Analysis
- max time kernel
148s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
19/08/2026, 17:07
General
- Target 2026-08-19_e4022ec4b152abd2bdecef1aa9edc8fa_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample260819-vm1cfsek6s
- SHA256 acdbc44e27e54c1d19b01686540017c59c85f7ebdeb0f30c3496f99855576b71
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_e4022ec4b152abd2bdecef1aa9edc8fa_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_e4022ec4b152abd2bdecef1aa9edc8fa_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\ztrljdbvtrojgeyw.exeC:\Temp\ztrljdbvtrojgeyw.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jgbztrljdb.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\jgbztrljdb.exeC:\Temp\jgbztrljdb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jgbztrljdb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jgbztrljdb.exeC:\Temp\i_jgbztrljdb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qligaywqoi.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qligaywqoi.exeC:\Temp\qligaywqoi.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qligaywqoi.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qligaywqoi.exeC:\Temp\i_qligaywqoi.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vqnlidaysq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vqnlidaysq.exeC:\Temp\vqnlidaysq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vqnlidaysq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vqnlidaysq.exeC:\Temp\i_vqnlidaysq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dxnifaysqk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dxnifaysqk.exeC:\Temp\dxnifaysqk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dxnifaysqk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dxnifaysqk.exeC:\Temp\i_dxnifaysqk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nhfaxsqkic.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nhfaxsqkic.exeC:\Temp\nhfaxsqkic.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nhfaxsqkic.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nhfaxsqkic.exeC:\Temp\i_nhfaxsqkic.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecausmkecx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ecausmkecx.exeC:\Temp\ecausmkecx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecausmkecx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ecausmkecx.exeC:\Temp\i_ecausmkecx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\urmkecwuom.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\urmkecwuom.exeC:\Temp\urmkecwuom.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_urmkecwuom.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_urmkecwuom.exeC:\Temp\i_urmkecwuom.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ebwurmjebw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ebwurmjebw.exeC:\Temp\ebwurmjebw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ebwurmjebw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ebwurmjebw.exeC:\Temp\i_ebwurmjebw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljdbztromg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ljdbztromg.exeC:\Temp\ljdbztromg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljdbztromg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ljdbztromg.exeC:\Temp\i_ljdbztromg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtnlgdywqo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vtnlgdywqo.exeC:\Temp\vtnlgdywqo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vtnlgdywqo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vtnlgdywqo.exeC:\Temp\i_vtnlgdywqo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vqnlfdxvsq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vqnlfdxvsq.exeC:\Temp\vqnlfdxvsq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vqnlfdxvsq.exe ups_ins3⤵
-
C:\Temp\i_vqnlfdxvsq.exeC:\Temp\i_vqnlfdxvsq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kfdxvpnhfa.exe ups_run3⤵
-
C:\Temp\kfdxvpnhfa.exeC:\Temp\kfdxvpnhfa.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kfdxvpnhfa.exe ups_ins3⤵
-
C:\Temp\i_kfdxvpnhfa.exeC:\Temp\i_kfdxvpnhfa.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kfcxvsnkif.exe ups_run3⤵
-
C:\Temp\kfcxvsnkif.exeC:\Temp\kfcxvsnkif.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kfcxvsnkif.exe ups_ins3⤵
-
C:\Temp\i_kfcxvsnkif.exeC:\Temp\i_kfcxvsnkif.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\khfzxspkhc.exe ups_run3⤵
-
C:\Temp\khfzxspkhc.exeC:\Temp\khfzxspkhc.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_khfzxspkhc.exe ups_ins3⤵
-
