Analysis
- max time kernel
149s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
26/10/2026, 08:37
General
- Target 2026-10-25_e622599be6f41789f2927d6086c0c202_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261026-kjddeaag24
- SHA256 36a8a90e4aadf79e92a90e9f6133756d2a9334a9c4d33d0dac58be8d549dad13
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-25_e622599be6f41789f2927d6086c0c202_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-25_e622599be6f41789f2927d6086c0c202_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\jdbztrljdbvtgdbv.exeC:\Temp\jdbztrljdbvtgdbv.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jdbytqljdy.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\jdbytqljdy.exeC:\Temp\jdbytqljdy.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jdbytqljdy.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jdbytqljdy.exeC:\Temp\i_jdbytqljdy.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tqljdbvtql.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\tqljdbvtql.exeC:\Temp\tqljdbvtql.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tqljdbvtql.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_tqljdbvtql.exeC:\Temp\i_tqljdbvtql.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\icayvqnlfd.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\icayvqnlfd.exeC:\Temp\icayvqnlfd.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_icayvqnlfd.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_icayvqnlfd.exeC:\Temp\i_icayvqnlfd.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qkifdaupnk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\qkifdaupnk.exeC:\Temp\qkifdaupnk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qkifdaupnk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_qkifdaupnk.exeC:\Temp\i_qkifdaupnk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\usmkecausm.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\usmkecausm.exeC:\Temp\usmkecausm.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_usmkecausm.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_usmkecausm.exeC:\Temp\i_usmkecausm.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hecwupmhec.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hecwupmhec.exeC:\Temp\hecwupmhec.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hecwupmhec.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hecwupmhec.exeC:\Temp\i_hecwupmhec.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gebzxrpjhb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\gebzxrpjhb.exeC:\Temp\gebzxrpjhb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gebzxrpjhb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_gebzxrpjhb.exeC:\Temp\i_gebzxrpjhb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rljebwtomg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\rljebwtomg.exeC:\Temp\rljebwtomg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rljebwtomg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_rljebwtomg.exeC:\Temp\i_rljebwtomg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wtoigeywqo.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wtoigeywqo.exeC:\Temp\wtoigeywqo.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wtoigeywqo.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wtoigeywqo.exeC:\Temp\i_wtoigeywqo.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dbvtnlgdyv.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dbvtnlgdyv.exeC:\Temp\dbvtnlgdyv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dbvtnlgdyv.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_dbvtnlgdyv.exeC:\Temp\i_dbvtnlgdyv.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dyvqnlfday.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\dyvqnlfday.exeC:\Temp\dyvqnlfday.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dyvqnlfday.exe ups_ins3⤵
-
C:\Temp\i_dyvqnlfday.exeC:\Temp\i_dyvqnlfday.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fcausnkfdx.exe ups_run3⤵
-
C:\Temp\fcausnkfdx.exeC:\Temp\fcausnkfdx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fcausnkfdx.exe ups_ins3⤵
-
C:\Temp\i_fcausnkfdx.exeC:\Temp\i_fcausnkfdx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnhfspkhcx.exe ups_run3⤵
-
C:\Temp\pnhfspkhcx.exeC:\Temp\pnhfspkhcx.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnhfspkhcx.exe ups_ins3⤵
-
C:\Temp\i_pnhfspkhcx.exeC:\Temp\i_pnhfspkhcx.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnhfcxusmk.exe ups_run3⤵
-
C:\Temp\pnhfcxusmk.exeC:\Temp\pnhfcxusmk.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnhfcxusmk.exe ups_ins3⤵
-
C:\Temp\i_pnhfcxusmk.exeC:\Temp\i_pnhfcxusmk.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\xromkhczus.exe ups_run3⤵
-
C:\Temp\xromkhczus.exeC:\Temp\xromkhczus.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_xromkhczus.exe ups_ins3⤵
-
C:\Temp\i_xromkhczus.exeC:\Temp\i_xromkhczus.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ezwrmjecwu.exe ups_run3⤵
