Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
09/08/2026, 13:48
General
- Target 2026-08-09_b344d08a8984a458fc52c430432fbd2b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample260809-q4kacassas
- SHA256 4afb2ba1ed27456804beffb777e2dfa0c9d72c0bc0153408d34a24c8a9eac9fe
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 19 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_b344d08a8984a458fc52c430432fbd2b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_b344d08a8984a458fc52c430432fbd2b_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\mhfzxrpjhczusmke.exeC:\Temp\mhfzxrpjhczusmke.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpjhfzupkc.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\rpjhfzupkc.exeC:\Temp\rpjhfzupkc.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpjhfzupkc.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rpjhfzupkc.exeC:\Temp\i_rpjhfzupkc.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trpjhbztrl.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\trpjhbztrl.exeC:\Temp\trpjhbztrl.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trpjhbztrl.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_trpjhbztrl.exeC:\Temp\i_trpjhbztrl.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\geywqojgeb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\geywqojgeb.exeC:\Temp\geywqojgeb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_geywqojgeb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_geywqojgeb.exeC:\Temp\i_geywqojgeb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gayvtrljdb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gayvtrljdb.exeC:\Temp\gayvtrljdb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gayvtrljdb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gayvtrljdb.exeC:\Temp\i_gayvtrljdb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ytqljdbvtn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ytqljdbvtn.exeC:\Temp\ytqljdbvtn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ytqljdbvtn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ytqljdbvtn.exeC:\Temp\i_ytqljdbvtn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\idavtnlfdx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\idavtnlfdx.exeC:\Temp\idavtnlfdx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_idavtnlfdx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_idavtnlfdx.exeC:\Temp\i_idavtnlfdx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\axvpnhcaus.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\axvpnhcaus.exeC:\Temp\axvpnhcaus.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_axvpnhcaus.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_axvpnhcaus.exeC:\Temp\i_axvpnhcaus.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xrpnkfcxup.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xrpnkfcxup.exeC:\Temp\xrpnkfcxup.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xrpnkfcxup.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_xrpnkfcxup.exeC:\Temp\i_xrpnkfcxup.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\causmkecxu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\causmkecxu.exeC:\Temp\causmkecxu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_causmkecxu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_causmkecxu.exeC:\Temp\i_causmkecxu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kecwuomhbz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kecwuomhbz.exeC:\Temp\kecwuomhbz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kecwuomhbz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kecwuomhbz.exeC:\Temp\i_kecwuomhbz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wuomgbztro.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wuomgbztro.exeC:\Temp\wuomgbztro.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wuomgbztro.exe ups_ins3⤵
-
C:\Temp\i_wuomgbztro.exeC:\Temp\i_wuomgbztro.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tolgeyvtol.exe ups_run3⤵
-
C:\Temp\tolgeyvtol.exeC:\Temp\tolgeyvtol.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tolgeyvtol.exe ups_ins3⤵
-
C:\Temp\i_tolgeyvtol.exeC:\Temp\i_tolgeyvtol.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\oigaywqoig.exe ups_run3⤵
-
C:\Temp\oigaywqoig.exeC:\Temp\oigaywqoig.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_oigaywqoig.exe ups_ins3⤵
-
C:\Temp\i_oigaywqoig.exeC:\Temp\i_oigaywqoig.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qlidayvtnl.exe ups_run3⤵
-
C:\Temp\qlidayvtnl.exeC:\Temp\qlidayvtnl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qlidayvtnl.exe ups_ins3⤵
