Analysis
- max time kernel
150s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
03/11/2026, 02:21
General
- Target 2026-11-02_a8f65ec22b94b1ab823145138473e42c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 361KB
- Sample261103-cs95qsysh1
- SHA256 8df09db5f1a70d0507ba28c538df1cce3b69dab3e86bbb1bae6062940b6b11d3
Score
10/10
Malware Config
Extracted
Family
-
systex
C2
-
http://xytets.com:2345/t.asp?os=wangba
-
http://xytets.com:2345/t.asp?os=home
-
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm
Signatures
- Family: Systex
Systex is a trojan loader written in C++.
- Executes dropped EXE 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 20 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 20 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-02_a8f65ec22b94b1ab823145138473e42c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-02_a8f65ec22b94b1ab823145138473e42c_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Temp\davtnlfdxvqnigay.exeC:\Temp\davtnlfdxvqnigay.exe run2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\lidasqkidv.exe ups_run3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Temp\lidasqkidv.exeC:\Temp\lidasqkidv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_lidasqkidv.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_lidasqkidv.exeC:\Temp\i_lidasqkidv.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\kfzxvsmkfc.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\kfzxvsmkfc.exeC:\Temp\kfzxvsmkfc.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_kfzxvsmkfc.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_kfzxvsmkfc.exeC:\Temp\i_kfzxvsmkfc.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hfzxrpnkec.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hfzxrpnkec.exeC:\Temp\hfzxrpnkec.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hfzxrpnkec.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hfzxrpnkec.exeC:\Temp\i_hfzxrpnkec.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\hecztrpmke.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\hecztrpmke.exeC:\Temp\hecztrpmke.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_hecztrpmke.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_hecztrpmke.exeC:\Temp\i_hecztrpmke.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\mgezwrpjhb.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\mgezwrpjhb.exeC:\Temp\mgezwrpjhb.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_mgezwrpjhb.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_mgezwrpjhb.exeC:\Temp\i_mgezwrpjhb.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jgebztqomj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\jgebztqomj.exeC:\Temp\jgebztqomj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jgebztqomj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_jgebztqomj.exeC:\Temp\i_jgebztqomj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\oljdbvtolj.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\oljdbvtolj.exeC:\Temp\oljdbvtolj.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_oljdbvtolj.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_oljdbvtolj.exeC:\Temp\i_oljdbvtolj.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vtnlfdyvtn.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vtnlfdyvtn.exeC:\Temp\vtnlfdyvtn.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vtnlfdyvtn.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vtnlfdyvtn.exeC:\Temp\i_vtnlfdyvtn.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\davtnlfdxv.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\davtnlfdxv.exeC:\Temp\davtnlfdxv.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_davtnlfdxv.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_davtnlfdxv.exeC:\Temp\i_davtnlfdxv.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vpnhfaxspk.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\vpnhfaxspk.exeC:\Temp\vpnhfaxspk.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
