Analysis
- max time kernel
149s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
19/10/2026, 05:00
General
- Target 2026-10-17_52f99997d4df82429f22b7779d77b466_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261019-fm24qaex6v
- SHA256 7f25887269400f8e5d588b606a943eb24e4cbeaf96c356d0ad6b9cf685a35caa
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 9 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-17_52f99997d4df82429f22b7779d77b466_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-17_52f99997d4df82429f22b7779d77b466_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\wqljdbwtolgeywig.exeC:\Temp\wqljdbwtolgeywig.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qoigaytqli.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\qoigaytqli.exeC:\Temp\qoigaytqli.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qoigaytqli.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qoigaytqli.exeC:\Temp\i_qoigaytqli.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtqoigbvtq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vtqoigbvtq.exeC:\Temp\vtqoigbvtq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vtqoigbvtq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vtqoigbvtq.exeC:\Temp\i_vtqoigbvtq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nigaysqkic.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\nigaysqkic.exeC:\Temp\nigaysqkic.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nigaysqkic.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nigaysqkic.exeC:\Temp\i_nigaysqkic.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ausqkfdxvp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ausqkfdxvp.exeC:\Temp\ausqkfdxvp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ausqkfdxvp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ausqkfdxvp.exeC:\Temp\i_ausqkfdxvp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ecxupnhfzx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ecxupnhfzx.exeC:\Temp\ecxupnhfzx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ecxupnhfzx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ecxupnhfzx.exeC:\Temp\i_ecxupnhfzx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\upmhezxusp.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\upmhezxusp.exeC:\Temp\upmhezxusp.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_upmhezxusp.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_upmhezxusp.exeC:\Temp\i_upmhezxusp.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wuomjhbzwu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wuomjhbzwu.exeC:\Temp\wuomjhbzwu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wuomjhbzwu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wuomjhbzwu.exeC:\Temp\i_wuomjhbzwu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ebwuomgeyw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ebwuomgeyw.exeC:\Temp\ebwuomgeyw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ebwuomgeyw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ebwuomgeyw.exeC:\Temp\i_ebwuomgeyw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywtnljgbyt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ywtnljgbyt.exeC:\Temp\ywtnljgbyt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywtnljgbyt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ywtnljgbyt.exeC:\Temp\i_ywtnljgbyt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gdywqolgey.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gdywqolgey.exeC:\Temp\gdywqolgey.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gdywqolgey.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gdywqolgey.exeC:\Temp\i_gdywqolgey.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dbvtnlfdyv.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dbvtnlfdyv.exeC:\Temp\dbvtnlfdyv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dbvtnlfdyv.exe ups_ins3⤵
-
C:\Temp\i_dbvtnlfdyv.exeC:\Temp\i_dbvtnlfdyv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\icauspnlfd.exe ups_run3⤵
-
C:\Temp\icauspnlfd.exeC:\Temp\icauspnlfd.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_icauspnlfd.exe ups_ins3⤵
-
C:\Temp\i_icauspnlfd.exeC:\Temp\i_icauspnlfd.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kicsmkecxu.exe ups_run3⤵
-
C:\Temp\kicsmkecxu.exeC:\Temp\kicsmkecxu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kicsmkecxu.exe ups_ins3⤵
-
C:\Temp\i_kicsmkecxu.exeC:\Temp\i_kicsmkecxu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fcxupnhfzx.exe ups_run3⤵
-
C:\Temp\fcxupnhfzx.exeC:\Temp\fcxupnhfzx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fcxupnhfzx.exe ups_ins3⤵
-
C:\Temp\i_fcxupnhfzx.exeC:\Temp\i_fcxupnhfzx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jheczusmke.exe ups_run3⤵
-
