Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
15/10/2026, 07:09
General
- Target 2026-10-13_a4d4068a76433c7937ac1cb6969e16f1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261015-hyt9cscg86
- SHA256 0ef6b9ec0a24584083f2d610873e199a0731c0b0e520a0b4bad1f3363723d93a
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 9 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-13_a4d4068a76433c7937ac1cb6969e16f1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-13_a4d4068a76433c7937ac1cb6969e16f1_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\vtqlgdywqoigaytq.exeC:\Temp\vtqlgdywqoigaytq.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\aytqligayt.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\aytqligayt.exeC:\Temp\aytqligayt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_aytqligayt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_aytqligayt.exeC:\Temp\i_aytqligayt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qkicavsnli.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qkicavsnli.exeC:\Temp\qkicavsnli.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qkicavsnli.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qkicavsnli.exeC:\Temp\i_qkicavsnli.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdxvpnkfca.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fdxvpnkfca.exeC:\Temp\fdxvpnkfca.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdxvpnkfca.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fdxvpnkfca.exeC:\Temp\i_fdxvpnkfca.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kicausnkfd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kicausnkfd.exeC:\Temp\kicausnkfd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kicausnkfd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kicausnkfd.exeC:\Temp\i_kicausnkfd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hfzxrpjhcz.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hfzxrpjhcz.exeC:\Temp\hfzxrpjhcz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hfzxrpjhcz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hfzxrpjhcz.exeC:\Temp\i_hfzxrpjhcz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wurmkezwuo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wurmkezwuo.exeC:\Temp\wurmkezwuo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wurmkezwuo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wurmkezwuo.exeC:\Temp\i_wurmkezwuo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ztrljdbwto.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ztrljdbwto.exeC:\Temp\ztrljdbwto.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ztrljdbwto.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ztrljdbwto.exeC:\Temp\i_ztrljdbwto.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljhbztromg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ljhbztromg.exeC:\Temp\ljhbztromg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljhbztromg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ljhbztromg.exeC:\Temp\i_ljhbztromg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\oigaytqlid.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\oigaytqlid.exeC:\Temp\oigaytqlid.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_oigaytqlid.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_oigaytqlid.exeC:\Temp\i_oigaytqlid.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lfaysqkiga.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\lfaysqkiga.exeC:\Temp\lfaysqkiga.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lfaysqkiga.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lfaysqkiga.exeC:\Temp\i_lfaysqkiga.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kicavsqkif.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kicavsqkif.exeC:\Temp\kicavsqkif.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kicavsqkif.exe ups_ins3⤵
-
C:\Temp\i_kicavsqkif.exeC:\Temp\i_kicavsqkif.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnhfaxvpnh.exe ups_run3⤵
-
C:\Temp\pnhfaxvpnh.exeC:\Temp\pnhfaxvpnh.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnhfaxvpnh.exe ups_ins3⤵
-
C:\Temp\i_pnhfaxvpnh.exeC:\Temp\i_pnhfaxvpnh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fzxrpkhczx.exe ups_run3⤵
-
C:\Temp\fzxrpkhczx.exeC:\Temp\fzxrpkhczx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fzxrpkhczx.exe ups_ins3⤵
-
C:\Temp\i_fzxrpkhczx.exeC:\Temp\i_fzxrpkhczx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fzxromkhcz.exe ups_run3⤵
-
C:\Temp\fzxromkhcz.exeC:\Temp\fzxromkhcz.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fzxromkhcz.exe ups_ins3⤵
-
C:\Temp\i_fzxromkhcz.exeC:\Temp\i_fzxromkhcz.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ebwuomhbzw.exe ups_run3⤵
-
C:\Temp\ebwuomhbzw.exeC:\Temp\ebwuomhbzw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ebwuomhbzw.exe ups_ins3⤵
