Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
09/08/2026, 10:21
General
- Target 2026-08-09_215819175d4a5e55c4e2aa03ee64f4da_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample260809-mdrd7aaa47
- SHA256 7c73db70d9a986c51ff57ce6f7cfb449c207e83c4ab8be484bd26a7a878886a2
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_215819175d4a5e55c4e2aa03ee64f4da_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_215819175d4a5e55c4e2aa03ee64f4da_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\zxrpjhbzurmkecwu.exeC:\Temp\zxrpjhbzurmkecwu.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zwupmhezxr.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\zwupmhezxr.exeC:\Temp\zwupmhezxr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zwupmhezxr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zwupmhezxr.exeC:\Temp\i_zwupmhezxr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljhezwuomh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ljhezwuomh.exeC:\Temp\ljhezwuomh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljhezwuomh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ljhezwuomh.exeC:\Temp\i_ljhezwuomh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\oljgeywroj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\oljgeywroj.exeC:\Temp\oljgeywroj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_oljgeywroj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_oljgeywroj.exeC:\Temp\i_oljgeywroj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bywqojdbwt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\bywqojdbwt.exeC:\Temp\bywqojdbwt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bywqojdbwt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_bywqojdbwt.exeC:\Temp\i_bywqojdbwt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qnljgaytql.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qnljgaytql.exeC:\Temp\qnljgaytql.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qnljgaytql.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qnljgaytql.exeC:\Temp\i_qnljgaytql.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\avtnlfdxvq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\avtnlfdxvq.exeC:\Temp\avtnlfdxvq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_avtnlfdxvq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_avtnlfdxvq.exeC:\Temp\i_avtnlfdxvq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nkfdxvsnkf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nkfdxvsnkf.exeC:\Temp\nkfdxvsnkf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nkfdxvsnkf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nkfdxvsnkf.exeC:\Temp\i_nkfdxvsnkf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fcaupnhfzx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fcaupnhfzx.exeC:\Temp\fcaupnhfzx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fcaupnhfzx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fcaupnhfzx.exeC:\Temp\i_fcaupnhfzx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpmhfzxrpk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rpmhfzxrpk.exeC:\Temp\rpmhfzxrpk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpmhfzxrpk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rpmhfzxrpk.exeC:\Temp\i_rpmhfzxrpk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hezuomgezw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hezuomgezw.exeC:\Temp\hezuomgezw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hezuomgezw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hezuomgezw.exeC:\Temp\i_hezuomgezw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywrojgezwr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ywrojgezwr.exeC:\Temp\ywrojgezwr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywrojgezwr.exe ups_ins3⤵
-
C:\Temp\i_ywrojgezwr.exeC:\Temp\i_ywrojgezwr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bwtrljdbwt.exe ups_run3⤵
-
C:\Temp\bwtrljdbwt.exeC:\Temp\bwtrljdbwt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bwtrljdbwt.exe ups_ins3⤵
-
C:\Temp\i_bwtrljdbwt.exeC:\Temp\i_bwtrljdbwt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lidbvtnlgd.exe ups_run3⤵
-
C:\Temp\lidbvtnlgd.exeC:\Temp\lidbvtnlgd.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lidbvtnlgd.exe ups_ins3⤵
-
C:\Temp\i_lidbvtnlgd.exeC:\Temp\i_lidbvtnlgd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nifdbvtnki.exe ups_run3⤵
-
C:\Temp\nifdbvtnki.exeC:\Temp\nifdbvtnki.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nifdbvtnki.exe ups_ins3⤵
-
C:\Temp\i_nifdbvtnki.exeC:\Temp\i_nifdbvtnki.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\axvpnifdxv.exe ups_run3⤵
-
C:\Temp\axvpnifdxv.exeC:\Temp\axvpnifdxv.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_axvpnifdxv.exe ups_ins3⤵
