Analysis
- max time kernel
149s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/10/2026, 04:16
General
- Target 2026-10-22_94c3dddab531232d013d1674e59bbaed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261024-evtxmsfx3s
- SHA256 0dc28e285561958edc89f28647e8356e247a18bd209dac27f6a7924f7cf1b1db
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_94c3dddab531232d013d1674e59bbaed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_94c3dddab531232d013d1674e59bbaed_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\pjhbztrmjecwuomg.exeC:\Temp\pjhbztrmjecwuomg.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpjhbwrphz.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\rpjhbwrphz.exeC:\Temp\rpjhbwrphz.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpjhbwrphz.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rpjhbwrphz.exeC:\Temp\i_rpjhbwrphz.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywqolgdbzt.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ywqolgdbzt.exeC:\Temp\ywqolgdbzt.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywqolgdbzt.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ywqolgdbzt.exeC:\Temp\i_ywqolgdbzt.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ljdbytqljd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ljdbytqljd.exeC:\Temp\ljdbytqljd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ljdbytqljd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ljdbytqljd.exeC:\Temp\i_ljdbytqljd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wqnigaysql.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wqnigaysql.exeC:\Temp\wqnigaysql.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wqnigaysql.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wqnigaysql.exeC:\Temp\i_wqnigaysql.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fdxvpnlfay.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fdxvpnlfay.exeC:\Temp\fdxvpnlfay.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fdxvpnlfay.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fdxvpnlfay.exeC:\Temp\i_fdxvpnlfay.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\icavpnhfax.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\icavpnhfax.exeC:\Temp\icavpnhfax.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_icavpnhfax.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_icavpnhfax.exeC:\Temp\i_icavpnhfax.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\upmkecxupn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\upmkecxupn.exeC:\Temp\upmkecxupn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_upmkecxupn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_upmkecxupn.exeC:\Temp\i_upmkecxupn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jhfcwurpnh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jhfcwurpnh.exeC:\Temp\jhfcwurpnh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jhfcwurpnh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jhfcwurpnh.exeC:\Temp\i_jhfcwurpnh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\urmkebztrm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\urmkebztrm.exeC:\Temp\urmkebztrm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_urmkebztrm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_urmkebztrm.exeC:\Temp\i_urmkebztrm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\urljebwtom.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\urljebwtom.exeC:\Temp\urljebwtom.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_urljebwtom.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_urljebwtom.exeC:\Temp\i_urljebwtom.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trljdbwtol.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\trljdbwtol.exeC:\Temp\trljdbwtol.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trljdbwtol.exe ups_ins3⤵
-
C:\Temp\i_trljdbwtol.exeC:\Temp\i_trljdbwtol.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gbytrlidbv.exe ups_run3⤵
-
C:\Temp\gbytrlidbv.exeC:\Temp\gbytrlidbv.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gbytrlidbv.exe ups_ins3⤵
-
C:\Temp\i_gbytrlidbv.exeC:\Temp\i_gbytrlidbv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvqnlfdysq.exe ups_run3⤵
-
C:\Temp\xvqnlfdysq.exeC:\Temp\xvqnlfdysq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xvqnlfdysq.exe ups_ins3⤵
-
C:\Temp\i_xvqnlfdysq.exeC:\Temp\i_xvqnlfdysq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqkicaxsqk.exe ups_run3⤵
-
C:\Temp\sqkicaxsqk.exeC:\Temp\sqkicaxsqk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqkicaxsqk.exe ups_ins3⤵
-
C:\Temp\i_sqkicaxsqk.exeC:\Temp\i_sqkicaxsqk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxspkicsmk.exe ups_run3⤵
-
C:\Temp\zxspkicsmk.exeC:\Temp\zxspkicsmk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxspkicsmk.exe ups_ins3⤵
-
C:\Temp\i_zxspkicsmk.exeC:\Temp\i_zxspkicsmk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fzxrpnhczu.exe ups_run3⤵
