Analysis
- max time kernel
148s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
31/07/2026, 14:00
General
- Target 2026-07-31_9b8e276cc8d49a1cc3ac2aa4ccf0db06_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample260731-rbf8navzcx
- SHA256 6f4d25a8f98e498a7ca5e3d07843025351ce20a0719a2201f0b64db90b66b8e2
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_9b8e276cc8d49a1cc3ac2aa4ccf0db06_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-31_9b8e276cc8d49a1cc3ac2aa4ccf0db06_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\fzxvpnhfcxusnkfc.exeC:\Temp\fzxvpnhfcxusnkfc.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nkicaxspkh.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\nkicaxspkh.exeC:\Temp\nkicaxspkh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nkicaxspkh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nkicaxspkh.exeC:\Temp\i_nkicaxspkh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpmhfcxusm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rpmhfcxusm.exeC:\Temp\rpmhfcxusm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpmhfcxusm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rpmhfcxusm.exeC:\Temp\i_rpmhfcxusm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gezwurmjeb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gezwurmjeb.exeC:\Temp\gezwurmjeb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gezwurmjeb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gezwurmjeb.exeC:\Temp\i_gezwurmjeb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gebztrmjeb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gebztrmjeb.exeC:\Temp\gebztrmjeb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gebztrmjeb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gebztrmjeb.exeC:\Temp\i_gebztrmjeb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\iytqoigbyt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\iytqoigbyt.exeC:\Temp\iytqoigbyt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_iytqoigbyt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_iytqoigbyt.exeC:\Temp\i_iytqoigbyt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ytqligdbvt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ytqligdbvt.exeC:\Temp\ytqligdbvt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ytqligdbvt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ytqligdbvt.exeC:\Temp\i_ytqligdbvt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqkidavtnl.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\sqkidavtnl.exeC:\Temp\sqkidavtnl.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqkidavtnl.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_sqkidavtnl.exeC:\Temp\i_sqkidavtnl.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ifdxvsqkif.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ifdxvsqkif.exeC:\Temp\ifdxvsqkif.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ifdxvsqkif.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ifdxvsqkif.exeC:\Temp\i_ifdxvsqkif.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fvsnkfcxvp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fvsnkfcxvp.exeC:\Temp\fvsnkfcxvp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fvsnkfcxvp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fvsnkfcxvp.exeC:\Temp\i_fvsnkfcxvp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kecxusmkec.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kecxusmkec.exeC:\Temp\kecxusmkec.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kecxusmkec.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kecxusmkec.exeC:\Temp\i_kecxusmkec.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zwupmhfzxr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zwupmhfzxr.exeC:\Temp\zwupmhfzxr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zwupmhfzxr.exe ups_ins3⤵
-
C:\Temp\i_zwupmhfzxr.exeC:\Temp\i_zwupmhfzxr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rljebwuomg.exe ups_run3⤵
-
C:\Temp\rljebwuomg.exeC:\Temp\rljebwuomg.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rljebwuomg.exe ups_ins3⤵
-
C:\Temp\i_rljebwuomg.exeC:\Temp\i_rljebwuomg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bwtqojgbzt.exe ups_run3⤵
-
C:\Temp\bwtqojgbzt.exeC:\Temp\bwtqojgbzt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bwtqojgbzt.exe ups_ins3⤵
-
C:\Temp\i_bwtqojgbzt.exeC:\Temp\i_bwtqojgbzt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wqolgdywqo.exe ups_run3⤵
-
C:\Temp\wqolgdywqo.exeC:\Temp\wqolgdywqo.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wqolgdywqo.exe ups_ins3⤵
-
