Analysis
- max time kernel
149s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
21/10/2026, 04:24
General
- Target 2026-10-19_0abc021a5aa3dc8d4c3da2b74bca98ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 376KB
- Sample261021-e1f8qszw8n
- SHA256 4b85ea7bc9668ba49ebdee97b27df8436d150a8b8ffa302d640ecb277b156042
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_0abc021a5aa3dc8d4c3da2b74bca98ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-19_0abc021a5aa3dc8d4c3da2b74bca98ab_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\idbvtnlfdyvtnlgd.exeC:\Temp\idbvtnlfdyvtnlgd.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\nlfdyvqlgy.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\nlfdyvqlgy.exeC:\Temp\nlfdyvqlgy.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_nlfdyvqlgy.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_nlfdyvqlgy.exeC:\Temp\i_nlfdyvqlgy.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fcaysnifdx.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\fcaysnifdx.exeC:\Temp\fcaysnifdx.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fcaysnifdx.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_fcaysnifdx.exeC:\Temp\i_fcaysnifdx.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\icausnkica.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\icausnkica.exeC:\Temp\icausnkica.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_icausnkica.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_icausnkica.exeC:\Temp\i_icausnkica.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hczxupmkhf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hczxupmkhf.exeC:\Temp\hczxupmkhf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hczxupmkhf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hczxupmkhf.exeC:\Temp\i_hczxupmkhf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mkecwrpnhf.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mkecwrpnhf.exeC:\Temp\mkecwrpnhf.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mkecwrpnhf.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mkecwrpnhf.exeC:\Temp\i_mkecwrpnhf.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mjhezwurmj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mjhezwurmj.exeC:\Temp\mjhezwurmj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mjhezwurmj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mjhezwurmj.exeC:\Temp\i_mjhezwurmj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\trojgebwuo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\trojgebwuo.exeC:\Temp\trojgebwuo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_trojgebwuo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_trojgebwuo.exeC:\Temp\i_trojgebwuo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ojytrljdbw.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\ojytrljdbw.exeC:\Temp\ojytrljdbw.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ojytrljdbw.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_ojytrljdbw.exeC:\Temp\i_ojytrljdbw.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gdbwtolgdy.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gdbwtolgdy.exeC:\Temp\gdbwtolgdy.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gdbwtolgdy.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gdbwtolgdy.exeC:\Temp\i_gdbwtolgdy.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\igaysqlidb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\igaysqlidb.exeC:\Temp\igaysqlidb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_igaysqlidb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_igaysqlidb.exeC:\Temp\i_igaysqlidb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xvsqkifdxv.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\xvsqkifdxv.exeC:\Temp\xvsqkifdxv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xvsqkifdxv.exe ups_ins3⤵
-
C:\Temp\i_xvsqkifdxv.exeC:\Temp\i_xvsqkifdxv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnkifaxsqk.exe ups_run3⤵
-
C:\Temp\pnkifaxsqk.exeC:\Temp\pnkifaxsqk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnkifaxsqk.exe ups_ins3⤵
-
C:\Temp\i_pnkifaxsqk.exeC:\Temp\i_pnkifaxsqk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usmkhcausm.exe ups_run3⤵
-
C:\Temp\usmkhcausm.exeC:\Temp\usmkhcausm.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usmkhcausm.exe ups_ins3⤵
-
C:\Temp\i_usmkhcausm.exeC:\Temp\i_usmkhcausm.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omkhczxrom.exe ups_run3⤵
-
C:\Temp\omkhczxrom.exeC:\Temp\omkhczxrom.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omkhczxrom.exe ups_ins3⤵
-
C:\Temp\i_omkhczxrom.exeC:\Temp\i_omkhczxrom.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rpjhbztrmj.exe ups_run3⤵
-
C:\Temp\rpjhbztrmj.exeC:\Temp\rpjhbztrmj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rpjhbztrmj.exe ups_ins3⤵
-