-
C:\Temp\i_qlidayvtnl.exeC:\Temp\i_qlidayvtnl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ifaxsqkifa.exe ups_run3⤵
-
C:\Temp\ifaxsqkifa.exeC:\Temp\ifaxsqkifa.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ifaxsqkifa.exe ups_ins3⤵
-
C:\Temp\i_ifaxsqkifa.exeC:\Temp\i_ifaxsqkifa.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\causpkhfcx.exe ups_run3⤵
-
C:\Temp\causpkhfcx.exeC:\Temp\causpkhfcx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_causpkhfcx.exe ups_ins3⤵
-
C:\Temp\i_causpkhfcx.exeC:\Temp\i_causpkhfcx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\czusmkecwu.exe ups_run3⤵
-
C:\Temp\czusmkecwu.exeC:\Temp\czusmkecwu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_czusmkecwu.exe ups_ins3⤵
-
C:\Temp\i_czusmkecwu.exeC:\Temp\i_czusmkecwu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\urmjecwuom.exe ups_run3⤵
-
C:\Temp\urmjecwuom.exeC:\Temp\urmjecwuom.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_urmjecwuom.exe ups_ins3⤵
-
C:\Temp\i_urmjecwuom.exeC:\Temp\i_urmjecwuom.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tromjebztr.exe ups_run3⤵
-
C:\Temp\tromjebztr.exeC:\Temp\tromjebztr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tromjebztr.exe ups_ins3⤵
-
C:\Temp\i_tromjebztr.exeC:\Temp\i_tromjebztr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x368,0x7ffafd5bc188,0x7ffafd5bc194,0x7ffafd5bc1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,12643204406221025854,3036237656420175775,262144 --field-trial-handle=2444,i,9223993371126749121,2655619130568604534,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,15914636308282534864,3698821348406673342,524288 --field-trial-handle=2444,i,9223993371126749121,2655619130568604534,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2220,i,5710388110907831160,6770447663731741373,524288 --field-trial-handle=2444,i,9223993371126749121,2655619130568604534,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,5798031476807058781,16346809261337679626,2097152 --field-trial-handle=2444,i,9223993371126749121,2655619130568604534,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3676,i,2282704617385170567,3184492198485095830,2097152 --field-trial-handle=2444,i,9223993371126749121,2655619130568604534,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,7666969994930784118,13659886584011060977,2097152 --field-trial-handle=2444,i,9223993371126749121,2655619130568604534,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,16010269173073755947,15647506582640960714,2097152 --field-trial-handle=2444,i,9223993371126749121,2655619130568604534,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,11010451902679842660,7571391047408295507,524288 --field-trial-handle=2444,i,9223993371126749121,2655619130568604534,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,4304521103612954064,5500240562336957599,524288 --field-trial-handle=2444,i,9223993371126749121,2655619130568604534,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,5338320192048487572,2358177046214066073,524288 --field-trial-handle=2444,i,9223993371126749121,2655619130568604534,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,17999752359330238383,14930004820253095598,524288 --field-trial-handle=2444,i,9223993371126749121,2655619130568604534,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,17999752359330238383,14930004820253095598,524288 --field-trial-handle=2444,i,9223993371126749121,2655619130568604534,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,14268681583485513404,1490325927939840413,524288 --field-trial-handle=2444,i,9223993371126749121,2655619130568604534,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,3738082205294257902,7298956750225680918,524288 --field-trial-handle=2444,i,9223993371126749121,2655619130568604534,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,13100273733854809362,13224328662999052032,524288 --field-trial-handle=2444,i,9223993371126749121,2655619130568604534,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,11235527847976111788,12734383926758173233,524288 --field-trial-handle=2444,i,9223993371126749121,2655619130568604534,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,6612493533996721975,9497784509575494543,524288 --field-trial-handle=2444,i,9223993371126749121,2655619130568604534,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,13741936868382456349,4271386240471535344,524288 --field-trial-handle=2444,i,9223993371126749121,2655619130568604534,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,6301631243008656885,7567808952005057159,524288 --field-trial-handle=2444,i,9223993371126749121,2655619130568604534,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3812,i,3338051587022287026,2592746439777825328,524288 --field-trial-handle=2444,i,9223993371126749121,2655619130568604534,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4740,i,1142073911229795999,8910898125190543714,524288 --field-trial-handle=2444,i,9223993371126749121,2655619130568604534,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,1853752064956903363,4120795123489139758,524288 --field-trial-handle=2444,i,9223993371126749121,2655619130568604534,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,12553831118140843083,7359841809674860938,524288 --field-trial-handle=2444,i,9223993371126749121,2655619130568604534,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=948,i,13315440109958442059,15288491942365178623,262144 --field-trial-handle=2444,i,9223993371126749121,2655619130568604534,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,11257506502944953446,1050877287820822321,524288 --field-trial-handle=2444,i,9223993371126749121,2655619130568604534,262144 --variations-seed-version --mojo-platform-channel-handle=1212 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\mhfzxrpjhczusmke.sysC:\Temp\mhfzxrpjhczusmke.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\eywuomgezw.sysC:\Temp\eywuomgezw.sys1⤵
- Executes dropped EXE
-
C:\Temp\jgbytrljdb.sysC:\Temp\jgbytrljdb.sys1⤵
- Executes dropped EXE
-
C:\Temp\ojgbywtolj.sysC:\Temp\ojgbywtolj.sys1⤵
- Executes dropped EXE
-
C:\Temp\gaytqljdbv.sysC:\Temp\gaytqljdbv.sys1⤵
- Executes dropped EXE
-
C:\Temp\qlidavsnlf.sysC:\Temp\qlidavsnlf.sys1⤵
- Executes dropped EXE
-
C:\Temp\cavsnkfdxv.sysC:\Temp\cavsnkfdxv.sys1⤵
- Executes dropped EXE
-
C:\Temp\czxspkhfdx.sysC:\Temp\czxspkhfdx.sys1⤵
- Executes dropped EXE
-
C:\Temp\ecauspjhfz.sysC:\Temp\ecauspjhfz.sys1⤵
- Executes dropped EXE
-
C:\Temp\pjhbzurpjh.sysC:\Temp\pjhbzurpjh.sys1⤵
- Executes dropped EXE
-
C:\Temp\wuomgeywto.sysC:\Temp\wuomgeywto.sys1⤵
- Executes dropped EXE
-
C:\Temp\bztrljdbwt.sysC:\Temp\bztrljdbwt.sys1⤵
-
C:\Temp\qolgdbvtqo.sysC:\Temp\qolgdbvtqo.sys1⤵
-
C:\Temp\nlidaysqni.sysC:\Temp\nlidaysqni.sys1⤵
-
C:\Temp\nlfdxvpnif.sysC:\Temp\nlfdxvpnif.sys1⤵
-
C:\Temp\sqkicavsnk.sysC:\Temp\sqkicavsnk.sys1⤵
-
C:\Temp\czuspkhfcx.sysC:\Temp\czuspkhfcx.sys1⤵
-
C:\Temp\zxrpjhbzur.sysC:\Temp\zxrpjhbzur.sys1⤵
-
C:\Temp\uomjebwtrp.sysC:\Temp\uomjebwtrp.sys1⤵
-
C:\Temp\jebwuomgey.sysC:\Temp\jebwuomgey.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
eywuomgezw.sys
gaytqljdbv.sys
gayvtrljdb.exe
geywqojgeb.exe
i_gayvtrljdb.exe
i_geywqojgeb.exe
i_rpjhfzupkc.exe
i_trpjhbztrl.exe
i_ytqljdbvtn.exe
idavtnlfdx.exe
jgbytrljdb.sys
mhfzxrpjhczusmke.exe
mhfzxrpjhczusmke.sys
ojgbywtolj.sys
qlidavsnlf.sys
rpjhfzupkc.exe
trpjhbztrl.exe
ytqljdbvtn.exe
settings.dat
settings.dat
the-real-index
the-real-index~RFe596f0c.TMP
SiteList-Enterprise.json
Edge Profile.ico
13a527af-06e9-42a5-bc6f-60023a4340d6.tmp
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Secure Preferences
OperationConfig
OperationConfig~RFe5a0ab0.TMP
Local State
Local State
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
50183a3b-4f14-417d-a823-a213fa379547.tmp
metadata.json
882ca15b-9905-4122-a794-614e9435f934.tmp
content_new.js
CreateProcess.exe
memory/428-230-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1284-675-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1764-183-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2324-707-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2700-733-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2828-492-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2928-729-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3032-553-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3340-508-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3536-563-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3536-62-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3828-559-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4444-651-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4636-655-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5044-582-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5344-712-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5368-631-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5796-686-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5944-578-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6104-611-0x0000000000010000-0x00000000000AB000-memory.dmp