Analysis
- max time kernel
150s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
26/10/2026, 11:33
General
- Target 2026-10-25_d093dded4fc891449ed877aaffd4ba81_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261026-npckvaba42
- SHA256 9f44d02eccc8bd2fcdea44270c79980750fa96a84fbecd27bb17ce4fb26d42e0
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-25_d093dded4fc891449ed877aaffd4ba81_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-25_d093dded4fc891449ed877aaffd4ba81_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\vtnlgaytqlidbvtn.exeC:\Temp\vtnlgaytqlidbvtn.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\yvtnlgayql.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\yvtnlgayql.exeC:\Temp\yvtnlgayql.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_yvtnlgayql.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_yvtnlgayql.exeC:\Temp\i_yvtnlgayql.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\sqkidavsqn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\sqkidavsqn.exeC:\Temp\sqkidavsqn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_sqkidavsqn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_sqkidavsqn.exeC:\Temp\i_sqkidavsqn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\faxsqkicau.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\faxsqkicau.exeC:\Temp\faxsqkicau.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_faxsqkicau.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_faxsqkicau.exeC:\Temp\i_faxsqkicau.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kfcausmcxu.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kfcausmcxu.exeC:\Temp\kfcausmcxu.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kfcausmcxu.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kfcausmcxu.exeC:\Temp\i_kfcausmcxu.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zxupkhczus.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\zxupkhczus.exeC:\Temp\zxupkhczus.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zxupkhczus.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_zxupkhczus.exeC:\Temp\i_zxupkhczus.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hecwtrpmge.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hecwtrpmge.exeC:\Temp\hecwtrpmge.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hecwtrpmge.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hecwtrpmge.exeC:\Temp\i_hecwtrpmge.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\omjebwuomg.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\omjebwuomg.exeC:\Temp\omjebwuomg.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_omjebwuomg.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_omjebwuomg.exeC:\Temp\i_omjebwuomg.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wtomjebztr.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\wtomjebztr.exeC:\Temp\wtomjebztr.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wtomjebztr.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_wtomjebztr.exeC:\Temp\i_wtomjebztr.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\tqoigavtql.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\tqoigavtql.exeC:\Temp\tqoigavtql.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_tqoigavtql.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_tqoigavtql.exeC:\Temp\i_tqoigavtql.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vqnidavtqk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vqnidavtqk.exeC:\Temp\vqnidavtqk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vqnidavtqk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vqnidavtqk.exeC:\Temp\i_vqnidavtqk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vsnlicaxsn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vsnlicaxsn.exeC:\Temp\vsnlicaxsn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vsnlicaxsn.exe ups_ins3⤵
-
C:\Temp\i_vsnlicaxsn.exeC:\Temp\i_vsnlicaxsn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\davsnkfdxv.exe ups_run3⤵
-
C:\Temp\davsnkfdxv.exeC:\Temp\davsnkfdxv.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_davsnkfdxv.exe ups_ins3⤵
-
C:\Temp\i_davsnkfdxv.exeC:\Temp\i_davsnkfdxv.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fzxspkicau.exe ups_run3⤵
-
C:\Temp\fzxspkicau.exeC:\Temp\fzxspkicau.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fzxspkicau.exe ups_ins3⤵
-
C:\Temp\i_fzxspkicau.exeC:\Temp\i_fzxspkicau.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zwurpjhecw.exe ups_run3⤵
-
C:\Temp\zwurpjhecw.exeC:\Temp\zwurpjhecw.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zwurpjhecw.exe ups_ins3⤵
-
C:\Temp\i_zwurpjhecw.exeC:\Temp\i_zwurpjhecw.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hbztrmjhbz.exe ups_run3⤵
-
C:\Temp\hbztrmjhbz.exeC:\Temp\hbztrmjhbz.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hbztrmjhbz.exe ups_ins3⤵
-
C:\Temp\i_hbztrmjhbz.exeC:\Temp\i_hbztrmjhbz.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\rojhbztrlj.exe ups_run3⤵