C:\Temp\i_rpjhbztrmj.exeC:\Temp\i_rpjhbztrmj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ebwuomgezw.exe ups_run3⤵
-
C:\Temp\ebwuomgezw.exeC:\Temp\ebwuomgezw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ebwuomgezw.exe ups_ins3⤵
-
C:\Temp\i_ebwuomgezw.exeC:\Temp\i_ebwuomgezw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ywtolgdywq.exe ups_run3⤵
-
C:\Temp\ywtolgdywq.exeC:\Temp\ywtolgdywq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ywtolgdywq.exe ups_ins3⤵
-
C:\Temp\i_ywtolgdywq.exeC:\Temp\i_ywtolgdywq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtnlgdyvqn.exe ups_run3⤵
-
C:\Temp\vtnlgdyvqn.exeC:\Temp\vtnlgdyvqn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vtnlgdyvqn.exe ups_ins3⤵
-
C:\Temp\i_vtnlgdyvqn.exeC:\Temp\i_vtnlgdyvqn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tnlfdxvsqn.exe ups_run3⤵
-
C:\Temp\tnlfdxvsqn.exeC:\Temp\tnlfdxvsqn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tnlfdxvsqn.exe ups_ins3⤵
-
C:\Temp\i_tnlfdxvsqn.exeC:\Temp\i_tnlfdxvsqn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\caxsqkicay.exe ups_run3⤵
-
C:\Temp\caxsqkicay.exeC:\Temp\caxsqkicay.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_caxsqkicay.exe ups_ins3⤵
-
C:\Temp\i_caxsqkicay.exeC:\Temp\i_caxsqkicay.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x30c,0x7ff832b1c188,0x7ff832b1c194,0x7ff832b1c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,2931170462180862392,9011382641616563415,262144 --field-trial-handle=2464,i,14588758255301946510,1402197268822410338,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,6093190735062593055,3846979927383177107,524288 --field-trial-handle=2464,i,14588758255301946510,1402197268822410338,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2244,i,8734744584293340117,16009357680000460019,524288 --field-trial-handle=2464,i,14588758255301946510,1402197268822410338,262144 --variations-seed-version --mojo-platform-channel-handle=2824 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,15361284336022683565,1668600851930691049,2097152 --field-trial-handle=2464,i,14588758255301946510,1402197268822410338,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,14049966885287438094,2678358758633349286,2097152 --field-trial-handle=2464,i,14588758255301946510,1402197268822410338,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4352,i,6608551411119444621,2810296575658129707,2097152 --field-trial-handle=2464,i,14588758255301946510,1402197268822410338,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4360,i,6160695722574175243,17930622338771206113,2097152 --field-trial-handle=2464,i,14588758255301946510,1402197268822410338,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,11546183921727851584,4402478874374663923,524288 --field-trial-handle=2464,i,14588758255301946510,1402197268822410338,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,5272134957843044343,13418717117798300203,524288 --field-trial-handle=2464,i,14588758255301946510,1402197268822410338,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,1867124140543497216,18268396401382287108,524288 --field-trial-handle=2464,i,14588758255301946510,1402197268822410338,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,14488195897714912936,10740801936437931491,524288 --field-trial-handle=2464,i,14588758255301946510,1402197268822410338,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,14488195897714912936,10740801936437931491,524288 --field-trial-handle=2464,i,14588758255301946510,1402197268822410338,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,14316466680814796027,18292980266844647931,524288 --field-trial-handle=2464,i,14588758255301946510,1402197268822410338,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,17006618763377729732,5177440541006060578,524288 --field-trial-handle=2464,i,14588758255301946510,1402197268822410338,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,4118777795066033290,16912919579502044624,524288 --field-trial-handle=2464,i,14588758255301946510,1402197268822410338,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,10963833213820397195,16467969531521849146,524288 --field-trial-handle=2464,i,14588758255301946510,1402197268822410338,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,5987363155149569434,14310392353894596322,524288 --field-trial-handle=2464,i,14588758255301946510,1402197268822410338,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4828,i,5452901736206743826,1342814112585262672,524288 --field-trial-handle=2464,i,14588758255301946510,1402197268822410338,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,9871569097268656299,8685917776716571651,524288 --field-trial-handle=2464,i,14588758255301946510,1402197268822410338,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,11349013461833734676,9264167436719579271,524288 --field-trial-handle=2464,i,14588758255301946510,1402197268822410338,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,3565172470079323658,9555620822905948904,524288 --field-trial-handle=2464,i,14588758255301946510,1402197268822410338,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5596,i,10952091026070267409,11424132219042898200,524288 --field-trial-handle=2464,i,14588758255301946510,1402197268822410338,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=932,i,134996999315507005,3068308778523651129,524288 --field-trial-handle=2464,i,14588758255301946510,1402197268822410338,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6688,i,17395231508345977867,14206513571081020321,262144 --field-trial-handle=2464,i,14588758255301946510,1402197268822410338,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,2318129801696909466,15432509445588462207,524288 --field-trial-handle=2464,i,14588758255301946510,1402197268822410338,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\idbvtnlfdyvtnlgd.sysC:\Temp\idbvtnlfdyvtnlgd.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Temp\lfdxvpnkig.sysC:\Temp\lfdxvpnkig.sys1⤵
- Executes dropped EXE
-
C:\Temp\kfaxvpnhfz.sysC:\Temp\kfaxvpnhfz.sys1⤵
- Executes dropped EXE
-
C:\Temp\mkfcauspnh.sysC:\Temp\mkfcauspnh.sys1⤵
- Executes dropped EXE
-
C:\Temp\spjhczusmk.sysC:\Temp\spjhczusmk.sys1⤵
- Executes dropped EXE
-
C:\Temp\mjebzurmje.sysC:\Temp\mjebzurmje.sys1⤵
- Executes dropped EXE
-
C:\Temp\urmjebwtro.sysC:\Temp\urmjebwtro.sys1⤵
- Executes dropped EXE
-
C:\Temp\ljhbztolje.sysC:\Temp\ljhbztolje.sys1⤵
- Executes dropped EXE
-
C:\Temp\igaytqoigd.sysC:\Temp\igaytqoigd.sys1⤵
- Executes dropped EXE
-
C:\Temp\ligaysqkid.sysC:\Temp\ligaysqkid.sys1⤵
- Executes dropped EXE
-
C:\Temp\nigaysqcax.sysC:\Temp\nigaysqcax.sys1⤵
- Executes dropped EXE
-
C:\Temp\kicaxvpnki.sysC:\Temp\kicaxvpnki.sys1⤵
-
C:\Temp\xupnhfzxrp.sysC:\Temp\xupnhfzxrp.sys1⤵
-
C:\Temp\omheczurpj.sysC:\Temp\omheczurpj.sys1⤵
-
C:\Temp\bzurmjeczu.sysC:\Temp\bzurmjeczu.sys1⤵
-
C:\Temp\bztrljhbzt.sysC:\Temp\bztrljhbzt.sys1⤵
-
C:\Temp\bywqomgdyv.sysC:\Temp\bywqomgdyv.sys1⤵
-
C:\Temp\wqoigdywqo.sysC:\Temp\wqoigdywqo.sys1⤵
-
C:\Temp\yvqolgdays.sysC:\Temp\yvqolgdays.sys1⤵
-
C:\Temp\fdysqkicay.sysC:\Temp\fdysqkicay.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
fcaysnifdx.exe
hczxupmkhf.exe
i_fcaysnifdx.exe
i_hczxupmkhf.exe
i_icausnkica.exe
i_mkecwrpnhf.exe
i_nlfdyvqlgy.exe
icausnkica.exe
idbvtnlfdyvtnlgd.exe
idbvtnlfdyvtnlgd.sys
kfaxvpnhfz.sys
lfdxvpnkig.sys
mjebzurmje.sys
mjhezwurmj.exe
mkecwrpnhf.exe
mkfcauspnh.sys
nlfdyvqlgy.exe
spjhczusmk.sys
100566cf-bfce-43ef-a8b2-7c7019dedc1c.tmp
67462ffe-3116-4050-963a-b2acd34f05e8.tmp
81868668-237a-47cf-b5fc-7b6760f4308b.tmp
settings.dat
settings.dat
temp-index
the-real-index
8d31005c-c360-4fdb-af43-fa4e02589ab5.tmp
Edge Profile.ico
dasherSettingSchema.json
03d29f6e-ed56-4114-9f27-fc577574bd9d.tmp
2ab15aa3-dc61-4f34-af69-8b6ddea55149.tmp
78de8732-2770-4ff4-8101-c1c3db433979.tmp
c11c5eb5-7cef-45d4-b4bb-411dd9ebdbc1.tmp
cb254890-5858-4301-9785-9415bdad60f4.tmp
d92b110f-780f-43b7-b394-6cf64b836670.tmp
f647544f-95c8-4632-bf36-22f45331599c.tmp
04a06f66-090f-40c1-81ac-07fa1971da6f.tmp
Local State
cf0bdfc9-1e01-420c-a681-a4ad093ae779.tmp
8411777e-86d5-4b01-bb4a-cf77097abd24.tmp
8492d356-064b-4e08-b2c3-6ac766e3e3db.tmp
fbf3cd32-e463-4716-ba99-7eff535ed7f6.tmp
efe1fa45-687c-4b05-a3e1-77c723e9f590.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
914072bd-256f-4e96-9031-2d19685a9b10.tmp
metadata.json
081f13af-c839-487f-904b-628c810edb29.tmp
9c4793ee-813e-4688-9408-828447f0c870.tmp
content.js
messages.json
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/200-434-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/352-682-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1184-687-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1392-559-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2416-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3380-661-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3512-615-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3688-523-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3824-720-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4044-563-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4144-511-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4192-483-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4328-724-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4476-536-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4992-627-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5288-567-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5740-585-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5740-663-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5740-641-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5832-742-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/6040-698-0x0000000000010000-0x00000000000AB000-memory.dmp