C:\Temp\jheczusmke.exeC:\Temp\jheczusmke.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jheczusmke.exe ups_ins3⤵
-
C:\Temp\i_jheczusmke.exeC:\Temp\i_jheczusmke.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mjecwuojhe.exe ups_run3⤵
-
C:\Temp\mjecwuojhe.exeC:\Temp\mjecwuojhe.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mjecwuojhe.exe ups_ins3⤵
-
C:\Temp\i_mjecwuojhe.exeC:\Temp\i_mjecwuojhe.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trojgebwuo.exe ups_run3⤵
-
C:\Temp\trojgebwuo.exeC:\Temp\trojgebwuo.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trojgebwuo.exe ups_ins3⤵
-
C:\Temp\i_trojgebwuo.exeC:\Temp\i_trojgebwuo.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wrojgbytrl.exe ups_run3⤵
-
C:\Temp\wrojgbytrl.exeC:\Temp\wrojgbytrl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wrojgbytrl.exe ups_ins3⤵
-
C:\Temp\i_wrojgbytrl.exeC:\Temp\i_wrojgbytrl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\avtnlfdbvt.exe ups_run3⤵
-
C:\Temp\avtnlfdbvt.exeC:\Temp\avtnlfdbvt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_avtnlfdbvt.exe ups_ins3⤵
-
C:\Temp\i_avtnlfdbvt.exeC:\Temp\i_avtnlfdbvt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dxvqnifdxv.exe ups_run3⤵
-
C:\Temp\dxvqnifdxv.exeC:\Temp\dxvqnifdxv.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dxvqnifdxv.exe ups_ins3⤵
-
C:\Temp\i_dxvqnifdxv.exeC:\Temp\i_dxvqnifdxv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x398,0x7ffd47cac188,0x7ffd47cac194,0x7ffd47cac1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,18078713005055082151,12033683790787618888,262144 --field-trial-handle=2316,i,16946706936797372599,7802860829063831882,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,15517597005538327874,17413856974808018247,524288 --field-trial-handle=2316,i,16946706936797372599,7802860829063831882,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2340,i,9304906205089378568,9617424889726116954,524288 --field-trial-handle=2316,i,16946706936797372599,7802860829063831882,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,1495424663694263819,5492511347944222996,2097152 --field-trial-handle=2316,i,16946706936797372599,7802860829063831882,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3624,i,7582157074845150385,648335749363722297,2097152 --field-trial-handle=2316,i,16946706936797372599,7802860829063831882,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,12879701968541090447,16984362194572012422,2097152 --field-trial-handle=2316,i,16946706936797372599,7802860829063831882,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,11631239227300741673,3515758228249608394,2097152 --field-trial-handle=2316,i,16946706936797372599,7802860829063831882,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3764,i,11261994543017422114,14185808441031875007,524288 --field-trial-handle=2316,i,16946706936797372599,7802860829063831882,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,1172588833006918928,4903289487100356188,524288 --field-trial-handle=2316,i,16946706936797372599,7802860829063831882,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,14356462557939364153,788986561171859714,524288 --field-trial-handle=2316,i,16946706936797372599,7802860829063831882,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,14447033315024894728,10145703217183435478,524288 --field-trial-handle=2316,i,16946706936797372599,7802860829063831882,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,14447033315024894728,10145703217183435478,524288 --field-trial-handle=2316,i,16946706936797372599,7802860829063831882,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,16808669369934865287,7436145005236791018,524288 --field-trial-handle=2316,i,16946706936797372599,7802860829063831882,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,18442240027776535489,4769594007394606453,524288 --field-trial-handle=2316,i,16946706936797372599,7802860829063831882,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,2012525355155245180,8753120480751715853,524288 --field-trial-handle=2316,i,16946706936797372599,7802860829063831882,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,12346013733904107681,11975229807567605941,524288 --field-trial-handle=2316,i,16946706936797372599,7802860829063831882,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,6199771800959354727,13251446600846418205,524288 --field-trial-handle=2316,i,16946706936797372599,7802860829063831882,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,6412843363137734650,15996560703019623328,524288 --field-trial-handle=2316,i,16946706936797372599,7802860829063831882,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6860,i,302255635603433296,6546134516786681939,524288 --field-trial-handle=2316,i,16946706936797372599,7802860829063831882,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,15703909070818058308,5327473579045132716,524288 --field-trial-handle=2316,i,16946706936797372599,7802860829063831882,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,1072041460215156583,280660912499757436,524288 --field-trial-handle=2316,i,16946706936797372599,7802860829063831882,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6264,i,16710753923824246438,8287028474771101629,262144 --field-trial-handle=2316,i,16946706936797372599,7802860829063831882,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1192,i,18207380568551307941,63358348184900921,524288 --field-trial-handle=2316,i,16946706936797372599,7802860829063831882,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\wqljdbwtolgeywig.sysC:\Temp\wqljdbwtolgeywig.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\aytqljdyvt.sysC:\Temp\aytqljdyvt.sys1⤵
- Executes dropped EXE
-
C:\Temp\qlfdxvqnif.sysC:\Temp\qlfdxvqnif.sys1⤵
- Executes dropped EXE
-
C:\Temp\causnkfcau.sysC:\Temp\causnkfcau.sys1⤵
- Executes dropped EXE
-
C:\Temp\pnhfcxvpnh.sysC:\Temp\pnhfcxvpnh.sys1⤵
- Executes dropped EXE
-
C:\Temp\upmhfzxrpk.sysC:\Temp\upmhfzxrpk.sys1⤵
- Executes dropped EXE
-
C:\Temp\wuomgebzxr.sysC:\Temp\wuomgebzxr.sys1⤵
- Executes dropped EXE
-
C:\Temp\bywuomgezw.sysC:\Temp\bywuomgezw.sys1⤵
- Executes dropped EXE
-
C:\Temp\qomgeztrlj.sysC:\Temp\qomgeztrlj.sys1⤵
- Executes dropped EXE
-
C:\Temp\jdaywqolgd.sysC:\Temp\jdaywqolgd.sys1⤵
- Executes dropped EXE
-
C:\Temp\idavtnlfdx.sysC:\Temp\idavtnlfdx.sys1⤵
- Executes dropped EXE
-
C:\Temp\faxvsnkifa.sysC:\Temp\faxvsnkifa.sys1⤵
-
C:\Temp\pnhfaxsqkh.sysC:\Temp\pnhfaxsqkh.sys1⤵
-
C:\Temp\kicausmkec.sysC:\Temp\kicausmkec.sys1⤵
-
C:\Temp\eczurpmkec.sysC:\Temp\eczurpmkec.sys1⤵
-
C:\Temp\zxrpjhczur.sysC:\Temp\zxrpjhczur.sys1⤵
-
C:\Temp\wrojhbywur.sysC:\Temp\wrojhbywur.sys1⤵
-
C:\Temp\wqolgeywqo.sysC:\Temp\wqolgeywqo.sys1⤵
-
C:\Temp\aytqoigayt.sysC:\Temp\aytqoigayt.sys1⤵
-
C:\Temp\gdxvsqoifd.sysC:\Temp\gdxvsqoifd.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ausqkfdxvp.exe
aytqljdyvt.sys
causnkfcau.sys
ecxupnhfzx.exe
i_ausqkfdxvp.exe
i_ecxupnhfzx.exe
i_nigaysqkic.exe
i_qoigaytqli.exe
i_vtqoigbvtq.exe
nigaysqkic.exe
pnhfcxvpnh.sys
qlfdxvqnif.sys
qoigaytqli.exe
upmhezxusp.exe
upmhfzxrpk.sys
vtqoigbvtq.exe
wqljdbwtolgeywig.exe
wqljdbwtolgeywig.sys
2fcffcb4-de69-411c-aed6-f9f624302497.tmp
343901ca-aa0f-43a7-a0de-883620b3f0ce.tmp
5319986c-61a5-427c-9cc7-a18add288ae8.tmp
727369b3-7d52-41f7-98c5-a51935ff2f75.tmp
settings.dat
settings.dat
759ed5dc-022c-43fd-b7ff-7e9ce2e0ee2c.tmp
89665abe-1c03-4852-a93f-8b7debe84d06.tmp
8c363c0c-ae7c-48ae-a7eb-53757a922936.tmp
998a8374-56bd-4ef7-9356-fd8d65d59b80.tmp
temp-index
6a379c85-4f5d-4adf-8b7a-035d21ede048.tmp
4a0ec400-352e-49c3-84d9-96a18e6575e1.tmp
ad72b682-a8a0-4bae-aebd-ea615db824e3.tmp
be604ddd-b136-4821-ba6f-09c117dba295.tmp
Secure Preferences
sync_diagnostic.log
b8a5869e-0fe9-4711-9584-00bd00f5902b.tmp
2176ddd3-0477-438d-9752-20d4f7702671.tmp
329bc486-2204-4321-b4f1-3ee062fde5f8.tmp
3dd764b2-674f-4e9f-b87e-75d499b2a8b6.tmp
73c29b75-c15d-485d-b0ba-0c80061f4ffa.tmp
dc6779c4-273f-483a-94c1-6c3a4660000e.tmp
e3c01f76-41c1-40ca-9e03-38b97a16eabb.tmp
b89a5b6c-241d-437b-ae2c-c0c8b6f103fc.tmp
7fe46f06-a282-4fb1-92d3-825b21538aba.tmp
e0a2a9ae-2583-48c8-a811-ee44fb34d171.tmp
content.js
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/864-370-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1180-278-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1300-372-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1300-340-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1768-336-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2436-449-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2488-437-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2584-316-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2652-279-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2652-266-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3168-417-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3272-241-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3336-397-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3924-453-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4324-383-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4360-292-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4560-475-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4568-497-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4580-60-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5180-192-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5852-320-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6016-479-0x0000000000010000-0x00000000000AB000-memory.dmp