C:\Temp\i_wqolgdywqo.exeC:\Temp\i_wqolgdywqo.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nigaysqlid.exe ups_run3⤵
-
C:\Temp\nigaysqlid.exeC:\Temp\nigaysqlid.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nigaysqlid.exe ups_ins3⤵
-
C:\Temp\i_nigaysqlid.exeC:\Temp\i_nigaysqlid.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\axsqkicavs.exe ups_run3⤵
-
C:\Temp\axsqkicavs.exeC:\Temp\axsqkicavs.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_axsqkicavs.exe ups_ins3⤵
-
C:\Temp\i_axsqkicavs.exeC:\Temp\i_axsqkicavs.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nhfzxspkif.exe ups_run3⤵
-
C:\Temp\nhfzxspkif.exeC:\Temp\nhfzxspkif.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nhfzxspkif.exe ups_ins3⤵
-
C:\Temp\i_nhfzxspkif.exeC:\Temp\i_nhfzxspkif.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fcausmkfcx.exe ups_run3⤵
-
C:\Temp\fcausmkfcx.exeC:\Temp\fcausmkfcx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fcausmkfcx.exe ups_ins3⤵
-
C:\Temp\i_fcausmkfcx.exeC:\Temp\i_fcausmkfcx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zusmkecxup.exe ups_run3⤵
-
C:\Temp\zusmkecxup.exeC:\Temp\zusmkecxup.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zusmkecxup.exe ups_ins3⤵
-
C:\Temp\i_zusmkecxup.exeC:\Temp\i_zusmkecxup.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffeb61cc188,0x7ffeb61cc194,0x7ffeb61cc1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,4291371765403267275,11829062637831618539,262144 --field-trial-handle=2352,i,17151767647742165302,11957523504779077508,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,12563140934872455852,7638615554950403872,524288 --field-trial-handle=2352,i,17151767647742165302,11957523504779077508,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,9526242822716872619,10274911021765241178,524288 --field-trial-handle=2352,i,17151767647742165302,11957523504779077508,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,11171108540067348256,9238715751269946034,2097152 --field-trial-handle=2352,i,17151767647742165302,11957523504779077508,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3708,i,18276299047493911904,6227761829921269172,2097152 --field-trial-handle=2352,i,17151767647742165302,11957523504779077508,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4324,i,10652927981223823887,16822096470122070581,2097152 --field-trial-handle=2352,i,17151767647742165302,11957523504779077508,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4368,i,13014205385553115295,282902363276414512,2097152 --field-trial-handle=2352,i,17151767647742165302,11957523504779077508,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3776,i,13697784524805901557,3771619424758004261,524288 --field-trial-handle=2352,i,17151767647742165302,11957523504779077508,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,18424180525764705737,13417733503462912077,524288 --field-trial-handle=2352,i,17151767647742165302,11957523504779077508,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,6730144056668117499,11787929789498676212,524288 --field-trial-handle=2352,i,17151767647742165302,11957523504779077508,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,14552246200752692994,6613188299354698606,524288 --field-trial-handle=2352,i,17151767647742165302,11957523504779077508,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,14552246200752692994,6613188299354698606,524288 --field-trial-handle=2352,i,17151767647742165302,11957523504779077508,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,13192370264320131516,12827796045224047305,524288 --field-trial-handle=2352,i,17151767647742165302,11957523504779077508,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,9700752686907035783,3770373406362793615,524288 --field-trial-handle=2352,i,17151767647742165302,11957523504779077508,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,5009510270687500422,13700801028379024280,524288 --field-trial-handle=2352,i,17151767647742165302,11957523504779077508,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,14249242555432068985,12878793812321376954,524288 --field-trial-handle=2352,i,17151767647742165302,11957523504779077508,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,9727135821273815793,2969793034667282306,524288 --field-trial-handle=2352,i,17151767647742165302,11957523504779077508,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,12300012909990652889,3066072359117682069,524288 --field-trial-handle=2352,i,17151767647742165302,11957523504779077508,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4584,i,5938052048526376024,5354063033216825861,524288 --field-trial-handle=2352,i,17151767647742165302,11957523504779077508,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2088,i,15304410793956994473,16999548810610846961,524288 --field-trial-handle=2352,i,17151767647742165302,11957523504779077508,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,5662436823019369879,41711502611929684,524288 --field-trial-handle=2352,i,17151767647742165302,11957523504779077508,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=916,i,16222132535426616890,17274704673000841688,524288 --field-trial-handle=2352,i,17151767647742165302,11957523504779077508,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,5383473210955043254,3376547099041789043,524288 --field-trial-handle=2352,i,17151767647742165302,11957523504779077508,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3528,i,7935135393550144784,18027201379400044174,262144 --field-trial-handle=2352,i,17151767647742165302,11957523504779077508,262144 --variations-seed-version --mojo-platform-channel-handle=1916 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,818144310823903045,6151004970674736076,524288 --field-trial-handle=2352,i,17151767647742165302,11957523504779077508,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\fzxvpnhfcxusnkfc.sysC:\Temp\fzxvpnhfcxusnkfc.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Temp\xsmkecxusm.sysC:\Temp\xsmkecxusm.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhezwromhe.sysC:\Temp\jhezwromhe.sys1⤵
- Executes dropped EXE
-
C:\Temp\bywurljhbz.sysC:\Temp\bywurljhbz.sys1⤵
- Executes dropped EXE
-
C:\Temp\ojgeywqojg.sysC:\Temp\ojgeywqojg.sys1⤵
- Executes dropped EXE
-
C:\Temp\ytqljgaywt.sysC:\Temp\ytqljgaywt.sys1⤵
- Executes dropped EXE
-
C:\Temp\ysqkidavtn.sysC:\Temp\ysqkidavtn.sys1⤵
- Executes dropped EXE
-
C:\Temp\ysqcausnkf.sysC:\Temp\ysqcausnkf.sys1⤵
- Executes dropped EXE
-
C:\Temp\qkicausnkf.sysC:\Temp\qkicausnkf.sys1⤵
- Executes dropped EXE
-
C:\Temp\nhfzxvpnhf.sysC:\Temp\nhfzxvpnhf.sys1⤵
- Executes dropped EXE
-
C:\Temp\fzxrpmhczx.sysC:\Temp\fzxrpmhczx.sys1⤵
- Executes dropped EXE
-
C:\Temp\rmjhbzwrpj.sysC:\Temp\rmjhbzwrpj.sys1⤵
-
C:\Temp\rljebwtrlj.sysC:\Temp\rljebwtrlj.sys1⤵
-
C:\Temp\ywqoigeywq.sysC:\Temp\ywqoigeywq.sys1⤵
-
C:\Temp\qoifdyvqni.sysC:\Temp\qoifdyvqni.sys1⤵
-
C:\Temp\fdysqnifax.sysC:\Temp\fdysqnifax.sys1⤵
-
C:\Temp\davsnlfdxv.sysC:\Temp\davsnlfdxv.sys1⤵
-
C:\Temp\kfcxspkhfc.sysC:\Temp\kfcxspkhfc.sys1⤵
-
C:\Temp\aurmkeczur.sysC:\Temp\aurmkeczur.sys1⤵
-
C:\Temp\rmjecwuomg.sysC:\Temp\rmjecwuomg.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
bywurljhbz.sys
fzxvpnhfcxusnkfc.exe
fzxvpnhfcxusnkfc.sys
gebztrmjeb.exe
gezwurmjeb.exe
i_gebztrmjeb.exe
i_gezwurmjeb.exe
i_iytqoigbyt.exe
i_nkicaxspkh.exe
i_rpmhfcxusm.exe
iytqoigbyt.exe
jhezwromhe.sys
nkicaxspkh.exe
ojgeywqojg.sys
rpmhfcxusm.exe
xsmkecxusm.sys
ytqligdbvt.exe
ytqljgaywt.sys
438e8353-bc87-49ba-b724-111bb13f361a.tmp
settings.dat
settings.dat
the-real-index
the-real-index~RFe5a3be1.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Secure Preferences
OperationConfig
OperationConfig~RFe5ad7c4.TMP
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
a92bfaef-aea2-488b-b3c0-cf7d0694cc2e.tmp
metadata.json~RFe5a134b.TMP
64b1f279-5bf4-4856-9eb3-f993d5553892.tmp
content_new.js
CreateProcess.exe
memory/252-547-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1136-640-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1140-508-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1180-702-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2676-543-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2676-496-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2816-672-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2924-64-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3212-661-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3248-698-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3896-567-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4220-677-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4248-421-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4292-719-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4660-596-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4696-637-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4920-658-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4920-635-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4920-521-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5676-562-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5744-468-0x0000000000010000-0x00000000000AB000-memory.dmp