-
C:\Temp\fzxrpnhczu.exeC:\Temp\fzxrpnhczu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fzxrpnhczu.exe ups_ins3⤵
-
C:\Temp\i_fzxrpnhczu.exeC:\Temp\i_fzxrpnhczu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxrpjhbzur.exe ups_run3⤵
-
C:\Temp\zxrpjhbzur.exeC:\Temp\zxrpjhbzur.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxrpjhbzur.exe ups_ins3⤵
-
C:\Temp\i_zxrpjhbzur.exeC:\Temp\i_zxrpjhbzur.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpjheywurl.exe ups_run3⤵
-
C:\Temp\rpjheywurl.exeC:\Temp\rpjheywurl.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpjheywurl.exe ups_ins3⤵
-
C:\Temp\i_rpjheywurl.exeC:\Temp\i_rpjheywurl.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hbzwtoljeb.exe ups_run3⤵
-
C:\Temp\hbzwtoljeb.exeC:\Temp\hbzwtoljeb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hbzwtoljeb.exe ups_ins3⤵
-
C:\Temp\i_hbzwtoljeb.exeC:\Temp\i_hbzwtoljeb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\olgeywqolg.exe ups_run3⤵
-
C:\Temp\olgeywqolg.exeC:\Temp\olgeywqolg.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_olgeywqolg.exe ups_ins3⤵
-
C:\Temp\i_olgeywqolg.exeC:\Temp\i_olgeywqolg.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffa93f6c188,0x7ffa93f6c194,0x7ffa93f6c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1920,i,9082945484509803768,2171748561708639297,262144 --field-trial-handle=3024,i,564687165469927960,13074100119398625181,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2184,i,2283636254943798262,4433405483350203273,524288 --field-trial-handle=3024,i,564687165469927960,13074100119398625181,262144 --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2452,i,11340605900073033142,3645308984023016883,524288 --field-trial-handle=3024,i,564687165469927960,13074100119398625181,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,13259665335231054955,7770408747085310700,2097152 --field-trial-handle=3024,i,564687165469927960,13074100119398625181,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3568,i,14694155267305849393,6720733942391292926,2097152 --field-trial-handle=3024,i,564687165469927960,13074100119398625181,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,13924789245773886811,4988925904220195265,2097152 --field-trial-handle=3024,i,564687165469927960,13074100119398625181,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,5654747067462839657,9304514699465144014,2097152 --field-trial-handle=3024,i,564687165469927960,13074100119398625181,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,13315492293954818924,4652589069122787487,524288 --field-trial-handle=3024,i,564687165469927960,13074100119398625181,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,1265259180240372126,14041970958121845964,524288 --field-trial-handle=3024,i,564687165469927960,13074100119398625181,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,12588433257103306322,13232034693462913330,524288 --field-trial-handle=3024,i,564687165469927960,13074100119398625181,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,9609730412339387542,9860441391126728169,524288 --field-trial-handle=3024,i,564687165469927960,13074100119398625181,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,9609730412339387542,9860441391126728169,524288 --field-trial-handle=3024,i,564687165469927960,13074100119398625181,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,2233171380216246428,13038307467997569367,524288 --field-trial-handle=3024,i,564687165469927960,13074100119398625181,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,874017968791942937,9963776800996181261,524288 --field-trial-handle=3024,i,564687165469927960,13074100119398625181,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,10209169671120235059,2051756616263062681,524288 --field-trial-handle=3024,i,564687165469927960,13074100119398625181,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,8702233976064736778,14986541174023630146,524288 --field-trial-handle=3024,i,564687165469927960,13074100119398625181,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1300,i,16003814293875524640,16080787547212899925,524288 --field-trial-handle=3024,i,564687165469927960,13074100119398625181,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1304,i,243857650875573610,17569547249080225346,524288 --field-trial-handle=3024,i,564687165469927960,13074100119398625181,262144 --variations-seed-version --mojo-platform-channel-handle=1292 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1308,i,178495898656859728,2613932490087291103,524288 --field-trial-handle=3024,i,564687165469927960,13074100119398625181,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5588,i,7237922304016238060,9979241522551089598,524288 --field-trial-handle=3024,i,564687165469927960,13074100119398625181,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,643380328103210218,1333844721495971432,524288 --field-trial-handle=3024,i,564687165469927960,13074100119398625181,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,8483516422113208080,440938679242690555,524288 --field-trial-handle=3024,i,564687165469927960,13074100119398625181,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,6860186792317185419,4030148091331184671,524288 --field-trial-handle=3024,i,564687165469927960,13074100119398625181,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6184,i,2570421778558368508,15231050317799361186,262144 --field-trial-handle=3024,i,564687165469927960,13074100119398625181,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3520,i,8161553216929847809,8506003248661054207,524288 --field-trial-handle=3024,i,564687165469927960,13074100119398625181,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\pjhbztrmjecwuomg.sysC:\Temp\pjhbztrmjecwuomg.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\gbztrljgbz.sysC:\Temp\gbztrljgbz.sys1⤵
- Executes dropped EXE
-
C:\Temp\wqoigeywqo.sysC:\Temp\wqoigeywqo.sys1⤵
- Executes dropped EXE
-
C:\Temp\tqoigayvql.sysC:\Temp\tqoigayvql.sys1⤵
- Executes dropped EXE
-
C:\Temp\kidavtnlfd.sysC:\Temp\kidavtnlfd.sys1⤵
- Executes dropped EXE
-
C:\Temp\fdxvsnkica.sysC:\Temp\fdxvsnkica.sys1⤵
- Executes dropped EXE
-
C:\Temp\auspkicaus.sysC:\Temp\auspkicaus.sys1⤵
- Executes dropped EXE
-
C:\Temp\kecwupmhec.sysC:\Temp\kecwupmhec.sys1⤵
- Executes dropped EXE
-
C:\Temp\tromhezxuo.sysC:\Temp\tromhezxuo.sys1⤵
- Executes dropped EXE
-
C:\Temp\wtrmjebwto.sysC:\Temp\wtrmjebwto.sys1⤵
- Executes dropped EXE
-
C:\Temp\hbztrojgbz.sysC:\Temp\hbztrojgbz.sys1⤵
- Executes dropped EXE
-
C:\Temp\bytqoljdbv.sysC:\Temp\bytqoljdbv.sys1⤵
-
C:\Temp\aysqnigays.sysC:\Temp\aysqnigays.sys1⤵
-
C:\Temp\fdxvqndxvs.sysC:\Temp\fdxvqndxvs.sys1⤵
-
C:\Temp\causnkfdxv.sysC:\Temp\causnkfdxv.sys1⤵
-
C:\Temp\cxupnkfczx.sysC:\Temp\cxupnkfczx.sys1⤵
-
C:\Temp\ecwusmjhcz.sysC:\Temp\ecwusmjhcz.sys1⤵
-
C:\Temp\zwrpjhezwu.sysC:\Temp\zwrpjhezwu.sys1⤵
-
C:\Temp\eywtrojgby.sysC:\Temp\eywtrojgby.sys1⤵
-
C:\Temp\rljgbvtolg.sysC:\Temp\rljgbvtolg.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
fdxvpnlfay.exe
fdxvsnkica.sys
gbztrljgbz.sys
i_fdxvpnlfay.exe
i_ljdbytqljd.exe
i_rpjhbwrphz.exe
i_wqnigaysql.exe
i_ywqolgdbzt.exe
icavpnhfax.exe
kidavtnlfd.sys
ljdbytqljd.exe
pjhbztrmjecwuomg.exe
pjhbztrmjecwuomg.sys
rpjhbwrphz.exe
tqoigayvql.sys
wqnigaysql.exe
wqoigeywqo.sys
ywqolgdbzt.exe
24a1aea8-87a0-46b8-9c43-2afbf2c8ac19.tmp
46881dfe-258f-42e3-b46a-e16cf39f1b10.tmp
6e37bac7-bd46-4666-930c-6195af899ac1.tmp
e7150862-4d0d-4436-865c-4847b0b90052.tmp
settings.dat
settings.dat
470a8aea-6cbc-4dcc-8cca-6e14cad0ac31.tmp
994bde8b-102c-41cf-a443-3af9f0f5941c.tmp
temp-index
the-real-index
9511ac85-6681-49e6-8b36-445904490a8e.tmp
dasherSettingSchema.json
62140403-2f56-410c-84a5-c53b3b668a25.tmp
6c32b7bc-d086-446e-abfa-06de013277e1.tmp
ff907578-c116-492b-b855-339747bcce58.tmp
sync_diagnostic.log
aab670ab-6fc9-4bae-80c7-0e7b5f0229ee.tmp
ae8cabf8-4f57-4fd4-a3f3-049cfeac25ed.tmp
dbcb9726-78d4-4627-8bc8-ea6c5fcf7c8f.tmp
e556a49f-43d3-41a9-9303-68a000cd05dd.tmp
OperationConfig
ae093c83-69ff-4b96-9a79-8560ddd0f008.tmp
b5925c4e-2329-4c29-ac8d-ddd711f44259.tmp
c0c0bd11-77a3-4a8b-b767-3599f9864b4d.tmp
58756c49-d0fb-45ac-a040-fef5bd381a54.tmp
8f9ef9f7-4cd0-4e11-939f-1afb1d276340.tmp
b0187e52-2a39-46e3-8e2a-4d9b752527be.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
b2be4831-6709-4ec0-baaf-71dedc5501c8.tmp
metadata.json
f0ec4b6f-e89e-4ec1-94a1-c595ad00649c.tmp
b06b7079-332e-433c-8879-1d8bd54bfbd7.tmp
b6eb4a61-9285-4570-a83f-1d36eaeec21a.tmp
messages.json
content.js
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/756-540-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1072-695-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1072-527-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1356-726-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2852-583-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2900-438-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3012-663-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3440-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4420-643-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4476-617-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4564-744-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4628-563-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4644-683-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4724-567-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5204-487-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5320-721-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5356-515-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5360-587-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5760-629-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5776-723-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5776-699-0x0000000000010000-0x00000000000AB000-memory.dmp