-
C:\Temp\i_ebwuomhbzw.exeC:\Temp\i_ebwuomhbzw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mgebwtrojg.exe ups_run3⤵
-
C:\Temp\mgebwtrojg.exeC:\Temp\mgebwtrojg.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mgebwtrojg.exe ups_ins3⤵
-
C:\Temp\i_mgebwtrojg.exeC:\Temp\i_mgebwtrojg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wqojgeywqo.exe ups_run3⤵
-
C:\Temp\wqojgeywqo.exeC:\Temp\wqojgeywqo.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wqojgeywqo.exe ups_ins3⤵
-
C:\Temp\i_wqojgeywqo.exeC:\Temp\i_wqojgeywqo.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tnlfdyvqni.exe ups_run3⤵
-
C:\Temp\tnlfdyvqni.exeC:\Temp\tnlfdyvqni.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tnlfdyvqni.exe ups_ins3⤵
-
C:\Temp\i_tnlfdyvqni.exeC:\Temp\i_tnlfdyvqni.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqligsqlfd.exe ups_run3⤵
-
C:\Temp\sqligsqlfd.exeC:\Temp\sqligsqlfd.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqligsqlfd.exe ups_ins3⤵
-
C:\Temp\i_sqligsqlfd.exeC:\Temp\i_sqligsqlfd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvpnifaysq.exe ups_run3⤵
-
C:\Temp\xvpnifaysq.exeC:\Temp\xvpnifaysq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xvpnifaysq.exe ups_ins3⤵
-
C:\Temp\i_xvpnifaysq.exeC:\Temp\i_xvpnifaysq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff8a19bc188,0x7ff8a19bc194,0x7ff8a19bc1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,5428486908074865907,17406998193042499485,262144 --field-trial-handle=2580,i,7877068539804064852,12557351281053568838,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,825057650896301563,8391608901049195026,524288 --field-trial-handle=2580,i,7877068539804064852,12557351281053568838,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2320,i,13861035920474224108,2817050120552574527,524288 --field-trial-handle=2580,i,7877068539804064852,12557351281053568838,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,3537259646304203431,4074357717930697261,2097152 --field-trial-handle=2580,i,7877068539804064852,12557351281053568838,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,6814381505285502171,1763863827065880752,2097152 --field-trial-handle=2580,i,7877068539804064852,12557351281053568838,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,10237978184582485827,7705215276038701790,2097152 --field-trial-handle=2580,i,7877068539804064852,12557351281053568838,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,12193461484857101320,5117312419034577639,2097152 --field-trial-handle=2580,i,7877068539804064852,12557351281053568838,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,8953985901092964981,16348346166390834621,524288 --field-trial-handle=2580,i,7877068539804064852,12557351281053568838,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,11742346758249815838,2243319483292334165,524288 --field-trial-handle=2580,i,7877068539804064852,12557351281053568838,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,1111633130747453674,12822081692166711222,524288 --field-trial-handle=2580,i,7877068539804064852,12557351281053568838,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,3987059350779424512,2166586130004315257,524288 --field-trial-handle=2580,i,7877068539804064852,12557351281053568838,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,3987059350779424512,2166586130004315257,524288 --field-trial-handle=2580,i,7877068539804064852,12557351281053568838,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,1799508274076260265,18400808147859507012,524288 --field-trial-handle=2580,i,7877068539804064852,12557351281053568838,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,9862704193596152886,13086131614410417175,524288 --field-trial-handle=2580,i,7877068539804064852,12557351281053568838,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,4870802891183333367,9820388374226331228,524288 --field-trial-handle=2580,i,7877068539804064852,12557351281053568838,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4832,i,6270565683639071994,15577923347190026385,524288 --field-trial-handle=2580,i,7877068539804064852,12557351281053568838,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,8960677290830570687,14020011087999918849,524288 --field-trial-handle=2580,i,7877068539804064852,12557351281053568838,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,5446398206795086458,14993247397344371329,524288 --field-trial-handle=2580,i,7877068539804064852,12557351281053568838,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,15153836212481537737,15900554337692710842,524288 --field-trial-handle=2580,i,7877068539804064852,12557351281053568838,262144 --variations-seed-version --mojo-platform-channel-handle=3340 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3504,i,10283555803863770921,14683924870914330703,524288 --field-trial-handle=2580,i,7877068539804064852,12557351281053568838,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,16202549159783274817,18014944728788198232,524288 --field-trial-handle=2580,i,7877068539804064852,12557351281053568838,262144 --variations-seed-version --mojo-platform-channel-handle=928 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=924,i,12158908162570119817,13764151384495587344,262144 --field-trial-handle=2580,i,7877068539804064852,12557351281053568838,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,2423392473913012751,11138155099415174676,524288 --field-trial-handle=2580,i,7877068539804064852,12557351281053568838,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\vtqlgdywqoigaytq.sysC:\Temp\vtqlgdywqoigaytq.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\snlfdxvqni.sysC:\Temp\snlfdxvqni.sys1⤵
- Executes dropped EXE
-
C:\Temp\qkicavsnkf.sysC:\Temp\qkicavsnkf.sys1⤵
- Executes dropped EXE
-
C:\Temp\icauspnkfc.sysC:\Temp\icauspnkfc.sys1⤵
- Executes dropped EXE
-
C:\Temp\hecxupnhfz.sysC:\Temp\hecxupnhfz.sys1⤵
- Executes dropped EXE
-
C:\Temp\ztrmjhbzur.sysC:\Temp\ztrmjhbzur.sys1⤵
- Executes dropped EXE
-
C:\Temp\heztrmjebw.sysC:\Temp\heztrmjebw.sys1⤵
- Executes dropped EXE
-
C:\Temp\ojgbzwrljg.sysC:\Temp\ojgbzwrljg.sys1⤵
- Executes dropped EXE
-
C:\Temp\rljdbvtqoi.sysC:\Temp\rljdbvtqoi.sys1⤵
- Executes dropped EXE
-
C:\Temp\qlidaytqli.sysC:\Temp\qlidaytqli.sys1⤵
- Executes dropped EXE
-
C:\Temp\tnlfdaysqn.sysC:\Temp\tnlfdaysqn.sys1⤵
- Executes dropped EXE
-
C:\Temp\snkicaxspk.sysC:\Temp\snkicaxspk.sys1⤵
-
C:\Temp\kicausmkfc.sysC:\Temp\kicausmkfc.sys1⤵
-
C:\Temp\hfzxrpjhez.sysC:\Temp\hfzxrpjhez.sys1⤵
-
C:\Temp\omgezwuomh.sysC:\Temp\omgezwuomh.sys1⤵
-
C:\Temp\mgeywuomjh.sysC:\Temp\mgeywuomjh.sys1⤵
-
C:\Temp\tojgeyvtol.sysC:\Temp\tojgeyvtol.sys1⤵
-
C:\Temp\ywqgaytqlj.sysC:\Temp\ywqgaytqlj.sys1⤵
-
C:\Temp\sqnlgdxvtn.sysC:\Temp\sqnlgdxvtn.sys1⤵
-
C:\Temp\xvpnifaysq.sysC:\Temp\xvpnifaysq.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
aytqligayt.exe
fdxvpnkfca.exe
hecxupnhfz.sys
hfzxrpjhcz.exe
i_aytqligayt.exe
i_fdxvpnkfca.exe
i_hfzxrpjhcz.exe
i_kicausnkfd.exe
i_qkicavsnli.exe
icauspnkfc.sys
kicausnkfd.exe
qkicavsnkf.sys
qkicavsnli.exe
snlfdxvqni.sys
vtqlgdywqoigaytq.exe
vtqlgdywqoigaytq.sys
wurmkezwuo.exe
ztrmjhbzur.sys
0939e1ad-7ff6-4769-ace3-e071e1ef6ff1.tmp
4c4f7d94-52d0-4fae-b62c-0ab49b324a3e.tmp
6568e082-5a88-41a7-a151-52891af99a2c.tmp
9a4d4343-234a-4adb-b6c4-0ab9aaceca94.tmp
settings.dat
settings.dat
05b4b2fd-0930-48a7-8394-e42710a12ff1.tmp
112a2ba5-4554-4da6-9b29-efa73f8c5d10.tmp
4c6e6b58-6a92-40bc-aee1-aecdd08af6a7.tmp
80d939dc-d291-4e82-81f8-7f11d485a9a7.tmp
temp-index
the-real-index
a6a97cfd-dfa7-4eee-ba68-c3167206c990.tmp
515b1878-1147-4fd8-9197-8be030550abb.tmp
c51e89f6-efb9-40e3-a16b-16bd5c760d2b.tmp
f90fa54f-a6cf-4b8a-8445-3431aab6f663.tmp
dbe5d66f-691f-4863-8147-6d0d0cf77cba.tmp
c3b59d1b-e965-4951-a16d-7d1b83c25986.tmp
a88c547e-481a-4b70-b2c5-77d6857488a6.tmp
53ea7a2d-cd3b-4b98-a733-fc56773e4c4f.tmp
81c80a61-2f6b-4f3a-afca-33d0e4800c72.tmp
a0361430-608d-4e29-87a9-e623c71a73f2.tmp
6d507c70-621e-4db3-b771-8967e95ed872.tmp
5df5c855-cecd-4b40-ac0a-f52acca36ef5.tmp
f332fa5d-131b-456d-a0ca-4d9dff57d052.tmp
content.js
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/760-287-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/760-317-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1276-380-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1552-446-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1860-458-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2220-422-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2324-350-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2628-426-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2672-392-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2764-326-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3396-484-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3540-346-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3580-196-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3936-330-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4300-489-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4628-274-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4676-300-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4868-463-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4868-486-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4920-507-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5560-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5560-231-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5752-280-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5752-246-0x0000000000010000-0x00000000000AB000-memory.dmp