-
C:\Temp\i_axvpnifdxv.exeC:\Temp\i_axvpnifdxv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qkicspnkfc.exe ups_run3⤵
-
C:\Temp\qkicspnkfc.exeC:\Temp\qkicspnkfc.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qkicspnkfc.exe ups_ins3⤵
-
C:\Temp\i_qkicspnkfc.exeC:\Temp\i_qkicspnkfc.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\czxrpnhcax.exe ups_run3⤵
-
C:\Temp\czxrpnhcax.exeC:\Temp\czxrpnhcax.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_czxrpnhcax.exe ups_ins3⤵
-
C:\Temp\i_czxrpnhcax.exeC:\Temp\i_czxrpnhcax.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ezwusmjhbz.exe ups_run3⤵
-
C:\Temp\ezwusmjhbz.exeC:\Temp\ezwusmjhbz.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ezwusmjhbz.exe ups_ins3⤵
-
C:\Temp\i_ezwusmjhbz.exeC:\Temp\i_ezwusmjhbz.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ebztrojhbz.exe ups_run3⤵
-
C:\Temp\ebztrojhbz.exeC:\Temp\ebztrojhbz.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ebztrojhbz.exe ups_ins3⤵
-
C:\Temp\i_ebztrojhbz.exeC:\Temp\i_ebztrojhbz.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x314,0x7ffb71e5c188,0x7ffb71e5c194,0x7ffb71e5c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,14289193416669556395,15265256253217726928,262144 --field-trial-handle=2588,i,8512724448933794522,17740411004598743811,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,8453075393664885134,13449791209264245650,524288 --field-trial-handle=2588,i,8512724448933794522,17740411004598743811,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,8196587218933826274,14255693962230557642,524288 --field-trial-handle=2588,i,8512724448933794522,17740411004598743811,262144 --variations-seed-version --mojo-platform-channel-handle=1888 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,6185916008522210080,8721238105149701740,2097152 --field-trial-handle=2588,i,8512724448933794522,17740411004598743811,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,8773843961325429735,11199775915799511357,2097152 --field-trial-handle=2588,i,8512724448933794522,17740411004598743811,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,16364525278240774252,12986274542542838424,2097152 --field-trial-handle=2588,i,8512724448933794522,17740411004598743811,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,1937988363285698776,3616874002017066196,2097152 --field-trial-handle=2588,i,8512724448933794522,17740411004598743811,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3872,i,1215051532902802128,14127098508324474595,524288 --field-trial-handle=2588,i,8512724448933794522,17740411004598743811,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,12518616767066315929,1132322291394045918,524288 --field-trial-handle=2588,i,8512724448933794522,17740411004598743811,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,9222092195769160242,3346826947746268246,524288 --field-trial-handle=2588,i,8512724448933794522,17740411004598743811,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,8751614374628987598,5548334097341979991,524288 --field-trial-handle=2588,i,8512724448933794522,17740411004598743811,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,8751614374628987598,5548334097341979991,524288 --field-trial-handle=2588,i,8512724448933794522,17740411004598743811,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,2392998473879737218,10540750907093357596,524288 --field-trial-handle=2588,i,8512724448933794522,17740411004598743811,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,16280737264125384797,16791278416639083613,524288 --field-trial-handle=2588,i,8512724448933794522,17740411004598743811,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,13204617167614717692,10244979508147220629,524288 --field-trial-handle=2588,i,8512724448933794522,17740411004598743811,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4196,i,3775725181360437517,2241669063789875681,524288 --field-trial-handle=2588,i,8512724448933794522,17740411004598743811,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4200,i,16623071763948913526,16915248154580188864,524288 --field-trial-handle=2588,i,8512724448933794522,17740411004598743811,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,1186308128571554064,9068768793892918939,524288 --field-trial-handle=2588,i,8512724448933794522,17740411004598743811,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,14875174400144309123,3106087020447029649,524288 --field-trial-handle=2588,i,8512724448933794522,17740411004598743811,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,2654148628789271493,16109348851592826739,524288 --field-trial-handle=2588,i,8512724448933794522,17740411004598743811,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,15911632987948771860,12190305601566030035,524288 --field-trial-handle=2588,i,8512724448933794522,17740411004598743811,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,2068009588374620063,13373645684498895870,524288 --field-trial-handle=2588,i,8512724448933794522,17740411004598743811,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,17094905798190240697,1652572692286727764,524288 --field-trial-handle=2588,i,8512724448933794522,17740411004598743811,262144 --variations-seed-version --mojo-platform-channel-handle=924 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5760,i,1873234632005175207,412107505382561392,262144 --field-trial-handle=2588,i,8512724448933794522,17740411004598743811,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,2414229498384739719,7387090382986340862,524288 --field-trial-handle=2588,i,8512724448933794522,17740411004598743811,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\zxrpjhbzurmkecwu.sysC:\Temp\zxrpjhbzurmkecwu.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\omkecwuomj.sysC:\Temp\omkecwuomj.sys1⤵
- Executes dropped EXE
-
C:\Temp\wuomjebwur.sysC:\Temp\wuomjebwur.sys1⤵
- Executes dropped EXE
-
C:\Temp\ljdbvtolgd.sysC:\Temp\ljdbvtolgd.sys1⤵
- Executes dropped EXE
-
C:\Temp\wqnlgdyvtq.sysC:\Temp\wqnlgdyvtq.sys1⤵
- Executes dropped EXE
-
C:\Temp\fdxvqnigay.sysC:\Temp\fdxvqnigay.sys1⤵
- Executes dropped EXE
-
C:\Temp\spnkidaysq.sysC:\Temp\spnkidaysq.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfcxvpnhfd.sysC:\Temp\hfcxvpnhfd.sys1⤵
- Executes dropped EXE
-
C:\Temp\zxupmkecwu.sysC:\Temp\zxupmkecwu.sys1⤵
- Executes dropped EXE
-
C:\Temp\hezxupmjeb.sysC:\Temp\hezxupmjeb.sys1⤵
- Executes dropped EXE
-
C:\Temp\ebztrmjhbz.sysC:\Temp\ebztrmjhbz.sys1⤵
- Executes dropped EXE
-
C:\Temp\ebwtolgeyw.sysC:\Temp\ebwtolgeyw.sys1⤵
-
C:\Temp\nljdbytqoi.sysC:\Temp\nljdbytqoi.sys1⤵
-
C:\Temp\lidaysqnlf.sysC:\Temp\lidaysqnlf.sys1⤵
-
C:\Temp\qndxvpnifa.sysC:\Temp\qndxvpnifa.sys1⤵
-
C:\Temp\pnhfaxvpnk.sysC:\Temp\pnhfaxvpnk.sys1⤵
-
C:\Temp\kfcxupmkfc.sysC:\Temp\kfcxupmkfc.sys1⤵
-
C:\Temp\eczurmkecw.sysC:\Temp\eczurmkecw.sys1⤵
-
C:\Temp\mkecwurmcw.sysC:\Temp\mkecwurmcw.sys1⤵
-
C:\Temp\jgeywrojhe.sysC:\Temp\jgeywrojhe.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
avtnlfdxvq.exe
bywqojdbwt.exe
fdxvqnigay.sys
i_bywqojdbwt.exe
i_ljhezwuomh.exe
i_oljgeywroj.exe
i_qnljgaytql.exe
i_zwupmhezxr.exe
ljdbvtolgd.sys
ljhezwuomh.exe
oljgeywroj.exe
omkecwuomj.sys
qnljgaytql.exe
wqnlgdyvtq.sys
wuomjebwur.sys
zwupmhezxr.exe
zxrpjhbzurmkecwu.exe
zxrpjhbzurmkecwu.sys
settings.dat
settings.dat
the-real-index
the-real-index~RFe5967e8.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Secure Preferences
516def1c-e826-4160-9982-60ab0275438a.tmp
Local State
Local State
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
metadata.json
299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
e4a4b375-89f4-40d8-964d-56854a2eab7a.tmp
metadata.json
1ed10091-c044-40e3-90d6-b0de68f8507b.tmp
content_new.js
CreateProcess.exe
memory/8-702-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/8-680-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2416-587-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2632-233-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2904-567-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2904-583-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3096-700-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3400-563-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3576-676-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3712-218-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3712-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4536-748-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4724-496-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4724-548-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4776-239-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4776-185-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4900-656-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5020-643-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5020-665-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5544-719-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5628-724-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5676-555-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5780-582-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5856-616-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5932-744-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5980-510-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5980-556-0x0000000000010000-0x00000000000AB000-memory.dmp