-
C:\Temp\ezwrmjecwu.exeC:\Temp\ezwrmjecwu.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ezwrmjecwu.exe ups_ins3⤵
-
C:\Temp\i_ezwrmjecwu.exeC:\Temp\i_ezwrmjecwu.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bzwrojgebz.exe ups_run3⤵
-
C:\Temp\bzwrojgebz.exeC:\Temp\bzwrojgebz.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bzwrojgebz.exe ups_ins3⤵
-
C:\Temp\i_bzwrojgebz.exeC:\Temp\i_bzwrojgebz.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\eywqojgbvt.exe ups_run3⤵
-
C:\Temp\eywqojgbvt.exeC:\Temp\eywqojgbvt.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_eywqojgbvt.exe ups_ins3⤵
-
C:\Temp\i_eywqojgbvt.exeC:\Temp\i_eywqojgbvt.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\bvtnlfdyvq.exe ups_run3⤵
-
C:\Temp\bvtnlfdyvq.exeC:\Temp\bvtnlfdyvq.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_bvtnlfdyvq.exe ups_ins3⤵
-
C:\Temp\i_bvtnlfdyvq.exeC:\Temp\i_bvtnlfdyvq.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\davsnliday.exe ups_run3⤵
-
C:\Temp\davsnliday.exeC:\Temp\davsnliday.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_davsnliday.exe ups_ins3⤵
-
C:\Temp\i_davsnliday.exeC:\Temp\i_davsnliday.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c4,0x304,0x7ffa52fec188,0x7ffa52fec194,0x7ffa52fec1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,1255142341962312020,14476910600228156391,262144 --field-trial-handle=2564,i,9669018545119522527,6950964309227649875,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,14123418232429267869,12597683418105759416,524288 --field-trial-handle=2564,i,9669018545119522527,6950964309227649875,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2064,i,6251404860117243450,32152907636752303,524288 --field-trial-handle=2564,i,9669018545119522527,6950964309227649875,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3620,i,9222209047415647708,9998694351787546495,2097152 --field-trial-handle=2564,i,9669018545119522527,6950964309227649875,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3624,i,10347111857717109369,7805335929851739103,2097152 --field-trial-handle=2564,i,9669018545119522527,6950964309227649875,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4344,i,733631843529930999,10762338816921874758,2097152 --field-trial-handle=2564,i,9669018545119522527,6950964309227649875,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4356,i,11068378274380784766,354788953910577967,2097152 --field-trial-handle=2564,i,9669018545119522527,6950964309227649875,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3816,i,8304843540346742676,7682494207587106025,524288 --field-trial-handle=2564,i,9669018545119522527,6950964309227649875,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3692,i,9941481484291818548,17365969073847394863,524288 --field-trial-handle=2564,i,9669018545119522527,6950964309227649875,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,7537603751605478707,3200609325541059391,524288 --field-trial-handle=2564,i,9669018545119522527,6950964309227649875,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,8036530418663780133,1956628385149102556,524288 --field-trial-handle=2564,i,9669018545119522527,6950964309227649875,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,8036530418663780133,1956628385149102556,524288 --field-trial-handle=2564,i,9669018545119522527,6950964309227649875,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,11856247544219317757,11694483797502633539,524288 --field-trial-handle=2564,i,9669018545119522527,6950964309227649875,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4608,i,6047744579524272662,15445150286807731803,524288 --field-trial-handle=2564,i,9669018545119522527,6950964309227649875,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,4007402619606315182,18229175921827117537,524288 --field-trial-handle=2564,i,9669018545119522527,6950964309227649875,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6844,i,14419574420601718078,12466895830320956648,524288 --field-trial-handle=2564,i,9669018545119522527,6950964309227649875,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,816061258338682430,5104133042387468026,524288 --field-trial-handle=2564,i,9669018545119522527,6950964309227649875,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,16590249908741578093,10734717652707145529,524288 --field-trial-handle=2564,i,9669018545119522527,6950964309227649875,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,9596749051673060418,9879352815328303027,524288 --field-trial-handle=2564,i,9669018545119522527,6950964309227649875,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,4862007527972579975,6578572775924846611,524288 --field-trial-handle=2564,i,9669018545119522527,6950964309227649875,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6832,i,18231339359202618694,11849393589366124534,524288 --field-trial-handle=2564,i,9669018545119522527,6950964309227649875,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,6668525254522025590,11802641203314742201,524288 --field-trial-handle=2564,i,9669018545119522527,6950964309227649875,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7016,i,14040780406165458101,10244020983021040607,524288 --field-trial-handle=2564,i,9669018545119522527,6950964309227649875,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7012,i,14784132411524033523,8500170829578274743,262144 --field-trial-handle=2564,i,9669018545119522527,6950964309227649875,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1196,i,12985767016970755155,14712602363228584211,524288 --field-trial-handle=2564,i,9669018545119522527,6950964309227649875,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\jdbztrljdbvtgdbv.sysC:\Temp\jdbztrljdbvtgdbv.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\bytqlgdyvt.sysC:\Temp\bytqlgdyvt.sys1⤵
- Executes dropped EXE
-
C:\Temp\ifdysqnigd.sysC:\Temp\ifdysqnigd.sys1⤵
- Executes dropped EXE
-
C:\Temp\nhfdxvsnki.sysC:\Temp\nhfdxvsnki.sys1⤵
- Executes dropped EXE
-
C:\Temp\fcxvpnhfzx.sysC:\Temp\fcxvpnhfzx.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfzxrpjhcz.sysC:\Temp\hfzxrpjhcz.sys1⤵
- Executes dropped EXE
-
C:\Temp\hezwuomkhb.sysC:\Temp\hezwuomkhb.sys1⤵
- Executes dropped EXE
-
C:\Temp\uomgeywqoj.sysC:\Temp\uomgeywqoj.sys1⤵
- Executes dropped EXE
-
C:\Temp\eywqojgeyw.sysC:\Temp\eywqojgeyw.sys1⤵
- Executes dropped EXE
-
C:\Temp\dywtolgdyw.sysC:\Temp\dywtolgdyw.sys1⤵
- Executes dropped EXE
-
C:\Temp\davtnlfdav.sysC:\Temp\davtnlfdav.sys1⤵
- Executes dropped EXE
-
C:\Temp\qcausqkifa.sysC:\Temp\qcausqkifa.sys1⤵
-
C:\Temp\pnhfaxsqki.sysC:\Temp\pnhfaxsqki.sys1⤵
-
C:\Temp\spkhczxrpm.sysC:\Temp\spkhczxrpm.sys1⤵
-
C:\Temp\upmkhbzxus.sysC:\Temp\upmkhbzxus.sys1⤵
-
C:\Temp\omjecwromh.sysC:\Temp\omjecwromh.sys1⤵
-
C:\Temp\gezwrojgby.sysC:\Temp\gezwrojgby.sys1⤵
-
C:\Temp\gbytrljdbw.sysC:\Temp\gbytrljdbw.sys1⤵
-
C:\Temp\dyvqoigdyv.sysC:\Temp\dyvqoigdyv.sys1⤵
-
C:\Temp\igaysqoifd.sysC:\Temp\igaysqoifd.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
bytqlgdyvt.sys
fcxvpnhfzx.sys
hecwupmhec.exe
hfzxrpjhcz.sys
i_icayvqnlfd.exe
i_jdbytqljdy.exe
i_qkifdaupnk.exe
i_tqljdbvtql.exe
i_usmkecausm.exe
icayvqnlfd.exe
ifdysqnigd.sys
jdbytqljdy.exe
jdbztrljdbvtgdbv.exe
jdbztrljdbvtgdbv.sys
nhfdxvsnki.sys
qkifdaupnk.exe
tqljdbvtql.exe
usmkecausm.exe
288bbf4c-448c-43c9-a508-67b18811efa5.tmp
392fc995-abf9-41b7-a37c-15c251fd44ff.tmp
47b30c91-c566-4a84-b78b-26872298400c.tmp
51a37632-168a-422c-8e84-dc9d8ab264a7.tmp
5943dad4-8501-4584-a218-48d05393bb5f.tmp
settings.dat
settings.dat
0f48d2cd-5620-4f38-ac2e-8ba4727a4372.tmp
1bcd16fc-d364-4168-bc61-4b77ea9ae58f.tmp
34e1aa9e-bcf2-4d7e-b75a-6f36302486ad.tmp
60466af9-fffe-4eae-a8ad-970595ae3b3f.tmp
temp-index
the-real-index
dcddb4d0-7d99-4a3a-9697-07b89f2db743.tmp
dasherSettingSchema.json
3a508be1-8df9-459b-a93c-fb137947eefa.tmp
999d6cbc-3fcc-4c96-9236-afcacc220eeb.tmp
d33aaf5a-0562-4906-8ead-110facd759a7.tmp
sync_diagnostic.log
b0672471-2dc6-465f-abe4-cbfa49c9f3cc.tmp
f2bddb27-6f79-44d5-b71b-d80a79066598.tmp
c63d5bbe-d0ac-47a7-8627-a039b3ade92b.tmp
568404f2-7396-4b8b-aae3-c61c93a849e8.tmp
c59a17e7-21eb-4ff5-b8ff-f4490cc02bc2.tmp
f5b53854-f0b1-4134-af9b-8a19fe4ccd8d.tmp
metadata.json
2fa36f15-dc80-4422-b05d-af01db1ae876.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
metadata.json
f2915bf1-bb3c-49ac-a577-d4dde4ece436.tmp
f693a782-73ab-4d55-b558-4e2daaff2c60.tmp
5ea01538-5600-41ef-9ca8-aaa5df31a3b7.tmp
e0d34948-8dd9-4c74-be99-9f41d3c634f8.tmp
content.js
messages.json
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/200-735-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1872-585-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2584-686-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2604-569-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2604-436-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2784-485-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2812-538-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2916-662-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3252-561-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3776-712-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3776-717-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4176-674-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4228-716-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4720-657-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4720-690-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4984-513-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5440-615-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5532-658-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5532-627-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5560-525-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5588-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5796-565-0x0000000000010000-0x00000000000AB000-memory.dmp