- Executes dropped EXE
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vpnhfaxspk.exe ups_ins3⤵
- Executes dropped EXE
-
C:\Temp\i_vpnhfaxspk.exeC:\Temp\i_vpnhfaxspk.exe ups_ins4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\pnhfzxspki.exe ups_run3⤵
- Executes dropped EXE
-
C:\Temp\pnhfzxspki.exeC:\Temp\pnhfzxspki.exe ups_run4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_pnhfzxspki.exe ups_ins3⤵
-
C:\Temp\i_pnhfzxspki.exeC:\Temp\i_pnhfzxspki.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\upmhezxrpj.exe ups_run3⤵
-
C:\Temp\upmhezxrpj.exeC:\Temp\upmhezxrpj.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_upmhezxrpj.exe ups_ins3⤵
-
C:\Temp\i_upmhezxrpj.exeC:\Temp\i_upmhezxrpj.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\zurmkecwuo.exe ups_run3⤵
-
C:\Temp\zurmkecwuo.exeC:\Temp\zurmkecwuo.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_zurmkecwuo.exe ups_ins3⤵
-
C:\Temp\i_zurmkecwuo.exeC:\Temp\i_zurmkecwuo.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\wtrojhbztr.exe ups_run3⤵
-
C:\Temp\wtrojhbztr.exeC:\Temp\wtrojhbztr.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_wtrojhbztr.exe ups_ins3⤵
-
C:\Temp\i_wtrojhbztr.exeC:\Temp\i_wtrojhbztr.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\jgbywqomge.exe ups_run3⤵
-
C:\Temp\jgbywqomge.exeC:\Temp\jgbywqomge.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_jgbywqomge.exe ups_ins3⤵
-
C:\Temp\i_jgbywqomge.exeC:\Temp\i_jgbywqomge.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\gbytoljdby.exe ups_run3⤵
-
C:\Temp\gbytoljdby.exeC:\Temp\gbytoljdby.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_gbytoljdby.exe ups_ins3⤵
-
C:\Temp\i_gbytoljdby.exeC:\Temp\i_gbytoljdby.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\dbysqoifdb.exe ups_run3⤵
-
C:\Temp\dbysqoifdb.exeC:\Temp\dbysqoifdb.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_dbysqoifdb.exe ups_ins3⤵
-
C:\Temp\i_dbysqoifdb.exeC:\Temp\i_dbysqoifdb.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vpnlfdxvpn.exe ups_run3⤵
-
C:\Temp\vpnlfdxvpn.exeC:\Temp\vpnlfdxvpn.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vpnlfdxvpn.exe ups_ins3⤵
-
C:\Temp\i_vpnlfdxvpn.exeC:\Temp\i_vpnlfdxvpn.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\vpnkfcausm.exe ups_run3⤵
-
C:\Temp\vpnkfcausm.exeC:\Temp\vpnkfcausm.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_vpnkfcausm.exe ups_ins3⤵
-
C:\Temp\i_vpnkfcausm.exeC:\Temp\i_vpnkfcausm.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\fzxupnhfax.exe ups_run3⤵
-
C:\Temp\fzxupnhfax.exeC:\Temp\fzxupnhfax.exe ups_run4⤵
- System Location Discovery: System Language Discovery
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release5⤵
-
C:\windows\system32\ipconfig.exeC:\windows\system32\ipconfig.exe /release6⤵
- Gathers network information
-
-
-
-
-
C:\temp\CreateProcess.exeC:\temp\CreateProcess.exe C:\Temp\i_fzxupnhfax.exe ups_ins3⤵
-
C:\Temp\i_fzxupnhfax.exeC:\Temp\i_fzxupnhfax.exe ups_ins4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffc7180c188,0x7ffc7180c194,0x7ffc7180c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,3911747924525547912,846236783039722166,262144 --field-trial-handle=2344,i,7985102539932528132,11240510155148378448,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,2209632101192344615,13184630986344803059,524288 --field-trial-handle=2344,i,7985102539932528132,11240510155148378448,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2440,i,4614809226644952570,9942360994756814203,524288 --field-trial-handle=2344,i,7985102539932528132,11240510155148378448,262144 --variations-seed-version --mojo-platform-channel-handle=3364 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,17478239419179089650,18170730496472370107,2097152 --field-trial-handle=2344,i,7985102539932528132,11240510155148378448,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,14298841595906458727,14562819063405547486,2097152 --field-trial-handle=2344,i,7985102539932528132,11240510155148378448,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,16012837285598732679,2078358817026419590,2097152 --field-trial-handle=2344,i,7985102539932528132,11240510155148378448,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,4027692618678092393,17925139270757510387,2097152 --field-trial-handle=2344,i,7985102539932528132,11240510155148378448,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,13057883110572927405,14432584697733068366,524288 --field-trial-handle=2344,i,7985102539932528132,11240510155148378448,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,6887159731012718823,9780616886481758605,524288 --field-trial-handle=2344,i,7985102539932528132,11240510155148378448,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,13732204296609783979,18317954243282265885,524288 --field-trial-handle=2344,i,7985102539932528132,11240510155148378448,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,15792972844502846246,9961334037058247102,524288 --field-trial-handle=2344,i,7985102539932528132,11240510155148378448,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,15792972844502846246,9961334037058247102,524288 --field-trial-handle=2344,i,7985102539932528132,11240510155148378448,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,10494852275506616735,14062647917701974995,524288 --field-trial-handle=2344,i,7985102539932528132,11240510155148378448,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,5584539371178152203,4922833427779189170,524288 --field-trial-handle=2344,i,7985102539932528132,11240510155148378448,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,16682403647387518969,14708981005576420448,524288 --field-trial-handle=2344,i,7985102539932528132,11240510155148378448,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,7124356803927329750,7353279836459321566,524288 --field-trial-handle=2344,i,7985102539932528132,11240510155148378448,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3564,i,11192639987002336358,1566536235570842071,524288 --field-trial-handle=2344,i,7985102539932528132,11240510155148378448,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,11026249473003367337,3360193003943040153,524288 --field-trial-handle=2344,i,7985102539932528132,11240510155148378448,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,8745761915016863237,6542272008280537414,524288 --field-trial-handle=2344,i,7985102539932528132,11240510155148378448,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3780,i,3170835415700261638,9671985058533234708,524288 --field-trial-handle=2344,i,7985102539932528132,11240510155148378448,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,8919870367266625631,10488719776386528259,524288 --field-trial-handle=2344,i,7985102539932528132,11240510155148378448,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,11883850539763543641,11832564513828947244,524288 --field-trial-handle=2344,i,7985102539932528132,11240510155148378448,262144 --variations-seed-version --mojo-platform-channel-handle=920 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,16198704390892732144,1572030101561630040,524288 --field-trial-handle=2344,i,7985102539932528132,11240510155148378448,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6928,i,7080713775422152627,14967346731878312477,262144 --field-trial-handle=2344,i,7985102539932528132,11240510155148378448,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2708,i,11250851529146809166,1586981334930777758,524288 --field-trial-handle=2344,i,7985102539932528132,11240510155148378448,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:144⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Temp\davtnlfdxvqnigay.sysC:\Temp\davtnlfdxvqnigay.sys1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Temp\kicausnkfd.sysC:\Temp\kicausnkfd.sys1⤵
- Executes dropped EXE
-
C:\Temp\khcausmkfc.sysC:\Temp\khcausmkfc.sys1⤵
