Analysis
- max time kernel
150s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
27/10/2026, 02:53
General
- Target 2026-10-26_ef3857d77d2f60645d643fe2765fdbf3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261027-ddqm8aaz7n
- SHA256 4aca5950ee50d9a171e5ccab9b5bded3a4b4c275b7a125953c57750558f5d088
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_ef3857d77d2f60645d643fe2765fdbf3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-26_ef3857d77d2f60645d643fe2765fdbf3_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\pkhcausmkecxupnh.exeC:\Temp\pkhcausmkecxupnh.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnhfzxrphc.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\pnhfzxrphc.exeC:\Temp\pnhfzxrphc.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnhfzxrphc.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pnhfzxrphc.exeC:\Temp\i_pnhfzxrphc.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omjhbzxrpj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\omjhbzxrpj.exeC:\Temp\omjhbzxrpj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omjhbzxrpj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_omjhbzxrpj.exeC:\Temp\i_omjhbzxrpj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\uomgezwjgb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\uomgezwjgb.exeC:\Temp\uomgezwjgb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_uomgezwjgb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_uomgezwjgb.exeC:\Temp\i_uomgezwjgb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wuoljdbywq.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wuoljdbywq.exeC:\Temp\wuoljdbywq.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wuoljdbywq.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wuoljdbywq.exeC:\Temp\i_wuoljdbywq.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtnlgeywqo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vtnlgeywqo.exeC:\Temp\vtnlgeywqo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vtnlgeywqo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vtnlgeywqo.exeC:\Temp\i_vtnlgeywqo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qoigayvqnl.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qoigayvqnl.exeC:\Temp\qoigayvqnl.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qoigayvqnl.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qoigayvqnl.exeC:\Temp\i_qoigayvqnl.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dxvsnkigay.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dxvsnkigay.exeC:\Temp\dxvsnkigay.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dxvsnkigay.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dxvsnkigay.exeC:\Temp\i_dxvsnkigay.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kicausnkfc.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kicausnkfc.exeC:\Temp\kicausnkfc.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kicausnkfc.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kicausnkfc.exeC:\Temp\i_kicausnkfc.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pkhfzusmkh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pkhfzusmkh.exeC:\Temp\pkhfzusmkh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pkhfzusmkh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_pkhfzusmkh.exeC:\Temp\i_pkhfzusmkh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mjhbzxrpjh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mjhbzxrpjh.exeC:\Temp\mjhbzxrpjh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mjhbzxrpjh.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mjhbzxrpjh.exeC:\Temp\i_mjhbzxrpjh.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pmhecwuomh.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pmhecwuomh.exeC:\Temp\pmhecwuomh.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pmhecwuomh.exe ups_ins3⤵
-
C:\Temp\i_pmhecwuomh.exeC:\Temp\i_pmhecwuomh.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wromjeywuo.exe ups_run3⤵
-
C:\Temp\wromjeywuo.exeC:\Temp\wromjeywuo.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wromjeywuo.exe ups_ins3⤵
-
C:\Temp\i_wromjeywuo.exeC:\Temp\i_wromjeywuo.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywqojgeywq.exe ups_run3⤵
-
C:\Temp\ywqojgeywq.exeC:\Temp\ywqojgeywq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywqojgeywq.exe ups_ins3⤵
-
C:\Temp\i_ywqojgeywq.exeC:\Temp\i_ywqojgeywq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\aywqoigday.exe ups_run3⤵
-
C:\Temp\aywqoigday.exeC:\Temp\aywqoigday.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_aywqoigday.exe ups_ins3⤵
-
C:\Temp\i_aywqoigday.exeC:\Temp\i_aywqoigday.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\olfdxvqoig.exe ups_run3⤵
-
C:\Temp\olfdxvqoig.exeC:\Temp\olfdxvqoig.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_olfdxvqoig.exe ups_ins3⤵
-
C:\Temp\i_olfdxvqoig.exeC:\Temp\i_olfdxvqoig.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vsqkfdxvsn.exe ups_run3⤵
