Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
07/07/2026, 18:18
General
- Target 2026-07-07_48e9a17b406f4b451bbb0c669b128f67_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample260707-wxqrfaby4w
- SHA256 adc9b5f797b832f6496565549b10c56d5fe2e32876142ab86e8bc26546c3e769
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 10 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 42 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-07_48e9a17b406f4b451bbb0c669b128f67_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-07_48e9a17b406f4b451bbb0c669b128f67_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\jhczusmkecwupmhf.exeC:\Temp\jhczusmkecwupmhf.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mjhfzxpmhc.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\mjhfzxpmhc.exeC:\Temp\mjhfzxpmhc.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mjhfzxpmhc.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mjhfzxpmhc.exeC:\Temp\i_mjhfzxpmhc.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wrojhbztrm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wrojhbztrm.exeC:\Temp\wrojhbztrm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wrojhbztrm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wrojhbztrm.exeC:\Temp\i_wrojhbztrm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdbwtomgey.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jdbwtomgey.exeC:\Temp\jdbwtomgey.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdbwtomgey.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jdbwtomgey.exeC:\Temp\i_jdbwtomgey.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gdywqoigay.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gdywqoigay.exeC:\Temp\gdywqoigay.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gdywqoigay.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gdywqoigay.exeC:\Temp\i_gdywqoigay.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqlidbvtnl.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\sqlidbvtnl.exeC:\Temp\sqlidbvtnl.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqlidbvtnl.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_sqlidbvtnl.exeC:\Temp\i_sqlidbvtnl.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\icayvqniga.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\icayvqniga.exeC:\Temp\icayvqniga.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_icayvqniga.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_icayvqniga.exeC:\Temp\i_icayvqniga.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kfdxvsnhfa.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kfdxvsnhfa.exeC:\Temp\kfdxvsnhfa.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kfdxvsnhfa.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kfdxvsnhfa.exeC:\Temp\i_kfdxvsnhfa.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\khczurpnhf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\khczurpnhf.exeC:\Temp\khczurpnhf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_khczurpnhf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_khczurpnhf.exeC:\Temp\i_khczurpnhf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fzxrpkhczu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fzxrpkhczu.exeC:\Temp\fzxrpkhczu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fzxrpkhczu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fzxrpkhczu.exeC:\Temp\i_fzxrpkhczu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zwuomkhbzu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zwuomkhbzu.exeC:\Temp\zwuomkhbzu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zwuomkhbzu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zwuomkhbzu.exeC:\Temp\i_zwuomkhbzu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jebwtolgey.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jebwtolgey.exeC:\Temp\jebwtolgey.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jebwtolgey.exe ups_ins3⤵
-
C:\Temp\i_jebwtolgey.exeC:\Temp\i_jebwtolgey.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tomgeywroj.exe ups_run3⤵
-
C:\Temp\tomgeywroj.exeC:\Temp\tomgeywroj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tomgeywroj.exe ups_ins3⤵
-
C:\Temp\i_tomgeywroj.exeC:\Temp\i_tomgeywroj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\yvqoigaywt.exe ups_run3⤵
-
C:\Temp\yvqoigaywt.exeC:\Temp\yvqoigaywt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_yvqoigaywt.exe ups_ins3⤵
-
C:\Temp\i_yvqoigaywt.exeC:\Temp\i_yvqoigaywt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dyvqoigays.exe ups_run3⤵
-
C:\Temp\dyvqoigays.exeC:\Temp\dyvqoigays.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dyvqoigays.exe ups_ins3⤵