-
C:\Temp\rojhbztrlj.exeC:\Temp\rojhbztrlj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_rojhbztrlj.exe ups_ins3⤵
-
C:\Temp\i_rojhbztrlj.exeC:\Temp\i_rojhbztrlj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wqomgeywql.exe ups_run3⤵
-
C:\Temp\wqomgeywql.exeC:\Temp\wqomgeywql.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wqomgeywql.exe ups_ins3⤵
-
C:\Temp\i_wqomgeywql.exeC:\Temp\i_wqomgeywql.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\qoigdytqoi.exe ups_run3⤵
-
C:\Temp\qoigdytqoi.exeC:\Temp\qoigdytqoi.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_qoigdytqoi.exe ups_ins3⤵
-
C:\Temp\i_qoigdytqoi.exeC:\Temp\i_qoigdytqoi.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dbvtnlfvpn.exe ups_run3⤵
-
C:\Temp\dbvtnlfvpn.exeC:\Temp\dbvtnlfvpn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dbvtnlfvpn.exe ups_ins3⤵
-
C:\Temp\i_dbvtnlfvpn.exeC:\Temp\i_dbvtnlfvpn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\ifaxsqnifa.exe ups_run3⤵
-
C:\Temp\ifaxsqnifa.exeC:\Temp\ifaxsqnifa.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_ifaxsqnifa.exe ups_ins3⤵
-
C:\Temp\i_ifaxsqnifa.exeC:\Temp\i_ifaxsqnifa.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ff8a19bc188,0x7ff8a19bc194,0x7ff8a19bc1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,14011405172735643350,13097112483816110517,262144 --field-trial-handle=2344,i,11873044907801152780,18305621980604642027,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,9479253515253775000,6628799458130317003,524288 --field-trial-handle=2344,i,11873044907801152780,18305621980604642027,262144 --variations-seed-version --mojo-platform-channel-handle=1996 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,9564119384000059545,12940396041579284045,524288 --field-trial-handle=2344,i,11873044907801152780,18305621980604642027,262144 --variations-seed-version --mojo-platform-channel-handle=3052 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3624,i,6975955079358616249,5994757193169973084,2097152 --field-trial-handle=2344,i,11873044907801152780,18305621980604642027,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3628,i,7883906762088961219,2910168239731086702,2097152 --field-trial-handle=2344,i,11873044907801152780,18305621980604642027,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4352,i,9502071434950338876,3217768957595209003,2097152 --field-trial-handle=2344,i,11873044907801152780,18305621980604642027,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,7089197131333148887,10814822387453100860,2097152 --field-trial-handle=2344,i,11873044907801152780,18305621980604642027,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3692,i,5358349690014109369,6598128487562704411,524288 --field-trial-handle=2344,i,11873044907801152780,18305621980604642027,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,1952306977555092206,3313626589879447646,524288 --field-trial-handle=2344,i,11873044907801152780,18305621980604642027,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,3755137729835296213,13933574752895256266,524288 --field-trial-handle=2344,i,11873044907801152780,18305621980604642027,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,6688486927513949341,17756145902085437052,524288 --field-trial-handle=2344,i,11873044907801152780,18305621980604642027,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,6688486927513949341,17756145902085437052,524288 --field-trial-handle=2344,i,11873044907801152780,18305621980604642027,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,3381340249964816643,4096866737111515772,524288 --field-trial-handle=2344,i,11873044907801152780,18305621980604642027,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,13325533524420853688,13046114218184820741,524288 --field-trial-handle=2344,i,11873044907801152780,18305621980604642027,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,891796472317816630,15693611095388860843,524288 --field-trial-handle=2344,i,11873044907801152780,18305621980604642027,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6732,i,11559523258848845994,12461384243689335487,524288 --field-trial-handle=2344,i,11873044907801152780,18305621980604642027,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,15678972567783470400,5742145714277993007,524288 --field-trial-handle=2344,i,11873044907801152780,18305621980604642027,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4556,i,11975611185453748543,1686282035885066017,524288 --field-trial-handle=2344,i,11873044907801152780,18305621980604642027,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,1555816419948845220,8134260738033838095,524288 --field-trial-handle=2344,i,11873044907801152780,18305621980604642027,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,4812840409991783115,5055019092695989448,524288 --field-trial-handle=2344,i,11873044907801152780,18305621980604642027,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,9956245995543763004,5606791521402994793,524288 --field-trial-handle=2344,i,11873044907801152780,18305621980604642027,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,9846941773256022719,18390606540958446031,524288 --field-trial-handle=2344,i,11873044907801152780,18305621980604642027,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,795723038606567579,17220622115729090033,524288 --field-trial-handle=2344,i,11873044907801152780,18305621980604642027,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6568,i,11404059510288763804,16536470750937196650,262144 --field-trial-handle=2344,i,11873044907801152780,18305621980604642027,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,18043587387157551231,7830341784951558601,524288 --field-trial-handle=2344,i,11873044907801152780,18305621980604642027,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\vtnlgaytqlidbvtn.sysC:\Temp\vtnlgaytqlidbvtn.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Temp\caysqliays.sysC:\Temp\caysqliays.sys1⤵
- Executes dropped EXE
-
C:\Temp\pnifdxnifa.sysC:\Temp\pnifdxnifa.sys1⤵
- Executes dropped EXE
-
C:\Temp\ifaxvpnkfc.sysC:\Temp\ifaxvpnkfc.sys1⤵
- Executes dropped EXE
-
C:\Temp\hfzxrpkhcz.sysC:\Temp\hfzxrpkhcz.sys1⤵
- Executes dropped EXE
-
C:\Temp\ebzxupmgec.sysC:\Temp\ebzxupmgec.sys1⤵
- Executes dropped EXE
-
C:\Temp\trmjebwuom.sysC:\Temp\trmjebwuom.sys1⤵
- Executes dropped EXE
-
C:\Temp\zwqojdbztr.sysC:\Temp\zwqojdbztr.sys1⤵
- Executes dropped EXE
-
C:\Temp\bvtrljdayw.sysC:\Temp\bvtrljdayw.sys1⤵
- Executes dropped EXE
-
C:\Temp\yvqnigaysq.sysC:\Temp\yvqnigaysq.sys1⤵
- Executes dropped EXE
-
C:\Temp\daysqnlfda.sysC:\Temp\daysqnlfda.sys1⤵
- Executes dropped EXE
-
C:\Temp\fdxvpnkfdx.sysC:\Temp\fdxvpnkfdx.sys1⤵
-
C:\Temp\icausmkfca.sysC:\Temp\icausmkfca.sys1⤵
-
C:\Temp\xrpmheczur.sysC:\Temp\xrpmheczur.sys1⤵
-
C:\Temp\rpjhbzuomh.sysC:\Temp\rpjhbzuomh.sys1⤵
-
C:\Temp\toljebwtrm.sysC:\Temp\toljebwtrm.sys1⤵
-
C:\Temp\wtrljdbvto.sysC:\Temp\wtrljdbvto.sys1⤵
-
C:\Temp\ywqgaywqoi.sysC:\Temp\ywqgaywqoi.sys1⤵
-
C:\Temp\ayvqnlfdav.sysC:\Temp\ayvqnlfdav.sys1⤵
-
C:\Temp\icaysqkica.sysC:\Temp\icaysqkica.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
caysqliays.sys
ebzxupmgec.sys
faxsqkicau.exe
hecwtrpmge.exe
hfzxrpkhcz.sys
i_faxsqkicau.exe
i_kfcausmcxu.exe
i_sqkidavsqn.exe
i_yvtnlgayql.exe
i_zxupkhczus.exe
ifaxvpnkfc.sys
kfcausmcxu.exe
pnifdxnifa.sys
sqkidavsqn.exe
vtnlgaytqlidbvtn.exe
vtnlgaytqlidbvtn.sys
yvtnlgayql.exe
zxupkhczus.exe
0ef7df5e-bc46-4030-91fa-77dfae86fb17.tmp
1a4b6449-c42e-43ea-9ba2-07c3c31c9cce.tmp
4ed46566-376c-4e70-806b-7c1625bd7f11.tmp
941428a6-e1b4-497c-9bd8-50aac6e404cc.tmp
settings.dat
settings.dat
1d2f492a-c3fe-4d97-b618-7a14fd9f5db4.tmp
20fe1102-ab43-4cbc-8681-b7d24ea4762a.tmp
38cd975a-0eb7-44c2-9652-92287cb49da5.tmp
temp-index
the-real-index
7d035ca3-0fce-48ae-bbbb-26fecfe97c02.tmp
dasherSettingSchema.json
15730039-8694-4513-b9f8-2a64887cdfd7.tmp
317db246-f0f6-475c-b837-1e2df4743573.tmp
5f5bdb65-33bc-47fe-ac61-b3e3f69674c6.tmp
ae2ab26f-bd7b-4476-b306-96369a26a27c.tmp
fe7e5f8c-e047-4c20-b7ac-4d74a168beb0.tmp
OperationConfig
c7f306fa-452f-45fb-b082-2be4ace88630.tmp
09402019-7f1c-4676-9a53-7dff095a2ad9.tmp
706689d8-7052-4404-b22e-00faff524ba7.tmp
856a2405-1c34-4951-862f-d797168edfe9.tmp
d88e67ed-f732-4f94-9573-6c0cffc8d79f.tmp
ded405e0-2eb2-4655-9bc7-f0a49df6db88.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
de0f0b10-17cb-4722-9b8c-264797c9601f.tmp
metadata.json
aea697ea-403f-483c-b3b5-157bceedb1a8.tmp
b1417cea-d33e-419e-9370-dd07532fac02.tmp
content.js
messages.json
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/592-681-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1088-649-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1688-527-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2000-553-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2336-711-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2376-615-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2412-573-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2424-685-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2828-569-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3280-502-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4164-707-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4248-645-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4532-603-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4632-729-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5344-473-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5612-669-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5636-59-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5904-549-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5984-514-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5988-479-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5988-424-0x0000000000010000-0x00000000000AB000-memory.dmp