C:\Temp\i_khfzxspkhc.exeC:\Temp\i_khfzxspkhc.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cwuomhezxr.exe ups_run3⤵
-
C:\Temp\cwuomhezxr.exeC:\Temp\cwuomhezxr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cwuomhezxr.exe ups_ins3⤵
-
C:\Temp\i_cwuomhezxr.exeC:\Temp\i_cwuomhezxr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wromgebztr.exe ups_run3⤵
-
C:\Temp\wromgebztr.exeC:\Temp\wromgebztr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wromgebztr.exe ups_ins3⤵
-
C:\Temp\i_wromgebztr.exeC:\Temp\i_wromgebztr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wrojhbztoj.exe ups_run3⤵
-
C:\Temp\wrojhbztoj.exeC:\Temp\wrojhbztoj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wrojhbztoj.exe ups_ins3⤵
-
C:\Temp\i_wrojhbztoj.exeC:\Temp\i_wrojhbztoj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dywtrljgey.exe ups_run3⤵
-
C:\Temp\dywtrljgey.exeC:\Temp\dywtrljgey.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dywtrljgey.exe ups_ins3⤵
-
C:\Temp\i_dywtrljgey.exeC:\Temp\i_dywtrljgey.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ytqlidbvtn.exe ups_run3⤵
-
C:\Temp\ytqlidbvtn.exeC:\Temp\ytqlidbvtn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ytqlidbvtn.exe ups_ins3⤵
-
C:\Temp\i_ytqlidbvtn.exeC:\Temp\i_ytqlidbvtn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x300,0x7ff860c4c188,0x7ff860c4c194,0x7ff860c4c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2164,i,6581199662740342601,17006345898497322468,524288 --field-trial-handle=2504,i,17123668136454334512,5439884215247247176,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1936,i,11056820521218871268,828533909034713702,262144 --field-trial-handle=2504,i,17123668136454334512,5439884215247247176,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,179918466142483517,7494655400946554741,524288 --field-trial-handle=2504,i,17123668136454334512,5439884215247247176,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,10278024267555134738,2089957934143395598,2097152 --field-trial-handle=2504,i,17123668136454334512,5439884215247247176,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,400455902499298977,3266201935467606484,2097152 --field-trial-handle=2504,i,17123668136454334512,5439884215247247176,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,13699955869222389947,17309157866753912788,2097152 --field-trial-handle=2504,i,17123668136454334512,5439884215247247176,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,6955606276203108186,5210717967863940195,2097152 --field-trial-handle=2504,i,17123668136454334512,5439884215247247176,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,514357666876884597,2271016046085878300,524288 --field-trial-handle=2504,i,17123668136454334512,5439884215247247176,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,10709443171280787515,3774714464240538069,524288 --field-trial-handle=2504,i,17123668136454334512,5439884215247247176,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,14880090992985402879,1675097790705476669,524288 --field-trial-handle=2504,i,17123668136454334512,5439884215247247176,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,12922476293028091363,13739028125605219377,524288 --field-trial-handle=2504,i,17123668136454334512,5439884215247247176,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,12922476293028091363,13739028125605219377,524288 --field-trial-handle=2504,i,17123668136454334512,5439884215247247176,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,6741550732776448523,6159254672670598576,524288 --field-trial-handle=2504,i,17123668136454334512,5439884215247247176,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,13416604169074426685,4042546248589203603,524288 --field-trial-handle=2504,i,17123668136454334512,5439884215247247176,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,9869859777170397249,496613125202088677,524288 --field-trial-handle=2504,i,17123668136454334512,5439884215247247176,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6812,i,12451482557741972173,7908242782749211495,524288 --field-trial-handle=2504,i,17123668136454334512,5439884215247247176,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1420,i,864268556193488379,9344498875956971106,524288 --field-trial-handle=2504,i,17123668136454334512,5439884215247247176,262144 --variations-seed-version --mojo-platform-channel-handle=1276 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1428,i,8624738656060261844,4015383234897832613,524288 --field-trial-handle=2504,i,17123668136454334512,5439884215247247176,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1436,i,11801037230856543148,16580002143637424916,524288 --field-trial-handle=2504,i,17123668136454334512,5439884215247247176,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,15658525506830833425,17403780697195426407,524288 --field-trial-handle=2504,i,17123668136454334512,5439884215247247176,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,11656900139111510518,7971293955705624047,524288 --field-trial-handle=2504,i,17123668136454334512,5439884215247247176,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,4818405012386270310,10159582450865451973,524288 --field-trial-handle=2504,i,17123668136454334512,5439884215247247176,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,14201648811553025808,1366768000214933979,524288 --field-trial-handle=2504,i,17123668136454334512,5439884215247247176,262144 --variations-seed-version --mojo-platform-channel-handle=932 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6420,i,17516251277069049363,10382110000905939319,262144 --field-trial-handle=2504,i,17123668136454334512,5439884215247247176,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4636,i,11454459986981561900,4446924649470415351,524288 --field-trial-handle=2504,i,17123668136454334512,5439884215247247176,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\ztrljdbvtrojgeyw.sysC:\Temp\ztrljdbvtrojgeyw.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\vtqljdbytq.sysC:\Temp\vtqljdbytq.sys1⤵
- Executes dropped EXE
-
C:\Temp\vtnlfdxvqn.sysC:\Temp\vtnlfdxvqn.sys1⤵
- Executes dropped EXE
-
C:\Temp\dxvsnlfdxv.sysC:\Temp\dxvsnlfdxv.sys1⤵
- Executes dropped EXE
-
C:\Temp\pnhfcxvpnk.sysC:\Temp\pnhfcxvpnk.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfzxuspkhc.sysC:\Temp\hfzxuspkhc.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfrpjhbzur.sysC:\Temp\hfrpjhbzur.sys1⤵
- Executes dropped EXE
-
C:\Temp\mgeczurpmh.sysC:\Temp\mgeczurpmh.sys1⤵
- Executes dropped EXE
-
C:\Temp\bztrljdbzt.sysC:\Temp\bztrljdbzt.sys1⤵
- Executes dropped EXE
-
C:\Temp\bvtqljdbyw.sysC:\Temp\bvtqljdbyw.sys1⤵
- Executes dropped EXE
-
C:\Temp\qoigdxvsqo.sysC:\Temp\qoigdxvsqo.sys1⤵
- Executes dropped EXE
-
C:\Temp\vsqkigaysq.sysC:\Temp\vsqkigaysq.sys1⤵
-
C:\Temp\nkfcausnkf.sysC:\Temp\nkfcausnkf.sys1⤵
-
C:\Temp\kecaxvpnhf.sysC:\Temp\kecaxvpnhf.sys1⤵
-
C:\Temp\czurmkecwu.sysC:\Temp\czurmkecwu.sys1⤵
-
C:\Temp\bzwuomkhbz.sysC:\Temp\bzwuomkhbz.sys1⤵
-
C:\Temp\bztrljebzt.sysC:\Temp\bztrljebzt.sys1⤵
-
C:\Temp\eyvtqoigeb.sysC:\Temp\eyvtqoigeb.sys1⤵
-
C:\Temp\aytqljdbvt.sysC:\Temp\aytqljdbvt.sys1⤵
-
C:\Temp\gdyvqnlidb.sysC:\Temp\gdyvqnlidb.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
dxnifaysqk.exe
dxvsnlfdxv.sys
ecausmkecx.exe
hfzxuspkhc.sys
i_dxnifaysqk.exe
i_jgbztrljdb.exe
i_nhfaxsqkic.exe
i_qligaywqoi.exe
i_vqnlidaysq.exe
jgbztrljdb.exe
nhfaxsqkic.exe
pnhfcxvpnk.sys
qligaywqoi.exe
vqnlidaysq.exe
vtnlfdxvqn.sys
vtqljdbytq.sys
ztrljdbvtrojgeyw.exe
ztrljdbvtrojgeyw.sys
settings.dat
settings.dat
the-real-index
the-real-index
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Secure Preferences
3f857a41-0667-4b08-afd6-792c19000b52.tmp
Local State
Local State
Local State
Local State
Local State
Local State
f6239a67-be25-421b-8b8a-2bcd3f1f41ec.tmp
metadata.json
metadata.json
metadata.json
e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
metadata.json
metadata.json
92cbdaae-99a1-4e3c-be7b-f123ec4ec78b.tmp
content_new.js
CreateProcess.exe
memory/912-633-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1012-581-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1200-506-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1208-64-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1284-733-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1320-417-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2164-669-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2248-689-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2452-539-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3136-558-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3488-632-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3504-712-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3824-554-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3984-707-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3984-730-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4152-492-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4204-573-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4680-646-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5688-464-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5848-737-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5920-658-0x0000000000010000-0x00000000000AB000-memory.dmp