-
C:\Temp\i_dyvqoigays.exeC:\Temp\i_dyvqoigays.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nhfdxvpnif.exe ups_run3⤵
-
C:\Temp\nhfdxvpnif.exeC:\Temp\nhfdxvpnif.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nhfdxvpnif.exe ups_ins3⤵
-
C:\Temp\i_nhfdxvpnif.exeC:\Temp\i_nhfdxvpnif.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fcxvpnhfsp.exe ups_run3⤵
-
C:\Temp\fcxvpnhfsp.exeC:\Temp\fcxvpnhfsp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fcxvpnhfsp.exe ups_ins3⤵
-
C:\Temp\i_fcxvpnhfsp.exeC:\Temp\i_fcxvpnhfsp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\caxspnhfzx.exe ups_run3⤵
-
C:\Temp\caxspnhfzx.exeC:\Temp\caxspnhfzx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_caxspnhfzx.exe ups_ins3⤵
-
C:\Temp\i_caxspnhfzx.exeC:\Temp\i_caxspnhfzx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ezxrpjhbzu.exe ups_run3⤵
-
C:\Temp\ezxrpjhbzu.exeC:\Temp\ezxrpjhbzu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ezxrpjhbzu.exe ups_ins3⤵
-
C:\Temp\i_ezxrpjhbzu.exeC:\Temp\i_ezxrpjhbzu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wromjhbzwu.exe ups_run3⤵
-
C:\Temp\wromjhbzwu.exeC:\Temp\wromjhbzwu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wromjhbzwu.exe ups_ins3⤵
-
C:\Temp\i_wromjhbzwu.exeC:\Temp\i_wromjhbzwu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hbzwrojhbz.exe ups_run3⤵
-
C:\Temp\hbzwrojhbz.exeC:\Temp\hbzwrojhbz.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x204,0x7ffc63fec188,0x7ffc63fec194,0x7ffc63fec1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,5139148610524018093,15906297253466062914,262144 --field-trial-handle=2304,i,15502179499175037240,5528218508575367289,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,18114188568606313481,16779522407884438058,524288 --field-trial-handle=2304,i,15502179499175037240,5528218508575367289,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,15653890478711796347,16379957860859308496,524288 --field-trial-handle=2304,i,15502179499175037240,5528218508575367289,262144 --variations-seed-version --mojo-platform-channel-handle=3148 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3580,i,12961421640232202953,14092822965215003196,2097152 --field-trial-handle=2304,i,15502179499175037240,5528218508575367289,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,13906889892933025478,16556167405136715176,2097152 --field-trial-handle=2304,i,15502179499175037240,5528218508575367289,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,1860163991476831071,12571269769704825430,2097152 --field-trial-handle=2304,i,15502179499175037240,5528218508575367289,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,12183019848165330664,13845210895627043090,2097152 --field-trial-handle=2304,i,15502179499175037240,5528218508575367289,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4232,i,15886672149589936512,6758837320440736983,524288 --field-trial-handle=2304,i,15502179499175037240,5528218508575367289,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,9330395391359235822,14701735539826983879,524288 --field-trial-handle=2304,i,15502179499175037240,5528218508575367289,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,173829671228325834,4100271687228154457,524288 --field-trial-handle=2304,i,15502179499175037240,5528218508575367289,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,6288376357425731171,15582316491727635617,524288 --field-trial-handle=2304,i,15502179499175037240,5528218508575367289,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,6288376357425731171,15582316491727635617,524288 --field-trial-handle=2304,i,15502179499175037240,5528218508575367289,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,6874232466199874598,8214638286303792029,524288 --field-trial-handle=2304,i,15502179499175037240,5528218508575367289,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,9311274475807897072,14791583081537513844,524288 --field-trial-handle=2304,i,15502179499175037240,5528218508575367289,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5040,i,79843793120014467,8632335647245312626,2097152 --field-trial-handle=2304,i,15502179499175037240,5528218508575367289,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3636,i,9754318670584800585,14649231521404949041,2097152 --field-trial-handle=2304,i,15502179499175037240,5528218508575367289,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,9622859892211199931,6871532147881775937,524288 --field-trial-handle=2304,i,15502179499175037240,5528218508575367289,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,4079794920051391944,10852810940465875987,524288 --field-trial-handle=2304,i,15502179499175037240,5528218508575367289,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,10812414477727592738,10384896247890438032,524288 --field-trial-handle=2304,i,15502179499175037240,5528218508575367289,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,9506187233152519317,12633249464229286836,524288 --field-trial-handle=2304,i,15502179499175037240,5528218508575367289,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,12216908350520301370,1205036705527901887,524288 --field-trial-handle=2304,i,15502179499175037240,5528218508575367289,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3272,i,1956141269073280388,2793519153845375603,524288 --field-trial-handle=2304,i,15502179499175037240,5528218508575367289,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3780,i,10548079146876328332,9117380919365732189,524288 --field-trial-handle=2304,i,15502179499175037240,5528218508575367289,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6176,i,10228676819767127565,10344512645534648540,262144 --field-trial-handle=2304,i,15502179499175037240,5528218508575367289,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,11409997137176858564,8942299308218888216,524288 --field-trial-handle=2304,i,15502179499175037240,5528218508575367289,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\jhczusmkecwupmhf.sysC:\Temp\jhczusmkecwupmhf.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\hbztrmjebw.sysC:\Temp\hbztrmjebw.sys1⤵
- Executes dropped EXE
-
C:\Temp\tolgeywqoj.sysC:\Temp\tolgeywqoj.sys1⤵
- Executes dropped EXE
-
C:\Temp\ywqoigbytr.sysC:\Temp\ywqoigbytr.sys1⤵
- Executes dropped EXE
-
C:\Temp\bvtnljdywq.sysC:\Temp\bvtnljdywq.sys1⤵
- Executes dropped EXE
-
C:\Temp\lfdxvqnigd.sysC:\Temp\lfdxvqnigd.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfaxvpnhfd.sysC:\Temp\hfaxvpnhfd.sys1⤵
- Executes dropped EXE
-
C:\Temp\usqkhcausm.sysC:\Temp\usqkhcausm.sys1⤵
- Executes dropped EXE
-
C:\Temp\khcausmkec.sysC:\Temp\khcausmkec.sys1⤵
- Executes dropped EXE
-
C:\Temp\ezwrpmhezw.sysC:\Temp\ezwrpmhezw.sys1⤵
- Executes dropped EXE
-
C:\Temp\omjhbztjeb.sysC:\Temp\omjhbztjeb.sys1⤵
- Executes dropped EXE
-
C:\Temp\rljdbwtomj.sysC:\Temp\rljdbwtomj.sys1⤵
-
C:\Temp\bytqolgdbv.sysC:\Temp\bytqolgdbv.sys1⤵
-
C:\Temp\yvqnigaysq.sysC:\Temp\yvqnigaysq.sys1⤵
-
C:\Temp\vqnlfdxvtq.sysC:\Temp\vqnlfdxvtq.sys1⤵
-
C:\Temp\nhfaxspkic.sysC:\Temp\nhfaxspkic.sys1⤵
-
C:\Temp\zxrpnkiczx.sysC:\Temp\zxrpnkiczx.sys1⤵
-
C:\Temp\fzxrpjhbzu.sysC:\Temp\fzxrpjhbzu.sys1⤵
-
C:\Temp\bzurpmhecw.sysC:\Temp\bzurpmhecw.sys1⤵
-
C:\Temp\bzwrojgebw.sysC:\Temp\bzwrojgebw.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
bvtnljdywq.sys
gdywqoigay.exe
hbztrmjebw.sys
i_gdywqoigay.exe
i_jdbwtomgey.exe
i_mjhfzxpmhc.exe
i_sqlidbvtnl.exe
i_wrojhbztrm.exe
icayvqniga.exe
jdbwtomgey.exe
jhczusmkecwupmhf.exe
jhczusmkecwupmhf.sys
lfdxvqnigd.sys
mjhfzxpmhc.exe
sqlidbvtnl.exe
tolgeywqoj.sys
wrojhbztrm.exe
ywqoigbytr.sys
settings.dat
settings.dat
the-real-index
the-real-index
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Preferences
Secure Preferences
62f37595-0246-441f-8557-492ee4fc94ce.tmp
Local State
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
7820bb3b-83ac-4c1c-a19b-563c4df11914.tmp
content_new.js
CreateProcess.exe
memory/364-284-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/364-414-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/812-438-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1052-374-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2312-394-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2540-455-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3068-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3172-314-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3224-450-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4436-475-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4564-345-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4804-487-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4832-341-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4980-504-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5176-321-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5176-197-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5272-272-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5272-299-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5344-439-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5344-418-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5356-244-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5784-325-0x0000000000010000-0x00000000000AB000-memory.dmp