-
C:\Temp\vsqkfdxvsn.exeC:\Temp\vsqkfdxvsn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vsqkfdxvsn.exe ups_ins3⤵
-
C:\Temp\i_vsqkfdxvsn.exeC:\Temp\i_vsqkfdxvsn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\spnkfcaxvp.exe ups_run3⤵
-
C:\Temp\spnkfcaxvp.exeC:\Temp\spnkfcaxvp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_spnkfcaxvp.exe ups_ins3⤵
-
C:\Temp\i_spnkfcaxvp.exeC:\Temp\i_spnkfcaxvp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\causpkhcax.exe ups_run3⤵
-
C:\Temp\causpkhcax.exeC:\Temp\causpkhcax.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_causpkhcax.exe ups_ins3⤵
-
C:\Temp\i_causpkhcax.exeC:\Temp\i_causpkhcax.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xupmhfzxrp.exe ups_run3⤵
-
C:\Temp\xupmhfzxrp.exeC:\Temp\xupmhfzxrp.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xupmhfzxrp.exe ups_ins3⤵
-
C:\Temp\i_xupmhfzxrp.exeC:\Temp\i_xupmhfzxrp.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\urpjhbztrm.exe ups_run3⤵
-
C:\Temp\urpjhbztrm.exeC:\Temp\urpjhbztrm.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_urpjhbztrm.exe ups_ins3⤵
-
C:\Temp\i_urpjhbztrm.exeC:\Temp\i_urpjhbztrm.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x30c,0x7ffdcf81c188,0x7ffdcf81c194,0x7ffdcf81c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2136,i,15065439289278140137,9191753289720915803,524288 --field-trial-handle=2296,i,6669277387918349691,15835520311154631359,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2660,i,8034012285236496351,3413317476130491113,524288 --field-trial-handle=2296,i,6669277387918349691,15835520311154631359,262144 --variations-seed-version --mojo-platform-channel-handle=2816 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1872,i,18369146127879736779,18068585553478786849,262144 --field-trial-handle=2296,i,6669277387918349691,15835520311154631359,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,15044593640027074594,9031060665493341052,2097152 --field-trial-handle=2296,i,6669277387918349691,15835520311154631359,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,16549787396564370003,9589299755800577484,2097152 --field-trial-handle=2296,i,6669277387918349691,15835520311154631359,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4300,i,16470990277024433353,14107517294320358410,2097152 --field-trial-handle=2296,i,6669277387918349691,15835520311154631359,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4328,i,12249137592057549974,17797955759070886384,2097152 --field-trial-handle=2296,i,6669277387918349691,15835520311154631359,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,116886165155551355,10528316985409233890,524288 --field-trial-handle=2296,i,6669277387918349691,15835520311154631359,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,4096742947034784805,18223039591509950362,524288 --field-trial-handle=2296,i,6669277387918349691,15835520311154631359,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,2430466471279734693,13165555263930996814,524288 --field-trial-handle=2296,i,6669277387918349691,15835520311154631359,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,3371533096262081476,17170354436905599896,524288 --field-trial-handle=2296,i,6669277387918349691,15835520311154631359,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,3371533096262081476,17170354436905599896,524288 --field-trial-handle=2296,i,6669277387918349691,15835520311154631359,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,8628788710397618529,3848768413157504871,524288 --field-trial-handle=2296,i,6669277387918349691,15835520311154631359,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,10541284763245710614,3261200501073963845,524288 --field-trial-handle=2296,i,6669277387918349691,15835520311154631359,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,9603443773672224879,16681113118171432471,524288 --field-trial-handle=2296,i,6669277387918349691,15835520311154631359,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,5131614239157219361,16231135586393197842,524288 --field-trial-handle=2296,i,6669277387918349691,15835520311154631359,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1492,i,6087787054328403716,12757243673540656685,524288 --field-trial-handle=2296,i,6669277387918349691,15835520311154631359,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1500,i,11118357983994489044,176378449659196923,524288 --field-trial-handle=2296,i,6669277387918349691,15835520311154631359,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1508,i,14259606643911587324,13677069548348713153,524288 --field-trial-handle=2296,i,6669277387918349691,15835520311154631359,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,10088409083314841406,1978423055709804830,524288 --field-trial-handle=2296,i,6669277387918349691,15835520311154631359,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,925250151215998860,9867633256784413683,524288 --field-trial-handle=2296,i,6669277387918349691,15835520311154631359,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3464,i,6362958903958039654,18151296390927938379,524288 --field-trial-handle=2296,i,6669277387918349691,15835520311154631359,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,13969065478888732640,11887992968789110197,524288 --field-trial-handle=2296,i,6669277387918349691,15835520311154631359,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4840,i,2397333643666271864,8549599215443663253,262144 --field-trial-handle=2296,i,6669277387918349691,15835520311154631359,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,11652132293155309526,855080295785943933,524288 --field-trial-handle=2296,i,6669277387918349691,15835520311154631359,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\pkhcausmkecxupnh.sysC:\Temp\pkhcausmkecxupnh.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Temp\usmjhfrpjh.sysC:\Temp\usmjhfrpjh.sys1⤵
- Executes dropped EXE
-
C:\Temp\zwrpjhbzur.sysC:\Temp\zwrpjhbzur.sys1⤵
- Executes dropped EXE
-
C:\Temp\uomgdbztro.sysC:\Temp\uomgdbztro.sys1⤵
- Executes dropped EXE
-
C:\Temp\bywqolgdbv.sysC:\Temp\bywqolgdbv.sys1⤵
- Executes dropped EXE
-
C:\Temp\daywqoigay.sysC:\Temp\daywqoigay.sys1⤵
- Executes dropped EXE
-
C:\Temp\avsqkifdxv.sysC:\Temp\avsqkifdxv.sys1⤵
- Executes dropped EXE
-
C:\Temp\nkicavsnlf.sysC:\Temp\nkicavsnlf.sys1⤵
- Executes dropped EXE
-
C:\Temp\pnhfzxspnk.sysC:\Temp\pnhfzxspnk.sys1⤵
- Executes dropped EXE
-
C:\Temp\uspjhczxrp.sysC:\Temp\uspjhczxrp.sys1⤵
- Executes dropped EXE
-
C:\Temp\urpjecwusm.sysC:\Temp\urpjecwusm.sys1⤵
- Executes dropped EXE
-
C:\Temp\rmjhbzwurm.sysC:\Temp\rmjhbzwurm.sys1⤵
-
C:\Temp\wqojgbytrl.sysC:\Temp\wqojgbytrl.sys1⤵
-
C:\Temp\olgeywtolg.sysC:\Temp\olgeywtolg.sys1⤵
-
C:\Temp\lfdbvsqoif.sysC:\Temp\lfdbvsqoif.sys1⤵
-
C:\Temp\vsqkicavsn.sysC:\Temp\vsqkicavsn.sys1⤵
-
C:\Temp\dxvpnifayv.sysC:\Temp\dxvpnifayv.sys1⤵
-
C:\Temp\czxvpnhfzu.sysC:\Temp\czxvpnhfzu.sys1⤵
-
C:\Temp\zurmkecwus.sysC:\Temp\zurmkecwus.sys1⤵
-
C:\Temp\urmjhbzwuo.sysC:\Temp\urmjhbzwuo.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
bywqolgdbv.sys
daywqoigay.sys
i_omjhbzxrpj.exe
i_pnhfzxrphc.exe
i_uomgezwjgb.exe
i_vtnlgeywqo.exe
i_wuoljdbywq.exe
omjhbzxrpj.exe
pkhcausmkecxupnh.exe
pkhcausmkecxupnh.sys
pnhfzxrphc.exe
qoigayvqnl.exe
uomgdbztro.sys
uomgezwjgb.exe
usmjhfrpjh.sys
vtnlgeywqo.exe
wuoljdbywq.exe
zwrpjhbzur.sys
151474d7-0079-4829-83db-f28dd70d8017.tmp
47283584-2d05-4038-b4a5-03c63ea77b06.tmp
settings.dat
settings.dat
482ce769-700a-479c-beb1-470d048ad3e6.tmp
7fbc465f-afa7-4b4e-b693-9339815cad02.tmp
93f40a51-9194-4a8c-8c23-b00b6b672139.tmp
temp-index
the-real-index
d339af94-3015-4060-8824-e16f91108dbe.tmp
dasherSettingSchema.json
55e660c7-82a4-4371-a7bc-e8af7b4660e7.tmp
7c8cf426-8c82-475a-b5b1-33156d0cc74e.tmp
877dcead-30b8-47d8-80fc-d9b777f7648d.tmp
Preferences
c10fb545-81b6-46f0-99aa-3d6eabee4241.tmp
7d342b32-c605-4530-904d-bb1966eed888.tmp
OperationConfig
b0e941d3-2d9c-4719-8ba1-d12455df737c.tmp
59287de9-9e87-4c4e-a67f-89bd1c3f55e6.tmp
5dce037d-3057-48b7-a8df-7aad54e6e2af.tmp
7e430365-a0e8-40f6-a089-e0d4a96fd05c.tmp
fdfbee49-60c8-4b85-a4fd-ef5fbe8df03c.tmp
e09b6599-d0a5-4ba0-b58c-dfb14fa72180.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
a053ca48-4296-4bb7-9fbd-46b7b64a352a.tmp
metadata.json
f3162728-fe6a-434d-9017-7e2a9df00c4b.tmp
fd5d8dd2-afb6-432b-907f-9d3ef74d829c.tmp
7f5673b2-6a83-4dcc-9fb1-5f4d92c372eb.tmp
d6fe74a4-24b1-4a31-ab62-8c3000d9b289.tmp
content.js
messages.json
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/52-661-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1060-510-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1800-523-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1824-487-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1824-430-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2408-681-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2632-479-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2632-516-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2792-741-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2872-719-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2888-563-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2960-723-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3536-627-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3972-697-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4228-536-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4472-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4660-585-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4872-567-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5084-559-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5636-639-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5768-615-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5832-693-0x0000000000010000-0x00000000000AB000-memory.dmp