,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,3908098597894369265,16504866298992931456,524288 --field-trial-handle=2588,i,4275861097040601199,5676461309578355967,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,6427845279141372542,5756321802843712647,524288 --field-trial-handle=2588,i,4275861097040601199,5676461309578355967,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,15350804185734509433,1062681116076946595,524288 --field-trial-handle=2588,i,4275861097040601199,5676461309578355967,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=948,i,14417435999618252787,6518844614231949406,524288 --field-trial-handle=2588,i,4275861097040601199,5676461309578355967,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,14049557302246199358,9615038882081024770,524288 --field-trial-handle=2588,i,4275861097040601199,5676461309578355967,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5016,i,402040981123024110,7398891334724528996,262144 --field-trial-handle=2588,i,4275861097040601199,5676461309578355967,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,844891529684650605,8206425195339169381,524288 --field-trial-handle=2588,i,4275861097040601199,5676461309578355967,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\vtnlfdxvqnigaysq.sysC:\Temp\vtnlfdxvqnigaysq.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Temp\davsnkfdxn.sysC:\Temp\davsnkfdxn.sys1⤵
- Executes dropped EXE
-
C:\Temp\khfdxvsmkf.sysC:\Temp\khfdxvsmkf.sys1⤵
- Executes dropped EXE
-
C:\Temp\zusmkecwup.sysC:\Temp\zusmkecwup.sys1⤵
- Executes dropped EXE
-
C:\Temp\jeczxrpjhc.sysC:\Temp\jeczxrpjhc.sys1⤵
- Executes dropped EXE
-
C:\Temp\zwjhbztrlj.sysC:\Temp\zwjhbztrlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\gebwtomgey.sysC:\Temp\gebwtomgey.sys1⤵
- Executes dropped EXE
-
C:\Temp\igbytqljdb.sysC:\Temp\igbytqljdb.sys1⤵
- Executes dropped EXE
-
C:\Temp\qnigdxvqni.sysC:\Temp\qnigdxvqni.sys1⤵
- Executes dropped EXE
-
C:\Temp\icayspnlfd.sysC:\Temp\icayspnlfd.sys1⤵
- Executes dropped EXE
-
C:\Temp\xvpnhfaxsq.sysC:\Temp\xvpnhfaxsq.sys1⤵
- Executes dropped EXE
-
C:\Temp\spkhfcausm.sysC:\Temp\spkhfcausm.sys1⤵
-
C:\Temp\rpjhezxrpj.sysC:\Temp\rpjhezxrpj.sys1⤵
-
C:\Temp\ebztrljhbz.sysC:\Temp\ebztrljhbz.sys1⤵
-
C:\Temp\ojebwuomge.sysC:\Temp\ojebwuomge.sys1⤵
-
C:\Temp\gbytqoljdb.sysC:\Temp\gbytqoljdb.sys1⤵
-
C:\Temp\idavtnlfdy.sysC:\Temp\idavtnlfdy.sys1⤵
-
C:\Temp\tnlfdxvsnk.sysC:\Temp\tnlfdxvsnk.sys1⤵
-
C:\Temp\snlfdxvpni.sysC:\Temp\snlfdxvpni.sys1⤵
-
C:\Temp\iczxvpnhfz.sysC:\Temp\iczxvpnhfz.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
davsnkfdxn.sys
ezwrpjhbzt.exe
hfzxspcaxs.exe
i_ezwrpjhbzt.exe
i_hfzxspcaxs.exe
i_pkicausnkf.exe
i_qlidaysqli.exe
i_zxrmkecwup.exe
jeczxrpjhc.sys
khfdxvsmkf.sys
pkicausnkf.exe
qlidaysqli.exe
vtnlfdxvqnigaysq.exe
vtnlfdxvqnigaysq.sys
zusmkecwup.sys
zwjhbztrlj.sys
zxrmkecwup.exe
settings.dat
settings.dat
the-real-index
the-real-index~RFe59fe1d.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Secure Preferences
OperationConfig
OperationConfig~RFe5a9898.TMP
Local State
Local State
Local State
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
6982ace5-d7b4-48bd-b46a-b1139e56e251.tmp
metadata.json~RFe59d4fa.TMP
8f800468-4431-4f38-b7ef-9a92e027d4b9.tmp
content_new.js
CreateProcess.exe
memory/668-468-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1008-548-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1008-542-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1228-421-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1348-496-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1764-620-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1804-664-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2052-718-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2052-587-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2172-675-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2388-696-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2608-600-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3032-722-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3044-562-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3880-640-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4456-660-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4520-65-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4728-537-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5036-508-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5240-700-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6132-546-0x0000000000010000-0x00000000000AB000-memory.dmp