- Executes dropped EXE
-
C:\Temp\pmhecaurmj.sysC:\Temp\pmhecaurmj.sys1⤵
- Executes dropped EXE
-
C:\Temp\romgezwrpj.sysC:\Temp\romgezwrpj.sys1⤵
- Executes dropped EXE
-
C:\Temp\mgeywromge.sysC:\Temp\mgeywromge.sys1⤵
- Executes dropped EXE
-
C:\Temp\ljgaywtolj.sysC:\Temp\ljgaywtolj.sys1⤵
- Executes dropped EXE
-
C:\Temp\geywqoigay.sysC:\Temp\geywqoigay.sys1⤵
- Executes dropped EXE
-
C:\Temp\ifdyvqoifa.sysC:\Temp\ifdyvqoifa.sys1⤵
- Executes dropped EXE
-
C:\Temp\dxvpnhfaxs.sysC:\Temp\dxvpnhfaxs.sys1⤵
- Executes dropped EXE
-
C:\Temp\vpnhfzxrpk.sysC:\Temp\vpnhfzxrpk.sys1⤵
- Executes dropped EXE
-
C:\Temp\xuspkhfzxu.sysC:\Temp\xuspkhfzxu.sys1⤵
-
C:\Temp\bzurmkecwu.sysC:\Temp\bzurmkecwu.sys1⤵
-
C:\Temp\wromgebwtr.sysC:\Temp\wromgebwtr.sys1⤵
-
C:\Temp\omgebomgey.sysC:\Temp\omgebomgey.sys1⤵
-
C:\Temp\gaytqljdbv.sysC:\Temp\gaytqljdbv.sys1⤵
-
C:\Temp\gayvqoigdy.sysC:\Temp\gayvqoigdy.sys1⤵
-
C:\Temp\aysqkidavt.sysC:\Temp\aysqkidavt.sys1⤵
-
C:\Temp\faxsqkifda.sysC:\Temp\faxsqkifda.sys1⤵
-
C:\Temp\zxusmkiczx.sysC:\Temp\zxusmkiczx.sys1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
davtnlfdxvqnigay.exe
davtnlfdxvqnigay.sys
hecztrpmke.exe
hfzxrpnkec.exe
i_hecztrpmke.exe
i_hfzxrpnkec.exe
i_kfzxvsmkfc.exe
i_lidasqkidv.exe
i_mgezwrpjhb.exe
jgebztqomj.exe
kfzxvsmkfc.exe
khcausmkfc.sys
kicausnkfd.sys
lidasqkidv.exe
mgeywromge.sys
mgezwrpjhb.exe
pmhecaurmj.sys
romgezwrpj.sys
17c46cdc-521f-49bc-9586-cd2ff68efb97.tmp
3222d132-d48a-4444-8285-ea51e796c49d.tmp
418bf1e6-b5e2-4aeb-b302-208b3b7d90c3.tmp
bd9930a9-58cd-45fe-9f54-31a12a9bcfde.tmp
settings.dat
settings.dat
096976d8-9f96-4937-a02c-c53df1d02594.tmp
3ccacff8-0a1b-49ce-a028-9b71a73bb070.tmp
97bfe88f-2990-4294-b35f-5c025d332c55.tmp
temp-index
the-real-index
65ce5061-0c8c-4c67-a8fc-d21dc4a505f5.tmp
dasherSettingSchema.json
286007d9-5a82-4ba8-8018-cfe5af5fc146.tmp
347f787d-0935-4bc2-8fcd-58a1057acd19.tmp
69b4c0d3-7d20-49c9-ac23-dfb493f3c631.tmp
sync_diagnostic.log
b8d1e565-ce3f-4062-bb31-b6371a586374.tmp
c0691530-3d33-4105-8407-3eeaf1703c26.tmp
d71b2255-586c-4fe4-9133-8b048f397e54.tmp
44daced7-80c7-4c00-828d-8aae683ae455.tmp
a9ce11c3-bf9c-40fb-aa6c-0a0da20a6000.tmp
b6b2431d-1cdd-4032-aae3-b4cc03084258.tmp
0afbbd71-61e9-44bf-8627-a84de658c57e.tmp
1f64dd36-b72a-4330-9625-0460dc4db38a.tmp
b98a3ce3-d578-4ca6-836c-83c735458aa9.tmp
edb596d9-28f8-4335-a50f-4dadb42e6035.tmp
3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
779041b6-6829-4d28-af66-df18e77a61c0.tmp
metadata.json
ff8f0598-aeed-4dba-8b42-3f454aa3dda0.tmp
7768ac70-1df4-4897-af8b-7850a9e1abbe.tmp
8090bb7d-8f0f-469e-b880-265fd933dd6a.tmp
content.js
messages.json
manifest.json
manifest.json
manifest.json
manifest.json
CreateProcess.exe
memory/356-564-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/360-572-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/544-632-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/1756-540-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2164-698-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2692-686-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/2984-515-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3416-724-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/3440-527-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4084-66-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4648-746-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4692-702-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4776-487-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4888-590-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/4936-666-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5240-438-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5280-620-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5608-568-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5788-646-0x0000000000010000-0x00000000000AB000-memory.dmp
memory/5872-728-0x0000000000010000-0x00000000000AB000-memory.dmp